Miss Islington (bot) ab5ef98af6 [3.13] gh-146581: Fix vulnerability in shutil.unpack_archive() for ZIP files on Windows (GH-146591) (GH-149065) ... Use ZipFile.extractall() to sanitize file names and extract files. Files with invalid names (e.g. absolute paths) are now skipped. Files containing ".." in the name are no longer skipped. (cherry picked from commit fc829e8875) Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>		2026-04-27 22:54:45 +03:00
..
__phello__
_pyrepl	[3.13] gh-140131: Fix REPL cursor position on Windows when module completion suggestion line hits console width (GH-140333) (GH-145872)	2026-03-12 18:15:17 +01:00
asyncio	[3.13] gh-146544: Fix asyncio.Queue docstring ambiguity (GH-146545) (#146568)	2026-03-28 11:27:59 +00:00
collections	[3.13] gh-140911: Ensure that UserString.index() and UserString.rindex() accept UserString as argument (GH-140945) (GH-141945)	2025-11-25 13:50:30 +00:00
concurrent	[3.13] gh-132969: Fix error/hang when shutdown(wait=False) and task exited abnormally (GH-133222) (GH-135343)	2025-06-16 14:08:03 +02:00
ctypes	[3.13] gh-143304: Fix ctypes.CDLL to honor handle parameter on POSIX systems (GH-143318) (GH-145173)	2026-03-05 15:34:49 +01:00
curses
dbm	[3.13] gh-135386: Fix "unable to open database file" errors on readonly DB (GH-135566) (GH-138057)	2025-08-22 11:35:21 +00:00
email	[3.13] gh-148192: Fix Generator._make_boundary behavior with CRLF line endings. (GH-148193) (#148549)	2026-04-14 12:21:55 -04:00
encodings	[3.13] gh-146054: Limit the growth of encodings.search_function cache (GH-146055) (GH-146068)	2026-03-18 13:46:50 +01:00
ensurepip	[3.13] gh-146310: Fix ensurepip to treat empty WHEEL_PKG_DIR as unset (GH-146357) (#146535)	2026-03-27 21:10:44 +00:00
html	[3.13] gh-140875: Fix handling of unclosed charrefs before EOF in HTMLParser (GH-140904) (GH-141746)	2025-11-19 12:17:54 +00:00
http	[3.13] gh-90309: Base64-encode cookie values embedded in JS (GH-148888)	2026-04-23 15:05:17 +02:00
idlelib	[3.13] gh-135142: Initial 3.15 News3.txt entries (GH-144200) (#144202)	2026-01-23 22:16:21 -05:00
importlib	[3.13] gh-145506: Fixes CVE-2026-2297 by ensuring SourcelessFileLoader uses io.open_code (GH-145507)	2026-03-04 20:17:04 +00:00
json	[3.13] gh-132631: Fix "I/O operation on closed file" when parsing JSON Lines file (GH-132632) (#148922)	2026-04-23 19:30:13 +00:00
logging	[3.13] gh-143237: Fix support of named pipes in the rotating logging handlers (GH-143259) (#143298)	2026-01-25 17:09:40 +00:00
multiprocessing	[3.13] gh-137335: remove a mktemp use in multiprocessing.connection to avoid security scanner noise (GH-148578) (#148584)	2026-04-14 17:06:33 -07:00
pathlib	[3.13] GH-125069: Fix inconsistent joining in WindowsPath(PosixPath(...)) (GH-125156) (#125409)	2024-10-13 18:12:57 +00:00
pydoc_data	Python 3.13.13	2026-04-07 20:19:01 +02:00
re	[3.13] Revert "[3.13] gh-140797: Forbid capturing groups in re.Scanner lexicon patterns (GH-140944) (GH-140983)" (GH-142231)	2025-12-05 15:31:34 +02:00
site-packages
sqlite3	[3.13] gh-133439: Fix dot commands with trailing spaces are mistaken for multi-line sqlite statements in the sqlite3 command-line interface (GH-133440) (GH-133765)	2025-06-13 20:40:24 +03:00
sysconfig	[3.13] gh-146541: Allow building the Android testbed for 32-bit targets (GH-146542) (#148107)	2026-04-06 07:47:01 +08:00
test	[3.13] gh-146581: Fix vulnerability in shutil.unpack_archive() for ZIP files on Windows (GH-146591) (GH-149065)	2026-04-27 22:54:45 +03:00
tkinter	[3.13] gh-143754: Modernize Tkinter docs (GH-143841) (GH-144033)	2026-01-19 12:26:26 +00:00
tomllib	[3.13] gh-133117: Enable stricter mypy checks for tomllib (GH-133206) (#133343)	2025-05-03 14:20:34 +00:00
turtledemo	[3.13] gh-137586: Open external osascript program with absolute path (GH-137584) (#148174)	2026-04-07 03:35:14 +00:00
unittest	[3.13] gh-142651: use NonCallableMock._lock for thread safety of call_count (GH-142922) (#145740)	2026-03-10 12:34:37 +00:00
urllib	[3.13] gh-144148: Update the urllib.parse documentation (GH-144497) (GH-144507) (GH-144509)	2026-02-05 15:47:52 +00:00
venv	[3.13] gh-145417: Do not preserve SELinux context when copying venv scripts (GH-145454) (#145550)	2026-03-05 17:44:29 +00:00
wsgiref	[3.13] gh-144370: Disallow usage of control characters in status in wsgiref.handlers for security (GH-144371) (#145585)	2026-03-06 12:45:34 +00:00
xml	[3.13] gh-142754: Ensure that Element & Attr instances have the ownerDocument attribute (GH-142794) (#142819)	2025-12-20 15:56:59 -08:00
xmlrpc
zipfile	[3.13] gh-146581: Fix vulnerability in shutil.unpack_archive() for ZIP files on Windows (GH-146591) (GH-149065)	2026-04-27 22:54:45 +03:00
zoneinfo	[3.13] gh-145883: Fix two heap-buffer-overflows in _zoneinfo (GH-145885) (#148086)	2026-04-04 17:14:19 +01:00
__future__.py
__hello__.py
_aix_support.py
_android_support.py	[3.13] gh-144415: Android testbed fixes (GH-142912) (#144417)	2026-02-03 09:28:43 +00:00
_apple_support.py	[3.13] gh-126925: Modify how iOS test results are gathered (GH-127592) (#127754)	2024-12-09 14:39:11 +08:00
_collections_abc.py	[3.13] gh-118803: Fixup a few references in the 3.13 branch to the intended removal date for ByteString (#139171)	2025-09-19 18:51:39 +01:00
_colorize.py	[3.13] gh-141570: can_colorize: Expect fileno() to raise OSError, as documented (#141716) (#141748)	2025-11-19 14:28:31 +00:00
_compat_pickle.py
_compression.py
_ios_support.py	[3.13] gh-119253: use ImportError in _ios_support (GH-119254) (#119265)	2024-05-20 22:21:28 +00:00
_markupbase.py
_opcode_metadata.py	GH-118095: Use broader specializations of CALL in tier 1, for better tier 2 support of calls. (GH-118322)	2024-05-04 12:11:11 +01:00
_osx_support.py
_py_abc.py
_pydatetime.py	[3.13] gh-135956: Remove duplicate word in _pydatetime docstring (GH-135957) (#135963)	2025-06-26 04:08:17 +00:00
_pydecimal.py	[3.13] gh-102431: Clarify constraints on operands of Decimal logical operations (GH-102836) (#140106)	2025-10-14 15:45:02 +02:00
_pyio.py	[3.13] gh-143602: Fix duplicate buffer exports in io.BytesIO.write (#143629) (#143872) (#143878)	2026-01-16 14:23:03 +01:00
_pylong.py	gh-118610: Centralize power caching in _pylong.py (#118611)	2024-05-07 19:09:09 -05:00
_sitebuiltins.py	[3.13] gh-138897: Use _pyrepl.pager for _sitebuiltins._Printer (GH-138898) (GH-143365)	2026-01-02 17:28:04 +01:00
_strptime.py	[3.13] gh-136028: Fix parsing month names containing "İ" (U+0130) in strptime() (GH-136029) (GH-136038)	2025-06-27 14:10:51 +00:00
_threading_local.py	[3.13] gh-107006: Move threading.local docstring to docs (GH-131840) (#133432)	2025-05-05 16:18:00 +03:00
_weakrefset.py
abc.py
antigravity.py
argparse.py	[3.13] gh-112527: Fix help text for required options in argparse (GH-112528) (GH-142477)	2025-12-09 17:36:24 +00:00
ast.py	[3.13] gh-134718: Fix ast.dump() for empty non-default values (GH-134926) (GH-134936)	2025-05-30 15:48:48 +00:00
base64.py	[3.13] gh-138775: fix handle python -m base64 stdin correct with EOF signal (GH-138776) (#141433)	2025-11-12 00:10:07 +00:00
bdb.py	[3.13] gh-136057: Allow step and next to step over for loops (GH-136160) (#141641)	2025-11-16 22:23:03 +00:00
bisect.py
bz2.py	gh-115961: Add name and mode attributes for compressed file-like objects (GH-116036)	2024-04-21 11:46:39 +03:00
calendar.py	[3.13] gh-126476: Raise IllegalMonthError for calendar.formatmonth() when the input month is not correct (GH-126484) (GH-126879)	2024-11-15 15:20:25 -08:00
cmd.py
code.py	[3.13] gh-125666: Avoid PyREPL exiting when a null byte is in input (GH-125732) (#126023)	2024-12-02 15:04:51 +01:00
codecs.py	[3.13] gh-52876: Implement missing parameter in codecs.StreamReaderWriter functions (GH-136498) (#136515)	2025-07-10 18:06:34 +02:00
codeop.py	[3.13] gh-124960: Fixed barry_as_FLUFL future flag does not work in new REPL (#124999) (#125475)	2024-10-14 20:00:45 +02:00
colorsys.py	[3.13] gh-121905: Consistently use "floating-point" instead of "floating point" (GH-121907) (GH-122012)	2024-07-19 09:13:08 +00:00
compileall.py
configparser.py	[3.13] gh-146333: Fix quadratic regex backtracking in configparser option parsing (GH-146399) (GH-148559)	2026-04-15 12:11:10 +02:00
contextlib.py
contextvars.py	[3.13] gh-126451: Revert backports of ABC registrations for contextvars.Context and multiprocessing proxies (#126734)	2024-11-12 12:29:13 +00:00
copy.py	[3.13] gh-121300: Add replace to copy.__all__ (GH-121302) (#121337)	2024-07-03 15:28:57 +00:00
copyreg.py
cProfile.py
csv.py	[3.13] gh-121905: Consistently use "floating-point" instead of "floating point" (GH-121907) (GH-122012)	2024-07-19 09:13:08 +00:00
dataclasses.py	[3.13] gh-105936: Properly update closure cells for __setattr__ and __delattr__ in frozen dataclasses with slots (GH-144021) (GH-148476)	2026-04-25 22:55:20 -07:00
datetime.py
decimal.py	[3.13] gh-123339: Fix cases of inconsistency of __module__ and __firstlineno__ in classes (GH-123613) (#124735)	2024-09-29 21:21:40 -07:00
difflib.py	[3.13] gh-128051: Fix tests if sys.float_repr_style is 'legacy' (#135908) (#136026)	2025-06-30 11:40:06 +02:00
dis.py	[3.13] gh-127637: add tests for dis command-line interface (#127759) (#127781)	2024-12-10 12:32:32 +00:00
doctest.py	[3.13] gh-136914: Fix support of cached functions and properties in DocTest's lineno computation (GH-136930) (GH-137615)	2025-08-10 20:05:28 +00:00
enum.py	[3.13] gh-140806: add docs for enum.bin function (#140807) (#143740)	2026-02-02 22:57:53 +01:00
filecmp.py	[3.13] gh-122400: Handle ValueError in filecmp (GH-122401) (GH-122441)	2024-07-30 09:17:35 +00:00
fileinput.py
fnmatch.py
fractions.py	[3.13] gh-130664: Treat '0' fill character with align '=' as zero-padding for Fraction's (GH-131067) (GH-136242)	2025-07-03 11:20:49 +00:00
ftplib.py
functools.py	[3.13] gh-140873: Fix the singledispatchmethod documentation (GH-141523) (GH-141710)	2025-11-18 11:38:38 +00:00
genericpath.py	[3.13] gh-135034: Normalize link targets in tarfile, add os.path.realpath(strict='allow_missing') (GH-135037) (GH-135064)	2025-06-03 15:59:54 +02:00
getopt.py
getpass.py
gettext.py
glob.py	[3.13] gh-144835: Added missing explanations for some parameters in glob and iglob. (GH-144836) (#145416)	2026-03-02 15:32:13 +02:00
graphlib.py	[3.13] gh-129892: Doc: Remove unnecessary role directive in graphlib.py (GH-129896) (#129904)	2025-02-09 15:47:10 +00:00
gzip.py	[3.13] gh-131492, gh-131461: handle exceptions in GzipFile constructor while owning resources (GH-131462) (#131518)	2025-03-21 11:20:52 +01:00
hashlib.py	[3.13] gh-134696: align OpenSSL and HACL*-based hash functions constructors AC signatures (GH-134713) (#134962)	2025-06-01 10:27:02 +02:00
heapq.py
hmac.py	[3.13] gh-142451: correctly copy HMAC attributes in HMAC.copy() (GH-142510) (#142701)	2025-12-14 09:36:26 +00:00
imaplib.py	[3.13] gh-78319: Fix implementation of IMAP APPEND UTF8 (GH-9436) (GH-139407)	2025-09-29 06:25:51 +00:00
inspect.py	[3.13] gh-138891: fix star-unpack in get_annotations (GH-138951) (#146491)	2026-03-26 21:39:27 +00:00
io.py
ipaddress.py	[3.13] gh-141497: Make ipaddress.IP{v4,v6}Network.hosts() always returning an iterator (GH-141547) (GH-141695)	2025-11-18 11:43:15 +02:00
keyword.py
linecache.py	[3.13] gh-133253: making linecache thread-safe (GH-133305) (#143911)	2026-01-16 13:34:53 -05:00
locale.py	[3.13] gh-133967: Do not normalize locale name 'C.UTF-8' to 'en_US.UTF-8' (GH-135347) (GH-135350)	2025-06-11 12:43:38 +03:00
lzma.py	gh-115961: Add name and mode attributes for compressed file-like objects (GH-116036)	2024-04-21 11:46:39 +03:00
mailbox.py	[3.13] gh-143010: Prevent a TOCTOU issue by only calling open once (GH-143011) (#143079)	2025-12-22 13:13:53 -05:00
mimetypes.py	gh-128703: Fix mimetypes.guess_type for empty Content-Type in registry (GH-128854)	2025-02-17 15:36:49 +00:00
modulefinder.py
netrc.py	[3.13] gh-135815: skip netrc security checks if os.getuid is missing (GH-135816) (#135826)	2025-06-22 20:12:20 +00:00
ntpath.py	[3.13] gh-136065: Fix quadratic complexity in os.path.expandvars() (GH-134952) (GH-140845)	2025-10-31 17:58:09 +01:00
nturl2path.py	[3.13] GH-127078: url2pathname(): handle extra slash before UNC drive in URL path (GH-127132) (#127135)	2024-11-22 04:37:30 +00:00
numbers.py	[3.13] gh-122450: Expand documentation for `Rational and Fraction` (#136800) (#137367)	2025-08-05 14:54:31 +01:00
opcode.py
operator.py	gh-118285: Fix signatures of operator.{attrgetter,itemgetter,methodcaller} instances (GH-118316)	2024-04-29 19:30:48 +03:00
optparse.py
os.py	[3.13] gh-136087: Remove \r from documented os.linesep values (GH-136088) (#136112)	2025-06-30 10:44:38 +03:00
pdb.py	[3.13] gh-142315: Don't pass the "real path" of Pdb script target to system functions (GH-142371) (#142498)	2025-12-16 10:53:09 -05:00
pickle.py	[3.13] gh-126489: Do not call persistent_id() for a persistent id in Python pickle (GH-126490) (GH-126514)	2024-11-06 22:54:48 +02:00
pickletools.py	[3.13] gh-139646: fix typo in pickletools error message (GH-139647) (GH-139650)	2025-10-07 20:19:24 +02:00
pkgutil.py
platform.py	gh-127732: Add Windows Server 2025 detection to platform module (GH-127733)	2024-12-09 12:50:34 +00:00
plistlib.py	[3.13] Docs: replace all datetime imports with import datetime as dt (GH-145640) (#146259)	2026-03-21 18:41:50 +00:00
poplib.py	[3.13] gh-130637: Add validation for numeric response data in stat() method (GH-130646) (#130763)	2025-03-02 20:28:56 +00:00
posixpath.py	[3.13] gh-136065: Fix quadratic complexity in os.path.expandvars() (GH-134952) (GH-140845)	2025-10-31 17:58:09 +01:00
pprint.py
profile.py
pstats.py	[3.13] gh-121905: Consistently use "floating-point" instead of "floating point" (GH-121907) (GH-122012)	2024-07-19 09:13:08 +00:00
pty.py
py_compile.py
pyclbr.py
pydoc.py	[3.13] gh-138568: Make help mode in PyREPL not exit on empty line input (GH-143512) (GH-143520)	2026-01-07 18:44:39 +01:00
queue.py	[3.13] Fix Queue.shutdown docs for condition to unblock a join (gh-137088) (gh-137102)	2025-07-25 08:48:28 -06:00
quopri.py
random.py	[3.13] gh-130285: Fix handling of zero or empty counts in random.sample() (gh-130291) (gh-130416)	2025-02-21 17:56:51 +00:00
reprlib.py	[3.13] gh-135487: fix reprlib.Repr.repr_int when given very large integers (GH-135506) (#135886)	2025-06-24 12:00:14 +00:00
rlcompleter.py	[3.13] gh-113978: Ignore warnings on text completion inside REPL (GH-113979) (#119429)	2024-05-22 23:13:32 +02:00
runpy.py
sched.py	[3.13] gh-121905: Consistently use "floating-point" instead of "floating point" (GH-121907) (GH-122012)	2024-07-19 09:13:08 +00:00
secrets.py
selectors.py
shelve.py
shlex.py
shutil.py	[3.13] gh-146581: Fix vulnerability in shutil.unpack_archive() for ZIP files on Windows (GH-146591) (GH-149065)	2026-04-27 22:54:45 +03:00
signal.py
site.py	[3.13] gh-138993: Dedent credits text (GH-138994) (#140087)	2025-10-15 14:05:53 +03:00
smtplib.py	[3.13] gh-70039: smtplib: store the server name in ._host in .connect() (GH-115259) (#148272)	2026-04-08 18:15:16 -04:00
socket.py	[3.13] gh-146139: Disable socketpair authentication on WASI (GH-146140) (#148527)	2026-04-13 21:30:52 +00:00
socketserver.py	[3.13] gh-128916: Do not set SO_REUSEPORT on non-AF_INET* sockets (GH-128933) (#128969)	2025-01-18 03:45:42 +00:00
sre_compile.py
sre_constants.py
sre_parse.py
ssl.py	[3.13] Docs: fix RFC index reference for TLS 1.3 (GH-142262) (#142341)	2025-12-06 13:29:54 +00:00
stat.py	[3.13] gh-144050: Fix stat.filemode pure Python file type detection (GH-144059) (GH-144074)	2026-01-20 12:44:46 +00:00
statistics.py	[3.13] gh-140938: Raise ValueError for infinite inputs to stdev/pstdev (GH-141531) (#141584)	2025-11-15 04:45:28 +00:00
string.py
stringprep.py
struct.py
subprocess.py	[3.13] gh-142195: Fixed Popen.communicate indefinite loops (GH-143203) (#143256)	2025-12-28 17:20:40 +00:00
symtable.py	[3.13] gh-119698: fix a special case in symtable.Class.get_methods (GH-121802) (#121909)	2024-07-17 13:54:40 +00:00
tabnanny.py	[3.13] gh-120495: Fix incorrect exception handling in Tab Nanny (GH-120498) (#120548)	2024-06-15 11:28:28 +00:00
tarfile.py	[3.13] gh-141707: Skip TarInfo DIRTYPE normalization during GNU long name handling (GH-145818)	2026-03-17 10:51:43 +01:00
tempfile.py	[3.13] gh-66305: Fix a hang on Windows in the tempfile module (GH-144672) (GH-145169)	2026-02-24 11:37:52 +00:00
textwrap.py	[3.13] gh-139065: Fix trailing space before long word in textwrap (GH-139070) (GH-139903)	2025-10-10 13:51:41 +00:00
this.py
threading.py	[3.13] gh-114827: clarify threading.Event.wait timeout behavior (GH-114834) (#140099)	2025-10-14 14:13:31 +00:00
timeit.py	[3.13] gh-148254: Use singular "sec" in timeit verbose output (GH-148290) (#148304)	2026-04-09 15:06:27 +00:00
token.py	[3.13] gh-127303: Add docs for token.EXACT_TOKEN_TYPES (GH-127304) (#127390)	2024-11-30 08:13:13 +00:00
tokenize.py	[3.13] gh-125553: Fix backslash continuation in untokenize (GH-126010) (#129153)	2025-01-21 21:04:55 +00:00
trace.py	[3.13] gh-103956: Fix trace output in case of missing source line (GH-103958) (GH-118834)	2024-05-09 13:05:37 +00:00
traceback.py	[3.13] gh-139933: correctly suggest attributes for classes with a custom __dir__ (GH-139950) (GH-145827) (GH-145833)	2026-03-11 22:02:01 +01:00
tracemalloc.py
tty.py
turtle.py	[3.13] gh-138772: Fix and improve documentation for turtle color functions (GH-139325) (GH-140048)	2025-10-13 15:56:31 +00:00
types.py	[3.13] gh-143999: Fix: handle suspended state on types.coroutine wrappers (GH-144000) (GH-144065)	2026-01-20 12:59:24 +02:00
typing.py	[3.13] gh-146553: Fix infinite loop in typing.get_type_hints() on circular __wrapped__ (GH-148595) (#148896)	2026-04-23 02:55:40 +00:00
uuid.py	[3.13] gh-135244: generate UUID random Node ID with a CSPRNG as per RFC 9562, §6.10.3 (GH-135226) (#137408)	2025-08-05 09:01:07 +00:00
warnings.py	[3.13] gh-138010: Fix __init_subclass__ forwarding by warnings.deprecated (GH-138210) (#138564)	2025-09-05 14:21:19 -07:00
wave.py	[3.13] gh-136523: Fix wave.Wave_write emitting an unraisable when open raises (GH-136529) (GH-136607)	2025-07-13 06:13:01 +00:00
weakref.py
webbrowser.py	[3.13] gh-137586: Open external osascript program with absolute path (GH-137584) (#148174)	2026-04-07 03:35:14 +00:00
zipapp.py	[3.13] gh-130379: Fix incorrect zipapp logic to avoid including the target in itself (gh-130509) (gh-130791)	2025-03-03 15:20:05 +00:00
zipimport.py	[3.13] gh-121735: Fix module-adjacent references in zip files (GH-123037) (#123986)	2024-09-29 18:17:16 -07:00