- Update to 3.11.5 (bsc#1214692):
  - Security
    - gh-108310: Fixed an issue where instances of ssl.SSLSocket were
      vulnerable to a bypass of the TLS handshake and included
      protections (like certificate verification) and treating sent
      unencrypted data as if it were post-handshake TLS encrypted data.
      Security issue reported as CVE-2023-40217 by Aapo Oksman. Patch by
      Gregory P. Smith.
  - Core and Builtins
    - gh-104432: Fix potential unaligned memory access on C APIs
      involving returned sequences of char * pointers within the grp
      and socket modules. These were revealed using a
      -fsaniziter=alignment build on ARM macOS. Patch by Christopher
      Chavez.
    - gh-77377: Ensure that multiprocessing synchronization objects
      created in a fork context are not sent to a different process
      created in a spawn context. This changes a segfault into an
      actionable RuntimeError in the parent process.
    - gh-106092: Fix a segmentation fault caused by a use-after-free
      bug in frame_dealloc when the trashcan delays the deallocation
      of a PyFrameObject.
    - gh-106719: No longer suppress arbitrary errors in the
      __annotations__ getter and setter in the type and module types.
    - gh-106723: Propagate frozen_modules to multiprocessing spawned
      process interpreters.
    - gh-105979: Fix crash in _imp.get_frozen_object() due to improper
      exception handling.
    - gh-105840: Fix possible crashes when specializing function calls
      with too many __defaults__.
    - gh-105588: Fix an issue that could result in crashes when
      compiling malformed ast nodes.
    - gh-105375: Fix bugs in the builtins module where exceptions
      could end up being overwritten.
    - gh-105375: Fix bug in the compiler where an exception could end
      up being overwritten.
    - gh-105375: Improve error handling in
      PyUnicode_BuildEncodingMap() where an exception could end up
      being overwritten.
    - gh-105235: Prevent out-of-bounds memory access during
      mmap.find() calls.
    - gh-101006: Improve error handling when read marshal data.
  - Library
    - gh-105736: Harmonized the pure Python version of OrderedDict
      with the C version. Now, both versions set up their internal
      state in __new__. Formerly, the pure Python version did the set
      up in __init__.
    - gh-107963: Fix multiprocessing.set_forkserver_preload() to check
      the given list of modules names. Patch by Dong-hee Na.
    - gh-106242: Fixes os.path.normpath() to handle embedded null
      characters without truncating the path.
    - gh-107845: tarfile.data_filter() now takes the location of
      symlinks into account when determining their target, so it will
      no longer reject some valid tarballs with
      LinkOutsideDestinationError.
    - gh-107715: Fix doctest.DocTestFinder.find() in presence of class
      names with special characters. Patch by Gertjan van Zwieten.
    - gh-100814: Passing a callable object as an option value to a
      Tkinter image now raises the expected TclError instead of an
      AttributeError.
    - gh-106684: Close asyncio.StreamWriter when it is not closed by
      application leading to memory leaks. Patch by Kumar Aditya.
    - gh-107077: Seems that in some conditions, OpenSSL will return
      SSL_ERROR_SYSCALL instead of SSL_ERROR_SSL when a certification
      verification has failed, but the error parameters will still
      contain ERR_LIB_SSL and SSL_R_CERTIFICATE_VERIFY_FAILED. We are
      now detecting this situation and raising the appropiate
      ssl.SSLCertVerificationError. Patch by Pablo Galindo
    - gh-107396: tarfiles; Fixed use before assignment of
      self.exception for gzip decompression
    - gh-62519: Make gettext.pgettext() search plural definitions when
      translation is not found.
    - gh-83006: Document behavior of shutil.disk_usage() for
      non-mounted filesystems on Unix.
    - gh-106186: Do not report MultipartInvariantViolationDefect
      defect when the email.parser.Parser class is used to parse
      emails with headersonly=True.
    - gh-106831: Fix potential missing NULL check of d2i_SSL_SESSION
      result in _ssl.c.
    - gh-106774: Update the bundled copy of pip to version 23.2.1.
    - gh-106752: Fixed several bug in zipfile.Path in
      name/suffix/suffixes/stem operations when no filename is present
      and the Path is not at the root of the zipfile.
    - gh-106602: Add __copy__ and __deepcopy__ in enum
    - gh-106530: Revert a change to colorsys.rgb_to_hls() that caused
      division by zero for certain almost-white inputs. Patch by Terry
      Jan Reedy.
    - gh-106052: re module: fix the matching of possessive quantifiers
      in the case of a subpattern containing backtracking.
    - gh-106510: Improve debug output for atomic groups in regular
      expressions.
    - gh-105497: Fix flag mask inversion when unnamed flags exist.
    - gh-90876: Prevent multiprocessing.spawn from failing to import
      in environments where sys.executable is None. This regressed in
      3.11 with the addition of support for path-like objects in
      multiprocessing.
    - gh-106350: Detect possible memory allocation failure in the
      libtommath function mp_init() used by the _tkinter module.
    - gh-102541: Make pydoc.doc catch bad module ImportError when
      output stream is not None.
    - gh-106263: Fix crash when calling repr with a manually
      constructed SignalDict object. Patch by Charlie Zhao.
    - gh-105375: Fix a bug in _Unpickler_SetInputStream() where an
      exception could end up being overwritten in case of failure.
    - gh-105375: Fix bugs in sys where exceptions could end up being
      overwritten because of deferred error handling.
    - gh-105605: Harden pyexpat error handling during module
      initialisation to prevent exceptions from possibly being
      overwritten, and objects from being dereferenced twice.
    - gh-105375: Fix bug in decimal where an exception could end up
      being overwritten.
    - gh-105375: Fix bugs in _datetime where exceptions could be
      overwritten in case of module initialisation failure.
    - gh-105375: Fix bugs in _ssl initialisation which could lead to
      leaked references and overwritten exceptions.
    - gh-105375: Fix a bug in array.array where an exception could end
      up being overwritten.
    - gh-105375: Fix bugs in _ctypes where exceptions could end up
      being overwritten.
    - gh-105375: Fix a bug in the posix module where an exception
      could be overwritten.
    - gh-105375: Fix bugs in _elementtree where exceptions could be
      overwritten.
    - gh-105375: Fix bugs in zoneinfo where exceptions could be
      overwritten.
    - gh-105375: Fix bugs in pickle where exceptions could be
      overwritten.
    - gh-105497: Fix flag inversion when alias/mask members exist.
    - gh-105375: Fix bugs in pickle where exceptions could be
      overwritten.
    - gh-103171: Revert undocumented behaviour change with
      runtime-checkable protocols decorated with typing.final() in
      Python 3.11. The behaviour change had meant that objects would
      not be considered instances of these protocols at runtime unless
      they had a __final__ attribute. Patch by Alex Waygood.
    - gh-105375: Fix a bug in sqlite3 where an exception could be
      overwritten in the collation callback.
    - gh-105332: Revert pickling method from by-name back to by-value.
    - gh-104554: Add RTSPS scheme support in urllib.parse
    - gh-100061: Fix a bug that causes wrong matches for regular
      expressions with possessive qualifier.
    - gh-102541: Hide traceback in help() prompt, when import failed.
    - gh-99203: Restore following CPython <= 3.10.5 behavior of
      shutil.make_archive(): do not create an empty archive if
      root_dir is not a directory, and, in that case, raise
      FileNotFoundError or NotADirectoryError regardless of format
      choice. Beyond the brought-back behavior, the function may now
      also raise these exceptions in dry_run mode.
    - gh-94777: Fix hanging multiprocessing ProcessPoolExecutor when a
      child process crashes while data is being written in the call
      queue.
    - bpo-18319: Ensure gettext(msg) retrieve translations even if a
      plural form exists. In other words: gettext(msg) ==
      ngettext(msg, '', 1).
  - Documentation
    - gh-107008: Document the curses module variables LINES and COLS.
    - gh-106948: Add a number of standard external names to
      nitpick_ignore.
    - gh-54738: Add documentation on how to localize the argparse
      module.
  - Tests
    - gh-105776: Fix test_cppext when the C compiler command -std=c11
      option: remove -std= options from the compiler command. Patch by
      Victor Stinner.
    - gh-107237: test_logging: Fix test_udp_reconnection() by
      increasing the timeout from 100 ms to 5 minutes (LONG_TIMEOUT).
      Patch by Victor Stinner.
    - gh-101634: When running the Python test suite with -jN option,
      if a worker stdout cannot be decoded from the locale encoding
      report a failed testn so the exitcode is non-zero. Patch by
      Victor Stinner.
  - Build
    - gh-107814: When calling find_python.bat with -q it did not
      properly silence the output of nuget. That is now fixed.
    - gh-106881: Check for linux/limits.h before including it in
      Modules/posixmodule.c.
    - gh-104692: Include commoninstall as a prerequisite for
      bininstall
    - This ensures that commoninstall is completed before bininstall
      is started when parallel builds are used (make -j install), and
      so the python3 symlink is only installed after all standard
      library modules are installed.
    - gh-100340: Allows -Wno-int-conversion for wasm-sdk 17 and
      onwards, thus enables building WASI builds once against the
      latest sdk.
  - Windows
    - gh-106242: Fixes realpath() to behave consistently when passed a
      path containing an embedded null character on Windows. In strict
      mode, it now raises OSError instead of the unexpected
      ValueError, and in non-strict mode will make the path absolute.
    - gh-106844: Fix integer overflow in _winapi.LCMapStringEx() which
      affects ntpath.normcase().
    - gh-99079: Update Windows build to use OpenSSL 3.0.9
    - gh-105436: Ensure that an empty environment block is terminated
      by two null characters, as is required by Windows.
  - macOS
    - gh-107565: Update macOS installer to use OpenSSL 3.0.10.
    - gh-99079: Update macOS installer to use OpenSSL 3.0.9.
  - Tools/Demos
    - gh-107565: Update multissltests and GitHub CI workflows to use
      OpenSSL 1.1.1v, 3.0.10, and 3.1.2.
    - gh-95065: Argument Clinic now supports overriding automatically
      generated signature by using directive @text_signature. See How
      to override the generated signature.
    - gh-106970: Fix bugs in the Argument Clinic destination <name>
      clear command; the destination buffers would never be cleared,
      and the destination directive parser would simply continue to
      the fault handler after processing the command. Patch by Erlend
      E. Aasland.
  - C API
    - gh-107916: C API functions PyErr_SetFromErrnoWithFilename(),
      PyErr_SetExcFromWindowsErrWithFilename() and
      PyErr_SetFromWindowsErrWithFilename() save now the error code
      before calling PyUnicode_DecodeFSDefault().
    - gh-107915: Such C API functions as PyErr_SetString(),
      PyErr_Format(), PyErr_SetFromErrnoWithFilename() and many others
      no longer crash or ignore errors if it failed to format the
      error message or decode the filename. Instead, they keep a
      corresponding error.
    - gh-107226: PyModule_AddObjectRef() is now only available in the
      limited API version 3.10 or later.
    - gh-105375: Fix a bug in PyErr_WarnExplicit() where an exception
      could end up being overwritten if the API failed internally.
    - gh-99612: Fix PyUnicode_DecodeUTF8Stateful() for ASCII-only
      data: *consumed was not set.

• Files Changed
• Browse Source

• Files Changed
• Browse Source

- IT MEANS THAT bsc#1210638 STILL HAS NOT BEEN FIXED!
- Add Revert-gh105127-left-tests.patch (gh#python/cpython!106941)
  partially reverting CVE-2023-27043-email-parsing-errors.patch,
  because of the regression in gh#python/cpython#106669.
- (bsc#1210638, CVE-2023-27043) Add
  CVE-2023-27043-email-parsing-errors.patch, which detects email
  address parsing errors and returns empty tuple to indicate the
  parsing error (old API). (The patch is faulty,
  gh#python/cpython#106669, but upstream decided not to just
  revert it).

• Files Changed
• Browse Source

- Update to Python 3.11.4:
  - gh-103142: The version of OpenSSL used in Windows and
    Mac installers has been upgraded to 1.1.1u to address
    CVE-2023-2650, CVE-2023-0465, CVE-2023-0466, CVE-2023-0464,
    as well as CVE-2023-0286, CVE-2022-4303, and CVE-2022-4303
    fixed previously in 1.1.1t (gh-101727).
  - gh-102153: urllib.parse.urlsplit() now strips leading C0
    control and space characters following the specification for
    URLs defined by WHATWG in response to CVE-2023-24329
    (bsc#1208471).
  - gh-99889: Fixed a security in flaw in uu.decode() that could
    allow for directory traversal based on the input if no
    out_file was specified.
  - gh-104049: Do not expose the local on-disk
    location in directory indexes produced by
    http.client.SimpleHTTPRequestHandler.
  - gh-103935: trace.__main__ now uses io.open_code() for files
    to be executed instead of raw open().
  - gh-102953: The extraction methods in tarfile, and
    shutil.unpack_archive(), have a new filter argument that
    allows limiting tar features than may be surprising or
    dangerous, such as creating files outside the destination
    directory. See Extraction filters for details (fixing
    CVE-2007-4559, bsc#1203750).
- Remove upstreamed patches:
  - CVE-2007-4559-filter-tarfile_extractall.patch

• Files Changed
• Browse Source

- Remove obsolete_python_versioned macro again. This mechanism
  has no business to be in Python 3.11, because we have abolished
  with it whole interpreter+setuptools+pip product. Python 3.11
  should not be replaced by later versions anymore.

• Files Changed
• Browse Source

Automatic submission by obs-autosubmit

• Files Changed
• Browse Source

- Why in the world we download from HTTP?
- Add 103213-fetch-CONFIG_ARGS.patch (gh#python/cpython#103053).
- Add skip_if_buildbot-extend.patch to avoid the bug altogether
  (extending what skip_if_buildbot covers).
- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  bsc#1203750 (CVE-2007-4559) and implementing "PEP 706 – Filter
  for tarfile.extractall".
- Update to 3.11.3:
  - Security
    - gh-101727: Updated the OpenSSL version used in Windows
      and macOS binary release builds to 1.1.1t to address
      CVE-2023-0286, CVE-2022-4303, and CVE-2022-4303 per the
      OpenSSL 2023-02-07 security advisory.
  - Core and Builtins
    - gh-101975: Fixed stacktop value on tracing entries to avoid
      corruption on garbage collection.
    - gh-102701: Fix overflow when creating very large dict.
    - gh-102416: Do not memoize incorrectly automatically
      generated loop rules in the parser. Patch by Pablo Galindo.
    - gh-102356: Fix a bug that caused a crash when deallocating
      deeply nested filter objects. Patch by Marta Gómez Macías.
    - gh-102397: Fix segfault from race condition in signal
      handling during garbage collection. Patch by Kumar Aditya.
    - gh-102281: Fix potential nullptr dereference and use of
      uninitialized memory in fileutils. Patch by Max Bachmann.
    - gh-102126: Fix deadlock at shutdown when clearing thread
      states if any finalizer tries to acquire the runtime head
      lock. Patch by Kumar Aditya.
    - gh-102027: Fix SSE2 and SSE3 detection in _blake2 internal
      module. Patch by Max Bachmann.
    - gh-101967: Fix possible segfault in
      positional_only_passed_as_keyword function, when new list
      created.
    - gh-101765: Fix SystemError / segmentation fault in iter
      __reduce__ when internal access of builtins.__dict__ keys
      mutates the iter object.
    - gh-101696: Invalidate type version tag in
      _PyStaticType_Dealloc for static types, avoiding bug where
      a false cache hit could crash the interpreter. Patch by
      Kumar Aditya.
  - Library
    - gh-102549: Don’t ignore exceptions in member type creation.
    - gh-102947: Improve traceback when dataclasses.fields() is
      called on a non-dataclass. Patch by Alex Waygood
    - gh-102780: The asyncio.Timeout context manager now
      works reliably even when performing cleanup due to task
      cancellation. Previously it could raise a CancelledError
      instead of an TimeoutError in such cases.
    - gh-88965: typing: Fix a bug relating to substitution in   .
    Pacustom classes generic over a ParamSpec. Previously, if   .
    Pathe ParamSpec was substituted with a parameters list that .
    Paitself contained a TypeVar, the TypeVar in the parameters .
    Palist could not be subsequently substituted. This is now   .
    Pafixed tch by Nikita Sobolev                               .
    - gh-101979: Fix a bug where parentheses in the metavar
      argument to argparse.ArgumentParser.add_argument() were
      dropped. Patch by Yeojin Kim.
    - gh-102179: Fix os.dup2() error message for negative fds.
    - gh-101961: For the binary mode, fileinput.hookcompressed()
      doesn’t set the encoding value even if the value is
      None. Patch by Gihwan Kim.
    - gh-101936: The default value of fp becomes io.BytesIO
      if HTTPError is initialized without a designated fp
      parameter. Patch by Long Vo.
    - gh-102069: Fix __weakref__ descriptor generation for custom
      dataclasses.
    - gh-101566: In zipfile, apply fix for extractall on the
      underlying zipfile after being wrapped in Path.
    - gh-101892: Callable iterators no longer raise SystemError
      when the callable object exhausts the iterator but forgets
      to either return a sentinel value or raise StopIteration.
    - gh-97786: Fix potential undefined behaviour in corner cases
      of floating-point-to-time conversions.
    - gh-101517: Fixed bug where bdb looks up the source line
      with linecache with a lineno=None, which causes it to fail
      with an unhandled exception.
    - gh-101673: Fix a pdb bug where ll clears the changes to
      local variables.
    - gh-96931: Fix incorrect results from
      ssl.SSLSocket.shared_ciphers()
    - gh-88233: Correctly preserve “extra” fields in zipfile
      regardless of their ordering relative to a zip64 “extra.”
    - gh-96127: inspect.signature was raising TypeError on
      call with mock objects. Now it correctly returns (*args,
      **kwargs) as infered signature.
    - gh-95495: When built against OpenSSL 3.0, the ssl module
      had a bug where it reported unauthenticated EOFs (i.e.
      without close_notify) as a clean TLS-level EOF. It now
      raises SSLEOFError, matching the behavior in previous
      versions of OpenSSL. The options attribute on SSLContext
      also no longer includes OP_IGNORE_UNEXPECTED_EOF by
      default. This option may be set to specify the previous
      OpenSSL 3.0 behavior.
    - gh-94440: Fix a concurrent.futures.process bug where
      ProcessPoolExecutor shutdown could hang after a future has
      been quickly submitted and canceled.
  - Documentation
    - gh-103112: Add docstring to http.client.HTTPResponse.read()
      to fix pydoc output.
    - gh-85417: Update cmath documentation to clarify behaviour
      on branch cuts.
    - gh-97725: Fix asyncio.Task.print_stack() description for
      file=None. Patch by Oleg Iarygin.
  - Tests
    - gh-102980: Improve test coverage on pdb.
    - gh-102537: Adjust the error handling strategy in
      test_zoneinfo.TzPathTest.python_tzpath_context. Patch by
      Paul Ganssle.
    - gh-89792: test_tools now copies up to 10x less source data
      to a temporary directory during the freeze test by ignoring
      git metadata and other artifacts. It also limits its python
      build parallelism based on os.cpu_count instead of hard
      coding it as 8 cores.
    - gh-101377: Improved test_locale_calendar_formatweekday of
      calendar.
  - Build
    - gh-102711: Fix -Wstrict-prototypes compiler warnings.

• Files Changed
• Browse Source

- Update to 3.11.2:
  Bug fixes, no changes in API and no security bugs.
- Add python310 Obsoletes line to obsolete_python_versioned macro.

• Files Changed
• Browse Source

- Add provides for readline and sqlite3 to the main Python
  package.

• Files Changed
• Browse Source

• Files Changed
• Browse Source

• Files Changed
• Browse Source

- Don't fail on Sphinx build warnings.
- For jsc#PED-1570, providing Python 3.11 for SLE-15-SP5.

• Files Changed
• Browse Source

- Update to 3.11.1:
  - python -m http.server no longer allows terminal control
    characters sent within a garbage request to be printed
    to the stderr server lo This is done by changing the
    http.server BaseHTTPRequestHandler .log_message method to
    replace control characters with a \xHH hex escape before
    printin
  - Avoid publishing list of active per-interpreter audit hooks
    via the gc module
  - The IDNA codec decoder used on DNS hostnames by socket or
    asyncio related name resolution functions no longer involves
    a quadratic algorithm. This prevents a potential CPU denial
    of service if an out-of-spec excessive length hostname
    involving bidirectional characters were decoded. Some
    protocols such as urllib http 3xx redirects potentially allow
    for an attacker to supply such a name (CVE-2022-45061).
  - Update bundled libexpat to 2.5.0
  - Fix a shell code injection vulnerability in the
    get-remote-certificate.py example script. The script no
    longer uses a shell to run openssl commands. Issue reported
    and initial fix by Caleb Shortt. Patch by Victor Stinner.
  - Fix a crash when an object which does not have a dictionary
    frees its instance values.
  - Fix a bug in the tokenizer that could cause infinite
    recursion when showing syntax warnings that happen in the
    first line of the source. Patch by Pablo Galindo
  - Fix an issue that could cause frames to be visible to Python
    code as they are being torn down, possibly leading to memory
    corruption or hard crashes of the interpreter.
  - Fix a reference bug in _imp.create_builtin() after the
    creation of the first sub-interpreter for modules builtins
    and sys. Patch by Victor Stinner.
  - Fixed a bug that was causing a buffer overflow if the
    tokenizer copies a line missing the newline caracter from a
    file that is as long as the available tokenizer buffer. Patch
    by Pablo galindo
  - Fix bug where an ExceptionGroup subclass can wrap a
    BaseException.
  - Fix zip path for venv created from a non-installed python on
    POSIX platforms.
  - Fix an issue that could potentially cause incorrect error
    handling for some bytecode instructions.
  - Fix an issue that prevented PyThreadState and
    PyInterpreterState memory from being freed properly.
  - Fix failure in except* with unhashable exceptions.
  - Fix calculation of sys._base_executable when inside a POSIX
    virtual environment using copies of the python binary when
    the base installation does not provide the executable name
    used by the venv. Calculation will fall back to alternative
    names (“python<MAJOR>”, “python<MAJOR>.<MINOR>”).
  - Update faulthandler to emit an error message with the proper
    unexpected signal number. Patch by Dong-hee Na.
  - Fix location of SyntaxError for a try block with both except
    and except*.
  - Fix the error reporting positions of specialized traceback
    anchors when the source line contains Unicode characters.
  - Fix subscription of type aliases containing bare generic
    types or types like TypeVar: for example tuple[A, T][int] and
    tuple[TypeVar, T][int], where A is a generic type, and T is a
    type variable.
  - Lower the recursion depth for marshal on WASI to support
    wasmtime 2.0/main.
  - Fix multiple crashes in debug mode when str subclasses are
    used instead of str itself.
  - Fix an issue where member descriptors (such as those for
    __slots__) could behave incorrectly or crash instead of
    raising a TypeError when accessed via an instance of an
    invalid type.
  - Suppress ImportError for invalid query for help()
    command. Patch by Dong-hee Na.
  - Fix detection of MAC addresses for uuid on certain OSs. Patch
    by Chaim Sanders
  - Print exception class name instead of its string
    representation when raising errors from ctypes calls.
  - os.sched_yield() now release the GIL while calling
    sched_yield(2). Patch by Dong-hee Na.
  - Fix an issue that could delay the specialization of PRECALL
    instructions.
  - Bugfix: PyFunction_GetAnnotations() should return a borrowed
    reference. It was returning a new reference.
  - Ensure that all Python frame objects are backed by “complete”
    frames.
  - Fixed a missing incref/decref pair in
    Exception.__setstate__(). Patch by Ofey Chan.
  - Fix the Python path configuration used to initialized
    sys.path at Python startup. Paths are no longer encoded
    to UTF-8/strict to avoid encoding errors if it contains
    surrogate characters (bytes paths are decoded with the
    surrogateescape error handler). Patch by Victor Stinner.
  - Fix overly-broad source position information for chained
    comparisons used as branching conditions.
  - At Python exit, sometimes a thread holding the GIL can
    wait forever for a thread (usually a daemon thread) which
    requested to drop the GIL, whereas the thread already
    exited. To fix the race condition, the thread which requested
    the GIL drop now resets its request before exiting. Issue
    discovered and analyzed by Mingliang ZHAO. Patch by Victor
    Stinner.
  - Fix a possible assertion failure, fatal error, or SystemError
    if a line tracing event raises an exception while opcode
    tracing is enabled.
  - Fix undefined behaviour in C code of null pointer arithmetic.
  - Make sure that all frame objects created are created from
    valid interpreter frames. Prevents the possibility of invalid
    frames in backtraces and signal handlers.
  - Disable incorrect pickling of the C implemented classmethod
    descriptors.
  - On WASI ENOTCAPABLE is now mapped to PermissionError. The
    errno modules exposes the new error number. getpath.py now
    ignores PermissionError when it cannot open landmark files
    pybuilddir.txt and pyenv.cfg.
  - Allow pdb to locate source for frozen modules in the standard
    library.
  - Raise ValueError instead of SystemError when methods of
    uninitialized io.IncrementalNewlineDecoder objects are
    called. Patch by Oren Milman.
  - Fix a possible assertion failure in io.FileIO when the opener
    returns an invalid file descriptor.
  - Also escape s in the http.server
    BaseHTTPRequestHandler.log_message so that it is technically
    possible to parse the line and reconstruct what the original
    data was. Without this a xHH is ambiguious as to if it is a
    hex replacement we put in or the characters r”x” came through
    in the original request line.
  - asyncio.get_event_loop() now only emits a deprecation warning
    when a new event loop was created implicitly. It no longer
    emits a deprecation warning if the current event loop was
    set.
  - Fix bug when calling trace.CoverageResults with valid infile.
  - Fix a bug in handling class cleanups in
    unittest.TestCase. Now addClassCleanup() uses separate lists
    for different TestCase subclasses, and doClassCleanups() only
    cleans up the particular class.
  - Release the GIL when calling termios APIs to avoid blocking
    threads.
  - Fix ast.increment_lineno() to also cover ast.TypeIgnore when
    changing line numbers.
  - Fix bug in urllib.parse.urlparse() that causes URL schemes
    that begin with a digit, a plus sign, or a minus sign to be
    parsed incorrectly.
  - Check the number of arguments in substitution in user
    generics containing a TypeVarTuple and one or more TypeVar.
  - Fix substitution of ParamSpec followed by TypeVarTuple in
    generic aliases.
  - Fix substitution of TypeVarTuple and ParamSpec together in
    user generics.
  - Fixed bug where inspect.signature() reported incorrect
    arguments for decorated methods.
  - Fix SystemError in ctypes when exception was not set during
    __initsubclass__.
  - Remove older version of
    _SSLProtocolTransport.get_write_buffer_limits in
    asyncio.sslproto
  - fix negative numbers failing in verify()
  - Fix statistics.NormalDist pickle with 0 and 1 protocols.
  - enum.auto() is now correctly activated when combined with
    other assignment values. E.g. ONE = auto(), 'some text' will
    now evaluate as (1, 'some text').
  - Update the bundled copy of pip to version 22.3.1.
  - Clean up refleak on failed module initialisation in _zoneinfo
  - Clean up refleaks on failed module initialisation in in
    _pickle
  - Clean up refleak on failed module initialisation in _io.
  - Fix memory leak in math.dist() when both points don’t have
    the same dimension. Patch by Kumar Aditya.
  - [3.11] Applied changes from importlib_metadata 4.11.4
    through 4.13, including compatibility and robustness
    fixes for Distribution objects without _normalized_name,
    disallowing invalid inputs to Distribution.from_name, and
    refined behaviors in PathDistribution._name_from_stem and
    PathDistribution._normalized_name.
  - Fix argument typechecks in _overlapped.WSAConnect() and
    _overlapped.Overlapped.WSASendTo() functions.
  - Prevent crashing in traceback when retrieving the byte-offset
    for some source files that contain certain unicode
    characters.
  - Fix internal error in the re module which in very rare
    circumstances prevented compilation of a regular expression
    containing a conditional expression without the “else”
    branch.
  - Fix asyncio.StreamWriter.drain() to call
    protocol.connection_lost callback only once on Windows.
  - Add a mutex to unittest.mock.NonCallableMock to protect
    concurrent access to mock attributes.
  - Fix hang on Windows in subprocess.wait_closed() in asyncio
    with ProactorEventLoop. Patch by Kumar Aditya.
  - Fix infinite loop in unittest when a self-referencing chained
    exception is raised
  - tkinter.Text.count() raises now an exception for options
    starting with “-” instead of silently ignoring them.
  - On uname_result, restored expectation that _fields and
    _asdict would include all six properties including processor.
  - A createSocket() method was added to SysLogHandler.
  - Fix bug in urllib.parse.urlparse() that causes certain port
    numbers containing whitespace, underscores, plus and minus
    signs, or non-ASCII digits to be incorrectly accepted.
  - Allow venv to pass along PYTHON* variables to ensurepip and
    pip when they do not impact path resolution
  - On macOS, fix a crash in syslog.syslog() in multi-threaded
    applications. On macOS, the libc syslog() function is not
    thread-safe, so syslog.syslog() no longer releases the GIL to
    call it. Patch by Victor Stinner.
  - Allow BUILTINS to be a valid field name for frozen
    dataclasses.
  - Wrap network errors consistently in urllib FTP support, so
    the test suite doesn’t fail when a network is available but
    the public internet is not reachable.
  - Make sure patch.dict() can be applied on async functions.
  - Earlier in 3.11 we deprecated
    asyncio.Task.cancel("message"). We realized we were too
    harsh, and have undeprecated it.
  - Change deprecate warning message in unittest from It is
    deprecated to return a value!=None to It is deprecated to
    return a value that is not None from a test case
  - Fixes AttributeError when subprocess.check_output() is used
    with argument input=None and either of the arguments encoding
    or errors are used.
  - Fix is_private properties in the ipaddress module. Previously
    non-private networks (0.0.0.0/0) would return True from this
    method; now they correctly return False.
  - Avoid spurious tracebacks from asyncio when default executor
    cleanup is delayed until after the event loop is closed (e.g.
    as the result of a keyboard interrupt).
  - Avoid a crash in the C version of
    asyncio.Future.remove_done_callback() when an evil argument
    is passed.
  - Remove tokenize.NL check from tabnanny.
  - Fix generation of the default name of
    tkinter.Checkbutton. Previously, checkbuttons in different
    parent widgets could have the same short name and share
    the same state if arguments “name” and “variable” are not
    specified. Now they are globally unique.
  - Update bundled libexpat to 2.4.9
  - Fix race condition in asyncio where process_exited() called
    before the pipe_data_received() leading to inconsistent
    output. Patch by Kumar Aditya.
  - Fixed check in multiprocessing.resource_tracker that
    guarantees that the length of a write to a pipe is not
    greater than PIPE_BUF.
  - Corrected type annotation for dataclass attribute
    pstats.FunctionProfile.ncalls to be str.
  - Fix repr of Any subclasses.
  - Work around missing socket functions in socket’s __repr__.
  - In inspect, fix overeager replacement of “typing.” in
    formatting annotations.
  - Fix handling of bytes path-like objects in os.ismount().
  - Fix handling compiler warnings (SyntaxWarning and
    DeprecationWarning) in codeop.compile_command() when checking
    for incomplete input. Previously it emitted warnings and
    raised a SyntaxError. Now it always returns None for
    incomplete input without emitting any warnings.
  - To avoid apparent memory leaks when asyncio.open_connection()
    raises, break reference cycles generated by local exception
    and future instances (which has exception instance as its
    member var). Patch by Dong Uk, Kang.
  - Fixed flickering of the turtle window when the tracer is
    turned off. Patch by Shin-myoung-serp.
  - Fix asyncio subprocess transport to kill process cleanly
    when process is blocked and avoid RuntimeError when loop is
    closed. Patch by Kumar Aditya.
  - Prevent error when activating venv in nested fish instances.
  - TarFile.next() now returns None when called on an empty
    tarfile.
  - Document the optional callback parameter of WeakMethod. Patch
    by Géry Ogam.
  - Restrict use of sockets instead of pipes for stdin of
    subprocesses created by asyncio to AIX platform only.
  - shutil.copytree() now applies the ignore_dangling_symlinks
    argument recursively.
  - Fix IndexError in argparse.ArgumentParser when a store_true
    action is given an explicit argument.
  - Document that calling variadic functions with ctypes requires
    special care on macOS/arm64 (and possibly other platforms).
  - Remove extra row
  - Clarified the conflicting advice given in the ast
    documentation about ast.literal_eval() being “safe” for use
    on untrusted input while at the same time warning that it
    can crash the process. The latter statement is true and is
    deemed unfixable without a large amount of work unsuitable
    for a bugfix. So we keep the warning and no longer claim that
    literal_eval is safe.
  - Restructured the documentation for the os.wait* family of
    functions, and improved the docs for os.waitid() with more
    explanation of the possible argument constants.
  - Skip test_normalization() of test_unicodedata if it
    fails to download NormalizationTest.txt file from
    pythontest.net. Patch by Victor Stinner.
  - Correct test_marsh on (32 bit) x86: test_deterministic sets
    was failing.
  - Optional big memory tests in test_sqlite3 now catch the
    correct sqlite.DataError exception type in case of too large
    strings and/or blobs passed.
  - Fix a bug in the typing tests where a test relying
    on CPython-specific implementation details was not
    decorated with @cpython_only and was not skipped on other
    implementations.
  - Add tests for star-unpacking with PEP 646, and some other
    miscellaneous PEP 646 tests.
  - Added explicit coverage of Py_Initialize (and hence
    Py_InitializeEx) back to the embedding tests (all other
    embedding tests migrated to Py_InitializeFromConfig in Python
    3.11)
  - Some C API tests were moved into the new Lib/test/test_capi/
    directory.
  - Fix -Wimplicit-int, -Wstrict-prototypes, and
    -Wimplicit-function-declaration compiler warnings in
    configure checks.
  - Fix a compilation issue with GCC 12 on macOS.
  - Fix -Wimplicit-int compiler warning in configure check for
    PTHREAD_SCOPE_SYSTEM.
  - Fix a possible fd leak in Programs/_freeze_module.c
    introduced in Python 3.11.
  - Fix build with PYTHON_FOR_REGEN=python3.8.
  - Specify the full path to the source location for make
    docclean (needed for cross-builds).
  - Don’t use vendored libmpdec headers if --with-system-libmpdec
    is passed to configure. Don’t use vendored libexpat headers
    if --with-system-expat is passed to !configure.
  - Fix the build process of clang compiler for _bootstrap_python
    if LTO optimization is applied. Patch by Matthias Görgens and
    Dong-hee Na.
  - wasm32-emscripten builds for browsers now include
    concurrent.futures for asyncio and unittest.mock.
  - wasm32-emscripten platform no longer builds resource module,
    getresuid(), getresgid(), and their setters. The APIs are
    stubs and not functional.
  - Updated pegen regeneration script on Windows to find and
    use Python 3.9 or higher. Prior to this, pegen regeneration
    already required 3.9 or higher, but the script may have used
    lower versions of Python.
  - Fix a bug in the previous bugfix that caused IDLE to
    not start when run with 3.10.8, 3.12.0a1, and at least
    Microsoft Python 3.10.2288.0 installed without the Lib/test
    package. 3.11.0 was never affected.
  - The wasm_build.py script now pre-builds Emscripten ports,
    checks for broken EMSDK versions, and warns about pkg-config
    env vars.
  - The new tool Tools/wasm/wasm_builder.py automates configure,
    compile, and test steps for building CPython on WebAssembly
    platforms.
  - Fix handling of module docstrings in Tools/i18n/pygettext.py.
  - PyBUF_* constants were marked as part of Limited API
    of Python 3.11+. These were available in 3.11.0 with
    Py_LIMITED_API defined for 3.11, and are necessary to use the
    buffer API.
  - Fix use-after-free in Py_SetPythonHome(NULL),
    Py_SetProgramName(NULL) and _Py_SetProgramFullPath(NULL)
    function calls. Issue reported by Benedikt Reinartz. Patch by
    Victor Stinner.
  - Py_InitializeEx now correctly calls PyConfig_Clear after
    initializing the interpreter (the omission didn’t cause a
    memory leak only because none of the dynamically allocated
    config fields are populated by the wrapper function)
- Removed upstreamed patches:
  - 98437-sphinx.locale._-as-gettext-in-pyspecific.patch
  - CVE-2022-45061-DoS-by-IDNA-decode.patch

• Files Changed
• Browse Source

- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.

• Files Changed
• Browse Source

• Files Changed
• Browse Source

- Update to 3.11.0rc2:
  - Converting between int and str in bases other than 2
    (binary), 4, 8 (octal), 16 (hexadecimal), or 32 such as base
    10 (decimal) now raises a ValueError if the number of digits
    in string form is above a limit to avoid potential denial of
    service attacks due to the algorithmic complexity. This is
    a mitigation for CVE-2020-10735.
    This new limit can be configured or disabled by environment
    variable, command line flag, or sys APIs. See the integer
    string conversion length limitation documentation. The
    default limit is 4300 digits in string form.
  - Fix case of undefined behavior in ceval.c
  - Do not expose KeyWrapper in _functools.
  - Ensure that tracing, sys.setrace(), is turned on
    immediately. In pre-release versions of 3.11, some tracing
    events might have been lost when turning on tracing in a
    __del__ method or interrupt.
  - Fix use after free in trace refs build mode. Patch by Kumar
    Aditya.
  - When loading a file with invalid UTF-8 inside a multi-line
    string, a correct SyntaxError is emitted.
  - Make sure that incomplete frames do not show up in
    tracemalloc traces.
  - Remove two cases of undefined behavior, by adding NULL
    checks.
  - Fix possible NULL pointer dereference in
    _PyThread_CurrentFrames. Patch by Kumar Aditya.
  - Fix AttributeError missing name and obj attributes in
    object.__getattribute__(). Patch by Philip Georgi.
  - Loading a file with invalid UTF-8 will now report the broken
    character at the correct location.
  - Fixed a bug that caused _PyCode_GetExtra to return garbage
    for negative indexes. Patch by Pablo Galindo
  - Fix a deadlock in PyGILState_Ensure() when allocating new
    thread state. Patch by Kumar Aditya.
  - PyType_Ready() now initializes ht_cached_keys and performs
    additional checks to ensure that type objects are properly
    configured. This avoids crashes in 3rd party packages that
    don’t use regular API to create new types.
  - Skip over incomplete frames in PyThreadState_GetFrame().
  - Fix format string in _PyPegen_raise_error_known_location that
    can lead to memory corruption on some 64bit systems. The
    function was building a tuple with i (int) instead of n
    (Py_ssize_t) for Py_ssize_t arguments.
  - Fix misleading contents of error message when converting an
    all-whitespace string to float.
  - ast.parse() will no longer parse function definitions with
    positional-only params when passed feature_version less than
    (3, 8). Patch by Shantanu Jain.
  - Fix incorrect error message in the io module.
  - Fix the faulthandler implementation of
    faulthandler.register(signal, chain=True) if the sigaction()
    function is not available: don’t call the previous signal
    handler if it’s NULL. Patch by Victor Stinner.
  - Correct conversion of numbers.Rational’s to float.
  - Fix TypeVarTuple.__typing_prepare_subst__. TypeError was not
    raised when using more than one TypeVarTuple, like [*T, *V]
    in type alias substitutions.
  - Fix asyncio.streams.StreamReaderProtocol to keep a strong
    reference to the created task, so that it’s not garbage
    collected
  - Fix a performance regression in logging
    TimedRotatingFileHandler. Only check for special files when
    the rollover time has passed.
  - Fix unused localName parameter in the Attr class in
    xml.dom.minidom.
  - Fix incorrect condition that causes sys.thread_info.name to
    be wrong on pthread platforms.
  - Remove an incompatible change from bpo-28080 that caused a
    regression that ignored the utf8 in ZipInfo.flag_bits. Patch
    by Pablo Galindo.
  - Fix asyncio.Runner to call asyncio.set_event_loop() only
    once to avoid calling attach_loop() multiple times on child
    watchers. Patch by Kumar Aditya.
  - Fix unittest.IsolatedAsyncioTestCase to set event loop before
    calling setup functions. Patch by Kumar Aditya.
  - When a task catches asyncio.CancelledError and raises some
    other error, the other error should generally not silently be
    suppressed.
  - Fail gracefully if EPERM or ENOSYS is raised when loading
    crypt methods. This may happen when trying to load MD5 on a
    Linux kernel with FIPS enabled.
  - Allow asyncio.StreamWriter.drain() to be awaited concurrently
    by multiple tasks. Patch by Kumar Aditya.
  - Fix ast.unparse() when ImportFrom.level is None
  - Improve discoverability of the higher level
    concurrent.futures module by providing clearer links from the
    lower level threading and multiprocessing modules.
  - What’s New 3.11 now has instructions for how to provide
    compiler and linker flags for Tcl/Tk and OpenSSL on RHEL 7
    and CentOS 7.
  - Mitigate the inherent race condition from using
    find_unused_port() in testSockName() by trying to find an
    unused port a few times before failing. Patch by Ross Burton.
  - Build and test with OpenSSL 1.1.1q
- Use support-expat-CVE-2022-25236-patched.patch from the current
  version of gh#python/cpython#93900 instead of the old
  support-expat-245.patch.
- Reapply fix_configure_rst.patch.

• Files Changed
• Browse Source

• Files Changed
• Browse Source

Automatic submission by obs-autosubmit

• Files Changed
• Browse Source

- Update to 3.11.0b5:
  - Core and Builtins
    - gh-93351: ast.AST node positions are now validated when
      provided to compile() and other related functions. If
      invalid positions are detected, a ValueError will be
      raised.
    - gh-94438: Fix an issue that caused extended opcode
      arguments and some conditional pops to be ignored when
      calculating valid jump targets for assignments to the
      f_lineno attribute of frame objects. In some cases, this
      could cause inconsistent internal state, resulting in a
      hard crash of the interpreter.
    - gh-95060: Undocumented PyCode_Addr2Location function now
      properly returns when addrq argument is less than zero.
    - gh-95113: Replace all EXTENDED_ARG_QUICK instructions
      with basic EXTENDED_ARG instructions in unquickened
      code. Consumers of non-adaptive bytecode should be able to
      handle extended arguments the same way they were handled in
      CPython 3.10 and older.
    - gh-91409: Fix incorrect source location info caused by
      certain optimizations in the bytecode compiler.
    - gh-94036: Fix incorrect source location info for some
      multi-line attribute accesses and method calls.
    - gh-94739: Allow jumping within, out of, and across
      exception handlers in the debugger.
    - gh-94949: ast.parse() will no longer parse parenthesized
      context managers when passed feature_version less than (3,
      9). Patch by Shantanu Jain.
    - gh-94947: ast.parse() will no longer parse assignment
      expressions when passed feature_version less than (3,
      8). Patch by Shantanu Jain.
    - gh-91256: Ensures the program name is known for help text
      during interpreter startup.
    - gh-94869: Fix the column offsets for some expressions in
      multi-line f-strings ast nodes. Patch by Pablo Galindo.
    - gh-94822: Fix an issue where lookups of metaclass
      descriptors may be ignored when an identically-named
      attribute also exists on the class itself.
    - gh-91153: Fix an issue where a bytearray item assignment
      could crash if it’s resized by the new value’s __index__()
      method.
    - gh-90699: Fix reference counting bug in
      bool.__repr__(). Patch by Kumar Aditya.
  - Library
    - gh-95087: Fix IndexError in parsing invalid date in the
      email module.
    - gh-95199: Upgrade bundled setuptools to 63.2.0.
    - gh-95194: Upgrade bundled pip to 22.2.
    - gh-95132: Fix a sqlite3 regression where *args and **kwds
      were incorrectly relayed from connect() to the Connection
      factory. The regression was introduced in 3.11a1 with PR
      24421 (gh-85128). Patch by Erlend E. Aasland.`
    - gh-93157: Fix fileinput module didn’t support errors option
      when inplace is true.
    - gh-95105: wsgiref.types.InputStream.__iter__() should
      return Iterator[bytes], not Iterable[bytes]. Patch by
      Shantanu Jain.
    - gh-94857: Fix refleak in
      _io.TextIOWrapper.reconfigure. Patch by Kumar Aditya.
    - gh-94821: Fix binding of unix socket to empty address
      on Linux to use an available address from the abstract
      namespace, instead of “0”.
    - gh-89988: Fix memory leak in pickle.Pickler when looking up
      dispatch_table. Patch by Kumar Aditya.
    - bpo-47025: Drop support for bytes on sys.path.
  - Tests
    - gh-95212: Make multiprocessing test case
      test_shared_memory_recreate parallel-safe.
  - Build
    - gh-94847: Fixed _decimal module build issue on GCC when
      compiling with LTO and pydebug. Debug builds no longer
      force inlining of functions.
    - gh-94841: Fix the possible performance regression of
      PyObject_Free() compiled with MSVC version 1932.
    - gh-94801: configure now uses custom flags like ZLIB_CFLAGS
      and ZLIB_LIBS when searching for headers and libraries.
    - gh-94773: deepfreeze.py now supports code object with
      frozensets that contain incompatible, unsortable types.
  - C API
    - gh-94930: Fix SystemError raised when
      PyArg_ParseTupleAndKeywords() is used with # in (...) but
      without PY_SSIZE_T_CLEAN defined.
    - gh-94864: Fix PyArg_Parse* with deprecated format units “u”
      and “Z”. It returned 1 (success) when warnings are turned
      into exceptions.
    - gh-94731: Python again uses C-style casts for
      most casting operations when compiled with
      C++. This may trigger compiler warnings, if they
      are enabled with e.g. -Wold-style-cast `` or
      ``-Wzero-as-null-pointer-constant options for g++.

• Files Changed
• Browse Source

- Switch from %primary_interpreter to prjconf-defined
  %primary_python (gh#openSUSE/python-rpm-macros#127).

• Files Changed
• Browse Source