------------------------------------------------------------------ --- Changelog.all ----------- Fri May 9 13:14:04 UTC 2025 ------ ------------------------------------------------------------------ ------------------------------------------------------------------ ------------------ 2025-5-9 - May 9 2025 ------------------- ------------------------------------------------------------------ ++++ sle-module-python3-release: - automatically generated by openSUSE-release-tools/pkglistgen ------------------------------------------------------------------ ------------------ 2025-4-25 - Apr 25 2025 ------------------- ------------------------------------------------------------------ ++++ python-h11: - Add CVE-2025-43859.patch to fix security issue with malformed Chunked-Encoding bodies. (bsc#1241872, gh#python-hyper/h11@114803a29ce5) ------------------------------------------------------------------ ------------------ 2025-4-23 - Apr 23 2025 ------------------- ------------------------------------------------------------------ ++++ libxml2-python: - security update - added patches CVE-2025-32414 [bsc#1241551], out-of-bounds read when parsing text via the Python API + libxml2-CVE-2025-32414.patch CVE-2025-32415 [bsc#1241453], a crafted XML document may lead to a heap-based buffer under-read + libxml2-CVE-2025-32415.patch ------------------------------------------------------------------ ------------------ 2025-4-10 - Apr 10 2025 ------------------- ------------------------------------------------------------------ ++++ pgadmin4: - Patch the minified axios code included by upstream to fix a potential SSRF and credential leakage in axios (CVE-2025-27152, bsc#1239308). Since all the npm dependencies are minified and packed in a single file, creating a patch uses the full dependencies sources as context so, since the fix just removes one character from a regex, I used sed to apply the same change. ------------------------------------------------------------------ ------------------ 2025-4-9 - Apr 9 2025 ------------------- ------------------------------------------------------------------ ++++ pgadmin4: - Add patch to fix a potential SSRF and credential leakage in axios (CVE-2025-27152, bsc#1239308): * 0001-axios-fixsec-disregard-protocol-relative-URL-to-remediate-SSRF.patch ------------------------------------------------------------------ ------------------ 2025-3-31 - Mar 31 2025 ------------------- ------------------------------------------------------------------ ++++ python-entrypoints: - Switch to %{?sle15allpythons} (bsc#1240402) ++++ python-flake8: - Switch to %{?sle15allpythons} (bsc#1240402) - Skip failing tests test_proxy_contains_to_managers_plugins_dict and test_proxies_getitem_to_managers_plugins_dict failing with "unittest.mock.InvalidSpecError: Cannot autospec a Mock object". ++++ python-mccabe: - Switch to %{?sle15allpythons} (bsc#1240402) ------------------------------------------------------------------ ------------------ 2025-3-20 - Mar 20 2025 ------------------- ------------------------------------------------------------------ ++++ python-gunicorn: - Add upstream CVE-2024-6827.patch to don't tolerate wrong te headers. (gh#benoitc/gunicorn#3260, CVE-2024-6827, bsc#1239830) ------------------------------------------------------------------ ------------------ 2025-3-12 - Mar 12 2025 ------------------- ------------------------------------------------------------------ ++++ python311: - Allow to disable PGO ++++ python-Jinja2: - Add security patch CVE-2025-27516.patch (bsc#1238879) ++++ python311-core: - Allow to disable PGO ++++ python-requests-mock: - Tell urllib3 v2 to ignore content length mismatch - Added: * fix_issues_with_urllib3_v2.patch ------------------------------------------------------------------ ------------------ 2025-3-10 - Mar 10 2025 ------------------- ------------------------------------------------------------------ ++++ python311: - Skip PGO with %want_reproducible_builds (bsc#1239210) ++++ python311-core: - Skip PGO with %want_reproducible_builds (bsc#1239210) ------------------------------------------------------------------ ------------------ 2025-3-6 - Mar 6 2025 ------------------- ------------------------------------------------------------------ ++++ csp-billing-adapter: - Update to vrsion 1.3.0 * Add batch metering workflow for SaaS billing ------------------------------------------------------------------ ------------------ 2025-3-3 - Mar 3 2025 ------------------- ------------------------------------------------------------------ ++++ python-dmidecode: - Add patch fix-loglevel.patch to fix invalid log level error. gh#nima/python-dmidecode#60 bsc#1237685 ------------------------------------------------------------------ ------------------ 2025-2-26 - Feb 26 2025 ------------------- ------------------------------------------------------------------ ++++ csp-billing-adapter-microsoft: - Update to version 1.2.1 * Fix bug in meter billing. Handle no api flag in config file ------------------------------------------------------------------ ------------------ 2025-2-21 - Feb 21 2025 ------------------- ------------------------------------------------------------------ ++++ csp-billing-adapter-amazon: - Update to version 1.2.0 * Add batch metering function to handle subscription billing ++++ csp-billing-adapter-microsoft: - Update to version 1.2.0 * Add customer id to handle subscription billing ------------------------------------------------------------------ ------------------ 2025-2-20 - Feb 20 2025 ------------------- ------------------------------------------------------------------ ++++ libxml2-python: - version update to 2.12.10 ([bsc#1237363], [bsc#1237370], [bsc#1237418]): [#]## Security - [CVE-2025-24928] Fix stack-buffer-overflow in xmlSnprintfElements - [CVE-2024-56171] Fix use-after-free after xmlSchemaItemListAdd - pattern: Fix compilation of explicit child axis [#]## Regressions - parser: Fix detection of duplicate attributes [#]## Bug fixes - xpath: Fix parsing of non-ASCII names [#]## Portability - python: Declare init func with PyMODINIT_FUNC - tests: Fix sanitizer version check on old Apple clang [#]## Build - autotools: Set AC_CONFIG_AUX_DIR - cmake: Always build Python module as shared library - cmake: Fix compatibility in package version file - Also CVE-2025-27113 was assigned to this release. ------------------------------------------------------------------ ------------------ 2025-2-19 - Feb 19 2025 ------------------- ------------------------------------------------------------------ ++++ python-M2Crypto: - Change macro to %{?sle15allpythons} so we build both Python 3.6 and Python 3.11 on SLE-15. ------------------------------------------------------------------ ------------------ 2025-2-18 - Feb 18 2025 ------------------- ------------------------------------------------------------------ ++++ python-M2Crypto: - Fix spelling of BSD-2-Clause license. - Add rpmlintrc … overflow of ignorable rpmlint warnings caused me not to see the previous problem. ++++ zypp-plugin: - version 0.6.5 ------------------------------------------------------------------ ------------------ 2025-2-17 - Feb 17 2025 ------------------- ------------------------------------------------------------------ ++++ python-M2Crypto: - Update to 0.44.0: - fix(rsa): introduce internal cache for rsa.check_key() (bsc#1236664, srht#mcepl/m2crypto#369) - fix[authcookie]: modernize the module - fix(_lib): add missing #include for windows - ci: relax fedora crypto policy to legacy. - enhance setup.py for macos compatibility - prefer packaging.version over distutils.version - fix segfault with openssl 3.4.0 - fix[ec]: raise ioerror instead when load_key_bio() cannot read the file. - doc: update installation instructions for windows. - fix setting x509.verify_* variables - fix building against openssl in non-standard location - test_x509: use only x509_version_1 (0) as version for csr. ++++ zypp-plugin: - Build package for multiple Python flavors on the SLE15 family (fixes #4) ------------------------------------------------------------------ ------------------ 2025-2-12 - Feb 12 2025 ------------------- ------------------------------------------------------------------ ++++ python-M2Crypto: - The real license is BSD 2-Clause, not MIT. ++++ csp-billing-adapter: - Update to version 1.2.0 * Add fixed billing feature ------------------------------------------------------------------ ------------------ 2025-2-4 - Feb 4 2025 ------------------- ------------------------------------------------------------------ ++++ python311: - Add CVE-2025-0938-sq-brackets-domain-names.patch which disallows square brackets ([ and ]) in domain names for parsed URLs (bsc#1236705, CVE-2025-0938, gh#python/cpython#105704) ++++ python311-core: - Add CVE-2025-0938-sq-brackets-domain-names.patch which disallows square brackets ([ and ]) in domain names for parsed URLs (bsc#1236705, CVE-2025-0938, gh#python/cpython#105704) ++++ python-durationpy: - Initial package version — 0.9 ++++ python-kubernetes: - version update to 31.0.0 * please refer to the changelog at https://github.com/kubernetes-client/python/blob/v31.0.0/CHANGELOG.md#v3100 - update build requirements: `BuildRequires: %{python_module durationpy >= 0.7}` `Requires: python-durationpy >= 0.7` ------------------------------------------------------------------ ------------------ 2025-2-3 - Feb 3 2025 ------------------- ------------------------------------------------------------------ ++++ csp-billing-adapter: - Fix update-alternatives to ensure there is a symlink for csp-billing-adapter binary ------------------------------------------------------------------ ------------------ 2025-1-27 - Jan 27 2025 ------------------- ------------------------------------------------------------------ ++++ python311: - Configure externally_managed with a bcond https://en.opensuse.org/openSUSE:Python:Externally_managed bsc#1228165 ++++ python311-core: - Configure externally_managed with a bcond https://en.opensuse.org/openSUSE:Python:Externally_managed bsc#1228165 ++++ python-pydantic: - Add CVE-2024-3772.patch to fix Regular expression DoS, gh#pydantic/pydantic#7673 bsc#1222806 ------------------------------------------------------------------ ------------------ 2025-1-3 - Jan 3 2025 ------------------- ------------------------------------------------------------------ ++++ pgadmin4: - Add patch backported from upstream to fix an issue which could result in users being authenticated in another user's session if two users authenticate simultaneously via ldap (CVE-2023-1907, bsc#1234840): * 0001-Fixed-the-LDAP-authentication-issue-for-the-simultaneous.patch ------------------------------------------------------------------ ------------------ 2024-12-27 - Dec 27 2024 ------------------- ------------------------------------------------------------------ ++++ python-Jinja2: - Add security patch CVE-2024-56201.patch (bsc#1234808) - Add security patch CVE-2024-56326.patch (bsc#1234809) ------------------------------------------------------------------ ------------------ 2024-12-12 - Dec 12 2024 ------------------- ------------------------------------------------------------------ ++++ python-aiohttp: - Add upstream patch CVE-2024-30251.patch (bsc#1223726, CVE-2024-30251) Include three upstream commits: * gh#aio-libs/aiohttp@cebe526b9c34#diff-5954cadbd6b57b1921fc64d0e6a8f81717127873d9ccec33184d2f971fe6834f * gh#aio-libs/aiohttp@7eecdff163cc#diff-d582bf292efb8e19696d88c895b99e0937687cb909d9d00b5c2f1d948a5cbae5 * gh#aio-libs/aiohttp@f21c6f2ca512#diff-d582bf292efb8e19696d88c895b99e0937687cb909d9d00b5c2f1d948a5cbae5 ------------------------------------------------------------------ ------------------ 2024-12-5 - Dec 5 2024 ------------------- ------------------------------------------------------------------ ++++ python-urllib3_1: - Add patch CVE-2024-37891.patch (bsc#1226469, CVE-2024-37891) ------------------------------------------------------------------ ------------------ 2024-12-4 - Dec 4 2024 ------------------- ------------------------------------------------------------------ ++++ python311: - Update to 3.11.11: - Tools/Demos - gh-123418: Update GitHub CI workflows to use OpenSSL 3.0.15 and multissltests to use 3.0.15, 3.1.7, and 3.2.3. - Tests - gh-125041: Re-enable skipped tests for zlib on the s390x architecture: only skip checks of the compressed bytes, which can be different between zlib’s software implementation and the hardware-accelerated implementation. - Security - gh-126623: Upgrade libexpat to 2.6.4 - gh-122792: Changed IPv4-mapped ipaddress.IPv6Address to consistently use the mapped IPv4 address value for deciding properties. Properties which have their behavior fixed are is_multicast, is_reserved, is_link_local, is_global, and is_unspecified. - Library - gh-124651: Properly quote template strings in venv activation scripts (bsc#1232241, CVE-2024-9287). - Removed upstreamed patches: - CVE-2024-9287-venv_path_unquoted.patch ++++ python311-core: - Update to 3.11.11: - Tools/Demos - gh-123418: Update GitHub CI workflows to use OpenSSL 3.0.15 and multissltests to use 3.0.15, 3.1.7, and 3.2.3. - Tests - gh-125041: Re-enable skipped tests for zlib on the s390x architecture: only skip checks of the compressed bytes, which can be different between zlib’s software implementation and the hardware-accelerated implementation. - Security - gh-126623: Upgrade libexpat to 2.6.4 - gh-122792: Changed IPv4-mapped ipaddress.IPv6Address to consistently use the mapped IPv4 address value for deciding properties. Properties which have their behavior fixed are is_multicast, is_reserved, is_link_local, is_global, and is_unspecified. - Library - gh-124651: Properly quote template strings in venv activation scripts (bsc#1232241, CVE-2024-9287). - Removed upstreamed patches: - CVE-2024-9287-venv_path_unquoted.patch ------------------------------------------------------------------ ------------------ 2024-12-3 - Dec 3 2024 ------------------- ------------------------------------------------------------------ ++++ python311: - Add add-loongarch64-support.patch to support loongarch64 ++++ python311-core: - Add add-loongarch64-support.patch to support loongarch64 ------------------------------------------------------------------ ------------------ 2024-12-2 - Dec 2 2024 ------------------- ------------------------------------------------------------------ ++++ python311: - Fix changelog ++++ python311-core: - Fix changelog ------------------------------------------------------------------ ------------------ 2024-11-29 - Nov 29 2024 ------------------- ------------------------------------------------------------------ ++++ python313-core: - Drop CVE-2023-52425-libexpat-2.6.0-backport-15.6.patch, not needed anymore because libexpat is updated to 2.6 in SP7. bsc#1233777 ++++ python313: - Drop CVE-2023-52425-libexpat-2.6.0-backport-15.6.patch, not needed anymore because libexpat is updated to 2.6 in SP7. bsc#1233777 ------------------------------------------------------------------ ------------------ 2024-11-27 - Nov 27 2024 ------------------- ------------------------------------------------------------------ ++++ python-tornado6: - Add patch CVE-2024-52804-avoid-quadratic-cookie-parsing.patch: * Avoid quadratic performance of cookie parsing. (CVE-2024-52804, bsc#1233668) ------------------------------------------------------------------ ------------------ 2024-11-26 - Nov 26 2024 ------------------- ------------------------------------------------------------------ ++++ pgadmin4: - Add patch to update the braces nodejs module to 3.0.3 in order to fix a possible memory exhaustion (bsc#1224295, CVE-2024-4068): * use-braces-3.0.3.patch ------------------------------------------------------------------ ------------------ 2024-11-25 - Nov 25 2024 ------------------- ------------------------------------------------------------------ ++++ csp-billing-adapter-amazon: - Update to version 1.1.0 * Add plugin file with plugin name for verification ++++ csp-billing-adapter-microsoft: - Update to version 1.1.0 * Add plugin file with plugin name for verification ++++ python-virtualenv: - Add upstream patch CVE-2024-53899.patch, to fix command injection through activation scripts (bsc#1233706, CVE-2024-53899) ------------------------------------------------------------------ ------------------ 2024-11-20 - Nov 20 2024 ------------------- ------------------------------------------------------------------ ++++ python-resolvelib: - update to 1.1.0: * Declare supported Python version support ">= 3.7" in dist meta #129 * Improve exception chaining when ResolutionImpossible raises during backjumping #133 * Switch from pyi files to modern annotations based type hinting #135 * In tests the commentjson test dependency with re.sub #141 * Deduplicate failure causes to save memory and reduce backtracking overhead #143 * New narrow_requirement_selection provider method giving option for providers to reduce the number of times sort key get_preference is called in long running backtrack #145 * Run tests against Python 3.12, 3.13, and use latest version of CI dependencies #153 * Update py2ndex script to use metadata files, skip 404, and support PEP 723 #156 * Replace setuptools.cfg and mypy.ini with pyproject.toml #157 * Add tests type "unvisited" to functional Python tests to ensure backjumping is correctly skipping candidates #158 * Switch from flake8 to ruff for linting #160 * Enable automatic TYPE_CHECK guarding for imports only used for type hinting via ruff rules TCH and FA #166 * Fix example reporter_demo get_preference method which requires arg backtrack_causes #136 * Clarify the docstrings for providers.py #138 * Pin Black version for linting to prevent CI failures #150 * In unexpected situation where broken_state.mapping is empty, stop backtracking, and continue resolution (rather than throwing ResolutionImpossible) #152 * During backtracking check if the current broken state is an incompatible dependency, if not stop backtracking and continue resolution. #155 * Separate AbstractResolver and Resolver into different modules [#162] * Separate resolvers into different modules #163 * Export criterion in resolvers to keep compatibility #164 * Enable isorting via ruff #165 ------------------------------------------------------------------ ------------------ 2024-11-19 - Nov 19 2024 ------------------- ------------------------------------------------------------------ ++++ python-aiohttp: - Add upstream patch CVE-2024-52304.patch, gh#aio-libs/aiohttp@259edc369075 (bsc#1233447, CVE-2024-52304) ------------------------------------------------------------------ ------------------ 2024-11-15 - Nov 15 2024 ------------------- ------------------------------------------------------------------ ++++ python313-core: - Allow building with default LLVM version 19: just replace the hard-coded LLVM_version in the scripts. ++++ python313: - Allow building with default LLVM version 19: just replace the hard-coded LLVM_version in the scripts. ------------------------------------------------------------------ ------------------ 2024-11-14 - Nov 14 2024 ------------------- ------------------------------------------------------------------ ++++ python313-core: - Remove -IVendor/ from python-config boo#1231795 - Require exact clang18 and llvm18, because apparently CPython is not ready for 19 yet (gh#python/cpython!125499). ++++ python313: - Remove -IVendor/ from python-config boo#1231795 - Require exact clang18 and llvm18, because apparently CPython is not ready for 19 yet (gh#python/cpython!125499). ------------------------------------------------------------------ ------------------ 2024-11-13 - Nov 13 2024 ------------------- ------------------------------------------------------------------ ++++ libxml2-python: - add %{?sle15allpythons} macro [jsc#PED-68] - use %python_build and %python_install for 15 ------------------------------------------------------------------ ------------------ 2024-11-11 - Nov 11 2024 ------------------- ------------------------------------------------------------------ ++++ python311: - Remove -IVendor/ from python-config boo#1231795 ++++ python311-core: - Remove -IVendor/ from python-config boo#1231795 ------------------------------------------------------------------ ------------------ 2024-11-4 - Nov 4 2024 ------------------- ------------------------------------------------------------------ ++++ python-kubernetes: - version update to 30.1.0 * please refer to the changelog at https://github.com/kubernetes-client/python/blob/v30.1.0/CHANGELOG.md#v3010 - remove patch: - kubernetes-client-python-pr2178-assertEqual-py312.patch gh#kubernetes-client/python#2178 - merged upstream and released. ------------------------------------------------------------------ ------------------ 2024-11-1 - Nov 1 2024 ------------------- ------------------------------------------------------------------ ++++ python311: - Add CVE-2024-9287-venv_path_unquoted.patch to properly quote path names provided when creating a virtual environment (bsc#1232241, CVE-2024-9287) ++++ python311-core: - Add CVE-2024-9287-venv_path_unquoted.patch to properly quote path names provided when creating a virtual environment (bsc#1232241, CVE-2024-9287) ------------------------------------------------------------------ ------------------ 2024-10-30 - Oct 30 2024 ------------------- ------------------------------------------------------------------ ++++ python-M2Crypto: - Update to 0.43.0: - feat[m2]: add m2.time_t_bits to checking for 32bitness. - fix[tests]: Use only X509_VERSION_1 (0) as version for CSR. - fix[EC]: raise ValueError when load_key_bio() cannot read the file (bsc#1231589). - ci: use -mpip wheel instead of -mbuild - fix: use PyMem_Malloc() instead of malloc() - fix[hints]: more work on conversion of type hints to the py3k ones - fix: make the package build even on Python 3.6 - ci[local]: skip freezing local tests - fix[hints]: remove AnyStr type - test: add suggested test for RSA.{get,set}_ex_data - fix: implement interfaces for RSA_{get,set}_ex_new_{data,index} - fix: generate src/SWIG/x509_v_flag.h to overcome weaknesses of swig - fix: replace literal enumeration of all VERIFY_ constants by a cycle - test: unify various test cases in test_ssl related to ftpslib - fix: replace deprecated url keyword in setup.cfg with complete project_urls map ++++ python-waitress: - Add security patches: * CVE-2024-49768.patch (bsc#1232556) * CVE-2024-49769.patch (bsc#1232554) ++++ python-waitress-doc: - Add security patches: * CVE-2024-49768.patch (bsc#1232556) * CVE-2024-49769.patch (bsc#1232554) ++++ python313-pipx: - Create version.py file manually because we're not using hatch-vcs for this package. (bsc#1232537) ------------------------------------------------------------------ ------------------ 2024-10-28 - Oct 28 2024 ------------------- ------------------------------------------------------------------ ++++ python-Werkzeug: - Add CVE-2024-49767.patch, apply max_form_memory_size another level up in the parser (bsc#1232449, CVE-2024-49767.patch, gh#pallets/werkzeug@8760275afb72) ++++ python-kubernetes: - version update to 29.0.0 * please refer to the changelog at https://github.com/kubernetes-client/python/blob/v29.0.0/CHANGELOG.md#v2900 ------------------------------------------------------------------ ------------------ 2024-10-27 - Oct 27 2024 ------------------- ------------------------------------------------------------------ ++++ protobuf: - Build the java part with maven, so that we create artifacts that correspond to upstream distributed ones. - Add maven artifact metadata to the protoc binary - Package also the bom and pom artifacts ------------------------------------------------------------------ ------------------ 2024-10-24 - Oct 24 2024 ------------------- ------------------------------------------------------------------ ++++ python313-core: - Add CVE-2024-9287-venv_path_unquoted.patch to properly quote path names provided when creating a virtual environment (bsc#1232241, CVE-2024-9287) ++++ python313: - Add CVE-2024-9287-venv_path_unquoted.patch to properly quote path names provided when creating a virtual environment (bsc#1232241, CVE-2024-9287) ------------------------------------------------------------------ ------------------ 2024-10-22 - Oct 22 2024 ------------------- ------------------------------------------------------------------ ++++ pgadmin4: - Add patches to fix issues in several js packages (in some cases, by updating the vendored packages): - The npm package micromatch is vulnerable to Regular Expression Denial of Service (bsc#1224366, CVE-2024-4067): * use-micromatch-4.0.8.patch - The npm package socket.io can be forced to trigger an uncaught exception, thus killing the Node.js process (bsc#1226967, CVE-2024-38355): * use-socket.io-4.7.4.patch - Not affected by bsc#1221454, CVE-2024-28849 (follow-redirect keeps the proxy-authorization header, which contains credentials, across hosts), we already use follow-redirect 1.15.6 which includes the fix for it. - Not affected by bsc#1227080, CVE-2024-6238, since we don't use the related install scripts. - requirejs v2.3.6 contains a prototype pollution issue which allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties (bsc#1227248, CVE-2024-38998, bsc#1227252, CVE-2024-38999): * 0001-Fixes-requirejs-prototype-pollution.patch - The NPM package `braces` in versions < 3.0.2 fails to limit the number of characters it can handle, which could lead to a memory exhaustion. The package was updated to 3.0.3 as part of the micromatch update to 4.0.8 (bsc#1224295, CVE-2024-4068). - axios < 1.7.4 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs (bsc#1229423, CVE-2024-39338): * use-axios-1.7.7.patch - webpack < 5.94.0 has a DOM Clobbering vulnerability in AutoPublicPathRuntimeModule (bsc#1229861, CVE-2024-43788): * use-webpack-5.95.0.patch - Force using elliptic 6.5.7 which fixes a missing validation (bsc#1231564, CVE-2024-48949) and also fixes an incorrect verification of valid signatures if the hash contains at least four leading 0 bytes (bsc#1231684, CVE-2024-48948): * use-elliptic-6.5.7.patch - Ran update-vendor.sh which updates: * node_modules.obscpio * node_modules.spec.inc * package-lock.json ------------------------------------------------------------------ ------------------ 2024-10-21 - Oct 21 2024 ------------------- ------------------------------------------------------------------ ++++ pgadmin4: - Add a patch from upstream to fix a vulnerability to a security flaw in OAuth2 authentication which allows an attacker to potentially obtain the client ID and secret (bsc#1230928, CVE-2024-9014): * 0001-Fixed-a-security-issue-where-the-OAuth2-client-ID-and-secret.patch ------------------------------------------------------------------ ------------------ 2024-10-16 - Oct 16 2024 ------------------- ------------------------------------------------------------------ ++++ python313-core: - With python311-Sphinx we don't need no-skipif-doctests.patch any more. ++++ python313: - With python311-Sphinx we don't need no-skipif-doctests.patch any more. ------------------------------------------------------------------ ------------------ 2024-10-15 - Oct 15 2024 ------------------- ------------------------------------------------------------------ ++++ protobuf: - Add patch to fix StackOverflow vulnerability in Protocol Buffers * CVE-2024-7254.patch (bsc#1230778, CVE-2024-7254) ------------------------------------------------------------------ ------------------ 2024-10-10 - Oct 10 2024 ------------------- ------------------------------------------------------------------ ++++ python313-core: - Add warning about no-GIL builds being experimental. ++++ python313: - Add warning about no-GIL builds being experimental. ------------------------------------------------------------------ ------------------ 2024-10-8 - Oct 8 2024 ------------------- ------------------------------------------------------------------ ++++ python313-core: - Update to 3.13.0: Major new features of the 3.13 series, compared to 3.12 Some of the new major new features and changes in Python 3.13 are: - New features - A new and improved interactive interpreter, based on PyPy's, featuring multi-line editing and color support, as well as colorized exception tracebacks. - An experimental free-threaded build mode, which disables the Global Interpreter Lock, allowing threads to run more concurrently. The build mode is available as an experimental feature in the Windows and macOS installers as well. - A preliminary, experimental JIT, providing the ground work for significant performance improvements. - The locals() builtin function (and its C equivalent) now has well-defined semantics when mutating the returned mapping, which allows debuggers to operate more consistently. - A modified version of mimalloc is now included, optional but enabled by default if supported by the platform, and required for the free-threaded build mode. - Docstrings now have their leading indentation stripped, reducing memory use and the size of .pyc files. (Most tools handling docstrings already strip leading indentation.) - The dbm module has a new dbm.sqlite3 backend that is used by default when creating new files. - WASI is now a Tier 2 supported platform. Emscripten is no longer an officially supported platform (but Pyodide continues to support Emscripten). - Typing - Support for type defaults in type parameters. - A new type narrowing annotation, typing.TypeIs. - A new annotation for read-only items in TypeDicts. - A new annotation for marking deprecations in the type system. - Removals and new deprecations - PEP 594 (Removing dead batteries from the standard library) scheduled removals of many deprecated modules: aifc, audioop, chunk, cgi, cgitb, crypt, imghdr, mailcap, msilib, nis, nntplib, ossaudiodev, pipes, sndhdr, spwd, sunau, telnetlib, uu, xdrlib, lib2to3. - Many other removals of deprecated classes, functions and methods in various standard library modules. - C API removals and deprecations. (Some removals present in alpha 1 were reverted in alpha 2, as the removals were deemed too disruptive at this time.) - New deprecations, most of which are scheduled for removal from Python 3.15 or 3.16. - For more details on the changes to Python 3.13, see What's new in Python 3.13 in the documentation. ++++ python313: - Update to 3.13.0: Major new features of the 3.13 series, compared to 3.12 Some of the new major new features and changes in Python 3.13 are: - New features - A new and improved interactive interpreter, based on PyPy's, featuring multi-line editing and color support, as well as colorized exception tracebacks. - An experimental free-threaded build mode, which disables the Global Interpreter Lock, allowing threads to run more concurrently. The build mode is available as an experimental feature in the Windows and macOS installers as well. - A preliminary, experimental JIT, providing the ground work for significant performance improvements. - The locals() builtin function (and its C equivalent) now has well-defined semantics when mutating the returned mapping, which allows debuggers to operate more consistently. - A modified version of mimalloc is now included, optional but enabled by default if supported by the platform, and required for the free-threaded build mode. - Docstrings now have their leading indentation stripped, reducing memory use and the size of .pyc files. (Most tools handling docstrings already strip leading indentation.) - The dbm module has a new dbm.sqlite3 backend that is used by default when creating new files. - WASI is now a Tier 2 supported platform. Emscripten is no longer an officially supported platform (but Pyodide continues to support Emscripten). - Typing - Support for type defaults in type parameters. - A new type narrowing annotation, typing.TypeIs. - A new annotation for read-only items in TypeDicts. - A new annotation for marking deprecations in the type system. - Removals and new deprecations - PEP 594 (Removing dead batteries from the standard library) scheduled removals of many deprecated modules: aifc, audioop, chunk, cgi, cgitb, crypt, imghdr, mailcap, msilib, nis, nntplib, ossaudiodev, pipes, sndhdr, spwd, sunau, telnetlib, uu, xdrlib, lib2to3. - Many other removals of deprecated classes, functions and methods in various standard library modules. - C API removals and deprecations. (Some removals present in alpha 1 were reverted in alpha 2, as the removals were deemed too disruptive at this time.) - New deprecations, most of which are scheduled for removal from Python 3.15 or 3.16. - For more details on the changes to Python 3.13, see What's new in Python 3.13 in the documentation. ------------------------------------------------------------------ ------------------ 2024-10-6 - Oct 6 2024 ------------------- ------------------------------------------------------------------ ++++ python313-argcomplete: - Add argparse-3_12_7.patch which should actually fix gh#kislyuk/argcomplete#507. - Remove skip-failing-tests-3_12_7.patch, which is now unnecessary. ------------------------------------------------------------------ ------------------ 2024-10-5 - Oct 5 2024 ------------------- ------------------------------------------------------------------ ++++ python313-argcomplete: - Add skip-failing-tests-3_12_7.patch as a temporary workaround, skip failing tests (gh#kislyuk/argcomplete#507). ------------------------------------------------------------------ ------------------ 2024-10-2 - Oct 2 2024 ------------------- ------------------------------------------------------------------ ++++ pgadmin4: - Add rebased patch from upstream to fix a XSS vulnerability in /settings/store API response json payload (bsc#1223868, CVE-2024-4216): * 0001-Fixed-a-XSS-vulnerability-in-the-_settings_store-endpoint.patch ++++ python311: - Drop .pyc files from docdir for reproducible builds (bsc#1230906). ++++ python311-core: - Drop .pyc files from docdir for reproducible builds (bsc#1230906). ------------------------------------------------------------------ ------------------ 2024-10-1 - Oct 1 2024 ------------------- ------------------------------------------------------------------ ++++ python313-core: - Update to 3.13.0~rc3: - The most important change is rolling back the incremental cyclic garbage collector (GC), which was added in one of the alpha releases. The incremental GC had more significant performance regressions in specific workloads than we expected. - Tests - gh-124378: Updated test_ttk to pass with Tcl/Tk 8.6.15. - Library - gh-124538: Fixed crash when using gc.get_referents() on a capsule object. - gh-124498: Fix typing.TypeAliasType not to be generic, when type_params is an empty tuple. - gh-123017: Due to unreliable results on some devices, time.strftime() no longer accepts negative years on Android. - gh-123014: os.pidfd_open() and signal.pidfd_send_signal() are now unavailable when building against Android API levels older than 31, since the underlying system calls may cause a crash. - gh-124248: Fixed potential crash when using struct to process zero-width ‘Pascal string’ fields (0p). - gh-87041: Fix a bug in argparse where lengthy subparser argument help is incorrectly indented. - gh-124212: Fix invalid variable in venv handling of failed symlink on Windows - gh-124171: Add workaround for broken fmod() implementations on Windows, that loose zero sign (e.g. fmod(-10, 1) returns 0.0). Patch by Sergey B Kirpichev. - gh-123934: Fix unittest.mock.MagicMock reseting magic methods return values after .reset_mock(return_value=True) was called. - gh-123968: Fix the command-line interface for the random module to select floats between 0 and N, not 1 and N. - gh-123892: Add "_wmi" to sys.stdlib_module_names. Patch by Victor Stinner. - gh-123339: Fix inspect.getsource() for classes in collections.abc and decimal (for pure Python implementation) modules. inspect.getcomments() now raises OSError instead of IndexError if the __firstlineno__ value for a class is out of bound. - gh-121735: When working with zip archives, importlib.resources now properly honors module-adjacent references (e.g. files(pkg.mod) and not just files(pkg)). - gh-122145: Fix an issue when reporting tracebacks corresponding to Python code emitting an empty AST body. Patch by Nikita Sobolev and Bénédikt Tran. - gh-119004: Fix a crash in OrderedDict.__eq__ when operands are mutated during the check. Patch by Bénédikt Tran. - bpo-44864: Do not translate user-provided strings in argparse.ArgumentParser. - IDLE - gh-112938: Fix uninteruptable hang when Shell gets rapid continuous output. - gh-120104: Fix padding in config and search dialog windows in IDLE. - Documentation - gh-124720: Update “Using Python on a Mac” section of the “Python Setup and Usage” document and include information on installing free-threading support. - gh-116622: Add an Android platform guide, and flag modules not available on Android. - Core and Builtins - gh-124567: Revert the incremental GC (in 3.13), since it’s not clear the benefits outweigh the costs at this point. - gh-124642: Fixed scalability issue in free-threaded builds for lock-free reads from dictionaries in multi-threaded scenarios - gh-116510: Fix a bug that can cause a crash when sub-interpreters use “basic” single-phase extension modules. Shared objects could refer to PyGC_Head nodes that had been freed as part of interpreter cleanup. - gh-124547: When deallocating an object with inline values whose __dict__ is still live: if memory allocation for the inline values fails, clear the dictionary. Prevents an interpreter crash. - gh-124513: Fix a crash in FrameLocalsProxy constructor: check the number of arguments. Patch by Victor Stinner. - gh-124442: Fix nondeterminism in compilation by sorting the value of __static_attributes__. Patch by kp2pml30. - gh-123856: Fix PyREPL failure when a keyboard interrupt is triggered after using a history search - gh-65961: Document the deprecation of setting and using __package__ and __cached__. - gh-124027: Support , , and keys in the Python REPL when $TERM is set to vt100. - gh-77894: Fix possible crash in the garbage collector when it tries to break a reference loop containing a memoryview object. Now a memoryview object can only be cleared if there are no buffers that refer it. - gh-123339: Setting the __module__ attribute for a class now removes the __firstlineno__ item from the type’s dict, so they will no longer be inconsistent. - C API - gh-124160: Fix crash when importing modules containing state and single-phase initialization in a subinterpreter. - gh-123880: Fixed a bug that prevented circular imports of extension modules that use single-phase initialization. - Build - gh-124487: Windows builds now use Windows 8.1 as their API baseline (installation already required Windows 8.1). - gh-124043: Building using --with-trace-refs is (temporarily) disallowed when the GIL is disabled. - Remove upstreamed patch: - gh-124040-fix-test-math-i586.patch - Drop .pyc files from docdir for reproducible builds (bsc#1230906). ++++ python313: - Update to 3.13.0~rc3: - The most important change is rolling back the incremental cyclic garbage collector (GC), which was added in one of the alpha releases. The incremental GC had more significant performance regressions in specific workloads than we expected. - Tests - gh-124378: Updated test_ttk to pass with Tcl/Tk 8.6.15. - Library - gh-124538: Fixed crash when using gc.get_referents() on a capsule object. - gh-124498: Fix typing.TypeAliasType not to be generic, when type_params is an empty tuple. - gh-123017: Due to unreliable results on some devices, time.strftime() no longer accepts negative years on Android. - gh-123014: os.pidfd_open() and signal.pidfd_send_signal() are now unavailable when building against Android API levels older than 31, since the underlying system calls may cause a crash. - gh-124248: Fixed potential crash when using struct to process zero-width ‘Pascal string’ fields (0p). - gh-87041: Fix a bug in argparse where lengthy subparser argument help is incorrectly indented. - gh-124212: Fix invalid variable in venv handling of failed symlink on Windows - gh-124171: Add workaround for broken fmod() implementations on Windows, that loose zero sign (e.g. fmod(-10, 1) returns 0.0). Patch by Sergey B Kirpichev. - gh-123934: Fix unittest.mock.MagicMock reseting magic methods return values after .reset_mock(return_value=True) was called. - gh-123968: Fix the command-line interface for the random module to select floats between 0 and N, not 1 and N. - gh-123892: Add "_wmi" to sys.stdlib_module_names. Patch by Victor Stinner. - gh-123339: Fix inspect.getsource() for classes in collections.abc and decimal (for pure Python implementation) modules. inspect.getcomments() now raises OSError instead of IndexError if the __firstlineno__ value for a class is out of bound. - gh-121735: When working with zip archives, importlib.resources now properly honors module-adjacent references (e.g. files(pkg.mod) and not just files(pkg)). - gh-122145: Fix an issue when reporting tracebacks corresponding to Python code emitting an empty AST body. Patch by Nikita Sobolev and Bénédikt Tran. - gh-119004: Fix a crash in OrderedDict.__eq__ when operands are mutated during the check. Patch by Bénédikt Tran. - bpo-44864: Do not translate user-provided strings in argparse.ArgumentParser. - IDLE - gh-112938: Fix uninteruptable hang when Shell gets rapid continuous output. - gh-120104: Fix padding in config and search dialog windows in IDLE. - Documentation - gh-124720: Update “Using Python on a Mac” section of the “Python Setup and Usage” document and include information on installing free-threading support. - gh-116622: Add an Android platform guide, and flag modules not available on Android. - Core and Builtins - gh-124567: Revert the incremental GC (in 3.13), since it’s not clear the benefits outweigh the costs at this point. - gh-124642: Fixed scalability issue in free-threaded builds for lock-free reads from dictionaries in multi-threaded scenarios - gh-116510: Fix a bug that can cause a crash when sub-interpreters use “basic” single-phase extension modules. Shared objects could refer to PyGC_Head nodes that had been freed as part of interpreter cleanup. - gh-124547: When deallocating an object with inline values whose __dict__ is still live: if memory allocation for the inline values fails, clear the dictionary. Prevents an interpreter crash. - gh-124513: Fix a crash in FrameLocalsProxy constructor: check the number of arguments. Patch by Victor Stinner. - gh-124442: Fix nondeterminism in compilation by sorting the value of __static_attributes__. Patch by kp2pml30. - gh-123856: Fix PyREPL failure when a keyboard interrupt is triggered after using a history search - gh-65961: Document the deprecation of setting and using __package__ and __cached__. - gh-124027: Support , , and keys in the Python REPL when $TERM is set to vt100. - gh-77894: Fix possible crash in the garbage collector when it tries to break a reference loop containing a memoryview object. Now a memoryview object can only be cleared if there are no buffers that refer it. - gh-123339: Setting the __module__ attribute for a class now removes the __firstlineno__ item from the type’s dict, so they will no longer be inconsistent. - C API - gh-124160: Fix crash when importing modules containing state and single-phase initialization in a subinterpreter. - gh-123880: Fixed a bug that prevented circular imports of extension modules that use single-phase initialization. - Build - gh-124487: Windows builds now use Windows 8.1 as their API baseline (installation already required Windows 8.1). - gh-124043: Building using --with-trace-refs is (temporarily) disallowed when the GIL is disabled. - Remove upstreamed patch: - gh-124040-fix-test-math-i586.patch - Drop .pyc files from docdir for reproducible builds (bsc#1230906). ------------------------------------------------------------------ ------------------ 2024-9-26 - Sep 26 2024 ------------------- ------------------------------------------------------------------ ++++ python-kubernetes: - Fixed %{?sle15_python_module_pythons}, jsc#PED-8481 ------------------------------------------------------------------ ------------------ 2024-9-23 - Sep 23 2024 ------------------- ------------------------------------------------------------------ ++++ python313-pip: - Adapt disable-ssl-context-in-buildenv.patch to make it compatible with leap ------------------------------------------------------------------ ------------------ 2024-9-16 - Sep 16 2024 ------------------- ------------------------------------------------------------------ ++++ python-pyvmomi: - Update to version 8.0.3.0.1 Bindings * Added support for vSAN Health APIs * Updated bindings with support for the new vSphere 8.0U3 APIs. * New features of vSphere 8.0U3 based on REST APIs are available via the vSphere Automation SDK for Python Type Hints * Added type stubs for vSAN APIs. * All type stubs are refactored. Added * Python 3.12 compatibility * Stub adapters allow the usage of an existing session. * Added pyVmomi version in the user-agent request header * Added certFile and certKeyFile attributes to SoapStubAdapter. * Added project wide variables to hold the current pyVmomi version, version_info and version_info_str * Added functions to VmomiSupport to list all types ListManagedTypes(), ListDataTypes(), ListEnumTypes(). Changes * Doc: Non-remote ManagedObject and DataObject methods are documented. * The support statement now reflects the Broadcom support policy. * Copyright switch from VMware to Broadcom. Breaking changes * sso.SsoAuthenticator.get_bearer_saml_assertion_gss_api() is removed. * SSLTunnelConnection is trimmed down to handle only tunnel connections. The code that handles remote proxy doubles the HTTPProxyConnection logic and therefore is removed. Deprecated * 'publicVersions' and 'dottedVersions' aliases are deprecated. * pyVmomiSettings.py and related settings are deprecated allowGetSet, allowCapitalizedNames, binaryIsBytearray, legacyThumbprintException. * Features.py and all pyVmomi feature states logic is deprecated * pyVmomi.VmomiSupport.VmomiJSONEncoder is deprecated. Use pyVmomi.VmomiJSONEncoder.VmomiJSONEncoder * pyVmomi.VmomiSupport.templateOf() is deprecated. Use pyVmomi.VmomiJSONEncoder.templateOf() * pyVmomi.SoapAdapter.ThumbprintMismatchException is deprecated. Use pyVmomi.Security.ThumbprintMismatchException - Update to version 8.0.2.0.1 Maintenance Patch 1 for 8.0U2 - 2023-11-17 Changes * Fixed: #978 and #1053 - Fix SmartConnect()'s handling of IPv6 address with square brackets * Added PyPI classifiers for Python 3.10 and Python 3.11. Support for both versions is verified. - Update to version 8.0.2.0 Bindings * Updated bindings and type hints with support for vSphere 8.0U2. Includes updates to VIM, PBM, EAM, SMS and VSLM namespaces. * New features of vSphere 8.0U2 based on REST APIs are available via the vSphere Automation SDK for Python https://github.com/vmware/vsphere-automation-sdk-python - Update to version 8.0.1.0.2 Bindings * Added bindings and type hints for Virtual Storage Lifecycle Management for vSphere 8.0U1 - VSLM namespace. Changes * Fixed: #1021 - Switch to static imports for type info modules. * Fixed: #1022 - Support proxy authentication. * Add custom HTTP headers support to connect.SmartStubAdapter(). * Missing filters are no longer treated as task failures. * Various small fixes for docstrings and linter checks. Type Hints Fixes * Fixed: #1026 - Use the "from Y import X as X" format to re-export submodules. * Fixed: #1030 - Use a fully qualified name when the type is from another namespace/package Tests * vcrpy dependency is updated to the latest version with Python 2 support. * testtools dependency is removed. * Travis CI is no longer used. * Various test updates and fixes. All tests are enabled. - Update to version 8.0.1.0.1 Type Hints Fixes * Added missing VMODL1 classes to the type hints * Enum values now match the letter case of the values from typeinfo files. * Fixed: #1115 - Syntax error in vim/__init__pyi. * Fixed: #1117 - Type stubs: Writable properties are marked as read-only. * Fixed: #1118 - Type stubs: Missing vim.fault.* and vmodl.fault.* types * Fixed: #1119 - Type stubs: Enum fields should also accept Literal[] str type. * Fixed: #1120 - Type stubs: Exception types must inherit from (Base)Exception. - Update to version 8.0.1.0 Bindings * Updated bindings with support for vSphere 8.0U1. Includes updates to VIM, PBM, EAM and SMS namespaces. * New features of vSphere 8.0U1 based on REST APIs are available via the vSphere Automation SDK for Python. Changes * Added support for type hints. * #892 - Allow passing ssl_context when login in with a token. * Fixed: #750 - Bumped vcrpy tests dependency to 2.1. * Fixed: #812 - Fix exception leaks. * Fixed: #1004 - Fix SmartConnect()'s SOAP and OAuth token login. - Update to version 8.0.0.1.1 Changes * Fixed: #993 - WaitForTask broken on version >8.0.0. * Fixed: #994 - Pyvomi module failing in connect method. * Replace publicVersions with ltsVersions. * Updated VIM namespace for the next vSphere 8.0 patch release. - Update to version 8.0.0.1 Bindings * Updated bindings with support for vSphere 8.0. Includes updates * New features of vSphere 8.0 based on REST APIs are available via the vSphere Automation SDK for Python. Breaking changes * Minimum Python 2 requirement is 2.7.9. * DynamicTypeManagerHelper.py is removed. * ManagedMethodExecutorHelper.py is removed. * connect.ConnectNoSSL() and connect.SmartConnectNoSSL() are removed. Use connect.Connect(disableSslCertValidation=True) and connect.SmartConnect(disableSslCertValidation=True) * VmomiSupport.UncallableManagedMethod is renamed to VmomiSupport.UnknownManagedMethod. New modules * Security.py A new module is added to handle thumbprint verification. There is a predefined set of available crypto functions to verify the certificate thumbprints. Its possible to configure during runtime which of the available crypto functions are allowed. * Feature.py A new module related to pyVmomi development within VMware. * VmomiJSONEncoder.py The VmomiJSONEncoder is moved into a dedicated module. More changes * A new 'binaryIsBytearray' setting is added to select the base type for the binary type. By default, the binary type is 'str' for Python 2 and 'bytes' for Python 3. If binaryIsBytearray is True, the binary type for Python 2 is set to 'bytearray'. Required for VmomiJSONEncoder to work properly. * The license note is removed from the Python files. LICENSE.txt holds the Apache 2 license note. * pyVmomi now uses relative imports * Dependency on "requests" is removed * Added support for SAML token authentication * Added timeout for HTTP requests * Added option to set the maximum amount of time a task is allowed to run. On timeout, an exception is generated if raiseOnError is True. * Add option to get all updates for the task. * Add option to use a logger instead of the standard output. * Various bug fixes * Code style improvements Deprecated * connect.OpenUrlWithBasicAuth() * connect.OpenPathWithStub() - Add patch * 0001-pyVmomi-pinned-certificates-support.patch - Reenable python3.12 builds ------------------------------------------------------------------ ------------------ 2024-9-12 - Sep 12 2024 ------------------- ------------------------------------------------------------------ ++++ python313-core: - Make it build for SLE SP7 (jsc#PED-10075): - Add CVE-2023-52425-libexpat-2.6.0-backport-15.6.patch to build in SLE-15-SP7. - Add fix-test-recursion-limit-15.6.patch, gh#python/cpython#115083 - Add gh-124040-fix-test-math-i586.patch, gh#python/cpython#124042 ++++ python313: - Make it build for SLE SP7 (jsc#PED-10075): - Add CVE-2023-52425-libexpat-2.6.0-backport-15.6.patch to build in SLE-15-SP7. - Add fix-test-recursion-limit-15.6.patch, gh#python/cpython#115083 - Add gh-124040-fix-test-math-i586.patch, gh#python/cpython#124042 ------------------------------------------------------------------ ------------------ 2024-9-9 - Sep 9 2024 ------------------- ------------------------------------------------------------------ ++++ python311: - Update to 3.11.10: - Security - gh-123678: Upgrade libexpat to 2.6.3 - gh-121957: Fixed missing audit events around interactive use of Python, now also properly firing for ``python -i``, as well as for ``python -m asyncio``. The event in question is ``cpython.run_stdin``. - gh-122133: Authenticate the socket connection for the ``socket.socketpair()`` fallback on platforms where ``AF_UNIX`` is not available like Windows. Patch by Gregory P. Smith and Seth Larson . Reported by Ellie - gh-121285: Remove backtracking from tarfile header parsing for ``hdrcharset``, PAX, and GNU sparse headers (bsc#1230227, CVE-2024-6232). - gh-118486: :func:`os.mkdir` on Windows now accepts * mode* of ``0o700`` to restrict the new directory to the current user. This fixes CVE-2024-4030 affecting :func:`tempfile.mkdtemp` in scenarios where the base temporary directory is more permissive than the default. - gh-116741: Update bundled libexpat to 2.6.2 - Library - gh-123270: Applied a more surgical fix for malformed payloads in :class:`zipfile.Path` causing infinite loops (gh-122905) without breaking contents using legitimate characters (bsc#1229704, CVE-2024-8088). - gh-123067: Fix quadratic complexity in parsing ``"``-quoted cookie values with backslashes by :mod:`http.cookies` (bsc#1229596, CVE-2024-7592). - gh-122905: :class:`zipfile.Path` objects now sanitize names from the zipfile. - gh-121650: :mod:`email` headers with embedded newlines are now quoted on output. The :mod:`~email.generator` will now refuse to serialize (write) headers that are unsafely folded or delimited; see :attr:`~email.policy.Policy.verify_generated_headers`. (Contributed by Bas Bloemsaat and Petr Viktorin in :gh:`121650`; CVE-2024-6923, bsc#1228780). - gh-119506: Fix :meth:`!io.TextIOWrapper.write` method breaks internal buffer when the method is called again during flushing internal buffer. - gh-118643: Fix an AttributeError in the :mod:`email` module when re-fold a long address list. Also fix more cases of incorrect encoding of the address separator in the address list. - gh-113171: Fixed various false positives and false negatives in * :attr:`ipaddress.IPv4Address.is_private` (see these docs for details) * :attr:`ipaddress.IPv4Address.is_global` * :attr:`ipaddress.IPv6Address.is_private` * :attr:`ipaddress.IPv6Address.is_global` Also in the corresponding :class:`ipaddress.IPv4Network` and :class:`ipaddress.IPv6Network` attributes. Fixes bsc#1226448 (CVE-2024-4032). - gh-102988: :func:`email.utils.getaddresses` and :func:`email.utils.parseaddr` now return ``('', '')`` 2-tuples in more situations where invalid email addresses are encountered instead of potentially inaccurate values. Add optional *strict* parameter to these two functions: use ``strict=False`` to get the old behavior, accept malformed inputs. ``getattr(email.utils, 'supports_strict_parsing', False)`` can be use to check if the *strict* paramater is available. Patch by Thomas Dwyer and Victor Stinner to improve the CVE-2023-27043 fix (bsc#1210638). - gh-67693: Fix :func:`urllib.parse.urlunparse` and :func:`urllib.parse.urlunsplit` for URIs with path starting with multiple slashes and no authority. Based on patch by Ashwin Ramaswami. - Core and Builtins - gh-112275: A deadlock involving ``pystate.c``'s ``HEAD_LOCK`` in ``posixmodule.c`` at fork is now fixed. Patch by ChuBoning based on previous Python 3.12 fix by Victor Stinner. - gh-109120: Added handle of incorrect star expressions, e.g ``f(3, *)``. Patch by Grigoryev Semyon - Removed upstreamed patches: - CVE-2023-27043-email-parsing-errors.patch - CVE-2024-4032-private-IP-addrs.patch - CVE-2024-6923-email-hdr-inject.patch - CVE-2024-8088-inf-loop-zipfile_Path.patch (renamed from CVE-2024-8088-zipfile-Path-sanitization.patch) - CVE-2024-6232-ReDOS-backtrack-tarfile.patch - CVE-2024-7592-quad-complex-cookies.patch ++++ python311-core: - Update to 3.11.10: - Security - gh-123678: Upgrade libexpat to 2.6.3 - gh-121957: Fixed missing audit events around interactive use of Python, now also properly firing for ``python -i``, as well as for ``python -m asyncio``. The event in question is ``cpython.run_stdin``. - gh-122133: Authenticate the socket connection for the ``socket.socketpair()`` fallback on platforms where ``AF_UNIX`` is not available like Windows. Patch by Gregory P. Smith and Seth Larson . Reported by Ellie - gh-121285: Remove backtracking from tarfile header parsing for ``hdrcharset``, PAX, and GNU sparse headers (bsc#1230227, CVE-2024-6232). - gh-118486: :func:`os.mkdir` on Windows now accepts * mode* of ``0o700`` to restrict the new directory to the current user. This fixes CVE-2024-4030 affecting :func:`tempfile.mkdtemp` in scenarios where the base temporary directory is more permissive than the default. - gh-116741: Update bundled libexpat to 2.6.2 - Library - gh-123270: Applied a more surgical fix for malformed payloads in :class:`zipfile.Path` causing infinite loops (gh-122905) without breaking contents using legitimate characters (bsc#1229704, CVE-2024-8088). - gh-123067: Fix quadratic complexity in parsing ``"``-quoted cookie values with backslashes by :mod:`http.cookies` (bsc#1229596, CVE-2024-7592). - gh-122905: :class:`zipfile.Path` objects now sanitize names from the zipfile. - gh-121650: :mod:`email` headers with embedded newlines are now quoted on output. The :mod:`~email.generator` will now refuse to serialize (write) headers that are unsafely folded or delimited; see :attr:`~email.policy.Policy.verify_generated_headers`. (Contributed by Bas Bloemsaat and Petr Viktorin in :gh:`121650`; CVE-2024-6923, bsc#1228780). - gh-119506: Fix :meth:`!io.TextIOWrapper.write` method breaks internal buffer when the method is called again during flushing internal buffer. - gh-118643: Fix an AttributeError in the :mod:`email` module when re-fold a long address list. Also fix more cases of incorrect encoding of the address separator in the address list. - gh-113171: Fixed various false positives and false negatives in * :attr:`ipaddress.IPv4Address.is_private` (see these docs for details) * :attr:`ipaddress.IPv4Address.is_global` * :attr:`ipaddress.IPv6Address.is_private` * :attr:`ipaddress.IPv6Address.is_global` Also in the corresponding :class:`ipaddress.IPv4Network` and :class:`ipaddress.IPv6Network` attributes. Fixes bsc#1226448 (CVE-2024-4032). - gh-102988: :func:`email.utils.getaddresses` and :func:`email.utils.parseaddr` now return ``('', '')`` 2-tuples in more situations where invalid email addresses are encountered instead of potentially inaccurate values. Add optional *strict* parameter to these two functions: use ``strict=False`` to get the old behavior, accept malformed inputs. ``getattr(email.utils, 'supports_strict_parsing', False)`` can be use to check if the *strict* paramater is available. Patch by Thomas Dwyer and Victor Stinner to improve the CVE-2023-27043 fix (bsc#1210638). - gh-67693: Fix :func:`urllib.parse.urlunparse` and :func:`urllib.parse.urlunsplit` for URIs with path starting with multiple slashes and no authority. Based on patch by Ashwin Ramaswami. - Core and Builtins - gh-112275: A deadlock involving ``pystate.c``'s ``HEAD_LOCK`` in ``posixmodule.c`` at fork is now fixed. Patch by ChuBoning based on previous Python 3.12 fix by Victor Stinner. - gh-109120: Added handle of incorrect star expressions, e.g ``f(3, *)``. Patch by Grigoryev Semyon - Removed upstreamed patches: - CVE-2023-27043-email-parsing-errors.patch - CVE-2024-4032-private-IP-addrs.patch - CVE-2024-6923-email-hdr-inject.patch - CVE-2024-8088-inf-loop-zipfile_Path.patch (renamed from CVE-2024-8088-zipfile-Path-sanitization.patch) - CVE-2024-6232-ReDOS-backtrack-tarfile.patch - CVE-2024-7592-quad-complex-cookies.patch ++++ python313-pipx: - Update to version 1.7.1: * 1.7.1: Use minimum supported Python to build zipapp (#1515) ------------------------------------------------------------------ ------------------ 2024-9-8 - Sep 8 2024 ------------------- ------------------------------------------------------------------ ++++ python313-wheel: - update to 0.44.0: * Canonicalized requirements in METADATA file * Deprecated the bdist_wheel module, as the code was migrated to setuptools itself ------------------------------------------------------------------ ------------------ 2024-9-7 - Sep 7 2024 ------------------- ------------------------------------------------------------------ ++++ python313-core: - Update to 3.13.0~rc2: - Tools/Demos - gh-123418: Update GitHub CI workflows to use OpenSSL 3.0.15 and multissltests to use 3.0.15, 3.1.7, and 3.2.3. - Tests - gh-119727: Add --single-process command line option to Python test runner (regrtest). Patch by Victor Stinner. - gh-101525: Skip test_gdb if the binary is relocated by BOLT. Patch by Donghee Na. - Security - gh-123678: Upgrade libexpat to 2.6.3 - gh-121285: Remove backtracking from tarfile header parsing for hdrcharset, PAX, and GNU sparse headers (bsc#1230227, CVE-2024-6232). - Library - gh-123448: Fixed memory leak of typing.NoDefault by moving it to the static types array. - gh-123409: Fix ipaddress.IPv6Address.reverse_pointer output according to RFC 3596, §2.5. Patch by Bénédikt Tran. - gh-123270: Applied a more surgical fix for malformed payloads in zipfile.Path causing infinite loops (gh-122905) without breaking contents using legitimate characters (bsc#1229704, CVE-2024-8088). - gh-123228: Fix return type for _pyrepl.readline._ReadlineWrapper.get_line_buffer() to be str(). Patch by Sergey B Kirpichev. - gh-123240: Raise audit events for the input() in the new REPL. - gh-123243: Fix memory leak in _decimal. - gh-122546: Consistently use same file name for different exceptions in the new repl. Patch by Sergey B Kirpichev. - gh-123213: xml.etree.ElementTree.Element.extend() and Element assignment no longer hide the internal exception if an erronous generator is passed. Patch by Bar Harel. - gh-85110: Preserve relative path in URL without netloc in urllib.parse.urlunsplit() and urllib.parse.urlunparse(). - gh-123067: Fix quadratic complexity in parsing "-quoted cookie values with backslashes by http.cookies (bsc#1229596, CVE-2024-7592) - gh-122981: Fix inspect.getsource() for generated classes with Python base classes (e.g. enums). - gh-122903: zipfile.Path.glob now correctly matches directories instead of silently omitting them. - gh-122905: zipfile.Path objects now sanitize names from the zipfile. - gh-122695: Fixed double-free when using gc.get_referents() with a freed asyncio.Future iterator. - gh-116263: logging.handlers.RotatingFileHandler no longer rolls over empty log files. - gh-105376: Restore the deprecated logging warn() method. It was removed in Python 3.13 alpha 1. Keep the deprecated warn() method in Python 3.13. Patch by Victor Stinner. - gh-122744: Bump the version of pip bundled in ensurepip to version 24.2. - gh-118814: Fix the typing.TypeVar constructor when name is passed by keyword. - gh-122478: Remove internal frames from tracebacks shown in code.InteractiveInterpreter with non-default sys.excepthook(). Save correct tracebacks in sys.last_traceback and update __traceback__ attribute of sys.last_value and sys.last_exc. - gh-116622: On Android, the FICLONE and FICLONERANGE constants are no longer exposed by fcntl, as these ioctls are blocked by SELinux. - gh-82378: Make sure that the new REPL interprets sys.tracebacklimit in the same way that the classic REPL did. - gh-122334: Fix crash when importing ssl after the main interpreter restarts. - gh-87320: In code.InteractiveInterpreter, handle exceptions caused by calling a non-default sys.excepthook(). Before, the exception bubbled up to the caller, ending the REPL. - gh-121650: email headers with embedded newlines are now quoted on output. The generator will now refuse to serialize (write) headers that are unsafely folded or delimited; see verify_generated_headers. (Contributed by Bas Bloemsaat and Petr Viktorin in gh-121650.; CVE-2024-6923, bsc#1228780) - gh-121723: Make logging.config.dictConfig() accept any object implementing the Queue public API. See the queue configuration section for details. Patch by Bénédikt Tran. - gh-122081: Fix a crash in the decimal.IEEEContext() optional function available via the EXTRA_FUNCTIONALITY configuration flag. - gh-121804: Correctly show error locations, when SyntaxError raised in new repl. Patch by Sergey B Kirpichev. - gh-121151: Fix wrapping of long usage text of arguments inside a mutually exclusive group in argparse. - gh-108172: webbrowser honors OS preferred browser on Linux when its desktop entry name contains the text of a known browser name. - gh-109109: You can now get the raw TLS . Cocertificate chains from TLS connections . Covia ssl.SSLSocket.get_verified_chain() and . Cossl.SSLSocket.get_unverified_chain() methods ntributed by . CoMateusz Nowak . - IDLE - gh-120083: Add explicit black IDLE Hovertip foreground color needed for recent macOS. Fixes Sonoma showing unreadable white on pale yellow. Patch by John Riggles. - Core and Builtins - gh-123572: Fix key mappings for various F-keys in Windows for the new REPL. Patch by devdanzin - gh-123484: Fix _Py_DebugOffsets for long objects to be relative to the start of the object rather than the start of a subobject. - gh-123344: Add AST optimizations for type parameter defaults. - gh-123321: Prevent Parser/myreadline race condition from segfaulting on multi-threaded use. Patch by Bar Harel and Amit Wienner. - gh-123177: Fix a bug causing stray prompts to appear in the middle of wrapped lines in the new REPL. - gh-122982: Extend the deprecation period for bool inversion (~) by two years. - gh-123177: Deactivate line wrap in the Apple Terminal via a ANSI escape code. Patch by Pablo Galindo - gh-123229: Fix valgrind warning by initializing the f-string buffers to 0 in the tokenizer. Patch by Pablo Galindo - gh-122298: Restore printout of GC stats when gc.set_debug(gc.DEBUG_STATS) is called. This featue was accidentally removed when implementing incremental GC. - gh-121804: Correctly show error locations when a SyntaxError is raised in the basic REPL. Patch by Sergey B Kirpichev. - gh-123142: Fix too-wide source location in exception tracebacks coming from broken iterables in comprehensions. - gh-123048: Fix a bug where pattern matching code could emit a JUMP_FORWARD with no source location. - gh-123123: Fix displaying SyntaxError exceptions covering multiple lines. Patch by Pablo Galindo - gh-123083: Fix a potential use-after-free in STORE_ATTR_WITH_HINT. - gh-123022: Fix crash in free-threaded build when calling Py_Initialize() from a non-main thread. - gh-122888: Fix crash on certain calls to str() with positional arguments of the wrong type. Patch by Jelle Zijlstra. - gh-116622: Fix Android stdout and stderr messages being truncated or lost. - gh-122527: Fix a crash that occurred when a PyStructSequence was deallocated after its type’s dictionary was cleared by the GC. The type’s tp_basicsize now accounts for non-sequence fields that aren’t included in the Py_SIZE of the sequence. - gh-122445: Add only fields which are modified via self.* to __static_attributes__. - gh-98442: Fix too wide source locations of the cleanup instructions of a with statement. - gh-93691: Fix source locations of instructions generated for with statements. - gh-120097: FrameLocalsProxy now subclasses collections.abc.Mapping and can be matched as a mapping in match statements - C API - gh-122728: Fix PyEval_GetLocals() to avoid SystemError (“bad argument to internal function”). Patch by Victor Stinner. - Build - gh-123297: Propagate the value of LDFLAGS to LDCXXSHARED in sysconfig. Patch by Pablo Galindo - gh-116622: Rename build variable MODULE_LDFLAGS back to LIBPYTHON, as it’s used by package build systems (e.g. Meson). - gh-118943: Fix an issue where the experimental JIT could be built several times by the make regen-all target, leading to possible race conditions on heavily parallelized builds. - gh-118943: Fix a possible race condition affecting parallel builds configured with --enable-experimental-jit, in which FileNotFoundError could be caused by another process already moving jit_stencils.h.new to jit_stencils.h. - Remove upstreamed patches: - bso1227999-reproducible-builds.patch - CVE-2024-8088-inf-loop-zipfile_Path.patch - gh120226-fix-sendfile-test-kernel-610.patch - gh122136-test_asyncio-kernel-buffer-data.patch - fix_configure_rst.patch - CVE-2024-6923-email-hdr-inject.patch ++++ python313: - Update to 3.13.0~rc2: - Tools/Demos - gh-123418: Update GitHub CI workflows to use OpenSSL 3.0.15 and multissltests to use 3.0.15, 3.1.7, and 3.2.3. - Tests - gh-119727: Add --single-process command line option to Python test runner (regrtest). Patch by Victor Stinner. - gh-101525: Skip test_gdb if the binary is relocated by BOLT. Patch by Donghee Na. - Security - gh-123678: Upgrade libexpat to 2.6.3 - gh-121285: Remove backtracking from tarfile header parsing for hdrcharset, PAX, and GNU sparse headers (bsc#1230227, CVE-2024-6232). - Library - gh-123448: Fixed memory leak of typing.NoDefault by moving it to the static types array. - gh-123409: Fix ipaddress.IPv6Address.reverse_pointer output according to RFC 3596, §2.5. Patch by Bénédikt Tran. - gh-123270: Applied a more surgical fix for malformed payloads in zipfile.Path causing infinite loops (gh-122905) without breaking contents using legitimate characters (bsc#1229704, CVE-2024-8088). - gh-123228: Fix return type for _pyrepl.readline._ReadlineWrapper.get_line_buffer() to be str(). Patch by Sergey B Kirpichev. - gh-123240: Raise audit events for the input() in the new REPL. - gh-123243: Fix memory leak in _decimal. - gh-122546: Consistently use same file name for different exceptions in the new repl. Patch by Sergey B Kirpichev. - gh-123213: xml.etree.ElementTree.Element.extend() and Element assignment no longer hide the internal exception if an erronous generator is passed. Patch by Bar Harel. - gh-85110: Preserve relative path in URL without netloc in urllib.parse.urlunsplit() and urllib.parse.urlunparse(). - gh-123067: Fix quadratic complexity in parsing "-quoted cookie values with backslashes by http.cookies (bsc#1229596, CVE-2024-7592) - gh-122981: Fix inspect.getsource() for generated classes with Python base classes (e.g. enums). - gh-122903: zipfile.Path.glob now correctly matches directories instead of silently omitting them. - gh-122905: zipfile.Path objects now sanitize names from the zipfile. - gh-122695: Fixed double-free when using gc.get_referents() with a freed asyncio.Future iterator. - gh-116263: logging.handlers.RotatingFileHandler no longer rolls over empty log files. - gh-105376: Restore the deprecated logging warn() method. It was removed in Python 3.13 alpha 1. Keep the deprecated warn() method in Python 3.13. Patch by Victor Stinner. - gh-122744: Bump the version of pip bundled in ensurepip to version 24.2. - gh-118814: Fix the typing.TypeVar constructor when name is passed by keyword. - gh-122478: Remove internal frames from tracebacks shown in code.InteractiveInterpreter with non-default sys.excepthook(). Save correct tracebacks in sys.last_traceback and update __traceback__ attribute of sys.last_value and sys.last_exc. - gh-116622: On Android, the FICLONE and FICLONERANGE constants are no longer exposed by fcntl, as these ioctls are blocked by SELinux. - gh-82378: Make sure that the new REPL interprets sys.tracebacklimit in the same way that the classic REPL did. - gh-122334: Fix crash when importing ssl after the main interpreter restarts. - gh-87320: In code.InteractiveInterpreter, handle exceptions caused by calling a non-default sys.excepthook(). Before, the exception bubbled up to the caller, ending the REPL. - gh-121650: email headers with embedded newlines are now quoted on output. The generator will now refuse to serialize (write) headers that are unsafely folded or delimited; see verify_generated_headers. (Contributed by Bas Bloemsaat and Petr Viktorin in gh-121650.; CVE-2024-6923, bsc#1228780) - gh-121723: Make logging.config.dictConfig() accept any object implementing the Queue public API. See the queue configuration section for details. Patch by Bénédikt Tran. - gh-122081: Fix a crash in the decimal.IEEEContext() optional function available via the EXTRA_FUNCTIONALITY configuration flag. - gh-121804: Correctly show error locations, when SyntaxError raised in new repl. Patch by Sergey B Kirpichev. - gh-121151: Fix wrapping of long usage text of arguments inside a mutually exclusive group in argparse. - gh-108172: webbrowser honors OS preferred browser on Linux when its desktop entry name contains the text of a known browser name. - gh-109109: You can now get the raw TLS . Cocertificate chains from TLS connections . Covia ssl.SSLSocket.get_verified_chain() and . Cossl.SSLSocket.get_unverified_chain() methods ntributed by . CoMateusz Nowak . - IDLE - gh-120083: Add explicit black IDLE Hovertip foreground color needed for recent macOS. Fixes Sonoma showing unreadable white on pale yellow. Patch by John Riggles. - Core and Builtins - gh-123572: Fix key mappings for various F-keys in Windows for the new REPL. Patch by devdanzin - gh-123484: Fix _Py_DebugOffsets for long objects to be relative to the start of the object rather than the start of a subobject. - gh-123344: Add AST optimizations for type parameter defaults. - gh-123321: Prevent Parser/myreadline race condition from segfaulting on multi-threaded use. Patch by Bar Harel and Amit Wienner. - gh-123177: Fix a bug causing stray prompts to appear in the middle of wrapped lines in the new REPL. - gh-122982: Extend the deprecation period for bool inversion (~) by two years. - gh-123177: Deactivate line wrap in the Apple Terminal via a ANSI escape code. Patch by Pablo Galindo - gh-123229: Fix valgrind warning by initializing the f-string buffers to 0 in the tokenizer. Patch by Pablo Galindo - gh-122298: Restore printout of GC stats when gc.set_debug(gc.DEBUG_STATS) is called. This featue was accidentally removed when implementing incremental GC. - gh-121804: Correctly show error locations when a SyntaxError is raised in the basic REPL. Patch by Sergey B Kirpichev. - gh-123142: Fix too-wide source location in exception tracebacks coming from broken iterables in comprehensions. - gh-123048: Fix a bug where pattern matching code could emit a JUMP_FORWARD with no source location. - gh-123123: Fix displaying SyntaxError exceptions covering multiple lines. Patch by Pablo Galindo - gh-123083: Fix a potential use-after-free in STORE_ATTR_WITH_HINT. - gh-123022: Fix crash in free-threaded build when calling Py_Initialize() from a non-main thread. - gh-122888: Fix crash on certain calls to str() with positional arguments of the wrong type. Patch by Jelle Zijlstra. - gh-116622: Fix Android stdout and stderr messages being truncated or lost. - gh-122527: Fix a crash that occurred when a PyStructSequence was deallocated after its type’s dictionary was cleared by the GC. The type’s tp_basicsize now accounts for non-sequence fields that aren’t included in the Py_SIZE of the sequence. - gh-122445: Add only fields which are modified via self.* to __static_attributes__. - gh-98442: Fix too wide source locations of the cleanup instructions of a with statement. - gh-93691: Fix source locations of instructions generated for with statements. - gh-120097: FrameLocalsProxy now subclasses collections.abc.Mapping and can be matched as a mapping in match statements - C API - gh-122728: Fix PyEval_GetLocals() to avoid SystemError (“bad argument to internal function”). Patch by Victor Stinner. - Build - gh-123297: Propagate the value of LDFLAGS to LDCXXSHARED in sysconfig. Patch by Pablo Galindo - gh-116622: Rename build variable MODULE_LDFLAGS back to LIBPYTHON, as it’s used by package build systems (e.g. Meson). - gh-118943: Fix an issue where the experimental JIT could be built several times by the make regen-all target, leading to possible race conditions on heavily parallelized builds. - gh-118943: Fix a possible race condition affecting parallel builds configured with --enable-experimental-jit, in which FileNotFoundError could be caused by another process already moving jit_stencils.h.new to jit_stencils.h. - Remove upstreamed patches: - bso1227999-reproducible-builds.patch - CVE-2024-8088-inf-loop-zipfile_Path.patch - gh120226-fix-sendfile-test-kernel-610.patch - gh122136-test_asyncio-kernel-buffer-data.patch - fix_configure_rst.patch - CVE-2024-6923-email-hdr-inject.patch ------------------------------------------------------------------ ------------------ 2024-9-6 - Sep 6 2024 ------------------- ------------------------------------------------------------------ ++++ python-looseversion: - Add %{?sle15_python_module_pythons} ------------------------------------------------------------------ ------------------ 2024-9-2 - Sep 2 2024 ------------------- ------------------------------------------------------------------ ++++ python313-core: - Add gh120226-fix-sendfile-test-kernel-610.patch to avoid failing test_sendfile_close_peer_in_the_middle_of_receiving tests on Linux >= 6.10 (GH-120227). ++++ python311: - Add gh120226-fix-sendfile-test-kernel-610.patch to avoid failing test_sendfile_close_peer_in_the_middle_of_receiving tests on Linux >= 6.10 (GH-120227). ++++ python311-core: - Add gh120226-fix-sendfile-test-kernel-610.patch to avoid failing test_sendfile_close_peer_in_the_middle_of_receiving tests on Linux >= 6.10 (GH-120227). ++++ python313: - Add gh120226-fix-sendfile-test-kernel-610.patch to avoid failing test_sendfile_close_peer_in_the_middle_of_receiving tests on Linux >= 6.10 (GH-120227). ------------------------------------------------------------------ ------------------ 2024-8-29 - Aug 29 2024 ------------------- ------------------------------------------------------------------ ++++ python313-core: - Add gh122136-test_asyncio-kernel-buffer-data.patch fixing gh#python/cpython#122136 (changes in kernel provide different amount of data in the socket buffers). - Remove skip_test_abort_clients.patch, which is not needed any more. ++++ python313: - Add gh122136-test_asyncio-kernel-buffer-data.patch fixing gh#python/cpython#122136 (changes in kernel provide different amount of data in the socket buffers). - Remove skip_test_abort_clients.patch, which is not needed any more. ------------------------------------------------------------------ ------------------ 2024-8-28 - Aug 28 2024 ------------------- ------------------------------------------------------------------ ++++ python313-core: - Add CVE-2024-8088-inf-loop-zipfile_Path.patch to prevent malformed payload to cause infinite loops in zipfile.Path (bsc#1229704, CVE-2024-8088). ++++ python311: - Add CVE-2024-8088-inf-loop-zipfile_Path.patch to prevent malformed payload to cause infinite loops in zipfile.Path (bsc#1229704, CVE-2024-8088). ++++ python311-core: - Add CVE-2024-8088-inf-loop-zipfile_Path.patch to prevent malformed payload to cause infinite loops in zipfile.Path (bsc#1229704, CVE-2024-8088). ++++ python313: - Add CVE-2024-8088-inf-loop-zipfile_Path.patch to prevent malformed payload to cause infinite loops in zipfile.Path (bsc#1229704, CVE-2024-8088). ------------------------------------------------------------------ ------------------ 2024-8-23 - Aug 23 2024 ------------------- ------------------------------------------------------------------ ++++ python-resolvelib: - drop optional test dependency on python-commentjson ++++ python313-pipx: - Update to 1.7.0: * Add help messages for pipx pin and pipx unpin commands * Add quotes to title and fix tag name in release action * Add a --prepend option to the pipx ensurepath command * ci: clean up auto changelog on releases * Introduce a new env variable to allow spaces in home path * Use multiple machine suffixes for standalone python * Fix install all example typo * Fix passing constraints file path into pipx install operation via --pip-args * Apply preview ruff/Pylint rule PLC0206 * Apply ruff/pycodestyle rule E721 * Enforce new ruff rules * Moved documentation to docs directory * Fix #1475 (--global installs to ~/.local) * Fix #1492: Add PIPX_GLOBAL_(HOME|BIN_DIR|MAN_DIR) documentation and list them in pipx environment * Assorted repo-review suggestions * Fixes #1509 short-circuit of installing packages when already installed - Use obs-service-tar_scm instead of GitHub releases ------------------------------------------------------------------ ------------------ 2024-8-22 - Aug 22 2024 ------------------- ------------------------------------------------------------------ ++++ python-aiohttp: - Add patch CVE-2024-42367-path-traversal-via-symlink.patch: * Do not follow symlinks for compressed file variants. (CVE-2024-42367, bsc#1229226) ------------------------------------------------------------------ ------------------ 2024-8-13 - Aug 13 2024 ------------------- ------------------------------------------------------------------ ++++ python313-argcomplete: - require ca-certificates-mozilla for the pip >= 24.2 ------------------------------------------------------------------ ------------------ 2024-8-12 - Aug 12 2024 ------------------- ------------------------------------------------------------------ ++++ python-setuptools: - Add patch CVE-2024-6345-code-execution-via-download-funcs.patch: * Sanitize any VCS URL we download. (CVE-2024-6345, bsc#1228105) ++++ python313-pip: - update to 24.2: * Deprecate pip install --editable falling back to setup.py develop when using a setuptools version that does not support PEP 660 (setuptools v63 and older). * Check unsupported packages for the current platform. (#11054) * Check unsupported packages for the current platform. * Use system certificates and certifi certificates to verify HTTPS connections on Python 3.10+. Python 3.9 and earlier only use certifi. To revert to previous behaviour, pass the flag --use-deprecated=legacy-certs. (#11647) * Use system certificates and certifi certificates to verify HTTPS connections on Python 3.10+. Python 3.9 and earlier only use certifi. * To revert to previous behaviour, pass the flag --use- deprecated=legacy-certs. * Improve discovery performance of installed packages when the importlib.metadata backend is used to load distribution metadata (used by default under Python 3.11+). (#12656) * Improve discovery performance of installed packages when the importlib.metadata backend is used to load distribution metadata (used by default under Python 3.11+). * Improve performance when the same requirement string appears many times during resolution, by consistently caching the parsed requirement string. (#12663) * Improve performance when the same requirement string appears many times during resolution, by consistently caching the parsed requirement string. * Minor performance improvement of finding applicable package candidates by not repeatedly calculating their versions (#12664) * Minor performance improvement of finding applicable package candidates by not repeatedly calculating their versions * Disable pip's self version check when invoking a pip subprocess to install PEP 517 build requirements. (#12683) * Disable pip's self version check when invoking a pip subprocess to install PEP 517 build requirements. * Improve dependency resolution performance by caching platform compatibility tags during wheel cache lookup. (#12712) * Improve dependency resolution performance by caching platform compatibility tags during wheel cache lookup. * wheel is no longer explicitly listed as a build dependency of pip. setuptools injects this dependency in the get_requires_for_build_wheel() hook and no longer needs it on newer versions. (#12728) * wheel is no longer explicitly listed as a build dependency of pip. setuptools injects this dependency in the get_requires_for_build_wheel() hook and no longer needs it on newer versions. * Ignore --require-virtualenv for pip check and pip freeze (#12842) * Ignore --require-virtualenv for pip check and pip freeze * Improve package download and install performance. Increase chunk sizes when downloading (256 kB, up from 10 kB) and reading files (1 MB, up from 8 kB). This reduces the frequency of updates to pip's progress bar. (#12810) * Improve package download and install performance. * Increase chunk sizes when downloading (256 kB, up from 10 kB) and reading files (1 MB, up from 8 kB). This reduces the frequency of updates to pip's progress bar. * Improve pip install performance. Files are now extracted in 1MB blocks, or in one block matching the file size for smaller files. A decompressor is no longer instantiated when extracting 0 bytes files, it is not necessary because there is no data to decompress. (#12803) * Improve pip install performance. * Files are now extracted in 1MB blocks, or in one block matching the file size for smaller files. A decompressor is no longer instantiated when extracting 0 bytes files, it is not necessary because there is no data to decompress. * Set no_color to global rich.Console instance. * Fix resolution to respect --python-version when checking Requires-Python. * Perform hash comparisons in a case-insensitive manner. * Avoid dlopen failure for glibc detection in musl builds * Avoid keyring logging crashes when pip is run in verbose mode. * Fix finding hardlink targets in tar files with an ignored top-level directory. * Improve pip install performance by only creating required parent directories once, instead of before extracting every file in the wheel. * Improve pip install performance by calculating installed packages printout in linear time instead of quadratic time. * Remove vendored tenacity. * Update the preload list for the DEBUNDLED case, to replace pep517 that has been renamed to pyproject_hooks. * Use tomllib from the stdlib if available, rather than tomli * Upgrade certifi to 2024.7.4 * Upgrade platformdirs to 4.2.2 * Upgrade pygments to 2.18.0 * Upgrade setuptools to 70.3.0 * Upgrade typing_extensions to 4.12.2 * Correct —-ignore-conflicts (including an em dash) to - -ignore-conflicts. * Fix finding hardlink targets in tar files with an ignored top-level directory. - add disable-ssl-context-in-buildenv.patch: treat missing ca-certificates as "ssl not available" for buildenvs ------------------------------------------------------------------ ------------------ 2024-8-10 - Aug 10 2024 ------------------- ------------------------------------------------------------------ ++++ python-M2Crypto: - Update 0.42.0: - allow ASN1_{Integer,String} be initialized directly - minimal infrastructure for type hints for a C extension and some type hints for some basic modules - time_t on 32bit Linux is 32bit (integer) not 64bit (long) - EOS for CentOS 7 - correct checking for OpenSSL version number on Windows - make compatible with Python 3.13 (replace PyEval_CallObject with PyObject_CallObject) - fix typo in extern function signature (and proper type of engine_ctrl_cmd_string()) - move the package to Sorucehut - setup CI to use Sourcehut CI - setup CI on GitLab for Windows as well (remove Appveyor) - initial draft of documentation for migration to pyca/cryptography - fix Read the Docs configuration (contributed kindly by Facundo Tuesca) - Remove upstreamed 32bit_ASN1_Time.patch - Remove python-M2Crypto.keyring, because PyPI broke GPG support ------------------------------------------------------------------ ------------------ 2024-8-9 - Aug 9 2024 ------------------- ------------------------------------------------------------------ ++++ python-sphinxcontrib-applehelp: - Add sphinx-7.2.patch to fix tests with python-Shpinx 7.2 gh#sphinx-doc/sphinxcontrib-applehelp@d36074c2ab60 jsc#PED-8481 ------------------------------------------------------------------ ------------------ 2024-8-8 - Aug 8 2024 ------------------- ------------------------------------------------------------------ ++++ python313-core: - Update list of skipped tests in qemu linux-user emulation ++++ python313: - Update list of skipped tests in qemu linux-user emulation ------------------------------------------------------------------ ------------------ 2024-8-7 - Aug 7 2024 ------------------- ------------------------------------------------------------------ ++++ python313-core: - Add CVE-2024-6923-email-hdr-inject.patch to prevent email header injection due to unquoted newlines (bsc#1228780, CVE-2024-6923). - Adding bso1227999-reproducible-builds.patch fixing bsc#1227999 adding reproducibility patches from gh#python/cpython!121872 and gh#python/cpython!121883. - Add skip_test_abort_clients.patch (gh#python/cpython#122136) skip not yet fixed failing test - %{profileopt} variable is set according to the variable %{do_profiling} (bsc#1227999) - Update bluez-devel-vendor.tar.xz ++++ python311: - Add CVE-2024-6923-email-hdr-inject.patch to prevent email header injection due to unquoted newlines (bsc#1228780, CVE-2024-6923). - %{profileopt} variable is set according to the variable %{do_profiling} (bsc#1227999) ++++ python311-core: - Add CVE-2024-6923-email-hdr-inject.patch to prevent email header injection due to unquoted newlines (bsc#1228780, CVE-2024-6923). - %{profileopt} variable is set according to the variable %{do_profiling} (bsc#1227999) ++++ python313: - Add CVE-2024-6923-email-hdr-inject.patch to prevent email header injection due to unquoted newlines (bsc#1228780, CVE-2024-6923). - Adding bso1227999-reproducible-builds.patch fixing bsc#1227999 adding reproducibility patches from gh#python/cpython!121872 and gh#python/cpython!121883. - Add skip_test_abort_clients.patch (gh#python/cpython#122136) skip not yet fixed failing test - %{profileopt} variable is set according to the variable %{do_profiling} (bsc#1227999) - Update bluez-devel-vendor.tar.xz ------------------------------------------------------------------ ------------------ 2024-8-1 - Aug 1 2024 ------------------- ------------------------------------------------------------------ ++++ python313-core: - Update to 3.13.0~rc1: - Tests - gh-59022: Add tests for pkgutil.extend_path(). Patch by Andreas Stocker. - gh-99242: os.getloadavg() may throw OSError when running regression tests under certain conditions (e.g. chroot). This error is now caught and ignored, since reporting load average is optional. - Security - gh-122133: Authenticate the socket connection for the socket.socketpair() fallback on platforms where AF_UNIX is not available like Windows. - Patch by Gregory P. Smith and Seth Larson . Reported by Ellie - gh-121957: Fixed missing audit events around interactive use of Python, now also properly firing for python -i, as well as for python -m asyncio. The events in question are cpython.run_stdin and cpython.run_startup. - Library - gh-122400: Handle ValueErrors raised by os.stat() in filecmp.dircmp and filecmp.cmpfiles(). Patch by Bénédikt Tran. - gh-122311: Fix some error messages in pickle. - gh-122332: Fixed segfault with asyncio.Task.get_coro() when using an eager task factory. - gh-105733: ctypes.ARRAY() is now soft deprecated: it no longer emits deprecation warnings and is not scheduled for removal. - gh-122087: Restore inspect.ismethoddescriptor() and inspect.isroutine() returning False for functools.partial objects. - gh-122170: Handle ValueErrors raised by os.stat() in linecache. Patch by Bénédikt Tran. - gh-82951: Serializing objects with complex __qualname__ (such as unbound methods and nested classes) by name no longer involves serializing parent objects by value in pickle protocols < 4. - gh-113785: csv now correctly parses numeric fields (when used with csv.QUOTE_NONNUMERIC or csv.QUOTE_STRINGS) which start with an escape character. - gh-122088: @warnings.deprecated now copies the coroutine status of functions and methods so that inspect.iscoroutinefunction() returns the correct result. - gh-120930: Fixed a bug introduced by gh-92081 that added an incorrect extra blank to encoded words occurring in wrapped headers. - gh-121474: Fix missing sanity check for parties arg in threading.Barrier constructor. Patch by Clinton Christian (pygeek). - gh-120289: Fixed the use-after-free issue in cProfile by disallowing disable() and clear() in external timers. - IDLE - gh-122482: Change About IDLE to direct users to discuss.python.org instead of the now unused idle-dev email and mailing list. - Core and Builtins - gh-116090: Fix an issue in JIT builds that prevented some for loops from correctly firing RAISE monitoring events. - gh-122208: Dictionary watchers now only deliver the PyDict_EVENT_ADDED event when the insertion is in a known good state to succeed. - gh-122300: Preserve AST nodes for f-string with single-element format specifiers. Patch by Pablo Galindo - gh-122029: Emit c_call events in sys.setprofile() when a PyMethodObject pointing to a PyCFunction is called. - gh-122026: Fix a bug that caused the tokenizer to not correctly identify mismatched parentheses inside f-strings in some situations. Patch by Pablo Galindo - gh-118934: Make PyEval_GetLocals return borrowed reference - C API - gh-116622: Make PyObject_Print work around a bug in Android and OpenBSD which prevented it from throwing an exception when trying to write to a read-only stream. - gh-121489: Export private _PyBytes_Join() again. - Build - gh-120522: Added a --with-app-store-compliance option to patch out known issues with macOS/iOS App Store review processes. ++++ python313: - Update to 3.13.0~rc1: - Tests - gh-59022: Add tests for pkgutil.extend_path(). Patch by Andreas Stocker. - gh-99242: os.getloadavg() may throw OSError when running regression tests under certain conditions (e.g. chroot). This error is now caught and ignored, since reporting load average is optional. - Security - gh-122133: Authenticate the socket connection for the socket.socketpair() fallback on platforms where AF_UNIX is not available like Windows. - Patch by Gregory P. Smith and Seth Larson . Reported by Ellie - gh-121957: Fixed missing audit events around interactive use of Python, now also properly firing for python -i, as well as for python -m asyncio. The events in question are cpython.run_stdin and cpython.run_startup. - Library - gh-122400: Handle ValueErrors raised by os.stat() in filecmp.dircmp and filecmp.cmpfiles(). Patch by Bénédikt Tran. - gh-122311: Fix some error messages in pickle. - gh-122332: Fixed segfault with asyncio.Task.get_coro() when using an eager task factory. - gh-105733: ctypes.ARRAY() is now soft deprecated: it no longer emits deprecation warnings and is not scheduled for removal. - gh-122087: Restore inspect.ismethoddescriptor() and inspect.isroutine() returning False for functools.partial objects. - gh-122170: Handle ValueErrors raised by os.stat() in linecache. Patch by Bénédikt Tran. - gh-82951: Serializing objects with complex __qualname__ (such as unbound methods and nested classes) by name no longer involves serializing parent objects by value in pickle protocols < 4. - gh-113785: csv now correctly parses numeric fields (when used with csv.QUOTE_NONNUMERIC or csv.QUOTE_STRINGS) which start with an escape character. - gh-122088: @warnings.deprecated now copies the coroutine status of functions and methods so that inspect.iscoroutinefunction() returns the correct result. - gh-120930: Fixed a bug introduced by gh-92081 that added an incorrect extra blank to encoded words occurring in wrapped headers. - gh-121474: Fix missing sanity check for parties arg in threading.Barrier constructor. Patch by Clinton Christian (pygeek). - gh-120289: Fixed the use-after-free issue in cProfile by disallowing disable() and clear() in external timers. - IDLE - gh-122482: Change About IDLE to direct users to discuss.python.org instead of the now unused idle-dev email and mailing list. - Core and Builtins - gh-116090: Fix an issue in JIT builds that prevented some for loops from correctly firing RAISE monitoring events. - gh-122208: Dictionary watchers now only deliver the PyDict_EVENT_ADDED event when the insertion is in a known good state to succeed. - gh-122300: Preserve AST nodes for f-string with single-element format specifiers. Patch by Pablo Galindo - gh-122029: Emit c_call events in sys.setprofile() when a PyMethodObject pointing to a PyCFunction is called. - gh-122026: Fix a bug that caused the tokenizer to not correctly identify mismatched parentheses inside f-strings in some situations. Patch by Pablo Galindo - gh-118934: Make PyEval_GetLocals return borrowed reference - C API - gh-116622: Make PyObject_Print work around a bug in Android and OpenBSD which prevented it from throwing an exception when trying to write to a read-only stream. - gh-121489: Export private _PyBytes_Join() again. - Build - gh-120522: Added a --with-app-store-compliance option to patch out known issues with macOS/iOS App Store review processes. ------------------------------------------------------------------ ------------------ 2024-7-31 - Jul 31 2024 ------------------- ------------------------------------------------------------------ ++++ python-Twisted: - Add a couple of upstream patches to fix http process information disclosure (CVE-2024-41671, bsc#1228549) and XSS via html injection (CVE-2024-41810, bsc#1228552): * CVE-2024-41671.patch gh#twisted/twisted@4a930de12fb6 * CVE-2024-41810.patch gh#twisted/twisted@046a164f89a0 ------------------------------------------------------------------ ------------------ 2024-7-30 - Jul 30 2024 ------------------- ------------------------------------------------------------------ ++++ python-requests: - Update CVE-2024-35195.patch to allow the usage of "verify" parameter as a directory, bsc#1225912 ++++ python313-setuptools: - Update to 72.1.0: * Restore the tests command and deprecate access to the module. * Added return types to typed public functions. * Removed lingering unused code around Distribution._patched_dist. * Reset the backports module when enabling vendored packages. * Include all vendored files in the sdist. * Restored package data that went missing in 71.0. This change also incidentally causes tests to be installed once again. * Now setuptools declares its own dependencies in the core extra. Dependencies are still vendored for bootstrapping purposes, but setuptools will prefer installed dependencies if present. The core extra is used for informational purposes and should *not* be declared in package metadata (e.g. build-requires). * Support for loading distutils from the standard library is now deprecated, including use of SETUPTOOLS_USE_DISTUTILS=stdlib and importing distutils before importing setuptools. * Fix distribution name normalisation for valid versions that are not canonical (e.g. 1.0-2). ------------------------------------------------------------------ ------------------ 2024-7-25 - Jul 25 2024 ------------------- ------------------------------------------------------------------ ++++ libxml2-python: - Update to version 2.12.9 [bsc#1234812]: + Security: (CVE-2024-40896) Fix XXE protection in downstream code. + Improvements: Undeprecate xmlKeepBlanksDefault. ------------------------------------------------------------------ ------------------ 2024-7-24 - Jul 24 2024 ------------------- ------------------------------------------------------------------ ++++ python313-core: - Update F00251-change-user-install-location.patch to install packages in /usr/local by default when using pip outside of a RPMBUILD environment. ++++ python313: - Update F00251-change-user-install-location.patch to install packages in /usr/local by default when using pip outside of a RPMBUILD environment. ------------------------------------------------------------------ ------------------ 2024-7-22 - Jul 22 2024 ------------------- ------------------------------------------------------------------ ++++ python313-core: - Update to 3.13.0~b4: - Tests - gh-121084: Fix test_typing random leaks. Clear typing ABC caches when running tests for refleaks (-R option): call _abc_caches_clear() on typing abstract classes and their subclasses. - gh-121160: Add a test for readline.set_history_length(). Note that this test may fail on readline libraries. - gh-121200: Fix test_expanduser_pwd2() of test_posixpath. Call getpwnam() to get pw_dir, since it can be different than getpwall() pw_dir. - gh-121188: When creating the JUnit XML file, regrtest now escapes characters which are invalid in XML, such as the chr(27) control character used in ANSI escape sequences. - Library - gh-57141: The shallow argument to filecmp.dircmp (new in Python 3.13) is now keyword-only. - gh-121245: Simplify handling of the history file in site.register_readline() helper. The CAN_USE_PYREPL variable now will be initialized, when imported. - gh-121332: Fix constructor of ast nodes with custom _attributes. Previously, passing custom attributes would raise a DeprecationWarning. Passing arguments to the constructor that are not in _fields or _attributes remains deprecated. - gh-121279: Avoid NameError for the warnings module when accessing the depracated atributes of the importlib.abc module. - gh-121245: Fix a bug in the handling of the command history of the new REPL that caused the history file to be wiped at REPL exit. - gh-87744: Fix waitpid race while calling send_signal() in asyncio. - gh-121018: Fixed other issues where argparse.ArgumentParser did not honor exit_on_error=False. - gh-120678: Fix regression in the new REPL that meant that globals from files passed using the -i argument would not be included in the REPL’s global namespace. - gh-120782: Fix wrong references of the datetime types after reloading the module. - gh-120713: datetime.datetime.strftime() now 0-pads years with less than four digits for the format specifiers %Y and %G on Linux. - gh-117983: Defer the threading import in importlib.util until lazy loading is used. - gh-119189: When using the ** operator or pow() with Fraction as the base and an exponent that is not rational, a float, or a complex, the fraction is no longer converted to a float. - gh-118714: Allow restart in post-mortem debugging of pdb. Removed restart message when the user quits pdb from post-mortem mode. - gh-105623: Fix performance degradation in logging.handlers.RotatingFileHandler. - IDLE - gh-78889: Stop Shell freezes by blocking user access to non-method sys.stdout.shell attributes, which are all private. - Documentation - gh-121749: Fix documentation for PyModule_AddObjectRef(). - gh-120012: Clarify the behaviours of multiprocessing.Queue.empty() and multiprocessing.SimpleQueue.empty() on closed queues. - Core and Builtins - gh-121860: Fix crash when rematerializing a managed dictionary after it was deleted. - gh-121814: Fixed the SegFault when PyEval_SetTrace() is used with no Python frame on stack. - gh-121295: Fix PyREPL console getting into a blocked state after interrupting a long paste - gh-121794: Fix bug in free-threaded Python where a resurrected object could lead to a negative ref count assertion failure. - gh-121657: Improve the SyntaxError message if the user tries to use yield from outside a function. - gh-121609: Fix pasting of characters containing unicode character joiners in the new REPL. Patch by Marta Gomez Macias - gh-117482: Unexpected slot wrappers are no longer created for builtin static types in subinterpreters. - gh-121499: Fix a bug affecting how multi-line history was being rendered in the new REPL after interacting with the new screen cache. Patch by Pablo Galindo - gh-121497: Fix a bug that was preventing the REPL to correctly respect the history when an input hook was set. Patch by Pablo Galindo - gh-121012: Tier 2 execution now ensures that list iterators remain exhausted, once they become exhausted. - gh-121439: Allow tuples of length 20 in the freelist to be reused. - gh-121368: Fix race condition in _PyType_Lookup in the free-threaded build due to a missing memory fence. This could lead to _PyType_Lookup returning incorrect results on arm64. - gh-121130: Fix f-strings with debug expressions in format specifiers. Patch by Pablo Galindo - gh-121115: PyLong_AsNativeBytes() no longer uses __index__() methods by default. The Py_ASNATIVEBYTES_ALLOW_INDEX flag has been added to allow it. - C API - gh-89364: Export the PySignal_SetWakeupFd() function. Previously, the function was documented but it couldn’t be used in 3rd party code. Patch by Victor Stinner. - gh-113993: PyUnicode_InternInPlace() no longer Seprevents its argument from being garbage collected Several functions that take char * are now documented Seas possibly preventing string objects from being Segarbage collected; refer to their documentation Sefor details: PyUnicode_InternFromString(), SePyDict_SetItemString(), PyObject_SetAttrString(), SePyObject_DelAttrString(), PyUnicode_InternFromString(), Seand PyModule_Add* convenience functions - gh-113601: Removed debug build assertions related to interning strings, which were falsely triggered by stable ABI extensions. - gh-112136: Restore the private _PyArg_Parser structure and the private _PyArg_ParseTupleAndKeywordsFast() function, previously removed in Python 3.13 alpha 1. Patch by Victor Stinner. - Build - gh-120371: Support WASI SDK 22 by explicitly skipping functions that are just stubs in wasi-libc. - gh-121731: Fix mimalloc compile error on GNU/Hurd - gh-121487: Fix deprecation warning for ATOMIC_VAR_INIT in mimalloc. - gh-121467: Fix a Makefile bug that prevented mimalloc header files from being installed. - gh-121103: On POSIX systems, excluding macOS framework installs, the lib directory for the free-threaded build now includes a “t” suffix to avoid conflicts with a co-located default build installation. - gh-120831: The default minimum iOS version was increased to 13.0. - gh-113565: Improve curses and curses.panel dependency checks in configure. - Remove %suse_update_desktop_file macro as it is not useful any more. - Update bluez-devel-vendor.tar.xz vendored files. ++++ python311: - Remove %suse_update_desktop_file macro as it is not useful any more. ++++ python311-core: - Remove %suse_update_desktop_file macro as it is not useful any more. ++++ python-recommonmark: - Move cm2html to the first update-alternatives to match the `python3-recommonmark` to fix: `update-alternatives: error: alternative cm2man can't be master: it is a slave of cm2html` ++++ python313: - Update to 3.13.0~b4: - Tests - gh-121084: Fix test_typing random leaks. Clear typing ABC caches when running tests for refleaks (-R option): call _abc_caches_clear() on typing abstract classes and their subclasses. - gh-121160: Add a test for readline.set_history_length(). Note that this test may fail on readline libraries. - gh-121200: Fix test_expanduser_pwd2() of test_posixpath. Call getpwnam() to get pw_dir, since it can be different than getpwall() pw_dir. - gh-121188: When creating the JUnit XML file, regrtest now escapes characters which are invalid in XML, such as the chr(27) control character used in ANSI escape sequences. - Library - gh-57141: The shallow argument to filecmp.dircmp (new in Python 3.13) is now keyword-only. - gh-121245: Simplify handling of the history file in site.register_readline() helper. The CAN_USE_PYREPL variable now will be initialized, when imported. - gh-121332: Fix constructor of ast nodes with custom _attributes. Previously, passing custom attributes would raise a DeprecationWarning. Passing arguments to the constructor that are not in _fields or _attributes remains deprecated. - gh-121279: Avoid NameError for the warnings module when accessing the depracated atributes of the importlib.abc module. - gh-121245: Fix a bug in the handling of the command history of the new REPL that caused the history file to be wiped at REPL exit. - gh-87744: Fix waitpid race while calling send_signal() in asyncio. - gh-121018: Fixed other issues where argparse.ArgumentParser did not honor exit_on_error=False. - gh-120678: Fix regression in the new REPL that meant that globals from files passed using the -i argument would not be included in the REPL’s global namespace. - gh-120782: Fix wrong references of the datetime types after reloading the module. - gh-120713: datetime.datetime.strftime() now 0-pads years with less than four digits for the format specifiers %Y and %G on Linux. - gh-117983: Defer the threading import in importlib.util until lazy loading is used. - gh-119189: When using the ** operator or pow() with Fraction as the base and an exponent that is not rational, a float, or a complex, the fraction is no longer converted to a float. - gh-118714: Allow restart in post-mortem debugging of pdb. Removed restart message when the user quits pdb from post-mortem mode. - gh-105623: Fix performance degradation in logging.handlers.RotatingFileHandler. - IDLE - gh-78889: Stop Shell freezes by blocking user access to non-method sys.stdout.shell attributes, which are all private. - Documentation - gh-121749: Fix documentation for PyModule_AddObjectRef(). - gh-120012: Clarify the behaviours of multiprocessing.Queue.empty() and multiprocessing.SimpleQueue.empty() on closed queues. - Core and Builtins - gh-121860: Fix crash when rematerializing a managed dictionary after it was deleted. - gh-121814: Fixed the SegFault when PyEval_SetTrace() is used with no Python frame on stack. - gh-121295: Fix PyREPL console getting into a blocked state after interrupting a long paste - gh-121794: Fix bug in free-threaded Python where a resurrected object could lead to a negative ref count assertion failure. - gh-121657: Improve the SyntaxError message if the user tries to use yield from outside a function. - gh-121609: Fix pasting of characters containing unicode character joiners in the new REPL. Patch by Marta Gomez Macias - gh-117482: Unexpected slot wrappers are no longer created for builtin static types in subinterpreters. - gh-121499: Fix a bug affecting how multi-line history was being rendered in the new REPL after interacting with the new screen cache. Patch by Pablo Galindo - gh-121497: Fix a bug that was preventing the REPL to correctly respect the history when an input hook was set. Patch by Pablo Galindo - gh-121012: Tier 2 execution now ensures that list iterators remain exhausted, once they become exhausted. - gh-121439: Allow tuples of length 20 in the freelist to be reused. - gh-121368: Fix race condition in _PyType_Lookup in the free-threaded build due to a missing memory fence. This could lead to _PyType_Lookup returning incorrect results on arm64. - gh-121130: Fix f-strings with debug expressions in format specifiers. Patch by Pablo Galindo - gh-121115: PyLong_AsNativeBytes() no longer uses __index__() methods by default. The Py_ASNATIVEBYTES_ALLOW_INDEX flag has been added to allow it. - C API - gh-89364: Export the PySignal_SetWakeupFd() function. Previously, the function was documented but it couldn’t be used in 3rd party code. Patch by Victor Stinner. - gh-113993: PyUnicode_InternInPlace() no longer Seprevents its argument from being garbage collected Several functions that take char * are now documented Seas possibly preventing string objects from being Segarbage collected; refer to their documentation Sefor details: PyUnicode_InternFromString(), SePyDict_SetItemString(), PyObject_SetAttrString(), SePyObject_DelAttrString(), PyUnicode_InternFromString(), Seand PyModule_Add* convenience functions - gh-113601: Removed debug build assertions related to interning strings, which were falsely triggered by stable ABI extensions. - gh-112136: Restore the private _PyArg_Parser structure and the private _PyArg_ParseTupleAndKeywordsFast() function, previously removed in Python 3.13 alpha 1. Patch by Victor Stinner. - Build - gh-120371: Support WASI SDK 22 by explicitly skipping functions that are just stubs in wasi-libc. - gh-121731: Fix mimalloc compile error on GNU/Hurd - gh-121487: Fix deprecation warning for ATOMIC_VAR_INIT in mimalloc. - gh-121467: Fix a Makefile bug that prevented mimalloc header files from being installed. - gh-121103: On POSIX systems, excluding macOS framework installs, the lib directory for the free-threaded build now includes a “t” suffix to avoid conflicts with a co-located default build installation. - gh-120831: The default minimum iOS version was increased to 13.0. - gh-113565: Improve curses and curses.panel dependency checks in configure. - Remove %suse_update_desktop_file macro as it is not useful any more. - Update bluez-devel-vendor.tar.xz vendored files. ------------------------------------------------------------------ ------------------ 2024-7-18 - Jul 18 2024 ------------------- ------------------------------------------------------------------ ++++ python311: - Adding bso1227999-reproducible-builds.patch fixing bsc#1227999 adding reproducibility patches from gh#python/cpython!121872 and gh#python/cpython!121883. ++++ python311-core: - Adding bso1227999-reproducible-builds.patch fixing bsc#1227999 adding reproducibility patches from gh#python/cpython!121872 and gh#python/cpython!121883. ------------------------------------------------------------------ ------------------ 2024-7-15 - Jul 15 2024 ------------------- ------------------------------------------------------------------ ++++ python311: - Stop using %%defattr, it seems to be breaking proper executable attributes on /usr/bin/ scripts (bsc#1227378). ++++ python311-core: - Stop using %%defattr, it seems to be breaking proper executable attributes on /usr/bin/ scripts (bsc#1227378). ++++ zypp-plugin: - Fix stomp header regex to include '-' (bsc#1227793) - version 0.6.4 ++++ python313-argcomplete: - Update to 3.4.0 * No stdin for python calls from bash completion functions (#488) - Prevents usage of stdin by (python) executables that are called during completion generation. This prevents the completion locking up the entire shell when the python script is broken i.e. it enters an interactive mode (REPL) instead of generating the completions, as expected. * Localize shell variable REPLY to avoid overwriting users’ value (#489) - The variable REPLY is used by default by the ``read`` shell builtin to store the return value, and like all bash/zsh variables, is scoped globally. This change allows this variable to be used for other needs by appropriately scoping its internal use by an argcomplete utility function that uses ``read``. - Drop patches for issued fixed upstream * bash-repl.patch ------------------------------------------------------------------ ------------------ 2024-7-11 - Jul 11 2024 ------------------- ------------------------------------------------------------------ ++++ python-dnspython: - Add upstream patches to solve CVE-2023-29483: - CVE-2023-29483.patch (bsc#1222693, CVE-2023-29483, gh#rthalley/dnspython#1044) ------------------------------------------------------------------ ------------------ 2024-7-10 - Jul 10 2024 ------------------- ------------------------------------------------------------------ ++++ csp-billing-adapter: - Update to version 1.1.0: * Fix unit file jsc#PED-8482 bsc#1227329 * Support daily billing interval to enable testing on Azure - Update to version 1.0.0: * Switch spec build to python 3.11 ++++ csp-billing-adapter-amazon: - Update to version 1.0.0: * Switch build to python 3.11 ++++ csp-billing-adapter-local: - Update to version 1.0.0: * Switch build to python 3.11 ++++ csp-billing-adapter-microsoft: - Update to version 1.0.0: * Switch build to python 3.11 ++++ python-lxml: - Add libexpat-2.6.0-backport.patch to fix compatibility with system libexpat in tests (bsc#1222075, CVE-2023-52425). ------------------------------------------------------------------ ------------------ 2024-7-9 - Jul 9 2024 ------------------- ------------------------------------------------------------------ ++++ python-zipp: - Add patch CVE-2024-5569.patch from upstream gh#jaraco/zipp@fd604bd34f03 (bsc#1227547, CVE-2024-5569) ------------------------------------------------------------------ ------------------ 2024-7-4 - Jul 4 2024 ------------------- ------------------------------------------------------------------ ++++ python313-core: - Stop using %%defattr, it seems to be breaking proper executable attributes on /usr/bin/ scripts (bsc#1227378). ++++ python313: - Stop using %%defattr, it seems to be breaking proper executable attributes on /usr/bin/ scripts (bsc#1227378). ------------------------------------------------------------------ ------------------ 2024-7-2 - Jul 2 2024 ------------------- ------------------------------------------------------------------ ++++ python311: - Update F00251-change-user-install-location.patch to make pip and modern tools install directly in /usr/local when used by the user. bsc#1225660 ++++ python311-core: - Update F00251-change-user-install-location.patch to make pip and modern tools install directly in /usr/local when used by the user. bsc#1225660 ------------------------------------------------------------------ ------------------ 2024-6-30 - Jun 30 2024 ------------------- ------------------------------------------------------------------ ++++ python313-core: - move pathlib to -base - move _pyrepl to -base (used by pydoc which is in base) - fix import-mapping ++++ python313: - move pathlib to -base - move _pyrepl to -base (used by pydoc which is in base) - fix import-mapping ++++ python313-flit-core: - add py312-avoid-using-utcfromtimestamp.patch, py314-avoid-using-ast-str.patch ++++ python313-pip: - update to 24.1.1: * Actually use system trust stores when the truststore feature is enabled. * Report informative messages about invalid requirements. * Eagerly import the self version check logic to avoid crashes while upgrading or downgrading pip at the same time. * Accommodate for mismatches between different sources of truth for extra names, for packages generated by setuptools. * Accommodate for development versions of CPython ending in + in the version string. * requests provides optional character detection support on some APIs when processing ambiguous bytes. This isn't relevant for pip to function and we're able to remove it due to recent upstream changes. * Drop support for EOL Python 3.7. * Remove support for legacy versions and dependency specifiers. * Packages with non standard-compliant versions or dependency specifiers are now ignored by the resolver. Already installed packages with non standard-compliant versions or dependency specifiers must be uninstalled before upgrading them. * Improve performance of resolution of large dependency trees, with more caching. * Further improve resolution performance of large dependency trees, by caching hash calculations. * Reduce startup time of commands (e.g. show, freeze) that do not access the network by 15-30%. * Reword and improve presentation of uninstallation errors. * Add a 'raw' progress_bar type for simple and parsable download progress reports * pip list no longer performs the pip version check unless - -outdated or --uptodate is given. * Use the data_filter when extracting tarballs, if it's available. * Display the Project-URL value under key "Home-page" in pip show when the Home-Page metadata field is not set. * The Project-URL key detection is case-insensitive, and ignores any dashes and underscores. * Ensure -vv gets passed to any pip install build environment subprocesses. * Deduplicate entries in the Requires field of pip show. * Fix error on checkout for subversion and bazaar with verbose mode on. * Fix exception with completions when COMP_CWORD is not set * Fix intermittent "cannot locate t64.exe" errors when upgrading pip. * Remove duplication in invalid wheel error message * Remove the incorrect pip3.x console entrypoint from the pip wheel. This console script continues to be generated by pip when it installs itself. * Gracefully skip VCS detection in pip freeze when PATH points to a non-directory path. * Make the --proxy parameter take precedence over environment variables. ++++ python313-pipx: - update to 1.6.0: * Add `install-all` command to install packages according to spec metadata file. * Introduce `pipx pin` and `pipx unpin` commands, which can be used to pin or unpin the version * of an installed package, so it will not be upgraded by `pipx upgrade` or `pipx upgrade-all`. * Add a new option `--pinned` to `pipx list` command for listing pinned packages only. * Add `pipx interpreter upgrade` command to upgrade local standalone python in micro/patch level * Add `--requirement` option to `inject` command to read list of packages from a text file. * Add `pipx upgrade-shared` command, to create/upgrade shared libraries as a standalone command. * Allow `upgrade` command to accept multiple packages as arguments. * Support Python version for `--python` arg when py launcher is not available * Make `install-all` gather errors in batch ------------------------------------------------------------------ ------------------ 2024-6-29 - Jun 29 2024 ------------------- ------------------------------------------------------------------ ++++ python313-setuptools: - update to 70.1.1: * Improve error message when pkg_resources.ZipProvider tries to extract resources with a missing Egg Added variables and parameter type annotations to pkg_resources to be nearly on par with typeshed.* * Improve error message when pkg_resources.ZipProvider tries to extract resources with a missing Egg * Added variables and parameter type annotations to pkg_resources to be nearly on par with typeshed.* * Migrated Setuptools' own config to pyproject.toml * Prevent a TypeError: 'NoneType' object is not callable when shutil_rmtree is called without an onexc parameter on Python<=3.11 * Replace use of mktemp with can_symlink from the stdlib test suite. * Improvement for attr: directives in configuration to handle more edge cases related to complex package_dir. * Fix accidental implicit string concatenation. ------------------------------------------------------------------ ------------------ 2024-6-28 - Jun 28 2024 ------------------- ------------------------------------------------------------------ ++++ python313-core: - Update to 3.13.0~b2: * Core and Builtins - gh-119462: Make sure that invariants of type versioning are maintained: * Superclasses always have their version number assigned before subclasses * The version tag is always zero if the tag is not valid. * The version tag is always non-zero if the tag is valid. - gh-120437: Fix _CHECK_STACK_SPACE optimization problems introduced in gh-118322. - gh-120722: Correctly set the bytecode position on return instructions within lambdas. Patch by Jelle Zijlstra. - gh-120367: Fix bug where compiler creates a redundant jump during pseudo-op replacement. Can only happen with a synthetic AST that has a try on the same line as the instruction following the exception handler. - gh-113993: Strings interned with sys.intern() are again garbage-collected when no longer used, as per the documentation. Strings interned with the C function PyUnicode_InternInPlace() are still immortal. Internals of the string interning mechanism have been changed. This may affect performance and identities of str objects. - gh-120384: Fix an array out of bounds crash in list_ass_subscript, which could be invoked via some specificly tailored input: including concurrent modification of a list object, where one thread assigns a slice and another clears it. - gh-120367: Fix crash in compiler on code with redundant NOPs and JUMPs which show up after exception handlers are moved to the end of the code. - gh-120400: Support Linux perf profiler to see Python calls on RISC-V architecture. - gh-120221: Deliver real signals on Ctrl-C and Ctrl-Z in the new REPL. Patch by Pablo Galindo - gh-120346: Respect PYTHON_BASIC_REPL when running in interative inspect mode (python -i). Patch by Pablo Galindo - gh-93691: Fix source locations of instructions generated for the iterator of a for statement. - gh-120198: Fix a crash when multiple threads read and write to the same __class__ of an object concurrently. - gh-120298: Fix use-after free in list_richcompare_impl which can be invoked via some specificly tailored evil input. - gh-119666: Fix a compiler crash in the case where two comprehensions in class scope both reference __class__. - gh-120225: Fix crash in compiler on empty block at end of exception handler. - gh-119933: Improve SyntaxError messages for invalid expressions in a type parameters bound, a type parameter constraint tuple or a default type parameter. Patch by Bénédikt Tran - bpo-24766: Fix handling of doc argument to subclasses of property * Library - gh-119614: Fix truncation of strings with embedded null characters in some internal operations in tkinter. - gh-120910: When reading installed files from an egg, use relative_to(walk_up=True) to honor files installed outside of the installation root. - gh-101830: Accessing the tkinter object’s string representation no longer converts the underlying Tcl object to a string on Windows. - gh-120811: Fix possible memory leak in contextvars.Context.run(). - gh-120769: Make empty line in pdb repeats the last command even when the command is from cmdqueue. - gh-120732: Fix name passing to unittest.mock.Mock object when using unittest.mock.create_autospec(). - gh-120683: Fix an error in logging.LogRecord, when the integer part of the timestamp is rounded up, while the millisecond calculation truncates, causing the log timestamp to be wrong by up to 999 ms (affected roughly 1 in 8 million timestamps). - gh-120633: Move scrollbar and remove tear-off menus in turtledemo. - gh-120541: Improve the prompt in the “less” pager when help() is called with non-string argument. - gh-120495: Fix incorrect exception handling in Tab Nanny. Patch by Wulian233. - gh-120381: Correct inspect.ismethoddescriptor() to check also for the lack of __delete__(). Patch by Jan Kaliszewski. - gh-90425: The OS byte in gzip headers is now always set to 255 when using gzip.compress(). - gh-120343: Fix column offset reporting for tokens that come after multiline f-strings in the tokenize module. - gh-119600: Fix unittest.mock.patch() to not read attributes of the target when new_callable is set. Patch by Robert Collins. - gh-114053: Fix erroneous NameError when calling inspect.get_annotations() with eval_str=True` on a class that made use of PEP 695 type parameters in a module that had from __future__ import annotations at the top of the file. Patch by Alex Waygood. - gh-120268: Prohibit passing None to pure-Python datetime.date.fromtimestamp() to achieve consistency with C-extension implementation. - gh-120244: Fix memory leak in re.sub() when the replacement string contains backreferences. - gh-120211: Fix tkinter.ttk with Tcl/Tk 9.0. - gh-71587: Fix crash in C version of datetime.datetime.strptime() when called again on the restarted interpreter. - gh-120161: datetime no longer crashes in certain complex reference cycle situations. - gh-119698: Fix symtable.Class.get_methods() and document its behaviour. Patch by Bénédikt Tran. - gh-120121: Add concurrent.futures.InvalidStateError to module’s __all__. - gh-119933: Add the symtable.SymbolTableType enumeration to represent the possible outputs of the symtable.SymbolTable.get_type method. Patch by Bénédikt Tran. - gh-120108: Fix calling copy.deepcopy() on ast trees that have been modified to have references to parent nodes. Patch by Jelle Zijlstra. - gh-112672: Support building tkinter with Tcl 9.0. - gh-65454: unittest.mock.Mock.attach_mock() no longer triggers a call to a PropertyMock being attached. - gh-81936: help() and showtopic() methods now respect a configured output argument to pydoc.Helper and not use the pager in such cases. Patch by Enrico Tröger. - gh-119577: The DeprecationWarning emitted when testing the truth value of an xml.etree.ElementTree.Element now describes unconditionally returning True in a future version rather than raising an exception in Python 3.14. - gh-118908: Limit exposed globals from internal imports and definitions on new REPL startup. Patch by Eugene Triguba and Pablo Galindo. - gh-119506: Fix io.TextIOWrapper.write() method breaks internal buffer when the method is called again during flushing internal buffer. * Build - gh-120671: Fix failing configure tests due to a missing space when appending to CFLAGS. - gh-120602: Correctly handle LLVM installs with LLVM_VERSION_SUFFIX when building with - -enable-experimental-jit. - gh-120326: On Windows, fix build error when --disable-gil and --experimental-jit options are combined. - gh-120291: Make the python-config shell script compatible with non-bash shells. * C API - gh-120858: PyDict_Next() no longer locks the dictionary in the free-threaded build. The locking needs to be done by the caller around the entire iteration loop. - gh-119344: The critical section API is now public as part of the non-limited C API. - gh-118789: Add PyUnstable_Object_ClearWeakRefsNoCallbacks(), which clears weakrefs without calling their callbacks. - gh-117511: Make the PyMutex public in the non-limited C API. - Readjust patches: - F00251-change-user-install-location.patch - bpo-31046_ensurepip_honours_prefix.patch - fix_configure_rst.patch - python-3.3.0b1-fix_date_time_compiler.patch - subprocess-raise-timeout.patch ++++ python313: - Update to 3.13.0~b2: * Core and Builtins - gh-119462: Make sure that invariants of type versioning are maintained: * Superclasses always have their version number assigned before subclasses * The version tag is always zero if the tag is not valid. * The version tag is always non-zero if the tag is valid. - gh-120437: Fix _CHECK_STACK_SPACE optimization problems introduced in gh-118322. - gh-120722: Correctly set the bytecode position on return instructions within lambdas. Patch by Jelle Zijlstra. - gh-120367: Fix bug where compiler creates a redundant jump during pseudo-op replacement. Can only happen with a synthetic AST that has a try on the same line as the instruction following the exception handler. - gh-113993: Strings interned with sys.intern() are again garbage-collected when no longer used, as per the documentation. Strings interned with the C function PyUnicode_InternInPlace() are still immortal. Internals of the string interning mechanism have been changed. This may affect performance and identities of str objects. - gh-120384: Fix an array out of bounds crash in list_ass_subscript, which could be invoked via some specificly tailored input: including concurrent modification of a list object, where one thread assigns a slice and another clears it. - gh-120367: Fix crash in compiler on code with redundant NOPs and JUMPs which show up after exception handlers are moved to the end of the code. - gh-120400: Support Linux perf profiler to see Python calls on RISC-V architecture. - gh-120221: Deliver real signals on Ctrl-C and Ctrl-Z in the new REPL. Patch by Pablo Galindo - gh-120346: Respect PYTHON_BASIC_REPL when running in interative inspect mode (python -i). Patch by Pablo Galindo - gh-93691: Fix source locations of instructions generated for the iterator of a for statement. - gh-120198: Fix a crash when multiple threads read and write to the same __class__ of an object concurrently. - gh-120298: Fix use-after free in list_richcompare_impl which can be invoked via some specificly tailored evil input. - gh-119666: Fix a compiler crash in the case where two comprehensions in class scope both reference __class__. - gh-120225: Fix crash in compiler on empty block at end of exception handler. - gh-119933: Improve SyntaxError messages for invalid expressions in a type parameters bound, a type parameter constraint tuple or a default type parameter. Patch by Bénédikt Tran - bpo-24766: Fix handling of doc argument to subclasses of property * Library - gh-119614: Fix truncation of strings with embedded null characters in some internal operations in tkinter. - gh-120910: When reading installed files from an egg, use relative_to(walk_up=True) to honor files installed outside of the installation root. - gh-101830: Accessing the tkinter object’s string representation no longer converts the underlying Tcl object to a string on Windows. - gh-120811: Fix possible memory leak in contextvars.Context.run(). - gh-120769: Make empty line in pdb repeats the last command even when the command is from cmdqueue. - gh-120732: Fix name passing to unittest.mock.Mock object when using unittest.mock.create_autospec(). - gh-120683: Fix an error in logging.LogRecord, when the integer part of the timestamp is rounded up, while the millisecond calculation truncates, causing the log timestamp to be wrong by up to 999 ms (affected roughly 1 in 8 million timestamps). - gh-120633: Move scrollbar and remove tear-off menus in turtledemo. - gh-120541: Improve the prompt in the “less” pager when help() is called with non-string argument. - gh-120495: Fix incorrect exception handling in Tab Nanny. Patch by Wulian233. - gh-120381: Correct inspect.ismethoddescriptor() to check also for the lack of __delete__(). Patch by Jan Kaliszewski. - gh-90425: The OS byte in gzip headers is now always set to 255 when using gzip.compress(). - gh-120343: Fix column offset reporting for tokens that come after multiline f-strings in the tokenize module. - gh-119600: Fix unittest.mock.patch() to not read attributes of the target when new_callable is set. Patch by Robert Collins. - gh-114053: Fix erroneous NameError when calling inspect.get_annotations() with eval_str=True` on a class that made use of PEP 695 type parameters in a module that had from __future__ import annotations at the top of the file. Patch by Alex Waygood. - gh-120268: Prohibit passing None to pure-Python datetime.date.fromtimestamp() to achieve consistency with C-extension implementation. - gh-120244: Fix memory leak in re.sub() when the replacement string contains backreferences. - gh-120211: Fix tkinter.ttk with Tcl/Tk 9.0. - gh-71587: Fix crash in C version of datetime.datetime.strptime() when called again on the restarted interpreter. - gh-120161: datetime no longer crashes in certain complex reference cycle situations. - gh-119698: Fix symtable.Class.get_methods() and document its behaviour. Patch by Bénédikt Tran. - gh-120121: Add concurrent.futures.InvalidStateError to module’s __all__. - gh-119933: Add the symtable.SymbolTableType enumeration to represent the possible outputs of the symtable.SymbolTable.get_type method. Patch by Bénédikt Tran. - gh-120108: Fix calling copy.deepcopy() on ast trees that have been modified to have references to parent nodes. Patch by Jelle Zijlstra. - gh-112672: Support building tkinter with Tcl 9.0. - gh-65454: unittest.mock.Mock.attach_mock() no longer triggers a call to a PropertyMock being attached. - gh-81936: help() and showtopic() methods now respect a configured output argument to pydoc.Helper and not use the pager in such cases. Patch by Enrico Tröger. - gh-119577: The DeprecationWarning emitted when testing the truth value of an xml.etree.ElementTree.Element now describes unconditionally returning True in a future version rather than raising an exception in Python 3.14. - gh-118908: Limit exposed globals from internal imports and definitions on new REPL startup. Patch by Eugene Triguba and Pablo Galindo. - gh-119506: Fix io.TextIOWrapper.write() method breaks internal buffer when the method is called again during flushing internal buffer. * Build - gh-120671: Fix failing configure tests due to a missing space when appending to CFLAGS. - gh-120602: Correctly handle LLVM installs with LLVM_VERSION_SUFFIX when building with - -enable-experimental-jit. - gh-120326: On Windows, fix build error when --disable-gil and --experimental-jit options are combined. - gh-120291: Make the python-config shell script compatible with non-bash shells. * C API - gh-120858: PyDict_Next() no longer locks the dictionary in the free-threaded build. The locking needs to be done by the caller around the entire iteration loop. - gh-119344: The critical section API is now public as part of the non-limited C API. - gh-118789: Add PyUnstable_Object_ClearWeakRefsNoCallbacks(), which clears weakrefs without calling their callbacks. - gh-117511: Make the PyMutex public in the non-limited C API. - Readjust patches: - F00251-change-user-install-location.patch - bpo-31046_ensurepip_honours_prefix.patch - fix_configure_rst.patch - python-3.3.0b1-fix_date_time_compiler.patch - subprocess-raise-timeout.patch ------------------------------------------------------------------ ------------------ 2024-6-25 - Jun 25 2024 ------------------- ------------------------------------------------------------------ ++++ python311: - Add CVE-2024-4032-private-IP-addrs.patch to fix bsc#1226448 (CVE-2024-4032) rearranging definition of private v global IP addresses. ++++ python311-core: - Add CVE-2024-4032-private-IP-addrs.patch to fix bsc#1226448 (CVE-2024-4032) rearranging definition of private v global IP addresses. ------------------------------------------------------------------ ------------------ 2024-6-22 - Jun 22 2024 ------------------- ------------------------------------------------------------------ ++++ python313-hatchling: - update to version 1.25.0: * Changed: + The macos-max-compat option for the wheel target is now disabled by default and will be removed in a future release * Added: + Artifacts for the wheel and sdist targets now have their permission bits normalized * Fixed: + Ignore manylinux/musllinux tags for the wheel target artifact name when enabling the infer_tag build data + The wheel target build data infer_tag when enabled now respects the MACOSX_DEPLOYMENT_TARGET environment variable ------------------------------------------------------------------ ------------------ 2024-6-20 - Jun 20 2024 ------------------- ------------------------------------------------------------------ ++++ python313-packaging: - update to 24.1: * No unreleased changes. ------------------------------------------------------------------ ------------------ 2024-6-19 - Jun 19 2024 ------------------- ------------------------------------------------------------------ ++++ python-cryptography: - Add CVE-2024-26130.patch to fix NULL pointer dereference in pkcs12.serialize_key_and_certificates() bsc#1220210, gh#pyca/cryptography@97d231672763 ------------------------------------------------------------------ ------------------ 2024-6-18 - Jun 18 2024 ------------------- ------------------------------------------------------------------ ++++ python-urllib3: - Add CVE-2024-37891.patch (bsc#1226469) - Add upstream patch openssl-3.2.patch, to fix tests with opennssl 3.2.0, gh#urllib3/urllib3#3271 ------------------------------------------------------------------ ------------------ 2024-6-12 - Jun 12 2024 ------------------- ------------------------------------------------------------------ ++++ libxml2-python: - Update to version 2.12.8: + parser: Fix performance regression when parsing namespaces. ------------------------------------------------------------------ ------------------ 2024-6-10 - Jun 10 2024 ------------------- ------------------------------------------------------------------ ++++ python-Authlib: - Update to 1.3.1 (CVE-2024-37568, bsc#1226138): * Prevent OctKey to import ssh and PEM strings. ------------------------------------------------------------------ ------------------ 2024-6-6 - Jun 6 2024 ------------------- ------------------------------------------------------------------ ++++ python313-core: - Build experimental package python313-base-nogil with - -disable-gil option. - Fix doc package build gh#python/cpython#120150 - Update to 3.13.0b2: - Security - gh-118773: Fixes creation of ACLs in os.mkdir() on Windows to work correctly on non-English machines. - gh-118486: os.mkdir() on Windows now accepts mode of 0o700 to restrict the new directory to the current user. This fixes CVE-2024-4030 affecting tempfile.mkdtemp() in scenarios where the base temporary directory is more permissive than the default. - Core and Builtins - gh-119724: Reverted improvements to error messages for elif/else statements not matching any valid statements, which made in hard to locate the syntax errors inside those elif/else blocks. - gh-119842: Honor PyOS_InputHook() in the new REPL. Patch by Pablo Galindo - gh-119821: Fix execution of annotation scopes within classes when globals is set to a non-dict. Patch by Jelle Zijlstra. - gh-119548: Add a clear command to the REPL. Patch by Pablo Galindo - gh-111999: Fix the signature of str.format_map(). - gh-119560: An invalid assert in beta 1 has been removed. The assert would fail if PyState_FindModule() was used in an extension module’s init function before the module def had been initialized. - gh-119369: Fix deadlock during thread deletion in free-threaded build, which could occur when the GIL was enabled at runtime. - gh-119525: Fix deadlock involving _PyType_Lookup() cache in the free-threaded build when the GIL is dynamically enabled at runtime. - gh-119311: Fix bug where names are unexpectedly mangled in the bases of generic classes. - gh-119395: Fix bug where names appearing after a generic class are mangled as if they are in the generic class. - gh-119213: Non-builtin modules built with argument clinic were crashing if used in a subinterpreter before the main interpreter. The objects that were causing the problem by leaking between interpreters carelessly have been fixed. - gh-119011: Fixes type.__type_params__ to return an empty tuple instead of a descriptor. - gh-118692: Avoid creating unnecessary StopIteration instances for monitoring. - gh-119049: Fix displaying the source line for warnings created by the C API if the warnings module had not yet been imported. - gh-118844: Fix build failures when configuring with both - -disable-gil and --enable-experimental-jit. - gh-118921: Add copy() method for FrameLocalsProxy which returns a snapshot dict for local variables. - gh-117657: Fix data races on the field that stores a pointer to the interpreter’s main thread that occur in free-threaded builds. - gh-118507: Speedup os.path.isjunction() and os.path.lexists() on Windows with a native implementation. - gh-118561: Fix race condition in free-threaded build where list.extend() could expose uninitialised memory to concurrent readers. - gh-118263: Speed up os.path.splitroot() & os.path.normpath() with a direct C call. - gh-117195: Avoid assertion failure for debug builds when calling object.__sizeof__(1) - Library - gh-119819: Fix regression to allow logging configuration with multiprocessing queue types. - gh-117142: The ctypes module may now be imported in all subinterpreters, including those that have their own GIL. - gh-118835: Fix _pyrepl crash when using custom prompt with ANSI escape codes. - gh-117398: The _datetime module (C implementation for datetime) now supports being imported in multiple interpreters. - gh-89727: Fix issue with shutil.rmtree() where a RecursionError is raised on deep directory trees. - gh-89727: Partially fix issue with shutil.rmtree() where a RecursionError is raised on deep directory trees. A recursion error is no longer raised when rmtree.avoids_symlink_attacks is false. - gh-119118: Fix performance regression in the tokenize module by caching the line token attribute and calculating the column offset more efficiently. - gh-89727: Fix issue with os.fwalk() where a RecursionError was raised on deep directory trees by adjusting the implementation to be iterative instead of recursive. - gh-119588: zipfile.Path.is_symlink now assesses if the given path is a symlink. - gh-119555: Catch SyntaxError from compile() in the runsource() method of the InteractiveColoredConsole. Patch by Sergey B Kirpichev. - gh-113892: Now, the method sock_connect of asyncio.ProactorEventLoop raises a ValueError if given socket is not in non-blocking mode, as well as in other loop implementations. - gh-119443: The interactive REPL no longer runs with from __future__ import annotations enabled. Patch by Jelle Zijlstra. - gh-117398: Objects in the datetime C-API are now all statically allocated, which means better memory safety, especially when the module is reloaded. This should be transparent to users. - gh-118894: asyncio REPL now has the same capabilities as PyREPL. - gh-118911: In PyREPL, updated maybe-accept’s logic so that if the user hits Enter twice, they are able to terminate the block even if there’s trailing whitespace. Also, now when the user hits arrow up, the cursor is on the last functional line. This matches IPython’s behavior. Patch by Aya Elsayed. - gh-111201: Remove dependency to readline from the new Python REPL. - gh-119174: Fix high DPI causes turtledemo(turtle-graphics examples) windows blurry Patch by Wulian233 and Terry Jan Reedy - gh-119121: Fix a NameError happening in asyncio.staggered.staggered_race. This function is now tested. - gh-119113: Fix issue where pathlib.PurePath.with_suffix() didn’t raise TypeError when given None as a suffix. - gh-118643: Fix an AttributeError in the email module when re-fold a long address list. Also fix more cases of incorrect encoding of the address separator in the address list. - gh-58933: Make pdb return to caller frame correctly when f_trace of the caller frame is not set - gh-118895: Setting attributes on typing.NoDefault now raises AttributeError instead of TypeError. - gh-118868: Fixed issue where kwargs were no longer passed to the logging handler QueueHandler - gh-118851: ctx arguments to the constructors of ast node classes now default to ast.Load(). Patch by Jelle Zijlstra. - gh-118760: Restore the default value of tkiter.wantobjects to 1. - gh-118760: Fix errors in calling Tkinter bindings on Windows. - gh-118772: Allow typing.TypeVar instances without a default to follow instances without a default in some cases. Patch by Jelle Zijlstra. - gh-110863: os.path.realpath() now suppresses any OSError from os.readlink() when strict mode is disabled (the default). - gh-118033: Fix dataclasses.dataclass() not creating a __weakref__ slot when subclassing typing.Generic. - gh-106531: In importlib.resources, sync with importlib_resources 6.3.2, including: MultiplexedPath now expects Traversable paths, deprecating string arguments to MultiplexedPath; Enabled support for resources in namespace packages in zip files; Fixed NotADirectoryError when calling files on a subdirectory of a namespace package. - gh-113978: Ignore warnings on text completion inside REPL. - gh-103956: Fix lack of newline characters in trace module output when line tracing is enabled but source code line for current frame is not available. - gh-92081: Fix missing spaces in email headers when the spaces are mixed with encoded 8-bit characters. - gh-103194: Prepare Tkinter for C API changes in Tcl 8.7/9.0 to avoid _tkinter.Tcl_Obj being unexpectedly returned instead of bool, str, bytearray, or int. - gh-87106: Fixed handling in inspect.Signature.bind() of keyword arguments having the same name as positional-only arguments when a variadic keyword argument (e.g. **kwargs) is present. - bpo-45767: Fix integer conversion in os.major(), os.minor(), and os.makedev(). Support device numbers larger than 2**63-1. Support non-existent device number (NODEV). - gh-67693: Fix urllib.parse.urlunparse() and urllib.parse.urlunsplit() for URIs with path starting with multiple slashes and no authority. Based on patch by Ashwin Ramaswami. - Tests - gh-119050: regrtest test runner: Add XML support to the refleak checker (-R option). Patch by Victor Stinner. Buil- d - gh-119729: On POSIX systems, the pkg-config (.pc) filenames now include the ABI flags, which may include debug (“d”) and free-threaded (“t”). For example: * python-3.14.pc (default, non-debug build) * python-3.14d.pc (default, debug build) * python-3.14t.pc (free-threaded build) - gh-115119: Fall back to the bundled libmpdec if a system version cannot be found. - gh-119132: Update sys.version to identify whether the build is default build or free-threading build. Patch By Donghee Na. - gh-118836: Fix an AssertionError when building with - -enable-experimental-jit and the compiler emits a SHT_NOTE section. - gh-118943: Fix a possible race condition affecting parallel builds configured with --enable-experimental-jit, in which compilation errors could be caused by an incompletely-generated header file. - Windows - gh-119679: Ensures correct import libraries are included in Windows installs. - gh-119690: Adds Unicode support and fixes audit events for _winapi.CreateNamedPipe. - gh-111201: Add support for new pyrepl on Windows - gh-119070: Fixes py.exe handling of shebangs like /usr/bin/env python3.12, which were previously interpreted as python3.exe instead of python3.12.exe. - gh-117505: Fixes an issue with the Windows installer not running ensurepip in a fully isolated environment. This could cause unexpected interactions with the user site-packages. - gh-118209: Avoid crashing in mmap on Windows when the mapped memory is inaccessible due to file system errors or access violations. - gh-116145: Updated bundled Tcl/Tk to 8.6.14. - C API - gh-119585: Fix crash when a thread state that was created by PyGILState_Ensure() calls a destructor that during PyThreadState_Clear() that calls back into PyGILState_Ensure() and PyGILState_Release(). This might occur when in the free-threaded build or when using thread-local variables whose destructors call PyGILState_Ensure(). - gh-119336: Restore the removed _PyLong_NumBits() function. It is used by the pywin32 project. Patch by Ethan Smith - gh-119247: Added Py_BEGIN_CRITICAL_SECTION_SEQUENCE_FAST and Py_END_CRITICAL_SECTION_SEQUENCE_FAST macros to make it possible to use PySequence_Fast APIs safely when free-threaded, and update str.join to work without the GIL using them. - gh-111389: Add PyHASH_MULTIPLIER constant: prime multiplier used in string and various other hashes. Patch by Victor Stinner. - gh-116984: Make mimalloc includes relative to the current file to avoid embedders or extensions needing to include Internal/mimalloc if they are already including internal CPython headers. - gh-118789: Restore _PyWeakref_ClearRef that was previously removed in Python 3.13 alpha 1. ++++ python313: - Build experimental package python313-base-nogil with - -disable-gil option. - Fix doc package build gh#python/cpython#120150 - Update to 3.13.0b2: - Security - gh-118773: Fixes creation of ACLs in os.mkdir() on Windows to work correctly on non-English machines. - gh-118486: os.mkdir() on Windows now accepts mode of 0o700 to restrict the new directory to the current user. This fixes CVE-2024-4030 affecting tempfile.mkdtemp() in scenarios where the base temporary directory is more permissive than the default. - Core and Builtins - gh-119724: Reverted improvements to error messages for elif/else statements not matching any valid statements, which made in hard to locate the syntax errors inside those elif/else blocks. - gh-119842: Honor PyOS_InputHook() in the new REPL. Patch by Pablo Galindo - gh-119821: Fix execution of annotation scopes within classes when globals is set to a non-dict. Patch by Jelle Zijlstra. - gh-119548: Add a clear command to the REPL. Patch by Pablo Galindo - gh-111999: Fix the signature of str.format_map(). - gh-119560: An invalid assert in beta 1 has been removed. The assert would fail if PyState_FindModule() was used in an extension module’s init function before the module def had been initialized. - gh-119369: Fix deadlock during thread deletion in free-threaded build, which could occur when the GIL was enabled at runtime. - gh-119525: Fix deadlock involving _PyType_Lookup() cache in the free-threaded build when the GIL is dynamically enabled at runtime. - gh-119311: Fix bug where names are unexpectedly mangled in the bases of generic classes. - gh-119395: Fix bug where names appearing after a generic class are mangled as if they are in the generic class. - gh-119213: Non-builtin modules built with argument clinic were crashing if used in a subinterpreter before the main interpreter. The objects that were causing the problem by leaking between interpreters carelessly have been fixed. - gh-119011: Fixes type.__type_params__ to return an empty tuple instead of a descriptor. - gh-118692: Avoid creating unnecessary StopIteration instances for monitoring. - gh-119049: Fix displaying the source line for warnings created by the C API if the warnings module had not yet been imported. - gh-118844: Fix build failures when configuring with both - -disable-gil and --enable-experimental-jit. - gh-118921: Add copy() method for FrameLocalsProxy which returns a snapshot dict for local variables. - gh-117657: Fix data races on the field that stores a pointer to the interpreter’s main thread that occur in free-threaded builds. - gh-118507: Speedup os.path.isjunction() and os.path.lexists() on Windows with a native implementation. - gh-118561: Fix race condition in free-threaded build where list.extend() could expose uninitialised memory to concurrent readers. - gh-118263: Speed up os.path.splitroot() & os.path.normpath() with a direct C call. - gh-117195: Avoid assertion failure for debug builds when calling object.__sizeof__(1) - Library - gh-119819: Fix regression to allow logging configuration with multiprocessing queue types. - gh-117142: The ctypes module may now be imported in all subinterpreters, including those that have their own GIL. - gh-118835: Fix _pyrepl crash when using custom prompt with ANSI escape codes. - gh-117398: The _datetime module (C implementation for datetime) now supports being imported in multiple interpreters. - gh-89727: Fix issue with shutil.rmtree() where a RecursionError is raised on deep directory trees. - gh-89727: Partially fix issue with shutil.rmtree() where a RecursionError is raised on deep directory trees. A recursion error is no longer raised when rmtree.avoids_symlink_attacks is false. - gh-119118: Fix performance regression in the tokenize module by caching the line token attribute and calculating the column offset more efficiently. - gh-89727: Fix issue with os.fwalk() where a RecursionError was raised on deep directory trees by adjusting the implementation to be iterative instead of recursive. - gh-119588: zipfile.Path.is_symlink now assesses if the given path is a symlink. - gh-119555: Catch SyntaxError from compile() in the runsource() method of the InteractiveColoredConsole. Patch by Sergey B Kirpichev. - gh-113892: Now, the method sock_connect of asyncio.ProactorEventLoop raises a ValueError if given socket is not in non-blocking mode, as well as in other loop implementations. - gh-119443: The interactive REPL no longer runs with from __future__ import annotations enabled. Patch by Jelle Zijlstra. - gh-117398: Objects in the datetime C-API are now all statically allocated, which means better memory safety, especially when the module is reloaded. This should be transparent to users. - gh-118894: asyncio REPL now has the same capabilities as PyREPL. - gh-118911: In PyREPL, updated maybe-accept’s logic so that if the user hits Enter twice, they are able to terminate the block even if there’s trailing whitespace. Also, now when the user hits arrow up, the cursor is on the last functional line. This matches IPython’s behavior. Patch by Aya Elsayed. - gh-111201: Remove dependency to readline from the new Python REPL. - gh-119174: Fix high DPI causes turtledemo(turtle-graphics examples) windows blurry Patch by Wulian233 and Terry Jan Reedy - gh-119121: Fix a NameError happening in asyncio.staggered.staggered_race. This function is now tested. - gh-119113: Fix issue where pathlib.PurePath.with_suffix() didn’t raise TypeError when given None as a suffix. - gh-118643: Fix an AttributeError in the email module when re-fold a long address list. Also fix more cases of incorrect encoding of the address separator in the address list. - gh-58933: Make pdb return to caller frame correctly when f_trace of the caller frame is not set - gh-118895: Setting attributes on typing.NoDefault now raises AttributeError instead of TypeError. - gh-118868: Fixed issue where kwargs were no longer passed to the logging handler QueueHandler - gh-118851: ctx arguments to the constructors of ast node classes now default to ast.Load(). Patch by Jelle Zijlstra. - gh-118760: Restore the default value of tkiter.wantobjects to 1. - gh-118760: Fix errors in calling Tkinter bindings on Windows. - gh-118772: Allow typing.TypeVar instances without a default to follow instances without a default in some cases. Patch by Jelle Zijlstra. - gh-110863: os.path.realpath() now suppresses any OSError from os.readlink() when strict mode is disabled (the default). - gh-118033: Fix dataclasses.dataclass() not creating a __weakref__ slot when subclassing typing.Generic. - gh-106531: In importlib.resources, sync with importlib_resources 6.3.2, including: MultiplexedPath now expects Traversable paths, deprecating string arguments to MultiplexedPath; Enabled support for resources in namespace packages in zip files; Fixed NotADirectoryError when calling files on a subdirectory of a namespace package. - gh-113978: Ignore warnings on text completion inside REPL. - gh-103956: Fix lack of newline characters in trace module output when line tracing is enabled but source code line for current frame is not available. - gh-92081: Fix missing spaces in email headers when the spaces are mixed with encoded 8-bit characters. - gh-103194: Prepare Tkinter for C API changes in Tcl 8.7/9.0 to avoid _tkinter.Tcl_Obj being unexpectedly returned instead of bool, str, bytearray, or int. - gh-87106: Fixed handling in inspect.Signature.bind() of keyword arguments having the same name as positional-only arguments when a variadic keyword argument (e.g. **kwargs) is present. - bpo-45767: Fix integer conversion in os.major(), os.minor(), and os.makedev(). Support device numbers larger than 2**63-1. Support non-existent device number (NODEV). - gh-67693: Fix urllib.parse.urlunparse() and urllib.parse.urlunsplit() for URIs with path starting with multiple slashes and no authority. Based on patch by Ashwin Ramaswami. - Tests - gh-119050: regrtest test runner: Add XML support to the refleak checker (-R option). Patch by Victor Stinner. Buil- d - gh-119729: On POSIX systems, the pkg-config (.pc) filenames now include the ABI flags, which may include debug (“d”) and free-threaded (“t”). For example: * python-3.14.pc (default, non-debug build) * python-3.14d.pc (default, debug build) * python-3.14t.pc (free-threaded build) - gh-115119: Fall back to the bundled libmpdec if a system version cannot be found. - gh-119132: Update sys.version to identify whether the build is default build or free-threading build. Patch By Donghee Na. - gh-118836: Fix an AssertionError when building with - -enable-experimental-jit and the compiler emits a SHT_NOTE section. - gh-118943: Fix a possible race condition affecting parallel builds configured with --enable-experimental-jit, in which compilation errors could be caused by an incompletely-generated header file. - Windows - gh-119679: Ensures correct import libraries are included in Windows installs. - gh-119690: Adds Unicode support and fixes audit events for _winapi.CreateNamedPipe. - gh-111201: Add support for new pyrepl on Windows - gh-119070: Fixes py.exe handling of shebangs like /usr/bin/env python3.12, which were previously interpreted as python3.exe instead of python3.12.exe. - gh-117505: Fixes an issue with the Windows installer not running ensurepip in a fully isolated environment. This could cause unexpected interactions with the user site-packages. - gh-118209: Avoid crashing in mmap on Windows when the mapped memory is inaccessible due to file system errors or access violations. - gh-116145: Updated bundled Tcl/Tk to 8.6.14. - C API - gh-119585: Fix crash when a thread state that was created by PyGILState_Ensure() calls a destructor that during PyThreadState_Clear() that calls back into PyGILState_Ensure() and PyGILState_Release(). This might occur when in the free-threaded build or when using thread-local variables whose destructors call PyGILState_Ensure(). - gh-119336: Restore the removed _PyLong_NumBits() function. It is used by the pywin32 project. Patch by Ethan Smith - gh-119247: Added Py_BEGIN_CRITICAL_SECTION_SEQUENCE_FAST and Py_END_CRITICAL_SECTION_SEQUENCE_FAST macros to make it possible to use PySequence_Fast APIs safely when free-threaded, and update str.join to work without the GIL using them. - gh-111389: Add PyHASH_MULTIPLIER constant: prime multiplier used in string and various other hashes. Patch by Victor Stinner. - gh-116984: Make mimalloc includes relative to the current file to avoid embedders or extensions needing to include Internal/mimalloc if they are already including internal CPython headers. - gh-118789: Restore _PyWeakref_ClearRef that was previously removed in Python 3.13 alpha 1. ------------------------------------------------------------------ ------------------ 2024-6-5 - Jun 5 2024 ------------------- ------------------------------------------------------------------ ++++ python-docker: - Add CVE-2024-35195.patch (bsc#1224788) * fix failure with updated python-requests ------------------------------------------------------------------ ------------------ 2024-6-4 - Jun 4 2024 ------------------- ------------------------------------------------------------------ ++++ python-Brotli: - Fix CVE-2020-8927, decoder: integer overflow when input chunk is larger than 2GiB. (CVE-2020-8927, bsc#1175825) * fix-cve-2020-8927.patch ++++ python313-platformdirs: - update to 4.2.2: * Fix android detection when python4android is present ------------------------------------------------------------------ ------------------ 2024-5-28 - May 28 2024 ------------------- ------------------------------------------------------------------ ++++ python313-setuptools: - Update to 70.0.0: * Features + Emit a warning when [tools.setuptools] is present in pyproject.toml and will be ignored. + Improved AttributeError error message if pkg_resources.EntryPoint.require is called without extras or distribution Gracefully "do nothing" when trying to activate a pkg_resources.Distribution with a None location, rather than raising a TypeError. + Refresh unpinned vendored dependencies. + Updated vendored packaging to version 24.0. + Merged with pypa/distutils@55982565e. + Support PEP 625 by canonicalizing package name and version in filenames. + Explicitly use encoding="locale" for .pth files whenever possible, to reduce EncodingWarnings. + Updated and removed obsolete Python < 3.8 code and comments. + Updated pkg_resources to use stdlib importlib.machinery instead of importlib_machinery. + Modernized and refactored VCS handling in package_index. (bsc#1228105, CVE-2024-6345) * Bugfixes + In install command, use super to call the superclass methods. Avoids race conditions when monkeypatching from _distutils_system_mod occurs late. + Fix finder template for lenient editable installs of implicit nested namespaces constructed by using package_dir to reorganise directory structure. + Remove attempt to canonicalize the version. It's already canonical enough. + Clarify some pkg_resources methods return bytes, not str. Also return an empty bytes in EmptyProvider._get. + Return an empty list by default in pkg_resources.ResourceManager.cleanup_resources. + Made pkg_resoursces.NullProvider's has_metadata and metadata_isdir methods return actual booleans like all other Providers. + In tests, rely on pytest-home for reusable fixture. + Explicitely marked as Protocol and fixed missing self argument in interfaces pkg_resources.IMetadataProvider and pkg_resources.IResourceProvider. + Restored expectation that egg-link files would be named with dash separators for compatibility with pip prior to version 24. - Refresh patch sort-for-reproducibility.patch ------------------------------------------------------------------ ------------------ 2024-5-21 - May 21 2024 ------------------- ------------------------------------------------------------------ ++++ python-requests: - Add CVE-2024-35195.patch (CVE-2024-35195, bsc#1224788) ------------------------------------------------------------------ ------------------ 2024-5-17 - May 17 2024 ------------------- ------------------------------------------------------------------ ++++ python-tqdm: - Re-add conditionals to numpy/pandas, it is required. ------------------------------------------------------------------ ------------------ 2024-5-14 - May 14 2024 ------------------- ------------------------------------------------------------------ ++++ python-aiohttp: - Add patch to fix XSS on index pages for static file handling * CVE-2024-27306.patch (bsc#1223098, CVE-2024-27306) - Add patch to remove pytest.mark.internal marker to enable CVE-2024-27306 tests * remove-pytest.mark.internal.patch ++++ libxml2-python: - Update to version 2.12.7: + Fix buffer overread with `xmllint --htmlout` (CVE-2024-34459, bsc#1224282). + xmllint: Fix --pedantic option. + save: Handle invalid parent pointers in xhtmlNodeDumpOutput. ------------------------------------------------------------------ ------------------ 2024-5-12 - May 12 2024 ------------------- ------------------------------------------------------------------ ++++ python313-hatchling: - Update to version 1.24.2: * Add .venv to the list of directories that cannot be traversed * Output from the core Application utility now writes to stderr - Changes from version 1.24.1: * Maintain file permissions for shared-scripts option/shared_scripts build data of the wheel target - Changes from version 1.24.0: * Add shared_data and shared_scripts build data for the wheel target ------------------------------------------------------------------ ------------------ 2024-5-10 - May 10 2024 ------------------- ------------------------------------------------------------------ ++++ python-Twisted: - Fix update-alternatives post script, bsc#1224109 ------------------------------------------------------------------ ------------------ 2024-5-9 - May 9 2024 ------------------- ------------------------------------------------------------------ ++++ python313-core: - Use proper version name including tilda to separate pre-release version. https://en.opensuse.org/openSUSE:Package_versioning_guidelines - Update to 3.13.0b1: - Security - gh-116741: Update bundled libexpat to 2.6.2 - gh-117233: Detect BLAKE2, SHA3, Shake, & truncated SHA512 support in the OpenSSL-ish libcrypto library at build time. This allows hashlib to be used with libraries that do not to support every algorithm that upstream OpenSSL does. - Core and Builtins - gh-118414: Add instrumented opcodes to YIELD_VALUE assertion for tracing cases. - gh-117953: When a builtin or extension module is imported for the first time, while a subinterpreter is active, the module’s init function is now run by the main interpreter first before import continues in the subinterpreter. Consequently, single-phase init modules now fail in an isolated subinterpreter without the init function running under that interpreter, whereas before it would run under the subinterpreter before failing, potentially leaving behind global state and callbacks and otherwise leaving the module in an inconsistent state. - gh-117549: Don’t use designated initializer syntax in inline functions in internal headers. They cause problems for C++ or MSVC users who aren’t yet using the latest C++ standard (C++20). While internal, pycore_backoff.h, is included (indirectly, via pycore_code.h) by some key 3rd party software that does so for speed. - gh-95382: Improve performance of json.dumps() and json.dump() when using the argument indent. Depending on the data the encoding using json.dumps() with indent can be up to 2 to 3 times faster. - gh-116322: In --disable-gil builds, the GIL will be enabled while loading C extension modules. If the module indicates that it supports running without the GIL, the GIL will be disabled once loading is complete. Otherwise, the GIL will remain enabled for the remainder of the interpreter’s lifetime. This behavior does not apply if the GIL has been explicitly enabled or disabled with PYTHON_GIL or -Xgil. - gh-118513: Fix incorrect UnboundLocalError when two comprehensions in the same function both reference the same name, and in one comprehension the name is bound while in the other it’s an implicit global. - gh-118518: Allow the Linux perf support to work without frame pointers using perf’s advanced JIT support. The feature is activated when using the PYTHON_PERF_JIT_SUPPORT environment variable or when running Python with -Xperf_jit. Patch by Pablo Galindo. - gh-117514: Add sys._is_gil_enabled() function that returns whether the GIL is currently enabled. In the default build it always returns True because the GIL is always enabled. In the free-threaded build, it may return True or False. - gh-118164: Break a loop between the Python implementation of the decimal module and the Python code for integer to string conversion. Also optimize integer to string conversion for values in the range from 9_000 to 135_000 decimal digits. - gh-118473: Fix sys.set_asyncgen_hooks() not to be partially set when raising TypeError. - gh-118465: Compiler populates the new __firstlineno__ field on a class with the line number of the first line of the class definition. - gh-118492: Fix an issue where the type cache can expose a previously accessed attribute when a finalizer is run. - gh-117714: update async_generator.athrow().close() and async_generator.asend().close() to close their section of the underlying async generator - gh-111201: The interactive interpreter is now implemented in Python, which allows for a number of new features like colors, multiline input, history viewing, and paste mode. Contributed by Pablo Galindo, Łukasz Langa and Lysandros Nikolaou based on code from the PyPy project. - gh-74929: Implement PEP 667: converted FrameType.f_locals and PyFrame_GetLocals() to return a write-through proxy object when the frame refers to a function or comprehension. - gh-116767: Fix crash in compiler on ‘async with’ that has many context managers. - gh-118335: Change how to use the tier 2 interpreter. Instead of running Python with -X uops or setting the environment variable PYTHON_UOPS=1, this choice is now made at build time by configuring with --enable-experimental-jit=interpreter. - Beware! This changes the environment variable to enable or disable micro-ops to PYTHON_JIT. The old PYTHON_UOPS is no longer used. - gh-118306: Update JIT compilation to use LLVM 18 - gh-118160: Annotation scopes within classes can now contain comprehensions. However, such comprehensions are not inlined into their parent scope at runtime. Patch by Jelle Zijlstra. - gh-118272: Fix bug where generator.close does not free the generator frame’s locals. - gh-118216: Don’t consider __future__ imports with dots before the module name. - gh-118074: Make sure that the Executor objects in the COLD_EXITS array aren’t assumed to be GC-able (which would access bytes outside the object). - gh-107674: Lazy load frame line number to improve performance of tracing - gh-118082: Improve SyntaxError message for imports without names, like in from x import and import cases. It now points out to users that import expects at least one name after it. - gh-118090: Improve SyntaxError message for empty type param brackets. - gh-102511: Speed up os.path.splitroot() with a native implementation. - gh-117958: Added a get_jit_code() method to access JIT compiled machine code from the UOp Executor when the experimental JIT is enabled. Patch by Anthony Shaw. - gh-117901: Add option for compiler’s codegen to save nested instruction sequences for introspection. - gh-116622: Redirect stdout and stderr to system log when embedded in an Android app. - gh-109118: annotation scope within class scopes can now contain lambdas. - gh-117894: Prevent agen.aclose() objects being re-used after .throw(). - gh-117881: prevent concurrent access to an async generator via athrow().throw() or asend().throw() - gh-115874: Fixed a possible segfault during garbage collection of _asyncio.FutureIter objects - gh-117536: Fix a RuntimeWarning when calling agen.aclose().throw(Exception). - gh-117755: Fix mimalloc allocator for huge memory allocation (around 8,589,934,592 GiB) on s390x. Patch by Victor Stinner. - gh-117750: Fix issue where an object’s dict would get out of sync with the object’s internal values when being cleared. obj.__dict__.clear() now clears the internal values, but leaves the dict attached to the object. - gh-117431: Improve the performance of the following bytes and bytearray methods by adapting them to the METH_FASTCALL calling convention: count() find() index() rfind() rindex() - gh-117709: Speed up calls to str() with positional-only argument, by using the PEP 590 vectorcall calling convention. Patch by Erlend Aasland. - gh-117680: Give _PyInstructionSequence a Python interface and use it in tests. - gh-115776: Statically allocated objects are, by definition, immortal so must be marked as such regardless of whether they are in extension modules or not. - gh-117641: Speedup os.path.commonpath() on Unix. - gh-117636: Speedup os.path.join(). - gh-117607: Speedup os.path.relpath(). - gh-117385: Remove unhandled PY_MONITORING_EVENT_BRANCH and PY_MONITORING_EVENT_EXCEPTION_HANDLED events from sys.settrace(). - gh-116322: Extension modules may indicate to the runtime that they can run without the GIL. Multi-phase init modules do so by calling providing Py_MOD_GIL_NOT_USED for the Py_mod_gil slot, while single-phase init modules call PyUnstable_Module_SetGIL(mod, Py_MOD_GIL_NOT_USED) from their init function. - gh-116129: Implement PEP 696, adding support for defaults on type parameters. Patch by Jelle Zijlstra. - gh-93502: Add two new functions to the C-API, PyRefTracer_SetTracer() and PyRefTracer_GetTracer(), that allows to track object creation and destruction the same way the tracemalloc module does. Patch by Pablo Galindo - gh-107674: Improved the performance of sys.settrace() significantly - gh-95754: Improve the error message when a script shadowing a module from the standard library causes AttributeError to be raised. Similarly, improve the error message when a script shadowing a third party module attempts to access an attribute from that third party module while still initialising. - gh-99180: Elide uninformative traceback indicators in return and simple assignment statements. Patch by Pablo Galindo. - gh-105879: Allow the globals and locals arguments to exec() and eval() to be passed as keywords. - Library - gh-118418: A DeprecationWarning is now emitted if you fail to pass a value to the new type_params parameter of typing._eval_type() or typing.ForwardRef._evaluate(). (Using either of these private and undocumented functions is discouraged to begin with, but failing to pass a value to the type_params parameter may lead to incorrect behaviour on Python 3.12 or newer.) - gh-118660: Add an optional second type parameter to typing.ContextManager and typing.AsyncContextManager, representing the return types of __exit__() and __aexit__() respectively. This parameter defaults to bool | None. - gh-118650: The enum module allows method named _repr_* to be defined on Enum types. - gh-118648: Add type parameter defaults to typing.Generator and typing.AsyncGenerator. - gh-101137: Mime type text/x-rst is now supported by mimetypes. - gh-118164: The Python implementation of the decimal module could appear to hang in relatively small power cases (like 2**117) if context precision was set to a very high value. A different method to check for exactly representable results is used now that doesn’t rely on computing 10**precision (which could be effectively too large to compute). - gh-111744: breakpoint() and pdb.set_trace() now enter the debugger immediately after the call rather than before the next line is executed. - gh-118500: Add pdb support for zipapps - gh-118406: Add signature for sqlite3.Connection objects. - gh-101732: Use a Y2038 compatible openssl time function when available. - gh-118404: Fix inspect.signature() for non-comparable callables. - gh-118402: Fix inspect.signature() for the result of the functools.cmp_to_key() call. - gh-116622: On Android, sysconfig.get_platform now returns the format specified by PEP 738. - gh-118285: Allow to specify the signature of custom callable instances of extension type by the __text_signature__ attribute. Specify signatures of operator.attrgetter, operator.itemgetter, and operator.methodcaller instances. - gh-118314: Fix an edge case in binascii.a2b_base64() strict mode, where excessive padding is not detected when no padding is necessary. - gh-118271: Add the PhotoImage methods read() to read an image from a file and data() to get the image data. Add background and grayscale parameters to PhotoImage method write(). - gh-118225: Add the PhotoImage method copy_replace() to copy a region from one image to other image, possibly with pixel zooming and/or subsampling. Add from_coords parameter to PhotoImage methods copy(), zoom() and subsample(). Add zoom and subsample parameters to PhotoImage method copy(). - gh-118221: Fix a bug where sqlite3.Connection.iterdump() could fail if a custom row factory was used. Patch by Erlend Aasland. - gh-118013: Fix regression introduced in gh-103193 that meant that calling inspect.getattr_static() on an instance would cause a strong reference to that instance’s class to persist in an internal cache in the inspect module. This caused unexpected memory consumption if the class was dynamically created, the class held strong references to other objects which took up a significant amount of memory, and the cache contained the sole strong reference to the class. The fix for the regression leads to a slowdown in getattr_static(), but the function should still be significantly faster than it was in Python 3.11. Patch by Alex Waygood. - gh-118218: Speed up itertools.pairwise() in the common case by up to 1.8x. - gh-117486: Improve the behavior of user-defined subclasses of ast.AST. Such classes will now require no changes in the usual case to conform with the behavior changes of the ast module in Python 3.13. Patch by Jelle Zijlstra. - gh-90848: Fixed unittest.mock.create_autospec() to configure parent mock with keyword arguments. - gh-118168: Fix incorrect argument substitution when typing.Unpack is used with the builtin tuple. typing.Unpack now raises TypeError when used with certain invalid types. Patch by Jelle Zijlstra. - gh-118131: Add command-line interface for the random module. Patch by Hugo van Kemenade. - gh-118107: Fix zipimport reading of ZIP64 files with file entries that are too big or offset too far. - gh-117535: Change the unknown filename of warnings from sys to to clarify that it’s not a real filename. - gh-114053: Fix erroneous NameError when calling typing.get_type_hints() on a class that made use of PEP 695 type parameters in a module that had from __future__ import annotations at the top of the file. Patch by Alex Waygood. - gh-116931: Add parameter fileobj check for tarfile.TarFile.addfile() - gh-117995: Don’t raise DeprecationWarning when a sequence of parameters is used to bind indexed, nameless placeholders. See also gh-100668. - gh-80361: Fix TypeError in email.Message.get_payload() when the charset is RFC 2231 encoded. - gh-86650: Fix IndexError when parse some emails with invalid Message-ID (including one-off addresses generated by Microsoft Outlook). - gh-117691: Improve the error messages emitted by tarfile deprecation warnings relating to PEP 706. If a filter argument is not provided to extract() or extractall, the deprecation warning now points to the line in the user’s code where the relevant function was called. Patch by Alex Waygood. - gh-115060: Speed up pathlib.Path.glob() by omitting an initial is_dir() call. As a result of this change, glob() can no longer raise OSError. - gh-77102: site module now parses .pth file with UTF-8 first, and locale encoding if UnicodeDecodeError happened. It supported only locale encoding before. - gh-76785: We’ve exposed the low-level _interpreters module for the sake of the PyPI implementation of PEP 734. It was sometimes available as the _xxsubinterpreters module and was formerly used only for testing. For the most part, it should be considered an internal module, like _thread and _imp. See https://discuss.python.org/t/pep-734-multiple-interpreters-in-the-stdlib/41147/26. - gh-115060: Speed up pathlib.Path.glob() by not scanning directories for non-wildcard pattern segments. - gh-117727: Speed up pathlib.Path.iterdir() by using os.scandir() internally. - gh-117586: Speed up pathlib.Path.walk() by working with strings internally. - gh-117722: Change the new multi-separator support in asyncio.Stream.readuntil() to only accept tuples of separators rather than arbitrary iterables. - gh-117692: Fixes a bug when doctest.DocTestFinder was failing on wrapped builtin_function_or_method. - gh-117348: Largely restored import time performance of configparser by avoiding dataclasses. - gh-117663: Fix _simple_enum to detect aliases when multiple arguments are present but only one is the member value. - gh-117618: Support package.module as filename for break command of pdb - gh-102247: the status codes enum with constants in http.HTTPStatus are updated to include the names from RFC9110. This RFC includes some HTTP statuses previously only used for WEBDAV and assigns more generic names to them. - The old constants are preserved for backwards compatibility. - gh-117586: Speed up pathlib.Path.glob() by working with strings internally. - gh-117225: Add colour to doctest output. Patch by Hugo van Kemenade. - gh-117566: ipaddress.IPv6Address.is_loopback() will now return True for IPv4-mapped loopback addresses, i.e. addresses in the ::ffff:127.0.0.0/104 address space. - gh-117546: Fix issue where os.path.realpath() stopped resolving symlinks after encountering a symlink loop on POSIX. - gh-116720: Improved behavior of asyncio.TaskGroup when an external cancellation collides with an internal cancellation. For example, when two task groups are nested and both experience an exception in a child task simultaneously, it was possible that the outer task group would misbehave, because its internal cancellation was swallowed by the inner task group. - In the case where a task group is cancelled externally and also must raise an ExceptionGroup, it will now call the parent task’s cancel() method. This ensures that a asyncio.CancelledError will be raised at the next await, so the cancellation is not lost. - An added benefit of these changes is that task groups now preserve the cancellation count (asyncio.Task.cancelling()). - In order to handle some corner cases, asyncio.Task.uncancel() may now reset the undocumented _must_cancel flag when the cancellation count reaches zero. - gh-117516: Add typing.TypeIs, implementing PEP 742. Patch by Jelle Zijlstra. - gh-117503: Fix support of non-ASCII user names in bytes paths in os.path.expanduser() on Posix. - gh-117394: os.path.ismount() is now 2-3 times faster if the user has permissions. - gh-117313: Only treat '\n', '\r' and '\r\n' as line separators in re-folding the email messages. Preserve control characters '\v', '\f', '\x1c', '\x1d' and '\x1e' and Unicode line separators '\x85', '\u2028' and '\u2029' as is. - gh-117142: Convert _ctypes to multi-phase initialisation (PEP 489). - gh-66543: Add the mimetypes.guess_file_type() function which works with file path. Passing file path instead of URL in guess_type() is soft deprecated. - gh-68583: webbrowser CLI: replace getopt with argparse, add long options. Patch by Hugo van Kemenade. - gh-116871: Name suggestions for AttributeError and ImportError now only include underscored names if the original name was underscored. - gh-116023: Don’t show empty fields (value None or []) in ast.dump() by default. Add show_empty=False parameter to optionally show them. - gh-115961: Added name and mode attributes for compressed and archived file-like objects in modules bz2, lzma, tarfile and zipfile. The value of the mode attribute of gzip.GzipFile was changed from integer (1 or 2) to string ('rb' or 'wb'). The value of the mode attribute of the readable file-like object returned by zipfile.ZipFile.open() was changed from 'r' to 'rb'. - gh-82062: Fix inspect.signature() to correctly handle parameter defaults on methods in extension modules that use names defined in the module namespace. - gh-83856: Honor atexit for all multiprocessing start methods - gh-113081: Print colorized exception just like built-in traceback in pdb - gh-112855: Speed up pickling of pathlib.PurePath objects. Patch by Barney Gale. - gh-111744: Support opcode events in bdb - gh-109617: ncurses: fixed a crash that could occur on macOS 13 or earlier when Python was built with Apple Xcode 15’s SDK. - gh-83151: Enabled arbitrary statements and evaluations in pdb shell to access the local variables of the current frame, which made it possible for multi-scope code like generators or nested function to work. - gh-110209: Add __class_getitem__() to types.GeneratorType and types.CoroutineType for type hinting purposes. Patch by James Hilton-Balfe. - gh-108191: The types.SimpleNamespace now accepts an optional positional argument which specifies initial values of attributes as a dict or an iterable of key-value pairs. - gh-62090: Fix assertion errors caused by whitespace in metavars or SUPPRESS-ed groups in argparse by simplifying usage formatting. Patch by Ali Hamdan. - gh-102402: Adjust logging.LogRecord to use time.time_ns() and fix minor bug related to floating point math. - gh-100242: Bring pure Python implementation functools.partial.__new__ more in line with the C-implementation by not just always checking for the presence of the attribute 'func' on the first argument of partial. Instead, both the Python version and the C version perform an isinstance(func, partial) check on the first argument of partial. - gh-99730: HEAD requests are no longer upgraded to GET request during redirects in urllib. - gh-66410: Callbacks registered in the tkinter module now take arguments as various Python objects (int, float, bytes, tuple), not just str. To restore the previous behavior set tkinter module global wantobject to 1 before creating the Tk object or call the wantobject() method of the Tk object with argument 1. Calling it with argument 2 restores the current default behavior. - bpo-40943: Fix several IndexError when parse emails with truncated Message-ID, address, routes, etc, e.g. example@. - bpo-39324: Add mime type mapping for .md <-> text/markdown - bpo-18108: shutil.chown() now supports dir_fd and follow_symlinks keyword arguments. - bpo-30988: Fix parsing of emails with invalid address headers having a leading or trailing dot. Patch by tsufeki. - bpo-32839: Add the after_info() method for Tkinter widgets. - Documentation - gh-117928: The minimum Sphinx version required for the documentation is now 6.2.1. - Build - gh-118734: Fixes Windows build when invoked directly (not through the build.bat script) without specifying a value for UseTIER2. - gh-115119: The configure option --with-system-libmpdec now defaults to yes. The bundled copy of libmpdecimal will be removed in Python 3.15. - gh-117845: Fix building against recent libedit versions by detecting readline hook signatures in configure. - gh-116622: A testbed project was added to run the test suite on Android. - gh-117645: Increase WASI stack size from 512 KiB to 8 MiB and the initial memory from 10 MiB to 20 MiB. Patch by Victor Stinner. - gh-115119: configure now uses pkg-config to detect decimal dependencies if the --with-system-libmpdec option is given. - Windows - gh-115119: Update Windows installer to use libmpdecimal 4.0.0. - gh-118486: os.mkdir() now accepts mode of 0o700 to restrict the new directory to the current user. - gh-118347: Fixes launcher updates not being installed. - gh-118293: The multiprocessing module now passes the STARTF_FORCEOFFFEEDBACK flag when spawning processes to tell Windows not to change the mouse cursor. - gh-115009: Update Windows installer to use SQLite 3.45.3. - gh-90329: Suppress the warning displayed on virtual environment creation when the requested and created paths differ only by a short (8.3 style) name. Warnings will continue to be shown if a junction or symlink in the path caused the venv to be created in a different location than originally requested. - gh-117786: Fixes virtual environments not correctly launching when created from a Store install. - macOS - gh-115119: Update macOS installer to use libmpdecimal 4.0.0. - gh-114099: iOS preprocessor symbol usage was made compatible with older macOS SDKs. - gh-115009: Update macOS installer to use SQLite 3.45.3. - gh-91629: Use ~/.config/fish/conf.d configs and fish_add_path to set PATH when installing for the Fish shell. - IDLE - bpo-34774: Use user-selected color theme for Help => IDLE Doc. - C API - gh-118124: Fix Py_BUILD_ASSERT and Py_BUILD_ASSERT_EXPR for non-constant expressions: use static_assert() on C11 and newer. Patch by Victor Stinner. - gh-110850: Add “Raw” variant of PyTime functions PyTime_MonotonicRaw() PyTime_PerfCounterRaw() PyTime_TimeRaw() Patch by Victor Stinner. - gh-117987: Restore functions removed in Python 3.13 alpha 1: Py_SetPythonHome() Py_SetProgramName() PySys_SetArgvEx() PySys_SetArgv() Patch by Victor Stinner. - gh-117929: Restore removed PyEval_InitThreads() function. Patch by Victor Stinner. - gh-117534: Improve validation logic in the C implementation of datetime.datetime.fromisoformat() to better handle invalid years. Patch by Vlad Efanov. - gh-68114: Fixed skipitem()’s handling of the old ‘w’ and ‘w#’ formatters. These are no longer supported and now raise an exception if used. - gh-111997: Add a C-API for firing monitoring events. - Python 3.13.0 alpha 6: - Core and Builtins - gh-117648: Improve performance of os.path.join() and os.path.expanduser(). - gh-117584: Raise TypeError for non-paths in posixpath.relpath(). - gh-117494: Refactored the instruction sequence data structure out of compile.c into instruction_sequence.c. - gh-116968: Introduce a unified 16-bit backoff counter type (_Py_BackoffCounter), shared between the Tier 1 adaptive specializer and the Tier 2 optimizer. The API used for adaptive specialization counters is changed but the behavior is (supposed to be) identical. - The behavior of the Tier 2 counters is changed: There are no longer dynamic thresholds (we never varied these). All counters now use the same exponential backoff. The counter for JUMP_BACKWARD starts counting down from 16. The temperature in side exits starts counting down from 64. - gh-117431: Improve the performance of the following bytes and bytearray methods by adapting them to the METH_FASTCALL calling convention: endswith() startswith() - gh-117431: Improve the performance of the following str methods by adapting them to the METH_FASTCALL calling convention: count() endswith() find() index() rfind() rindex() startswith() - gh-117411: Move PyFutureFeatures to an internal header and make it private. - gh-109120: Added handle of incorrect star expressions, e.g f(3, * ). Patch by Grigoryev Semyon - gh-117381: Fix error message for ntpath.commonpath(). - gh-117349: Optimise several functions in os.path. - gh-117335: Raise TypeError for non-sequences for ntpath.commonpath(). - gh-117266: Fix crashes for certain user-created subclasses of ast.AST. Such classes are now expected to set the _field_types attribute. - gh-99108: Updated the hashlib built-in HACL* project C code from upstream that we use for many implementations when they are not present via OpenSSL in a given build. This also avoids the rare potential for a C symbol name one definition rule linking issue. - gh-117108: Change the old space bit of objects in the young generation from 0 to gcstate->visited, so that any objects created during GC will have the old bit set correctly if they get moved into the old generation. - gh-117108: The cycle GC now chooses the size of increments based on the total heap size, instead of the rate of object creation. This ensures that it can keep up with growing heaps. - gh-117114: Make os.path.isdevdrive() available on all platforms. For those that do not offer Dev Drives, it will always return False. - gh-116735: For INSTRUMENTED_CALL_FUNCTION_EX, set arg0 to sys.monitoring.MISSING instead of None for CALL event. - gh-113964: Starting new threads and process creation through os.fork() are now only prevented once all non-daemon threads exit. - gh-116626: Ensure INSTRUMENTED_CALL_FUNCTION_EX always emits CALL - gh-116554: list.sort() now exploits more cases of partial ordering, particularly those with long descending runs with sub-runs of equal values. Those are recognized as single runs now (previously, each block of repeated values caused a new run to be created). - gh-114099: Added a Loader that can discover extension modules in an iOS-style Frameworks folder. - gh-115775: Compiler populates the new __static_attributes__ field on a class with the names of attributes of this class which are accessed through self.X from any function in its body. - gh-115776: The array of values, the PyDictValues struct is now embedded in the object during allocation. This provides better performance in the common case, and does not degrade as much when the object’s __dict__ is materialized. - gh-108362: Implement an incremental cyclic garbage collector. By collecting the old generation in increments, there is no need for a full heap scan. This can hugely reduce maximum pause time for programs with large heaps. - Reduce the number of generations from three to two. The old generation is split into two spaces, “visited” and “pending”. - Collection happens in two steps:: * An increment is formed from the young generation and a small part of the pending space. * This increment is scanned and the survivors moved to the end of the visited space. - When the collecting space becomes empty, the two spaces are swapped. - gh-109870: Dataclasses now calls exec() once per dataclass, instead of once per method being added. This can speed up dataclass creation by up to 20%. - gh-97901: Mime type text/rtf is now supported by mimetypes. - bpo-24612: Improve the SyntaxError that happens when ‘not’ appears after an operator. Patch by Pablo Galindo - Library - gh-117467: Preserve mailbox ownership when rewriting in mailbox.mbox.flush(). Patch by Tony Mountifield. - gh-114848: Raise FileNotFoundError when getcwd() returns ‘(unreachable)’, which can happen on Linux >= 2.6.36 with glibc < 2.27. - gh-117459: asyncio.asyncio.run_coroutine_threadsafe() now keeps the traceback of CancelledError, TimeoutError and InvalidStateError which are raised in the coroutine. - gh-117337: Deprecate undocumented glob.glob0() and glob.glob1() functions. Use glob.glob() and pass a directory to its root_dir argument instead. - gh-117348: Refactored configparser.RawConfigParser._read() to reduce cyclometric complexity and improve comprehensibility. - gh-66449: configparser.ConfigParser now accepts unnamed sections before named ones, if configured to do so. - gh-88014: In documentation of gzip.GzipFile in module gzip, explain data type of optional constructor argument mtime, and recommend mtime = 0 for generating deterministic streams. - gh-117310: Fixed an unlikely early & extra Py_DECREF triggered crash in ssl when creating a new _ssl._SSLContext if CPython was built implausibly such that the default cipher list is empty or the SSL library it was linked against reports a failure from its C SSL_CTX_set_cipher_list() API. - gh-117294: A DocTestCase now reports as skipped if all examples in the doctest are skipped. - gh-98966: In subprocess, raise a more informative message when stdout=STDOUT. - gh-117225: doctest: only print “and X failed” when non-zero, don’t pluralise “1 items”. Patch by Hugo van Kemenade. - gh-117205: Speed up compileall.compile_dir() by 20% when using multiprocessing by increasing chunksize. - gh-117178: Fix regression in lazy loading of self-referential modules, introduced in gh-114781. - gh-112383: Fix dis module’s handling of ENTER_EXECUTOR instructions. - gh-117182: Lazy-loading of modules that modify their own __class__ no longer reverts the __class__ to types.ModuleType. - gh-117084: Fix zipfile extraction for directory entries with the name containing backslashes on Windows. - gh-117110: Fix a bug that prevents subclasses of typing.Any to be instantiated with arguments. Patch by Chris Fu. - gh-109653: Deferred select imports in importlib.metadata and importlib.resources for a 14% speedup. - gh-70647: Start the deprecation period for the current behavior of datetime.datetime.strptime() and time.strptime() which always fails to parse a date string with a ValueError involving a day of month such as strptime("02-29", "%m-%d") when a year is not specified and the date happen to be February 29th. This should help avoid users finding new bugs every four years due to a natural mistaken assumption about the API when parsing partial date values. - gh-116987: Fixed inspect.findsource() for class code objects. - gh-114099: Modify standard library to allow for iOS platform differences. - gh-90872: On Windows, subprocess.Popen.wait() no longer calls WaitForSingleObject() with a negative timeout: pass 0 ms if the timeout is negative. Patch by Victor Stinner. - gh-116957: configparser: Don’t leave ConfigParser values in an invalid state (stored as a list instead of a str) after an earlier read raised DuplicateSectionError or DuplicateOptionError. - gh-115538: _io.WindowsConsoleIO now emit a warning if a boolean value is passed as a filedescriptor argument. - gh-90095: Ignore empty lines and comments in .pdbrc - gh-106531: Refreshed zipfile._path from zipp 3.18, providing better compatibility for PyPy, better glob performance for deeply nested zipfiles, and providing internal access to CompleteDirs.inject for use in other tests (like importlib.resources). - gh-63207: On Windows, time.time() now uses the GetSystemTimePreciseAsFileTime() clock to have a resolution better than 1 us, instead of the GetSystemTimeAsFileTime() clock which has a resolution of 15.6 ms. Patch by Victor Stinner. - gh-116764: Restore support of None and other false values in urllib.parse functions parse_qs() and parse_qsl(). Also, they now raise a TypeError for non-zero integers and non-empty sequences. - gh-116811: In PathFinder.invalidate_caches, delegate to MetadataPathFinder.invalidate_caches. - gh-116647: Fix recursive child in dataclasses - gh-113171: Fixed various false positives and false negatives in ipaddress.IPv4Address.is_private (see these docs for details) ipaddress.IPv4Address.is_global ipaddress.IPv6Address.is_private ipaddress.IPv6Address.is_global - Also in the corresponding ipaddress.IPv4Network and ipaddress.IPv6Network attributes. - Fixes bsc#1226448 (CVE-2024-4032). - gh-63283: In encodings.idna, any capitalization of the the ACE prefix (xn--) is now acceptable. Patch by Pepijn de Vos and Zackery Spytz. - gh-71042: Add platform.android_ver(), which provides device and OS information on Android. - gh-73468: Added new math.fma() function, wrapping C99’s fma() operation: fused multiply-add function. Patch by Mark Dickinson and Victor Stinner. - gh-116608: The importlib.resources functions is_resource(), open_binary(), open_text(), path(), read_binary(), and read_text() are un-deprecated, and support subdirectories via multiple positional arguments. The contents() function also allows subdirectories, but remains deprecated. - gh-116484: Change automatically generated tkinter.Checkbutton widget names to avoid collisions with automatically generated tkinter.ttk.Checkbutton widget names within the same parent widget. - gh-114314: In ctypes, ctype data is now stored in type objects directly rather than in a dict subclass. This is an internal change that should not affect usage. - gh-116401: Fix blocking os.fwalk() and shutil.rmtree() on opening named pipe. - gh-71052: Implement ctypes.util.find_library() on Android. - gh-90535: Fix support of interval values > 1 in logging.TimedRotatingFileHandler for when='MIDNIGHT' and when='Wx'. - gh-113308: Remove some internal protected parts from uuid: _has_uuid_generate_time_safe, _netbios_getnode, _ipconfig_getnode, and _load_system_functions. They were unused. - gh-115627: Fix the ssl module error handling of connection terminate by peer. It now throws an OSError with the appropriate error code instead of an EOFError. - gh-114847: Speed up os.path.realpath() on non-Windows platforms. - gh-114271: Fix a race in threading.Thread.join(). - threading._MainThread now always represents the main thread of the main interpreter. - PyThreadState.on_delete and PyThreadState.on_delete_data have been removed. - gh-113538: Add asyncio.Server.close_clients() and asyncio.Server.abort_clients() methods which allow to more forcefully close an asyncio server. - gh-85287: Changes Unicode codecs to return UnicodeEncodeError or UnicodeDecodeError, rather than just UnicodeError. - gh-113548: pdb now allows CLI arguments to pdb -m. - gh-112948: Make completion of pdb similar to Python REPL - gh-105866: Fixed _get_slots bug which caused error when defining dataclasses with slots and a weakref_slot. - gh-96471: Add asyncio.Queue termination with shutdown() method. - gh-89739: The zipimport module can now read ZIP64 files. - bpo-33533: asyncio.as_completed() now returns an object that is both an asynchronous iterator and plain iterator. The new asynchronous iteration pattern allows for easier correlation between prior tasks and their completed results. This is a closer match to concurrent.futures.as_completed()’s iteration pattern. Patch by Justin Arthur. - bpo-27578: inspect.getsource() (and related functions) work with empty module files, returning '\n' (or reasonable equivalent) instead of raising OSError. Patch by Kernc. - bpo-37141: Accept an iterable of separators in asyncio.StreamReader.readuntil(), stopping when one of them is encountered. - gh-66543: Make mimetypes.guess_type() properly parsing of URLs with only a host name, URLs containing fragment or query, and filenames with only a UNC sharepoint on Windows. Based on patch by Dong-hee Na. - bpo-15010: unittest.TestLoader.discover() now saves the original value of unittest.TestLoader._top_level_dir and restores it at the end of the call. - Documentation - gh-115977: Remove compatibilty references to Emscripten. - gh-114099: Add an iOS platform guide, and flag modules not available on iOS. - gh-91565: Changes to documentation files and config outputs to reflect the new location for reporting bugs - i.e. GitHub rather than bugs.python.org. - Tests - gh-83434: Disable JUnit XML output (--junit-xml=FILE command line option) in regrtest when hunting for reference leaks (-R option). Patch by Victor Stinner. - gh-117187: Fix XML tests for vanilla Expat <2.6.0. - gh-116333: Tests of TLS related things (error codes, etc) were updated to be more lenient about specific error message strings and behaviors as seen in the BoringSSL and AWS-LC forks of OpenSSL. - gh-117089: Consolidated tests for importlib.metadata in their own metadata package. - gh-115979: Update test_importlib so that it passes under WASI SDK 21. - gh-112536: Add –tsan to test.regrtest for running TSAN tests in reasonable execution times. Patch by Donghee Na. - gh-116307: Added import helper isolated_modules as CleanImport does not remove modules imported during the context. Use it in importlib.resources tests to avoid leaving mod around to impede importlib.metadata tests. - Build - gh-114736: Have WASI builds use WASI SDK 21. - gh-115983: Skip building test modules that must be built as shared under WASI. - gh-71052: Add Android build script and instructions. - Windows - gh-117267: Ensure DirEntry.stat().st_ctime behaves consistently with os.stat() during the deprecation period of st_ctime by containing the same value as st_birthtime. After the deprecation period, st_ctime will be the metadata change time (or unavailable through DirEntry), and only st_birthtime will contain the creation time. - gh-116195: Improves performance of os.getppid() by using an alternate system API when available. Contributed by vxiiduu. - gh-88494: On Windows, time.monotonic() now uses the QueryPerformanceCounter() clock to have a resolution better than 1 us, instead of the GetTickCount64() clock which has a resolution of 15.6 ms. Patch by Victor Stinner. - gh-116773: Fix instances of <_overlapped.Overlapped object at 0xXXX> still has pending operation at deallocation, the process may crash. - gh-91227: Fix the asyncio ProactorEventLoop implementation so that sending a datagram to an address that is not listening does not prevent receiving any more datagrams. - gh-115119: Switched from vendored libmpdecimal code to a separately-hosted external package in the cpython-source-deps repository when building the _decimal module. - C API - gh-117642: Fix PEP 737 implementation for %#T and %#N. - gh-87193: _PyBytes_Resize() can now be called for bytes objects with reference count > 1, including 1-byte bytes objects. It creates a new bytes object and destroys the old one if it has reference count > 1. - gh-117021: Fix integer overflow in PyLong_AsPid() on non-Windows 64-bit platforms. - gh-115756: PyCode_GetFirstFree() is an ustable API now and has been renamed to PyUnstable_Code_GetFirstFree(). (Contributed by Bogdan Romanyuk in gh-115781) - gh-116869: Add test_cext test: build a C extension to check if the Python C API emits C compiler warnings. Patch by Victor Stinner. - gh-116869: Make the C API compatible with - Werror=declaration-after-statement compiler flag again. Patch by Victor Stinner. - gh-116936: Add PyType_GetModuleByDef() to the limited C API. Patch by Victor Stinner. - gh-116809: Restore removed private _PyErr_ChainExceptions1() function. Patch by Victor Stinner. - gh-115754: In the limited C API version 3.13, getting Py_None, Py_False, Py_True, Py_Ellipsis and Py_NotImplemented singletons is now implemented as function calls at the stable ABI level to hide implementation details. Getting these constants still return borrowed references. Patch by Victor Stinner. - gh-115754: Add Py_GetConstant() and Py_GetConstantBorrowed() functions to get constants. For example, Py_GetConstant(Py_CONSTANT_ZERO) returns a strong reference to the constant zero. Patch by Victor Stinner. - gh-111696: Add support for %T, %T#, %N and %N# formats to PyUnicode_FromFormat(): format the fully qualified name of an object type and of a type: call PyType_GetModuleName(). See PEP 737 for more information. Patch by Victor Stinner. - gh-111696: Add PyType_GetModuleName() function to get the type’s module name. Equivalent to getting the type.__module__ attribute. Patch by Eric Snow and Victor Stinner. - gh-111696: Add PyType_GetFullyQualifiedName() function to get the type’s fully qualified name. Equivalent to f"{type.__module__}.{type.__qualname__}", or type.__qualname__ if type.__module__ is not a string or is equal to "builtins". Patch by Victor Stinner. - gh-85283: The fcntl, grp, pwd, termios, _statistics and _testconsole C extensions are now built with the limited C API. Patch by Victor Stinner. - gh-111140: Add additional flags to PyLong_AsNativeBytes() and PyLong_FromNativeBytes() to allow the caller to determine how to handle edge cases around values that fill the entire buffer. - gh-113024: Add PyObject_GenericHash() function. ++++ python313: - Use proper version name including tilda to separate pre-release version. https://en.opensuse.org/openSUSE:Package_versioning_guidelines - Update to 3.13.0b1: - Security - gh-116741: Update bundled libexpat to 2.6.2 - gh-117233: Detect BLAKE2, SHA3, Shake, & truncated SHA512 support in the OpenSSL-ish libcrypto library at build time. This allows hashlib to be used with libraries that do not to support every algorithm that upstream OpenSSL does. - Core and Builtins - gh-118414: Add instrumented opcodes to YIELD_VALUE assertion for tracing cases. - gh-117953: When a builtin or extension module is imported for the first time, while a subinterpreter is active, the module’s init function is now run by the main interpreter first before import continues in the subinterpreter. Consequently, single-phase init modules now fail in an isolated subinterpreter without the init function running under that interpreter, whereas before it would run under the subinterpreter before failing, potentially leaving behind global state and callbacks and otherwise leaving the module in an inconsistent state. - gh-117549: Don’t use designated initializer syntax in inline functions in internal headers. They cause problems for C++ or MSVC users who aren’t yet using the latest C++ standard (C++20). While internal, pycore_backoff.h, is included (indirectly, via pycore_code.h) by some key 3rd party software that does so for speed. - gh-95382: Improve performance of json.dumps() and json.dump() when using the argument indent. Depending on the data the encoding using json.dumps() with indent can be up to 2 to 3 times faster. - gh-116322: In --disable-gil builds, the GIL will be enabled while loading C extension modules. If the module indicates that it supports running without the GIL, the GIL will be disabled once loading is complete. Otherwise, the GIL will remain enabled for the remainder of the interpreter’s lifetime. This behavior does not apply if the GIL has been explicitly enabled or disabled with PYTHON_GIL or -Xgil. - gh-118513: Fix incorrect UnboundLocalError when two comprehensions in the same function both reference the same name, and in one comprehension the name is bound while in the other it’s an implicit global. - gh-118518: Allow the Linux perf support to work without frame pointers using perf’s advanced JIT support. The feature is activated when using the PYTHON_PERF_JIT_SUPPORT environment variable or when running Python with -Xperf_jit. Patch by Pablo Galindo. - gh-117514: Add sys._is_gil_enabled() function that returns whether the GIL is currently enabled. In the default build it always returns True because the GIL is always enabled. In the free-threaded build, it may return True or False. - gh-118164: Break a loop between the Python implementation of the decimal module and the Python code for integer to string conversion. Also optimize integer to string conversion for values in the range from 9_000 to 135_000 decimal digits. - gh-118473: Fix sys.set_asyncgen_hooks() not to be partially set when raising TypeError. - gh-118465: Compiler populates the new __firstlineno__ field on a class with the line number of the first line of the class definition. - gh-118492: Fix an issue where the type cache can expose a previously accessed attribute when a finalizer is run. - gh-117714: update async_generator.athrow().close() and async_generator.asend().close() to close their section of the underlying async generator - gh-111201: The interactive interpreter is now implemented in Python, which allows for a number of new features like colors, multiline input, history viewing, and paste mode. Contributed by Pablo Galindo, Łukasz Langa and Lysandros Nikolaou based on code from the PyPy project. - gh-74929: Implement PEP 667: converted FrameType.f_locals and PyFrame_GetLocals() to return a write-through proxy object when the frame refers to a function or comprehension. - gh-116767: Fix crash in compiler on ‘async with’ that has many context managers. - gh-118335: Change how to use the tier 2 interpreter. Instead of running Python with -X uops or setting the environment variable PYTHON_UOPS=1, this choice is now made at build time by configuring with --enable-experimental-jit=interpreter. - Beware! This changes the environment variable to enable or disable micro-ops to PYTHON_JIT. The old PYTHON_UOPS is no longer used. - gh-118306: Update JIT compilation to use LLVM 18 - gh-118160: Annotation scopes within classes can now contain comprehensions. However, such comprehensions are not inlined into their parent scope at runtime. Patch by Jelle Zijlstra. - gh-118272: Fix bug where generator.close does not free the generator frame’s locals. - gh-118216: Don’t consider __future__ imports with dots before the module name. - gh-118074: Make sure that the Executor objects in the COLD_EXITS array aren’t assumed to be GC-able (which would access bytes outside the object). - gh-107674: Lazy load frame line number to improve performance of tracing - gh-118082: Improve SyntaxError message for imports without names, like in from x import and import cases. It now points out to users that import expects at least one name after it. - gh-118090: Improve SyntaxError message for empty type param brackets. - gh-102511: Speed up os.path.splitroot() with a native implementation. - gh-117958: Added a get_jit_code() method to access JIT compiled machine code from the UOp Executor when the experimental JIT is enabled. Patch by Anthony Shaw. - gh-117901: Add option for compiler’s codegen to save nested instruction sequences for introspection. - gh-116622: Redirect stdout and stderr to system log when embedded in an Android app. - gh-109118: annotation scope within class scopes can now contain lambdas. - gh-117894: Prevent agen.aclose() objects being re-used after .throw(). - gh-117881: prevent concurrent access to an async generator via athrow().throw() or asend().throw() - gh-115874: Fixed a possible segfault during garbage collection of _asyncio.FutureIter objects - gh-117536: Fix a RuntimeWarning when calling agen.aclose().throw(Exception). - gh-117755: Fix mimalloc allocator for huge memory allocation (around 8,589,934,592 GiB) on s390x. Patch by Victor Stinner. - gh-117750: Fix issue where an object’s dict would get out of sync with the object’s internal values when being cleared. obj.__dict__.clear() now clears the internal values, but leaves the dict attached to the object. - gh-117431: Improve the performance of the following bytes and bytearray methods by adapting them to the METH_FASTCALL calling convention: count() find() index() rfind() rindex() - gh-117709: Speed up calls to str() with positional-only argument, by using the PEP 590 vectorcall calling convention. Patch by Erlend Aasland. - gh-117680: Give _PyInstructionSequence a Python interface and use it in tests. - gh-115776: Statically allocated objects are, by definition, immortal so must be marked as such regardless of whether they are in extension modules or not. - gh-117641: Speedup os.path.commonpath() on Unix. - gh-117636: Speedup os.path.join(). - gh-117607: Speedup os.path.relpath(). - gh-117385: Remove unhandled PY_MONITORING_EVENT_BRANCH and PY_MONITORING_EVENT_EXCEPTION_HANDLED events from sys.settrace(). - gh-116322: Extension modules may indicate to the runtime that they can run without the GIL. Multi-phase init modules do so by calling providing Py_MOD_GIL_NOT_USED for the Py_mod_gil slot, while single-phase init modules call PyUnstable_Module_SetGIL(mod, Py_MOD_GIL_NOT_USED) from their init function. - gh-116129: Implement PEP 696, adding support for defaults on type parameters. Patch by Jelle Zijlstra. - gh-93502: Add two new functions to the C-API, PyRefTracer_SetTracer() and PyRefTracer_GetTracer(), that allows to track object creation and destruction the same way the tracemalloc module does. Patch by Pablo Galindo - gh-107674: Improved the performance of sys.settrace() significantly - gh-95754: Improve the error message when a script shadowing a module from the standard library causes AttributeError to be raised. Similarly, improve the error message when a script shadowing a third party module attempts to access an attribute from that third party module while still initialising. - gh-99180: Elide uninformative traceback indicators in return and simple assignment statements. Patch by Pablo Galindo. - gh-105879: Allow the globals and locals arguments to exec() and eval() to be passed as keywords. - Library - gh-118418: A DeprecationWarning is now emitted if you fail to pass a value to the new type_params parameter of typing._eval_type() or typing.ForwardRef._evaluate(). (Using either of these private and undocumented functions is discouraged to begin with, but failing to pass a value to the type_params parameter may lead to incorrect behaviour on Python 3.12 or newer.) - gh-118660: Add an optional second type parameter to typing.ContextManager and typing.AsyncContextManager, representing the return types of __exit__() and __aexit__() respectively. This parameter defaults to bool | None. - gh-118650: The enum module allows method named _repr_* to be defined on Enum types. - gh-118648: Add type parameter defaults to typing.Generator and typing.AsyncGenerator. - gh-101137: Mime type text/x-rst is now supported by mimetypes. - gh-118164: The Python implementation of the decimal module could appear to hang in relatively small power cases (like 2**117) if context precision was set to a very high value. A different method to check for exactly representable results is used now that doesn’t rely on computing 10**precision (which could be effectively too large to compute). - gh-111744: breakpoint() and pdb.set_trace() now enter the debugger immediately after the call rather than before the next line is executed. - gh-118500: Add pdb support for zipapps - gh-118406: Add signature for sqlite3.Connection objects. - gh-101732: Use a Y2038 compatible openssl time function when available. - gh-118404: Fix inspect.signature() for non-comparable callables. - gh-118402: Fix inspect.signature() for the result of the functools.cmp_to_key() call. - gh-116622: On Android, sysconfig.get_platform now returns the format specified by PEP 738. - gh-118285: Allow to specify the signature of custom callable instances of extension type by the __text_signature__ attribute. Specify signatures of operator.attrgetter, operator.itemgetter, and operator.methodcaller instances. - gh-118314: Fix an edge case in binascii.a2b_base64() strict mode, where excessive padding is not detected when no padding is necessary. - gh-118271: Add the PhotoImage methods read() to read an image from a file and data() to get the image data. Add background and grayscale parameters to PhotoImage method write(). - gh-118225: Add the PhotoImage method copy_replace() to copy a region from one image to other image, possibly with pixel zooming and/or subsampling. Add from_coords parameter to PhotoImage methods copy(), zoom() and subsample(). Add zoom and subsample parameters to PhotoImage method copy(). - gh-118221: Fix a bug where sqlite3.Connection.iterdump() could fail if a custom row factory was used. Patch by Erlend Aasland. - gh-118013: Fix regression introduced in gh-103193 that meant that calling inspect.getattr_static() on an instance would cause a strong reference to that instance’s class to persist in an internal cache in the inspect module. This caused unexpected memory consumption if the class was dynamically created, the class held strong references to other objects which took up a significant amount of memory, and the cache contained the sole strong reference to the class. The fix for the regression leads to a slowdown in getattr_static(), but the function should still be significantly faster than it was in Python 3.11. Patch by Alex Waygood. - gh-118218: Speed up itertools.pairwise() in the common case by up to 1.8x. - gh-117486: Improve the behavior of user-defined subclasses of ast.AST. Such classes will now require no changes in the usual case to conform with the behavior changes of the ast module in Python 3.13. Patch by Jelle Zijlstra. - gh-90848: Fixed unittest.mock.create_autospec() to configure parent mock with keyword arguments. - gh-118168: Fix incorrect argument substitution when typing.Unpack is used with the builtin tuple. typing.Unpack now raises TypeError when used with certain invalid types. Patch by Jelle Zijlstra. - gh-118131: Add command-line interface for the random module. Patch by Hugo van Kemenade. - gh-118107: Fix zipimport reading of ZIP64 files with file entries that are too big or offset too far. - gh-117535: Change the unknown filename of warnings from sys to to clarify that it’s not a real filename. - gh-114053: Fix erroneous NameError when calling typing.get_type_hints() on a class that made use of PEP 695 type parameters in a module that had from __future__ import annotations at the top of the file. Patch by Alex Waygood. - gh-116931: Add parameter fileobj check for tarfile.TarFile.addfile() - gh-117995: Don’t raise DeprecationWarning when a sequence of parameters is used to bind indexed, nameless placeholders. See also gh-100668. - gh-80361: Fix TypeError in email.Message.get_payload() when the charset is RFC 2231 encoded. - gh-86650: Fix IndexError when parse some emails with invalid Message-ID (including one-off addresses generated by Microsoft Outlook). - gh-117691: Improve the error messages emitted by tarfile deprecation warnings relating to PEP 706. If a filter argument is not provided to extract() or extractall, the deprecation warning now points to the line in the user’s code where the relevant function was called. Patch by Alex Waygood. - gh-115060: Speed up pathlib.Path.glob() by omitting an initial is_dir() call. As a result of this change, glob() can no longer raise OSError. - gh-77102: site module now parses .pth file with UTF-8 first, and locale encoding if UnicodeDecodeError happened. It supported only locale encoding before. - gh-76785: We’ve exposed the low-level _interpreters module for the sake of the PyPI implementation of PEP 734. It was sometimes available as the _xxsubinterpreters module and was formerly used only for testing. For the most part, it should be considered an internal module, like _thread and _imp. See https://discuss.python.org/t/pep-734-multiple-interpreters-in-the-stdlib/41147/26. - gh-115060: Speed up pathlib.Path.glob() by not scanning directories for non-wildcard pattern segments. - gh-117727: Speed up pathlib.Path.iterdir() by using os.scandir() internally. - gh-117586: Speed up pathlib.Path.walk() by working with strings internally. - gh-117722: Change the new multi-separator support in asyncio.Stream.readuntil() to only accept tuples of separators rather than arbitrary iterables. - gh-117692: Fixes a bug when doctest.DocTestFinder was failing on wrapped builtin_function_or_method. - gh-117348: Largely restored import time performance of configparser by avoiding dataclasses. - gh-117663: Fix _simple_enum to detect aliases when multiple arguments are present but only one is the member value. - gh-117618: Support package.module as filename for break command of pdb - gh-102247: the status codes enum with constants in http.HTTPStatus are updated to include the names from RFC9110. This RFC includes some HTTP statuses previously only used for WEBDAV and assigns more generic names to them. - The old constants are preserved for backwards compatibility. - gh-117586: Speed up pathlib.Path.glob() by working with strings internally. - gh-117225: Add colour to doctest output. Patch by Hugo van Kemenade. - gh-117566: ipaddress.IPv6Address.is_loopback() will now return True for IPv4-mapped loopback addresses, i.e. addresses in the ::ffff:127.0.0.0/104 address space. - gh-117546: Fix issue where os.path.realpath() stopped resolving symlinks after encountering a symlink loop on POSIX. - gh-116720: Improved behavior of asyncio.TaskGroup when an external cancellation collides with an internal cancellation. For example, when two task groups are nested and both experience an exception in a child task simultaneously, it was possible that the outer task group would misbehave, because its internal cancellation was swallowed by the inner task group. - In the case where a task group is cancelled externally and also must raise an ExceptionGroup, it will now call the parent task’s cancel() method. This ensures that a asyncio.CancelledError will be raised at the next await, so the cancellation is not lost. - An added benefit of these changes is that task groups now preserve the cancellation count (asyncio.Task.cancelling()). - In order to handle some corner cases, asyncio.Task.uncancel() may now reset the undocumented _must_cancel flag when the cancellation count reaches zero. - gh-117516: Add typing.TypeIs, implementing PEP 742. Patch by Jelle Zijlstra. - gh-117503: Fix support of non-ASCII user names in bytes paths in os.path.expanduser() on Posix. - gh-117394: os.path.ismount() is now 2-3 times faster if the user has permissions. - gh-117313: Only treat '\n', '\r' and '\r\n' as line separators in re-folding the email messages. Preserve control characters '\v', '\f', '\x1c', '\x1d' and '\x1e' and Unicode line separators '\x85', '\u2028' and '\u2029' as is. - gh-117142: Convert _ctypes to multi-phase initialisation (PEP 489). - gh-66543: Add the mimetypes.guess_file_type() function which works with file path. Passing file path instead of URL in guess_type() is soft deprecated. - gh-68583: webbrowser CLI: replace getopt with argparse, add long options. Patch by Hugo van Kemenade. - gh-116871: Name suggestions for AttributeError and ImportError now only include underscored names if the original name was underscored. - gh-116023: Don’t show empty fields (value None or []) in ast.dump() by default. Add show_empty=False parameter to optionally show them. - gh-115961: Added name and mode attributes for compressed and archived file-like objects in modules bz2, lzma, tarfile and zipfile. The value of the mode attribute of gzip.GzipFile was changed from integer (1 or 2) to string ('rb' or 'wb'). The value of the mode attribute of the readable file-like object returned by zipfile.ZipFile.open() was changed from 'r' to 'rb'. - gh-82062: Fix inspect.signature() to correctly handle parameter defaults on methods in extension modules that use names defined in the module namespace. - gh-83856: Honor atexit for all multiprocessing start methods - gh-113081: Print colorized exception just like built-in traceback in pdb - gh-112855: Speed up pickling of pathlib.PurePath objects. Patch by Barney Gale. - gh-111744: Support opcode events in bdb - gh-109617: ncurses: fixed a crash that could occur on macOS 13 or earlier when Python was built with Apple Xcode 15’s SDK. - gh-83151: Enabled arbitrary statements and evaluations in pdb shell to access the local variables of the current frame, which made it possible for multi-scope code like generators or nested function to work. - gh-110209: Add __class_getitem__() to types.GeneratorType and types.CoroutineType for type hinting purposes. Patch by James Hilton-Balfe. - gh-108191: The types.SimpleNamespace now accepts an optional positional argument which specifies initial values of attributes as a dict or an iterable of key-value pairs. - gh-62090: Fix assertion errors caused by whitespace in metavars or SUPPRESS-ed groups in argparse by simplifying usage formatting. Patch by Ali Hamdan. - gh-102402: Adjust logging.LogRecord to use time.time_ns() and fix minor bug related to floating point math. - gh-100242: Bring pure Python implementation functools.partial.__new__ more in line with the C-implementation by not just always checking for the presence of the attribute 'func' on the first argument of partial. Instead, both the Python version and the C version perform an isinstance(func, partial) check on the first argument of partial. - gh-99730: HEAD requests are no longer upgraded to GET request during redirects in urllib. - gh-66410: Callbacks registered in the tkinter module now take arguments as various Python objects (int, float, bytes, tuple), not just str. To restore the previous behavior set tkinter module global wantobject to 1 before creating the Tk object or call the wantobject() method of the Tk object with argument 1. Calling it with argument 2 restores the current default behavior. - bpo-40943: Fix several IndexError when parse emails with truncated Message-ID, address, routes, etc, e.g. example@. - bpo-39324: Add mime type mapping for .md <-> text/markdown - bpo-18108: shutil.chown() now supports dir_fd and follow_symlinks keyword arguments. - bpo-30988: Fix parsing of emails with invalid address headers having a leading or trailing dot. Patch by tsufeki. - bpo-32839: Add the after_info() method for Tkinter widgets. - Documentation - gh-117928: The minimum Sphinx version required for the documentation is now 6.2.1. - Build - gh-118734: Fixes Windows build when invoked directly (not through the build.bat script) without specifying a value for UseTIER2. - gh-115119: The configure option --with-system-libmpdec now defaults to yes. The bundled copy of libmpdecimal will be removed in Python 3.15. - gh-117845: Fix building against recent libedit versions by detecting readline hook signatures in configure. - gh-116622: A testbed project was added to run the test suite on Android. - gh-117645: Increase WASI stack size from 512 KiB to 8 MiB and the initial memory from 10 MiB to 20 MiB. Patch by Victor Stinner. - gh-115119: configure now uses pkg-config to detect decimal dependencies if the --with-system-libmpdec option is given. - Windows - gh-115119: Update Windows installer to use libmpdecimal 4.0.0. - gh-118486: os.mkdir() now accepts mode of 0o700 to restrict the new directory to the current user. - gh-118347: Fixes launcher updates not being installed. - gh-118293: The multiprocessing module now passes the STARTF_FORCEOFFFEEDBACK flag when spawning processes to tell Windows not to change the mouse cursor. - gh-115009: Update Windows installer to use SQLite 3.45.3. - gh-90329: Suppress the warning displayed on virtual environment creation when the requested and created paths differ only by a short (8.3 style) name. Warnings will continue to be shown if a junction or symlink in the path caused the venv to be created in a different location than originally requested. - gh-117786: Fixes virtual environments not correctly launching when created from a Store install. - macOS - gh-115119: Update macOS installer to use libmpdecimal 4.0.0. - gh-114099: iOS preprocessor symbol usage was made compatible with older macOS SDKs. - gh-115009: Update macOS installer to use SQLite 3.45.3. - gh-91629: Use ~/.config/fish/conf.d configs and fish_add_path to set PATH when installing for the Fish shell. - IDLE - bpo-34774: Use user-selected color theme for Help => IDLE Doc. - C API - gh-118124: Fix Py_BUILD_ASSERT and Py_BUILD_ASSERT_EXPR for non-constant expressions: use static_assert() on C11 and newer. Patch by Victor Stinner. - gh-110850: Add “Raw” variant of PyTime functions PyTime_MonotonicRaw() PyTime_PerfCounterRaw() PyTime_TimeRaw() Patch by Victor Stinner. - gh-117987: Restore functions removed in Python 3.13 alpha 1: Py_SetPythonHome() Py_SetProgramName() PySys_SetArgvEx() PySys_SetArgv() Patch by Victor Stinner. - gh-117929: Restore removed PyEval_InitThreads() function. Patch by Victor Stinner. - gh-117534: Improve validation logic in the C implementation of datetime.datetime.fromisoformat() to better handle invalid years. Patch by Vlad Efanov. - gh-68114: Fixed skipitem()’s handling of the old ‘w’ and ‘w#’ formatters. These are no longer supported and now raise an exception if used. - gh-111997: Add a C-API for firing monitoring events. - Python 3.13.0 alpha 6: - Core and Builtins - gh-117648: Improve performance of os.path.join() and os.path.expanduser(). - gh-117584: Raise TypeError for non-paths in posixpath.relpath(). - gh-117494: Refactored the instruction sequence data structure out of compile.c into instruction_sequence.c. - gh-116968: Introduce a unified 16-bit backoff counter type (_Py_BackoffCounter), shared between the Tier 1 adaptive specializer and the Tier 2 optimizer. The API used for adaptive specialization counters is changed but the behavior is (supposed to be) identical. - The behavior of the Tier 2 counters is changed: There are no longer dynamic thresholds (we never varied these). All counters now use the same exponential backoff. The counter for JUMP_BACKWARD starts counting down from 16. The temperature in side exits starts counting down from 64. - gh-117431: Improve the performance of the following bytes and bytearray methods by adapting them to the METH_FASTCALL calling convention: endswith() startswith() - gh-117431: Improve the performance of the following str methods by adapting them to the METH_FASTCALL calling convention: count() endswith() find() index() rfind() rindex() startswith() - gh-117411: Move PyFutureFeatures to an internal header and make it private. - gh-109120: Added handle of incorrect star expressions, e.g f(3, * ). Patch by Grigoryev Semyon - gh-117381: Fix error message for ntpath.commonpath(). - gh-117349: Optimise several functions in os.path. - gh-117335: Raise TypeError for non-sequences for ntpath.commonpath(). - gh-117266: Fix crashes for certain user-created subclasses of ast.AST. Such classes are now expected to set the _field_types attribute. - gh-99108: Updated the hashlib built-in HACL* project C code from upstream that we use for many implementations when they are not present via OpenSSL in a given build. This also avoids the rare potential for a C symbol name one definition rule linking issue. - gh-117108: Change the old space bit of objects in the young generation from 0 to gcstate->visited, so that any objects created during GC will have the old bit set correctly if they get moved into the old generation. - gh-117108: The cycle GC now chooses the size of increments based on the total heap size, instead of the rate of object creation. This ensures that it can keep up with growing heaps. - gh-117114: Make os.path.isdevdrive() available on all platforms. For those that do not offer Dev Drives, it will always return False. - gh-116735: For INSTRUMENTED_CALL_FUNCTION_EX, set arg0 to sys.monitoring.MISSING instead of None for CALL event. - gh-113964: Starting new threads and process creation through os.fork() are now only prevented once all non-daemon threads exit. - gh-116626: Ensure INSTRUMENTED_CALL_FUNCTION_EX always emits CALL - gh-116554: list.sort() now exploits more cases of partial ordering, particularly those with long descending runs with sub-runs of equal values. Those are recognized as single runs now (previously, each block of repeated values caused a new run to be created). - gh-114099: Added a Loader that can discover extension modules in an iOS-style Frameworks folder. - gh-115775: Compiler populates the new __static_attributes__ field on a class with the names of attributes of this class which are accessed through self.X from any function in its body. - gh-115776: The array of values, the PyDictValues struct is now embedded in the object during allocation. This provides better performance in the common case, and does not degrade as much when the object’s __dict__ is materialized. - gh-108362: Implement an incremental cyclic garbage collector. By collecting the old generation in increments, there is no need for a full heap scan. This can hugely reduce maximum pause time for programs with large heaps. - Reduce the number of generations from three to two. The old generation is split into two spaces, “visited” and “pending”. - Collection happens in two steps:: * An increment is formed from the young generation and a small part of the pending space. * This increment is scanned and the survivors moved to the end of the visited space. - When the collecting space becomes empty, the two spaces are swapped. - gh-109870: Dataclasses now calls exec() once per dataclass, instead of once per method being added. This can speed up dataclass creation by up to 20%. - gh-97901: Mime type text/rtf is now supported by mimetypes. - bpo-24612: Improve the SyntaxError that happens when ‘not’ appears after an operator. Patch by Pablo Galindo - Library - gh-117467: Preserve mailbox ownership when rewriting in mailbox.mbox.flush(). Patch by Tony Mountifield. - gh-114848: Raise FileNotFoundError when getcwd() returns ‘(unreachable)’, which can happen on Linux >= 2.6.36 with glibc < 2.27. - gh-117459: asyncio.asyncio.run_coroutine_threadsafe() now keeps the traceback of CancelledError, TimeoutError and InvalidStateError which are raised in the coroutine. - gh-117337: Deprecate undocumented glob.glob0() and glob.glob1() functions. Use glob.glob() and pass a directory to its root_dir argument instead. - gh-117348: Refactored configparser.RawConfigParser._read() to reduce cyclometric complexity and improve comprehensibility. - gh-66449: configparser.ConfigParser now accepts unnamed sections before named ones, if configured to do so. - gh-88014: In documentation of gzip.GzipFile in module gzip, explain data type of optional constructor argument mtime, and recommend mtime = 0 for generating deterministic streams. - gh-117310: Fixed an unlikely early & extra Py_DECREF triggered crash in ssl when creating a new _ssl._SSLContext if CPython was built implausibly such that the default cipher list is empty or the SSL library it was linked against reports a failure from its C SSL_CTX_set_cipher_list() API. - gh-117294: A DocTestCase now reports as skipped if all examples in the doctest are skipped. - gh-98966: In subprocess, raise a more informative message when stdout=STDOUT. - gh-117225: doctest: only print “and X failed” when non-zero, don’t pluralise “1 items”. Patch by Hugo van Kemenade. - gh-117205: Speed up compileall.compile_dir() by 20% when using multiprocessing by increasing chunksize. - gh-117178: Fix regression in lazy loading of self-referential modules, introduced in gh-114781. - gh-112383: Fix dis module’s handling of ENTER_EXECUTOR instructions. - gh-117182: Lazy-loading of modules that modify their own __class__ no longer reverts the __class__ to types.ModuleType. - gh-117084: Fix zipfile extraction for directory entries with the name containing backslashes on Windows. - gh-117110: Fix a bug that prevents subclasses of typing.Any to be instantiated with arguments. Patch by Chris Fu. - gh-109653: Deferred select imports in importlib.metadata and importlib.resources for a 14% speedup. - gh-70647: Start the deprecation period for the current behavior of datetime.datetime.strptime() and time.strptime() which always fails to parse a date string with a ValueError involving a day of month such as strptime("02-29", "%m-%d") when a year is not specified and the date happen to be February 29th. This should help avoid users finding new bugs every four years due to a natural mistaken assumption about the API when parsing partial date values. - gh-116987: Fixed inspect.findsource() for class code objects. - gh-114099: Modify standard library to allow for iOS platform differences. - gh-90872: On Windows, subprocess.Popen.wait() no longer calls WaitForSingleObject() with a negative timeout: pass 0 ms if the timeout is negative. Patch by Victor Stinner. - gh-116957: configparser: Don’t leave ConfigParser values in an invalid state (stored as a list instead of a str) after an earlier read raised DuplicateSectionError or DuplicateOptionError. - gh-115538: _io.WindowsConsoleIO now emit a warning if a boolean value is passed as a filedescriptor argument. - gh-90095: Ignore empty lines and comments in .pdbrc - gh-106531: Refreshed zipfile._path from zipp 3.18, providing better compatibility for PyPy, better glob performance for deeply nested zipfiles, and providing internal access to CompleteDirs.inject for use in other tests (like importlib.resources). - gh-63207: On Windows, time.time() now uses the GetSystemTimePreciseAsFileTime() clock to have a resolution better than 1 us, instead of the GetSystemTimeAsFileTime() clock which has a resolution of 15.6 ms. Patch by Victor Stinner. - gh-116764: Restore support of None and other false values in urllib.parse functions parse_qs() and parse_qsl(). Also, they now raise a TypeError for non-zero integers and non-empty sequences. - gh-116811: In PathFinder.invalidate_caches, delegate to MetadataPathFinder.invalidate_caches. - gh-116647: Fix recursive child in dataclasses - gh-113171: Fixed various false positives and false negatives in ipaddress.IPv4Address.is_private (see these docs for details) ipaddress.IPv4Address.is_global ipaddress.IPv6Address.is_private ipaddress.IPv6Address.is_global - Also in the corresponding ipaddress.IPv4Network and ipaddress.IPv6Network attributes. - Fixes bsc#1226448 (CVE-2024-4032). - gh-63283: In encodings.idna, any capitalization of the the ACE prefix (xn--) is now acceptable. Patch by Pepijn de Vos and Zackery Spytz. - gh-71042: Add platform.android_ver(), which provides device and OS information on Android. - gh-73468: Added new math.fma() function, wrapping C99’s fma() operation: fused multiply-add function. Patch by Mark Dickinson and Victor Stinner. - gh-116608: The importlib.resources functions is_resource(), open_binary(), open_text(), path(), read_binary(), and read_text() are un-deprecated, and support subdirectories via multiple positional arguments. The contents() function also allows subdirectories, but remains deprecated. - gh-116484: Change automatically generated tkinter.Checkbutton widget names to avoid collisions with automatically generated tkinter.ttk.Checkbutton widget names within the same parent widget. - gh-114314: In ctypes, ctype data is now stored in type objects directly rather than in a dict subclass. This is an internal change that should not affect usage. - gh-116401: Fix blocking os.fwalk() and shutil.rmtree() on opening named pipe. - gh-71052: Implement ctypes.util.find_library() on Android. - gh-90535: Fix support of interval values > 1 in logging.TimedRotatingFileHandler for when='MIDNIGHT' and when='Wx'. - gh-113308: Remove some internal protected parts from uuid: _has_uuid_generate_time_safe, _netbios_getnode, _ipconfig_getnode, and _load_system_functions. They were unused. - gh-115627: Fix the ssl module error handling of connection terminate by peer. It now throws an OSError with the appropriate error code instead of an EOFError. - gh-114847: Speed up os.path.realpath() on non-Windows platforms. - gh-114271: Fix a race in threading.Thread.join(). - threading._MainThread now always represents the main thread of the main interpreter. - PyThreadState.on_delete and PyThreadState.on_delete_data have been removed. - gh-113538: Add asyncio.Server.close_clients() and asyncio.Server.abort_clients() methods which allow to more forcefully close an asyncio server. - gh-85287: Changes Unicode codecs to return UnicodeEncodeError or UnicodeDecodeError, rather than just UnicodeError. - gh-113548: pdb now allows CLI arguments to pdb -m. - gh-112948: Make completion of pdb similar to Python REPL - gh-105866: Fixed _get_slots bug which caused error when defining dataclasses with slots and a weakref_slot. - gh-96471: Add asyncio.Queue termination with shutdown() method. - gh-89739: The zipimport module can now read ZIP64 files. - bpo-33533: asyncio.as_completed() now returns an object that is both an asynchronous iterator and plain iterator. The new asynchronous iteration pattern allows for easier correlation between prior tasks and their completed results. This is a closer match to concurrent.futures.as_completed()’s iteration pattern. Patch by Justin Arthur. - bpo-27578: inspect.getsource() (and related functions) work with empty module files, returning '\n' (or reasonable equivalent) instead of raising OSError. Patch by Kernc. - bpo-37141: Accept an iterable of separators in asyncio.StreamReader.readuntil(), stopping when one of them is encountered. - gh-66543: Make mimetypes.guess_type() properly parsing of URLs with only a host name, URLs containing fragment or query, and filenames with only a UNC sharepoint on Windows. Based on patch by Dong-hee Na. - bpo-15010: unittest.TestLoader.discover() now saves the original value of unittest.TestLoader._top_level_dir and restores it at the end of the call. - Documentation - gh-115977: Remove compatibilty references to Emscripten. - gh-114099: Add an iOS platform guide, and flag modules not available on iOS. - gh-91565: Changes to documentation files and config outputs to reflect the new location for reporting bugs - i.e. GitHub rather than bugs.python.org. - Tests - gh-83434: Disable JUnit XML output (--junit-xml=FILE command line option) in regrtest when hunting for reference leaks (-R option). Patch by Victor Stinner. - gh-117187: Fix XML tests for vanilla Expat <2.6.0. - gh-116333: Tests of TLS related things (error codes, etc) were updated to be more lenient about specific error message strings and behaviors as seen in the BoringSSL and AWS-LC forks of OpenSSL. - gh-117089: Consolidated tests for importlib.metadata in their own metadata package. - gh-115979: Update test_importlib so that it passes under WASI SDK 21. - gh-112536: Add –tsan to test.regrtest for running TSAN tests in reasonable execution times. Patch by Donghee Na. - gh-116307: Added import helper isolated_modules as CleanImport does not remove modules imported during the context. Use it in importlib.resources tests to avoid leaving mod around to impede importlib.metadata tests. - Build - gh-114736: Have WASI builds use WASI SDK 21. - gh-115983: Skip building test modules that must be built as shared under WASI. - gh-71052: Add Android build script and instructions. - Windows - gh-117267: Ensure DirEntry.stat().st_ctime behaves consistently with os.stat() during the deprecation period of st_ctime by containing the same value as st_birthtime. After the deprecation period, st_ctime will be the metadata change time (or unavailable through DirEntry), and only st_birthtime will contain the creation time. - gh-116195: Improves performance of os.getppid() by using an alternate system API when available. Contributed by vxiiduu. - gh-88494: On Windows, time.monotonic() now uses the QueryPerformanceCounter() clock to have a resolution better than 1 us, instead of the GetTickCount64() clock which has a resolution of 15.6 ms. Patch by Victor Stinner. - gh-116773: Fix instances of <_overlapped.Overlapped object at 0xXXX> still has pending operation at deallocation, the process may crash. - gh-91227: Fix the asyncio ProactorEventLoop implementation so that sending a datagram to an address that is not listening does not prevent receiving any more datagrams. - gh-115119: Switched from vendored libmpdecimal code to a separately-hosted external package in the cpython-source-deps repository when building the _decimal module. - C API - gh-117642: Fix PEP 737 implementation for %#T and %#N. - gh-87193: _PyBytes_Resize() can now be called for bytes objects with reference count > 1, including 1-byte bytes objects. It creates a new bytes object and destroys the old one if it has reference count > 1. - gh-117021: Fix integer overflow in PyLong_AsPid() on non-Windows 64-bit platforms. - gh-115756: PyCode_GetFirstFree() is an ustable API now and has been renamed to PyUnstable_Code_GetFirstFree(). (Contributed by Bogdan Romanyuk in gh-115781) - gh-116869: Add test_cext test: build a C extension to check if the Python C API emits C compiler warnings. Patch by Victor Stinner. - gh-116869: Make the C API compatible with - Werror=declaration-after-statement compiler flag again. Patch by Victor Stinner. - gh-116936: Add PyType_GetModuleByDef() to the limited C API. Patch by Victor Stinner. - gh-116809: Restore removed private _PyErr_ChainExceptions1() function. Patch by Victor Stinner. - gh-115754: In the limited C API version 3.13, getting Py_None, Py_False, Py_True, Py_Ellipsis and Py_NotImplemented singletons is now implemented as function calls at the stable ABI level to hide implementation details. Getting these constants still return borrowed references. Patch by Victor Stinner. - gh-115754: Add Py_GetConstant() and Py_GetConstantBorrowed() functions to get constants. For example, Py_GetConstant(Py_CONSTANT_ZERO) returns a strong reference to the constant zero. Patch by Victor Stinner. - gh-111696: Add support for %T, %T#, %N and %N# formats to PyUnicode_FromFormat(): format the fully qualified name of an object type and of a type: call PyType_GetModuleName(). See PEP 737 for more information. Patch by Victor Stinner. - gh-111696: Add PyType_GetModuleName() function to get the type’s module name. Equivalent to getting the type.__module__ attribute. Patch by Eric Snow and Victor Stinner. - gh-111696: Add PyType_GetFullyQualifiedName() function to get the type’s fully qualified name. Equivalent to f"{type.__module__}.{type.__qualname__}", or type.__qualname__ if type.__module__ is not a string or is equal to "builtins". Patch by Victor Stinner. - gh-85283: The fcntl, grp, pwd, termios, _statistics and _testconsole C extensions are now built with the limited C API. Patch by Victor Stinner. - gh-111140: Add additional flags to PyLong_AsNativeBytes() and PyLong_FromNativeBytes() to allow the caller to determine how to handle edge cases around values that fill the entire buffer. - gh-113024: Add PyObject_GenericHash() function. ------------------------------------------------------------------ ------------------ 2024-5-8 - May 8 2024 ------------------- ------------------------------------------------------------------ ++++ pgadmin4: - Add patch from upstream to fix a multi-factor authentication bypass vulnerability (bsc#1223867, CVE-2024-4215): * 0001-Fixed-Multi-Factor-Authentication-bypass-vulnerability.patch - Add patch from upstream to fix a XSS vulnerability in /settings/store API response json payload (bsc#1223868, CVE-2024-4216): * 0001-Fixed-the-following-code-smells.patch * 0002-Fixed-a-XSS-vulnerability-in-the-_settings_store-endpoint.patch ------------------------------------------------------------------ ------------------ 2024-5-7 - May 7 2024 ------------------- ------------------------------------------------------------------ ++++ python-tqdm: - Update to 4.66.4: * rich: fix completion (#1395 <- #1306) * cli: eval safety (CVE-2024-34062, bsc#1223880) * pandas: add DataFrame.progress_map (#1549) * notebook: fix HTML padding (#1506) * keras: fix resuming training when verbose>=2 (#1508) * fix format_num negative fractions missing leading zero (#1548) * fix Python 3.12 DeprecationWarning on import (#1519) - Drop patch sprinkle-in-timezone.patch: Included upstream. ++++ python-Jinja2: - Add CVE-2024-34064.patch upstream patch (CVE-2024-34064, bsc#1223980, gh#pallets/jinja@0668239dc6b4) Also fixes (CVE-2024-22195, bsc#1218722) ++++ python-Werkzeug: - Add CVE-2024-34069.patch, restrict debugger trusted hosts. (bsc#1223979, CVE-2024-34069, gh#pallets/werkzeug@3386395b24c7) ------------------------------------------------------------------ ------------------ 2024-5-6 - May 6 2024 ------------------- ------------------------------------------------------------------ ++++ python313-pluggy: - Update to 1.5.0: * Features + Add support for deprecating specific hook parameters, or more generally, for issuing a warning whenever a hook implementation requests certain parameters. + A warning ~pluggy.PluggyTeardownRaisedWarning is now issued when an old-style hookwrapper raises an exception during teardown. + Add PluginManager.unblock method to unblock a plugin by plugin name. * Bug Fixes + PluginManager.get_plugins() no longer returns None for blocked plugins. + Fix ~pluggy.HookCaller.call_extra() extra methods getting ordered before everything else in some circumstances. Regressed in pluggy 1.1.0. + Fix plugins registering other plugins in a hook when the other plugins implement the same hook itself. Regressed in pluggy 1.1.0. - Switch to pyproject macros. ------------------------------------------------------------------ ------------------ 2024-5-1 - May 1 2024 ------------------- ------------------------------------------------------------------ ++++ python311: - Update CVE-2023-52425-libexpat-2.6.0-backport.patch so that it uses features sniffing, not just comparing version number. Include also support-expat-CVE-2022-25236-patched.patch. - Add CVE-2023-52425-remove-reparse_deferral-tests.patch skipping failing tests. - Refresh patches: - CVE-2023-27043-email-parsing-errors.patch - fix_configure_rst.patch - skip_if_buildbot-extend.patch - Remove included patch: - support-expat-CVE-2022-25236-patched.patch ++++ python311-core: - Update CVE-2023-52425-libexpat-2.6.0-backport.patch so that it uses features sniffing, not just comparing version number. Include also support-expat-CVE-2022-25236-patched.patch. - Add CVE-2023-52425-remove-reparse_deferral-tests.patch skipping failing tests. - Refresh patches: - CVE-2023-27043-email-parsing-errors.patch - fix_configure_rst.patch - skip_if_buildbot-extend.patch - Remove included patch: - support-expat-CVE-2022-25236-patched.patch ------------------------------------------------------------------ ------------------ 2024-4-28 - Apr 28 2024 ------------------- ------------------------------------------------------------------ ++++ python313-pip: - update to 24.0: * Retry on HTTP status code 502 * Automatically use the setuptools PEP 517 build backend when - -config-settings is used for projects without pyproject.toml. * Make pip freeze and pip uninstall of legacy editable installs of packages whose name contains _ compatible with setuptools>=69.0.3. * Support per requirement --config-settings for editable installs. * Optimized usage of --find-links=, by only scanning the relevant directory once, only considering file names that are valid wheel or sdist names, and only considering files in the directory that are related to the install. * Removed wheel from the [build-system].requires list fallback that is used when pyproject.toml is absent. * Upgrade distlib to 0.3.8 * Fix explanation of how PIP_CONFIG_FILE works * Fix outdated pip install argument description in documentation. * Replace some links to PEPs with links to the canonical specifications on the :doc:`pypug:index` * Updated the pyproject.toml document to stop suggesting to depend on wheel as a build dependency directly. * Update supported interpreters in development docs * Most project metadata is now defined statically via pip's pyproject.toml file. ------------------------------------------------------------------ ------------------ 2024-4-27 - Apr 27 2024 ------------------- ------------------------------------------------------------------ ++++ python313-platformdirs: - update to 4.2.1: * Switch to ruff for formatting and use codespell and docformatter * Use hatch over tox * Allow working without ctypes ------------------------------------------------------------------ ------------------ 2024-4-23 - Apr 23 2024 ------------------- ------------------------------------------------------------------ ++++ csp-billing-adapter: - Update to version 0.10.0: * Add free trial feature ------------------------------------------------------------------ ------------------ 2024-4-22 - Apr 22 2024 ------------------- ------------------------------------------------------------------ ++++ python-Sphinx: - Add fix-test-expectation-for-enum-rendering-on-python-3.12.3.patch gh#sphinx-doc/sphinx#12293, bsc#1223128 ------------------------------------------------------------------ ------------------ 2024-4-20 - Apr 20 2024 ------------------- ------------------------------------------------------------------ ++++ python313-trove-classifiers: - update to 2024.4.10: * added more trove classifiers ------------------------------------------------------------------ ------------------ 2024-4-18 - Apr 18 2024 ------------------- ------------------------------------------------------------------ ++++ python-argcomplete: - Update to 3.3.0 (bsc#1222880): * Preserve compatibility with argparse option tuples of length 4. This update is required to use argcomplete on Python 3.11.9+ or 3.12.3+. - update to 3.2.3: * Allow register-python-argcomplete output to be used as lazy-loaded zsh completion module (#475) - Move debug_stream initialization to helper method to allow fd 9 behavior to be overridden in subclasses (#471) ++++ python-idna: - Add CVE-2024-3651.patch, backported from upstream commit gh#kjd/idna#172/commits/5beb28b9dd77912c0dd656d8b0fdba3eb80222e7 (bsc#1222842, CVE-2024-3651) ++++ python313-argcomplete: - Update to 3.3.0 (bsc#1222880): * Preserve compatibility with argparse option tuples of length 4. This update is required to use argcomplete on Python 3.11.9+ or 3.12.3+. - update to 3.2.3: * Allow register-python-argcomplete output to be used as lazy-loaded zsh completion module (#475) - Move debug_stream initialization to helper method to allow fd 9 behavior to be overridden in subclasses (#471) ------------------------------------------------------------------ ------------------ 2024-4-17 - Apr 17 2024 ------------------- ------------------------------------------------------------------ ++++ python-gunicorn: - Add patch CVE-2024-1135.patch (bsc#1222950) ++++ libxml2-python: - Update to version 2.12.6 * Regressions - parser: Fix detection of duplicate attributes in XML namespace - xmlreader: Fix xmlTextReaderConstEncoding - html: Fix htmlCreatePushParserCtxt with encoding - xmllint: Return error code if XPath returns empty nodeset - Update to version 2.12.5 * Security - [CVE-2024-25062] xmlreader: Don't expand XIncludes when backtracking * Regressions - parser: Fix crash in xmlParseInNodeContext with HTML documents - Update to version 2.12.4 * Regressions - parser: Fix regression parsing standalone declarations - autotools: Readd --with-xptr-locs configuration option - parser: Fix build --without-output - parser: Don't grow or shrink pull parser memory buffers - io: Fix memory lifetime issue with input buffers - Update to version 2.12.3 * Regressions - parser: Fix namespaces redefined from default attributes * Build fixes - include: Rename XML_EMPTY helper macro - include: Move declaration of xmlInitGlobals - include: Add missing includes - include: Move globals from xmlsave.h to parser.h - include: Readd circular dependency between tree.h and parser.h - Drop libxml2-CVE-2024-25062.patch as it is part of upstream ------------------------------------------------------------------ ------------------ 2024-4-15 - Apr 15 2024 ------------------- ------------------------------------------------------------------ ++++ python311: - Add CVE-2023-52425-libexpat-2.6.0-backport.patch to fix tests with patched libexpat below 2.6.0 that doesn't update the version number, just in SLE. ++++ python311-core: - Add CVE-2023-52425-libexpat-2.6.0-backport.patch to fix tests with patched libexpat below 2.6.0 that doesn't update the version number, just in SLE. ------------------------------------------------------------------ ------------------ 2024-4-11 - Apr 11 2024 ------------------- ------------------------------------------------------------------ ++++ csp-billing-adapter-local: - Update to version 0.5.1: * Cast file path to a string for usage ------------------------------------------------------------------ ------------------ 2024-4-10 - Apr 10 2024 ------------------- ------------------------------------------------------------------ ++++ python-Pillow: - Reenable tests for s390x and ppc, bsc#1222553 gh#python-pillow/Pillow#1204 ------------------------------------------------------------------ ------------------ 2024-4-9 - Apr 9 2024 ------------------- ------------------------------------------------------------------ ++++ pgadmin4: - Add patch from upstream to fix an unsafe deserialization and Remote Code Execution by an authenticated user (bsc#1221172, CVE-2024-2044): * 0001-Unsafe-Deserialization-and-Remote-Code-Execution-by-an.patch ------------------------------------------------------------------ ------------------ 2024-4-8 - Apr 8 2024 ------------------- ------------------------------------------------------------------ ++++ pgadmin4: - update to 8.5: * supported database servers - postgresql: 12, 13, 14, 15, and 16 - edb advanced server: 12, 13, 14, 15, and 16 * bundled postgresql utilities - psql, pg_dump, pg_dumpall, pg_restore: 16.1 * New features - Added support for provider, deterministic, version and RULES parameter while creating collation. - Added support for EDB Job Scheduler. - Added support for viewing Log Based Clusters. - Added support for UNIX socket in entrypoint.sh for Docker implementation. * Bug fixes - Fixed an issue in Schema Diff where Columns with sequences get altered unnecessarily. - Fixed an issue where user was unable to share a newly registered server. - Bug fixes and improvements in pgAdmin CLI. - Fixed an issue where the 'Save Password' option for SSH tunneling password was consistently disabled. - Fixed schema diff wrong query generation for table, foreign table and sequence. - Fixed an issue where table properties were not updating from properties dialog. - Fixed an issue where maximize icon is missing from query tool panel. - Fix an issue in table dialog where changing column name was not syncing table constraints appropriately. - Fixed rollback and commit button activation on execute button click. - Fixed an issue where taking backup of a shared server was using server owner's user name. - Fix an issue in editor where replace option in query tool edit menu is not working on non-Mac OS. - Fix an issue in editor where Format SQL shortcut and multiline selection are not working. - Fix an issue in editor where "Use Spaces?" Preference of Editor is not working. - Fixed an issue where Triggers, Rules, Indexes were absent from the Schema Diff when comparing views. - Fix an issue in query tool where toggle case of selected text loses selection. - Fix query tool autocomplete results when cursor is in between the SQL query. - Fix an issue in query tool where custom keyboard shortcuts are not working for some. - Fixed the issue where the update-user CLI command doesn't change the password. - Fixed issue related to email authentication of Two-factor authentication. - Fixed a remote code execution issue in the validate binary path (boo#1222390, CVE-2024-3116). - update to 8.4: * supported database servers - postgresql: 12, 13, 14, 15, and 16 - edb advanced server: 12, 13, 14, 15, and 16 * bundled postgresql utilities - psql, pg_dump, pg_dumpall, pg_restore: 16.1 * New features - Allow preferences customization using a configuration file. - Add support for JSON log format. - Add --yes option for skipping the confirmation prompt while deleting the user via CLI for scripting purpose. * Housekeeping - Upgrade CodeMirror from version 5 to 6. - Added documentation for Dashboard's System Statistics tab. - Separate the application name, branding & version information from the configuration file. - Upgrade python packages cryptography to 42.0.x and Flask-Security-Too to 5.3.x. * Bug fixes - Fix multiple issues where PasswordExecCommand was not working in server mode and PasswordExecCommand was not loaded when importing servers. - Fix the tabbed panel backward/forward shortcut for tabs. - Fixed an issue where dependencies and dependents were not showing if a composite type is used as an attribute in another composite type. - Fix an issue where constraint check control is enabled in the edit table dialog. - Fix an issue where the scripts created by generate script of Schema diff for Table with sequence was not working earlier. - Ensure that the OAuth2 session is logged out when users log out from pgAdmin. - Remove role related checks on the UI dashboard when terminating session/query and let PostgreSQL take care of it. - Fix an issue where type column in dependents/dependencies tab is not showing correct label. - Unsafe Deserialization and Remote Code Execution by an Authenticated user in pgAdmin 4 (boo#1221172, CVE-2024-2044). - Replace the requirement for cryptography 42.0 to be satisfied with 41.0 (which is the version we have in SLE) given that the code using the cryptography module doesn't seem to really require 42.0 . ++++ python311: - Remove not needed upstream patches: * libexpat260.patch * CVE-2023-6597-TempDir-cleaning-symlink.patch, bsc#1219666 * CVE-2024-0397-memrace_ssl.SSLContext_cert_store.patch - Update to 3.11.9: * Security - gh-115398: Allow controlling Expat >=2.6.0 reparse deferral (CVE-2023-52425, bsc#1219559) by adding five new methods: xml.etree.ElementTree.XMLParser.flush() xml.etree.ElementTree.XMLPullParser.flush() xml.parsers.expat.xmlparser.GetReparseDeferralEnabled() xml.parsers.expat.xmlparser.SetReparseDeferralEnabled() xml.sax.expatreader.ExpatParser.flush() - gh-115399: Update bundled libexpat to 2.6.0 - gh-115243: Fix possible crashes in collections.deque.index() when the deque is concurrently modified. - gh-114572: ssl.SSLContext.cert_store_stats() and ssl.SSLContext.get_ca_certs() now correctly lock access to the certificate store, when the ssl.SSLContext is shared across multiple threads (bsc#1226447, CVE-2024-0397). * Core and Builtins - gh-116296: Fix possible refleak in object.__reduce__() internal error handling. - gh-116034: Fix location of the error on a failed assertion. - gh-115823: Properly calculate error ranges in the parser when raising SyntaxError exceptions caused by invalid byte sequences. Patch by Pablo Galindo - gh-112087: For an empty reverse iterator for list will be reduced to reversed(). Patch by Donghee Na. - gh-115011: Setters for members with an unsigned integer type now support the same range of valid values for objects that has a __index__() method as for int. - gh-96497: Fix incorrect resolution of mangled class variables used in assignment expressions in comprehensions. * Library - gh-117310: Fixed an unlikely early & extra Py_DECREF triggered crash in ssl when creating a new _ssl._SSLContext if CPython was built implausibly such that the default cipher list is empty or the SSL library it was linked against reports a failure from its C SSL_CTX_set_cipher_list() API. - gh-117178: Fix regression in lazy loading of self-referential modules, introduced in gh-114781. - gh-117084: Fix zipfile extraction for directory entries with the name containing backslashes on Windows. - gh-117110: Fix a bug that prevents subclasses of typing.Any to be instantiated with arguments. Patch by Chris Fu. - gh-90872: On Windows, subprocess.Popen.wait() no longer calls WaitForSingleObject() with a negative timeout: pass 0 ms if the timeout is negative. Patch by Victor Stinner. - gh-116957: configparser: Don’t leave ConfigParser values in an invalid state (stored as a list instead of a str) after an earlier read raised DuplicateSectionError or DuplicateOptionError. - gh-90095: Ignore empty lines and comments in .pdbrc - gh-116764: Restore support of None and other false values in urllib.parse functions parse_qs() and parse_qsl(). Also, they now raise a TypeError for non-zero integers and non-empty sequences. - gh-116811: In PathFinder.invalidate_caches, delegate to MetadataPathFinder.invalidate_caches. - gh-116600: Fix repr() for global Flag members. - gh-116484: Change automatically generated tkinter.Checkbutton widget names to avoid collisions with automatically generated tkinter.ttk.Checkbutton widget names within the same parent widget. - gh-116401: Fix blocking os.fwalk() and shutil.rmtree() on opening named pipe. - gh-116143: Fix a race in pydoc _start_server, eliminating a window in which _start_server can return a thread that is “serving” but without a docserver set. - gh-116325: typing: raise SyntaxError instead of AttributeError on forward references as empty strings. - gh-90535: Fix support of interval values > 1 in logging.TimedRotatingFileHandler for when='MIDNIGHT' and when='Wx'. - gh-115978: Disable preadv(), readv(), pwritev(), and writev() on WASI. - Under wasmtime for WASI 0.2, these functions don’t pass test_posix (https://github.com/bytecodealliance/wasmtime/issues/7830). - gh-88352: Fix the computation of the next rollover time in the logging.TimedRotatingFileHandler handler. computeRollover() now always returns a timestamp larger than the specified time and works correctly during the DST change. doRollover() no longer overwrite the already rolled over file, saving from data loss when run at midnight or during repeated time at the DST change. - gh-87115: Set __main__.__spec__ to None when running a script with pdb - gh-76511: Fix UnicodeEncodeError in email.Message.as_string() that results when a message that claims to be in the ascii character set actually has non-ascii characters. Non-ascii characters are now replaced with the U+FFFD replacement character, like in the replace error handler. - gh-75988: Fixed unittest.mock.create_autospec() to pass the call through to the wrapped object to return the real result. - gh-115881: Fix issue where ast.parse() would incorrectly flag conditional context managers (such as with (x() if y else z()): ...) as invalid syntax if feature_version=(3, 8) was passed. This reverts changes to the grammar made as part of gh-94949. - gh-115886: Fix silent truncation of the name with an embedded null character in multiprocessing.shared_memory.SharedMemory. - gh-115809: Improve algorithm for computing which rolled-over log files to delete in logging.TimedRotatingFileHandler. It is now reliable for handlers without namer and with arbitrary deterministic namer that leaves the datetime part in the file name unmodified. - gh-74668: urllib.parse functions parse_qs() and parse_qsl() now support bytes arguments containing raw and percent-encoded non-ASCII data. - gh-67044: csv.writer() now always quotes or escapes '\r' and '\n', regardless of lineterminator value. - gh-115712: csv.writer() now quotes empty fields if delimiter is a space and skipinitialspace is true and raises exception if quoting is not possible. - gh-115618: Fix improper decreasing the reference count for None argument in property methods getter(), setter() and deleter(). - gh-115570: A DeprecationWarning is no longer omitted on access to the __doc__ attributes of the deprecated typing.io and typing.re pseudo-modules. - gh-112006: Fix inspect.unwrap() for types with the __wrapper__ data descriptor. - gh-101293: Support callables with the __call__() method and types with __new__() and __init__() methods set to class methods, static methods, bound methods, partial functions, and other types of methods and descriptors in inspect.Signature.from_callable(). - gh-115392: Fix a bug in doctest where incorrect line numbers would be reported for decorated functions. - gh-114563: Fix several format() bugs when using the C implementation of Decimal: * memory leak in some rare cases when using the z format option (coerce negative 0) * incorrect output when applying the z format option to type F (fixed-point with capital NAN / INF) * incorrect output when applying the # format option (alternate form) - gh-115197: urllib.request no longer resolves the hostname before checking it against the system’s proxy bypass list on macOS and Windows. - gh-115198: Fix support of Docutils >= 0.19 in distutils. - gh-115165: Most exceptions are now ignored when attempting to set the __orig_class__ attribute on objects returned when calling typing generic aliases (including generic aliases created using typing.Annotated). Previously only AttributeError was ignored. Patch by Dave Shawley. - gh-115133: Fix tests for XMLPullParser with Expat 2.6.0. - gh-115059: io.BufferedRandom.read1() now flushes the underlying write buffer. - gh-79382: Trailing ** no longer allows to match files and non-existing paths in recursive glob(). - gh-114763: Protect modules loaded with importlib.util.LazyLoader from race conditions when multiple threads try to access attributes before the loading is complete. - gh-97959: Fix rendering class methods, bound methods, method and function aliases in pydoc. Class methods no longer have “method of builtins.type instance” note. Corresponding notes are now added for class and unbound methods. Method and function aliases now have references to the module or the class where the origin was defined if it differs from the current. Bound methods are now listed in the static methods section. Methods of builtin classes are now supported as well as methods of Python classes. - gh-112281: Allow creating union of types for typing.Annotated with unhashable metadata. - gh-111775: Fix importlib.resources.simple.ResourceHandle.open() for text mode, added missed stream argument. - gh-90095: Make .pdbrc and -c work with any valid pdb commands. - gh-107155: Fix incorrect output of help(x) where x is a lambda function, which has an __annotations__ dictionary attribute with a "return" key. - gh-105866: Fixed _get_slots bug which caused error when defining dataclasses with slots and a weakref_slot. - gh-60346: Fix ArgumentParser inconsistent with parse_known_args. - gh-100985: Update HTTPSConnection to consistently wrap IPv6 Addresses when using a proxy. - gh-100884: email: fix misfolding of comma in address-lists over multiple lines in combination with unicode encoding (bsc#1238450 CVE-2025-1795) - gh-95782: Fix io.BufferedReader.tell(), io.BufferedReader.seek(), _pyio.BufferedReader.tell(), io.BufferedRandom.tell(), io.BufferedRandom.seek() and _pyio.BufferedRandom.tell() being able to return negative offsets. - gh-96310: Fix a traceback in argparse when all options in a mutually exclusive group are suppressed. - gh-93205: Fixed a bug in logging.handlers.TimedRotatingFileHandler where multiple rotating handler instances pointing to files with the same name but different extensions would conflict and not delete the correct files. - bpo-44865: Add missing call to localization function in argparse. - bpo-43952: Fix multiprocessing.connection.Listener.accept() to accept empty bytes as authkey. Not accepting empty bytes as key causes it to hang indefinitely. - bpo-42125: linecache: get module name from __spec__ if available. This allows getting source code for the __main__ module when a custom loader is used. - gh-66543: Make mimetypes.guess_type() properly parsing of URLs with only a host name, URLs containing fragment or query, and filenames with only a UNC sharepoint on Windows. Based on patch by Dong-hee Na. - bpo-33775: Add ‘default’ and ‘version’ help text for localization in argparse. * Documentation - gh-115399: Document CVE-2023-52425 of Expat <2.6.0 under “XML vulnerabilities”. - gh-115233: Fix an example for LoggerAdapter in the Logging Cookbook. * Tests - gh-83434: Disable JUnit XML output (--junit-xml=FILE command line option) in regrtest when hunting for reference leaks (-R option). Patch by Victor Stinner. - gh-117187: Fix XML tests for vanilla Expat <2.6.0. - gh-115979: Update test_importlib so that it passes under WASI SDK 21. - gh-116307: Added import helper isolated_modules as CleanImport does not remove modules imported during the context. - gh-115720: Leak tests (-R, --huntrleaks) now show a summary of the number of leaks found in each iteration. - gh-115122: Add --bisect option to regrtest test runner: run failed tests with test.bisect_cmd to identify failing tests. Patch by Victor Stinner. - gh-115596: Fix ProgramPriorityTests in test_os permanently changing the process priority. - gh-115198: Fix test_check_metadata_deprecate in distutils tests with a newer Docutils. * Build - gh-116313: Get WASI builds to work under wasmtime 18 w/ WASI 0.2/preview2 primitives. - gh-115167: Avoid vendoring vcruntime140_threads.dll when building with Visual Studio 2022 version 17.8. * Windows - gh-116773: Fix instances of <_overlapped.Overlapped object at 0xXXX> still has pending operation at deallocation, the process may crash. - gh-91227: Fix the asyncio ProactorEventLoop implementation so that sending a datagram to an address that is not listening does not prevent receiving any more datagrams. - gh-115554: The installer now has more strict rules about updating the Python Launcher for Windows. In general, most users only have a single launcher installed and will see no difference. When multiple launchers have been installed, the option to install the launcher is disabled until all but one have been removed. Downgrading the launcher (which was never allowed) is now more obviously blocked. - gh-115543: Python Launcher for Windows can now detect Python 3.13 when installed from the Microsoft Store, and will install Python 3.12 by default when PYLAUNCHER_ALLOW_INSTALL is set. - gh-115009: Update Windows installer to use SQLite 3.45.1. * IDLE - gh-88516: On macOS show a proxy icon in the title bar of editor windows to match platform behaviour. * Tools/Demos - gh-113516: Don’t set LDSHARED when building for WASI. * C API - gh-117021: Fix integer overflow in PyLong_AsPid() on non-Windows 64-bit platforms. ++++ python311-core: - Remove not needed upstream patches: * libexpat260.patch * CVE-2023-6597-TempDir-cleaning-symlink.patch, bsc#1219666 * CVE-2024-0397-memrace_ssl.SSLContext_cert_store.patch - Update to 3.11.9: * Security - gh-115398: Allow controlling Expat >=2.6.0 reparse deferral (CVE-2023-52425, bsc#1219559) by adding five new methods: xml.etree.ElementTree.XMLParser.flush() xml.etree.ElementTree.XMLPullParser.flush() xml.parsers.expat.xmlparser.GetReparseDeferralEnabled() xml.parsers.expat.xmlparser.SetReparseDeferralEnabled() xml.sax.expatreader.ExpatParser.flush() - gh-115399: Update bundled libexpat to 2.6.0 - gh-115243: Fix possible crashes in collections.deque.index() when the deque is concurrently modified. - gh-114572: ssl.SSLContext.cert_store_stats() and ssl.SSLContext.get_ca_certs() now correctly lock access to the certificate store, when the ssl.SSLContext is shared across multiple threads (bsc#1226447, CVE-2024-0397). * Core and Builtins - gh-116296: Fix possible refleak in object.__reduce__() internal error handling. - gh-116034: Fix location of the error on a failed assertion. - gh-115823: Properly calculate error ranges in the parser when raising SyntaxError exceptions caused by invalid byte sequences. Patch by Pablo Galindo - gh-112087: For an empty reverse iterator for list will be reduced to reversed(). Patch by Donghee Na. - gh-115011: Setters for members with an unsigned integer type now support the same range of valid values for objects that has a __index__() method as for int. - gh-96497: Fix incorrect resolution of mangled class variables used in assignment expressions in comprehensions. * Library - gh-117310: Fixed an unlikely early & extra Py_DECREF triggered crash in ssl when creating a new _ssl._SSLContext if CPython was built implausibly such that the default cipher list is empty or the SSL library it was linked against reports a failure from its C SSL_CTX_set_cipher_list() API. - gh-117178: Fix regression in lazy loading of self-referential modules, introduced in gh-114781. - gh-117084: Fix zipfile extraction for directory entries with the name containing backslashes on Windows. - gh-117110: Fix a bug that prevents subclasses of typing.Any to be instantiated with arguments. Patch by Chris Fu. - gh-90872: On Windows, subprocess.Popen.wait() no longer calls WaitForSingleObject() with a negative timeout: pass 0 ms if the timeout is negative. Patch by Victor Stinner. - gh-116957: configparser: Don’t leave ConfigParser values in an invalid state (stored as a list instead of a str) after an earlier read raised DuplicateSectionError or DuplicateOptionError. - gh-90095: Ignore empty lines and comments in .pdbrc - gh-116764: Restore support of None and other false values in urllib.parse functions parse_qs() and parse_qsl(). Also, they now raise a TypeError for non-zero integers and non-empty sequences. - gh-116811: In PathFinder.invalidate_caches, delegate to MetadataPathFinder.invalidate_caches. - gh-116600: Fix repr() for global Flag members. - gh-116484: Change automatically generated tkinter.Checkbutton widget names to avoid collisions with automatically generated tkinter.ttk.Checkbutton widget names within the same parent widget. - gh-116401: Fix blocking os.fwalk() and shutil.rmtree() on opening named pipe. - gh-116143: Fix a race in pydoc _start_server, eliminating a window in which _start_server can return a thread that is “serving” but without a docserver set. - gh-116325: typing: raise SyntaxError instead of AttributeError on forward references as empty strings. - gh-90535: Fix support of interval values > 1 in logging.TimedRotatingFileHandler for when='MIDNIGHT' and when='Wx'. - gh-115978: Disable preadv(), readv(), pwritev(), and writev() on WASI. - Under wasmtime for WASI 0.2, these functions don’t pass test_posix (https://github.com/bytecodealliance/wasmtime/issues/7830). - gh-88352: Fix the computation of the next rollover time in the logging.TimedRotatingFileHandler handler. computeRollover() now always returns a timestamp larger than the specified time and works correctly during the DST change. doRollover() no longer overwrite the already rolled over file, saving from data loss when run at midnight or during repeated time at the DST change. - gh-87115: Set __main__.__spec__ to None when running a script with pdb - gh-76511: Fix UnicodeEncodeError in email.Message.as_string() that results when a message that claims to be in the ascii character set actually has non-ascii characters. Non-ascii characters are now replaced with the U+FFFD replacement character, like in the replace error handler. - gh-75988: Fixed unittest.mock.create_autospec() to pass the call through to the wrapped object to return the real result. - gh-115881: Fix issue where ast.parse() would incorrectly flag conditional context managers (such as with (x() if y else z()): ...) as invalid syntax if feature_version=(3, 8) was passed. This reverts changes to the grammar made as part of gh-94949. - gh-115886: Fix silent truncation of the name with an embedded null character in multiprocessing.shared_memory.SharedMemory. - gh-115809: Improve algorithm for computing which rolled-over log files to delete in logging.TimedRotatingFileHandler. It is now reliable for handlers without namer and with arbitrary deterministic namer that leaves the datetime part in the file name unmodified. - gh-74668: urllib.parse functions parse_qs() and parse_qsl() now support bytes arguments containing raw and percent-encoded non-ASCII data. - gh-67044: csv.writer() now always quotes or escapes '\r' and '\n', regardless of lineterminator value. - gh-115712: csv.writer() now quotes empty fields if delimiter is a space and skipinitialspace is true and raises exception if quoting is not possible. - gh-115618: Fix improper decreasing the reference count for None argument in property methods getter(), setter() and deleter(). - gh-115570: A DeprecationWarning is no longer omitted on access to the __doc__ attributes of the deprecated typing.io and typing.re pseudo-modules. - gh-112006: Fix inspect.unwrap() for types with the __wrapper__ data descriptor. - gh-101293: Support callables with the __call__() method and types with __new__() and __init__() methods set to class methods, static methods, bound methods, partial functions, and other types of methods and descriptors in inspect.Signature.from_callable(). - gh-115392: Fix a bug in doctest where incorrect line numbers would be reported for decorated functions. - gh-114563: Fix several format() bugs when using the C implementation of Decimal: * memory leak in some rare cases when using the z format option (coerce negative 0) * incorrect output when applying the z format option to type F (fixed-point with capital NAN / INF) * incorrect output when applying the # format option (alternate form) - gh-115197: urllib.request no longer resolves the hostname before checking it against the system’s proxy bypass list on macOS and Windows. - gh-115198: Fix support of Docutils >= 0.19 in distutils. - gh-115165: Most exceptions are now ignored when attempting to set the __orig_class__ attribute on objects returned when calling typing generic aliases (including generic aliases created using typing.Annotated). Previously only AttributeError was ignored. Patch by Dave Shawley. - gh-115133: Fix tests for XMLPullParser with Expat 2.6.0. - gh-115059: io.BufferedRandom.read1() now flushes the underlying write buffer. - gh-79382: Trailing ** no longer allows to match files and non-existing paths in recursive glob(). - gh-114763: Protect modules loaded with importlib.util.LazyLoader from race conditions when multiple threads try to access attributes before the loading is complete. - gh-97959: Fix rendering class methods, bound methods, method and function aliases in pydoc. Class methods no longer have “method of builtins.type instance” note. Corresponding notes are now added for class and unbound methods. Method and function aliases now have references to the module or the class where the origin was defined if it differs from the current. Bound methods are now listed in the static methods section. Methods of builtin classes are now supported as well as methods of Python classes. - gh-112281: Allow creating union of types for typing.Annotated with unhashable metadata. - gh-111775: Fix importlib.resources.simple.ResourceHandle.open() for text mode, added missed stream argument. - gh-90095: Make .pdbrc and -c work with any valid pdb commands. - gh-107155: Fix incorrect output of help(x) where x is a lambda function, which has an __annotations__ dictionary attribute with a "return" key. - gh-105866: Fixed _get_slots bug which caused error when defining dataclasses with slots and a weakref_slot. - gh-60346: Fix ArgumentParser inconsistent with parse_known_args. - gh-100985: Update HTTPSConnection to consistently wrap IPv6 Addresses when using a proxy. - gh-100884: email: fix misfolding of comma in address-lists over multiple lines in combination with unicode encoding (bsc#1238450 CVE-2025-1795) - gh-95782: Fix io.BufferedReader.tell(), io.BufferedReader.seek(), _pyio.BufferedReader.tell(), io.BufferedRandom.tell(), io.BufferedRandom.seek() and _pyio.BufferedRandom.tell() being able to return negative offsets. - gh-96310: Fix a traceback in argparse when all options in a mutually exclusive group are suppressed. - gh-93205: Fixed a bug in logging.handlers.TimedRotatingFileHandler where multiple rotating handler instances pointing to files with the same name but different extensions would conflict and not delete the correct files. - bpo-44865: Add missing call to localization function in argparse. - bpo-43952: Fix multiprocessing.connection.Listener.accept() to accept empty bytes as authkey. Not accepting empty bytes as key causes it to hang indefinitely. - bpo-42125: linecache: get module name from __spec__ if available. This allows getting source code for the __main__ module when a custom loader is used. - gh-66543: Make mimetypes.guess_type() properly parsing of URLs with only a host name, URLs containing fragment or query, and filenames with only a UNC sharepoint on Windows. Based on patch by Dong-hee Na. - bpo-33775: Add ‘default’ and ‘version’ help text for localization in argparse. * Documentation - gh-115399: Document CVE-2023-52425 of Expat <2.6.0 under “XML vulnerabilities”. - gh-115233: Fix an example for LoggerAdapter in the Logging Cookbook. * Tests - gh-83434: Disable JUnit XML output (--junit-xml=FILE command line option) in regrtest when hunting for reference leaks (-R option). Patch by Victor Stinner. - gh-117187: Fix XML tests for vanilla Expat <2.6.0. - gh-115979: Update test_importlib so that it passes under WASI SDK 21. - gh-116307: Added import helper isolated_modules as CleanImport does not remove modules imported during the context. - gh-115720: Leak tests (-R, --huntrleaks) now show a summary of the number of leaks found in each iteration. - gh-115122: Add --bisect option to regrtest test runner: run failed tests with test.bisect_cmd to identify failing tests. Patch by Victor Stinner. - gh-115596: Fix ProgramPriorityTests in test_os permanently changing the process priority. - gh-115198: Fix test_check_metadata_deprecate in distutils tests with a newer Docutils. * Build - gh-116313: Get WASI builds to work under wasmtime 18 w/ WASI 0.2/preview2 primitives. - gh-115167: Avoid vendoring vcruntime140_threads.dll when building with Visual Studio 2022 version 17.8. * Windows - gh-116773: Fix instances of <_overlapped.Overlapped object at 0xXXX> still has pending operation at deallocation, the process may crash. - gh-91227: Fix the asyncio ProactorEventLoop implementation so that sending a datagram to an address that is not listening does not prevent receiving any more datagrams. - gh-115554: The installer now has more strict rules about updating the Python Launcher for Windows. In general, most users only have a single launcher installed and will see no difference. When multiple launchers have been installed, the option to install the launcher is disabled until all but one have been removed. Downgrading the launcher (which was never allowed) is now more obviously blocked. - gh-115543: Python Launcher for Windows can now detect Python 3.13 when installed from the Microsoft Store, and will install Python 3.12 by default when PYLAUNCHER_ALLOW_INSTALL is set. - gh-115009: Update Windows installer to use SQLite 3.45.1. * IDLE - gh-88516: On macOS show a proxy icon in the title bar of editor windows to match platform behaviour. * Tools/Demos - gh-113516: Don’t set LDSHARED when building for WASI. * C API - gh-117021: Fix integer overflow in PyLong_AsPid() on non-Windows 64-bit platforms. ++++ python-jsonformatter: - Initial release of python-jsonformatter 0.3.2 ++++ python-pyvmomi: - add sle15 macro; disable python3.12 builds ------------------------------------------------------------------ ------------------ 2024-4-6 - Apr 6 2024 ------------------- ------------------------------------------------------------------ ++++ python313-trove-classifiers: - update to 2024.3.25: * added more trove classifiers ------------------------------------------------------------------ ------------------ 2024-4-5 - Apr 5 2024 ------------------- ------------------------------------------------------------------ ++++ python313-hatchling: - update to version 1.22.5: * Fix reading metadata from source distributions when fields are dynamic but not part of core metadata like entry points ------------------------------------------------------------------ ------------------ 2024-4-4 - Apr 4 2024 ------------------- ------------------------------------------------------------------ ++++ python-Pillow: - Add upstream patch CVE-2024-28219.patch to fix buffer overflow in _imagingcms.c. Add also the new source sGrey-v2-nano.icc needed to run the new test added by the patch. bsc#1222262, CVE-2024-28219, gh#python-pillow/Pillow@2a93aba5cfcf ------------------------------------------------------------------ ------------------ 2024-4-3 - Apr 3 2024 ------------------- ------------------------------------------------------------------ ++++ python-M2Crypto: - Build for modern python stack on SLE/Leap ------------------------------------------------------------------ ------------------ 2024-4-2 - Apr 2 2024 ------------------- ------------------------------------------------------------------ ++++ python313-pipx: - Update to 1.5.0 * Add --global option to pipx commands. - This will run the action in a global scope and affect environment for all system users. * Add a --fetch-missing-python flag to all commands that accept a --python flag. - When combined, this will automatically download a standalone copy of the requested python version if it's not already available on the user's system. * Add commands to list and prune standalone interpreters * Add --install option to pipx upgrade command. - This will install the package given as argument if it is not already installed. * Deprecate --skip-maintenance flag of pipx list; maintenance is now never executed there * Various bugfixes ------------------------------------------------------------------ ------------------ 2024-3-28 - Mar 28 2024 ------------------- ------------------------------------------------------------------ ++++ python-pyzmq: - Add %{?sle15_python_module_pythons} ------------------------------------------------------------------ ------------------ 2024-3-24 - Mar 24 2024 ------------------- ------------------------------------------------------------------ ++++ python311: - Add reference to CVE-2024-0450 (bsc#1221854) to changelog. ++++ python311-core: - Add reference to CVE-2024-0450 (bsc#1221854) to changelog. ++++ python313-hatchling: - update to 1.22.4: * Only read source distribution metadata for fields that are explicitly defined as dynamic ------------------------------------------------------------------ ------------------ 2024-3-23 - Mar 23 2024 ------------------- ------------------------------------------------------------------ ++++ python-opentelemetry-api: - update to 1.23.0: * Use Attribute rather than boundattribute in logrecord (#3567) * Fix flush error when no LoggerProvider configured for LoggingHandler (#3608) * Fix OTLPMetricExporter ignores preferred_aggregation property (#3603) * Logs: set observed_timestamp field (#3565) * Add missing Resource SchemaURL in OTLP exporters (#3652) * Fix loglevel warning text (#3566) * Prometheus Exporter string representation for target_info labels (#3659) * Logs: ObservedTimestamp field is missing in console exporter output (#3564) * Fix explicit bucket histogram aggregation (#3429) * Add code.lineno, code.function and code.filepath to all logs (#3645) * Add Synchronous Gauge instrument (#3462) * Drop support for 3.7 (#3668) * Include key in attribute sequence warning (#3639) * Upgrade markupsafe, Flask and related dependencies to dev and test environments (#3609) * Handle HTTP 2XX responses as successful in OTLP exporters (#3623) * Improve Resource Detector timeout messaging (#3645) * Add Proxy classes for logging (#3575) * Remove dependency on 'backoff' library (#3679) ------------------------------------------------------------------ ------------------ 2024-3-22 - Mar 22 2024 ------------------- ------------------------------------------------------------------ ++++ python311: - Because of bsc#1189495 we have to revert use of %autopatch. ++++ python311-core: - Because of bsc#1189495 we have to revert use of %autopatch. ------------------------------------------------------------------ ------------------ 2024-3-21 - Mar 21 2024 ------------------- ------------------------------------------------------------------ ++++ python-netaddr: - Update to 1.2.1: * Fix bad version 1.2.0 upload to PyPI – now yanked. No changes to the package. - 1.2.0: * Add CLI tool subcommand to display cli-network-info. * Support running interactive-shell without IPython installed. * Explicitly raise TypeError is a non-string value is passed to valid_ipv4 or valid_ipv6. - 1.1.0: * Add the required Python version to the package metadata (#365). * Add expand_partial_ipv4_address to the public API. * Fix IPNetwork(...) in IPRange(...) false negatives (#157). * Fix a few IPNetwork slicing edge cases (#214). * Fix support for partial IP addresses accidentally left in IPNetwork in 1.0.0. * Fixed an incorrect license classifier in the package metadata. - 1.0.0: * Removed: * Drop support for Python versions lower than 3.7. * Remove the flag shorthands: N, P and Z. Use NOHOST, INET_PTON and ZEROFILL instead. * Remove abbreviated CIDR format support in IPNetwork (implicit_prefix=True), use cidr_abbrev_to_verbose if you need this behavior. * Remove the IPAddress.is_private method. * Changed: * Stop accepting leading zeros when parsing IPv4 addresses in INET_PTON mode (it's been allowed on some platforms). * Stop parsing IPv4 addresses permissively (inet_aton()-like) by default. * Apply the two changes above to valid_ipv4 as well. * Update the address databases to the 2024-02-10 versions. * Fixed: * Return False instead of raising AddrFormatError when an empty string is passed to valid_ipv4 or valid_ipv6. * Fix handling of dialect provided to EUI during copy-construction. ------------------------------------------------------------------ ------------------ 2024-3-20 - Mar 20 2024 ------------------- ------------------------------------------------------------------ ++++ python313-core: - Update to 3.13.0a5: - Security - gh-115398: Allow controlling Expat >=2.6.0 reparse deferral (CVE-2023-52425) by adding five new methods: xml.etree.ElementTree.XMLParser.flush() xml.etree.ElementTree.XMLPullParser.flush() xml.parsers.expat.xmlparser.GetReparseDeferralEnabled() xml.parsers.expat.xmlparser.SetReparseDeferralEnabled() xml.sax.expatreader.ExpatParser.flush() - gh-114572: ssl.SSLContext.cert_store_stats() and ssl.SSLContext.get_ca_certs() now correctly lock access to the certificate store, when the ssl.SSLContext is shared across multiple threads. - Core and Builtins - gh-116604: Respect the status of the garbage collector when indirect calls are made via PyErr_CheckSignals() and the evaluation breaker. Patch by Pablo Galindo - gh-112087: list is now compatible with the implementation of PEP 703. - gh-116381: Add specialization for CONTAINS_OP. - gh-116296: Fix possible refleak in object.__reduce__() internal error handling. - gh-115823: Properly calculate error ranges in the parser when raising SyntaxError exceptions caused by invalid byte sequences. Patch by Pablo Galindo - gh-115778: Add tierN annotation for instruction definition in interpreter DSL. - gh-115733: Fix crash when calling next() on exhausted list iterators. - gh-115700: The regen-cases build stage now works on Windows. - gh-115347: Fix bug where docstring was replaced by a redundant NOP when Python is run with -OO. - gh-115323: Make error message more meaningful for when bytearray.extend() is called with a str object. - gh-112175: Every PyThreadState now has its own eval_breaker, allowing specific threads to be interrupted. - gh-115154: Fix a bug that was causing the tokenize.untokenize() function to handle unicode named literals incorrectly. Patch by Pablo Galindo - gh-112433: Add ability to force alignment of ctypes.Structure by way of the new _align_ attribute on the class. - gh-104090: The multiprocessing resource tracker now exits with non-zero status code if a resource leak was detected. It still exits with status code 0 otherwise. - gh-105858: Improve the constructors for ast nodes. Arguments of list types now default to an empty list if omitted, and optional fields default to None. AST nodes now have an __annotations__ attribute with the expected types of their attributes. Passing unrecognized extra arguments to AST nodes is deprecated and will become an error in Python 3.15. Omitting a required argument to an AST node is deprecated and will become an error in Python 3.15. Patch by Jelle Zijlstra. - gh-101860: Expose __name__ attribute on property. - gh-96497: Fix incorrect resolution of mangled class variables used in assignment expressions in comprehensions. - Library - gh-116600: Fix repr() for global Flag members. - gh-116349: platform.java_ver() is deprecated and will be removed in 3.15. It was largely untested, had a confusing API, and was only useful for Jython support. - gh-116143: Fix a race in pydoc _start_server, eliminating a window in which _start_server can return a thread that is “serving” but without a docserver set. - gh-116127: typing: implement PEP 705 which adds typing.ReadOnly support to typing.TypedDict. - gh-116325: typing: raise SyntaxError instead of AttributeError on forward references as empty strings. - gh-115957: When asyncio.TaskGroup.create_task is called on an inactive asyncio.TaskGroup, the given coroutine will be closed (which prevents a RuntimeWarning). - gh-115978: Disable preadv(), readv(), pwritev(), and writev() on WASI. Under wasmtime for WASI 0.2, these functions don’t pass test_posix (gh-bytecodealliance/wasmtime#7830). - gh-88352: Fix the computation of the next rollover time in the logging.TimedRotatingFileHandler handler. computeRollover() now always returns a timestamp larger than the specified time and works correctly during the DST change. doRollover() no longer overwrite the already rolled over file, saving from data loss when run at midnight or during repeated time at the DST change. - gh-87115: Set __main__.__spec__ to None when running a script with pdb - gh-76511: Fix UnicodeEncodeError in email.Message.as_string() that results when a message that claims to be in the ascii character set actually has non-ascii characters. Non-ascii characters are now replaced with the U+FFFD replacement character, like in the replace error handler. - gh-89547: Add support for nested typing special forms like Final[ClassVar[int]]. - gh-65824: Improve the less prompt in pydoc. - gh-116040: [Enum] fix by-value calls when second value is falsey; e.g. Cardinal(1, 0) - gh-115821: [Enum] Improve error message when calling super().__new__() in custom __new__. - gh-85644: Use the XDG_CURRENT_DESKTOP environment variable in webbrowser to check desktop. Prefer it to the deprecated GNOME_DESKTOP_SESSION_ID for GNOME detection. - gh-75988: Fixed unittest.mock.create_autospec() to pass the call through to the wrapped object to return the real result. - gh-115881: Fix issue where ast.parse() would incorrectly flag conditional context managers (such as with (x() if y else z()): ...) as invalid syntax if feature_version=(3, 8) was passed. This reverts changes to the grammar made as part of gh-94949. - gh-115886: Fix silent truncation of the name with an embedded null character in multiprocessing.shared_memory.SharedMemory. - gh-115532: Add kernel density estimation to the statistics module. - gh-115714: On WASI, the time module no longer get process time using times() or CLOCK_PROCESS_CPUTIME_ID, system API is that is unreliable and is likely to be removed from WASI. The affected clock functions fall back to calling clock(). - gh-115809: Improve algorithm for computing which rolled-over log files to delete in logging.TimedRotatingFileHandler. It is now reliable for handlers without namer and with arbitrary deterministic namer that leaves the datetime part in the file name unmodified. - gh-74668: urllib.parse functions parse_qs() and parse_qsl() now support bytes arguments containing raw and percent-encoded non-ASCII data. - gh-67044: csv.writer() now always quotes or escapes '\r' and '\n', regardless of lineterminator value. - gh-115712: Restore support of space delimiter with skipinitialspace=True in csv. csv.writer() now quotes empty fields if delimiter is a space and skipinitialspace is true and raises exception if quoting is not possible. - gh-112364: Fixed ast.unparse() to handle format_spec with ", ' or \\. Patched by Frank Hoffmann. - gh-112997: Stop logging potentially sensitive callback arguments in asyncio unless debug mode is active. - gh-114914: Fix an issue where an abandoned StreamWriter would not be garbage collected. - gh-111358: Fix a bug in asyncio.BaseEventLoop.shutdown_default_executor() to ensure the timeout passed to the coroutine behaves as expected. - gh-115618: Fix improper decreasing the reference count for None argument in property methods getter(), setter() and deleter(). - gh-112720: Refactor dis.ArgResolver to make it possible to subclass and change the way jump args are interpreted. - gh-112006: Fix inspect.unwrap() for types with the __wrapper__ data descriptor. Fix inspect.Signature.from_callable() for builtins classmethod() and staticmethod(). - gh-101293: Support callables with the __call__() method and types with __new__() and __init__() methods set to class methods, static methods, bound methods, partial functions, and other types of methods and descriptors in inspect.Signature.from_callable(). - gh-103092: Isolate _lsprof (apply PEP 687). - gh-113942: pydoc no longer skips global functions implemented as builtin methods, such as MethodDescriptorType and WrapperDescriptorType. - gh-115256: Added DeprecationWarning when accessing the tarfile attribute of TarInfo objects. The attribute is never used internally and is only attached to TarInfos when the tarfile is opened in write-mode, not read-mode. The attribute creates an unnecessary reference cycle which may cause corruption when not closing the handle after writing a tarfile. - gh-115197: urllib.request no longer resolves the hostname before checking it against the system’s proxy bypass list on macOS and Windows. - gh-113812: DatagramTransport.sendto() will now send zero-length datagrams if called with an empty bytes object. The transport flow control also now accounts for the datagram header when calculating the buffer size. - gh-114763: Protect modules loaded with importlib.util.LazyLoader from race conditions when multiple threads try to access attributes before the loading is complete. - gh-114709: posixpath.commonpath() now raises a ValueError exception when passed an empty iterable. Previously, IndexError was raised. posixpath.commonpath() now raises a TypeError exception when passed None. Previously, ValueError was raised. - gh-114610: Fix bug where pathlib.PurePath.with_stem() converted a non-empty path suffix to a stem when given an empty stem argument. It now raises ValueError, just like pathlib.PurePath.with_suffix() does when called on a path with an empty stem, given a non-empty suffix argument. - gh-107361: Add ssl.VERIFY_X509_PARTIAL_CHAIN and VERIFY_X509_STRICT to the default SSL context created with ssl.create_default_context(). - gh-112281: Allow creating union of types for typing.Annotated with unhashable metadata. - gh-111775: Fix importlib.resources.simple.ResourceHandle.open() for text mode, added missed stream argument. - gh-90095: Make .pdbrc and -c work with any valid pdb commands. - gh-107625: Raise configparser.ParsingError from read() and read_file() methods of configparser.ConfigParser if a key without a corresponding value is continued (that is, followed by an indented line). - gh-107155: Fix incorrect output of help(x) where x is a lambda function, which has an __annotations__ dictionary attribute with a "return" key. - gh-57141: Add option for non-shallow comparisons to filecmp.dircmp like filecmp.cmp(). Original patch by Steven Ward. Enhanced by Tobias Rautenkranz - gh-69990: Profile.print_stats() has been improved to accept multiple sort arguments. Patched by Chiu-Hsiang Hsu and Furkan Onder. - gh-104061: Add socket.SO_BINDTOIFINDEX constant. - gh-60346: Fix ArgumentParser inconsistent with parse_known_args. - gh-102389: Add windows_31j to aliases for cp932 codec - gh-72249: functools.partial`s of :func:`repr() has been improved to include the module name. Patched by Furkan Onder and Anilyka Barry. - gh-100985: Update HTTPSConnection to consistently wrap IPv6 Addresses when using a proxy. - gh-100884: email: fix misfolding of comma in address-lists over multiple lines in combination with unicode encoding. - gh-95782: Fix io.BufferedReader.tell(), io.BufferedReader.seek(), _pyio.BufferedReader.tell(), io.BufferedRandom.tell(), io.BufferedRandom.seek() and _pyio.BufferedRandom.tell() being able to return negative offsets. - gh-96310: Fix a traceback in argparse when all options in a mutually exclusive group are suppressed. - gh-93205: Fixed a bug in logging.handlers.TimedRotatingFileHandler where multiple rotating handler instances pointing to files with the same name but different extensions would conflict and not delete the correct files. - bpo-31116: Add Z85 encoding to base64. - bpo-44865: Add missing call to localization function in argparse. - bpo-43952: Fix multiprocessing.connection.Listener.accept() to accept empty bytes as authkey. Not accepting empty bytes as key causes it to hang indefinitely. - bpo-42125: linecache: get module name from __spec__ if available. This allows getting source code for the __main__ module when a custom loader is used. - bpo-41122: Failing to pass arguments properly to functools.singledispatchmethod() now throws a TypeError instead of hitting an index out of bounds internally. - bpo-40818: The asyncio REPL now runs sys.__interactivehook__ on startup. The default implementation of sys.__interactivehook__ provides auto-completion to the asyncio REPL. Patch contributed by Rémi Lapeyre. - bpo-33775: Add ‘default’ and ‘version’ help text for localization in argparse. - Documentation - gh-115399: Document CVE-2023-52425 of Expat <2.6.0 under “XML vulnerabilities”. - gh-109653: Improve import time of uuid on Linux. - Tests - gh-71052: Add test exclusions to support running the test suite on Android. - gh-71052: Enable test_concurrent_futures on platforms that support threading but not multiprocessing. - gh-115796: Make ‘_testinternalcapi.assemble_code_object’ construct the exception table for the code object. - gh-115720: Leak tests (-R, --huntrleaks) now show a summary of the number of leaks found in each iteration. - gh-115122: Add --bisect option to regrtest test runner: run failed tests with test.bisect_cmd to identify failing tests. Patch by Victor Stinner. - gh-115596: Fix ProgramPriorityTests in test_os permanently changing the process priority. - gh-115556: On Windows, commas passed in arguments to Tools\buildbot\test.bat and PCbuild\\rt.bat are now properly handled. - gh-115420: Fix translation of exception hander targets by _testinternalcapi.optimize_cfg. - gh-115376: Fix segfault in _testinternalcapi.compiler_codegen on bad input. ++++ python313: - Update to 3.13.0a5: - Security - gh-115398: Allow controlling Expat >=2.6.0 reparse deferral (CVE-2023-52425) by adding five new methods: xml.etree.ElementTree.XMLParser.flush() xml.etree.ElementTree.XMLPullParser.flush() xml.parsers.expat.xmlparser.GetReparseDeferralEnabled() xml.parsers.expat.xmlparser.SetReparseDeferralEnabled() xml.sax.expatreader.ExpatParser.flush() - gh-114572: ssl.SSLContext.cert_store_stats() and ssl.SSLContext.get_ca_certs() now correctly lock access to the certificate store, when the ssl.SSLContext is shared across multiple threads. - Core and Builtins - gh-116604: Respect the status of the garbage collector when indirect calls are made via PyErr_CheckSignals() and the evaluation breaker. Patch by Pablo Galindo - gh-112087: list is now compatible with the implementation of PEP 703. - gh-116381: Add specialization for CONTAINS_OP. - gh-116296: Fix possible refleak in object.__reduce__() internal error handling. - gh-115823: Properly calculate error ranges in the parser when raising SyntaxError exceptions caused by invalid byte sequences. Patch by Pablo Galindo - gh-115778: Add tierN annotation for instruction definition in interpreter DSL. - gh-115733: Fix crash when calling next() on exhausted list iterators. - gh-115700: The regen-cases build stage now works on Windows. - gh-115347: Fix bug where docstring was replaced by a redundant NOP when Python is run with -OO. - gh-115323: Make error message more meaningful for when bytearray.extend() is called with a str object. - gh-112175: Every PyThreadState now has its own eval_breaker, allowing specific threads to be interrupted. - gh-115154: Fix a bug that was causing the tokenize.untokenize() function to handle unicode named literals incorrectly. Patch by Pablo Galindo - gh-112433: Add ability to force alignment of ctypes.Structure by way of the new _align_ attribute on the class. - gh-104090: The multiprocessing resource tracker now exits with non-zero status code if a resource leak was detected. It still exits with status code 0 otherwise. - gh-105858: Improve the constructors for ast nodes. Arguments of list types now default to an empty list if omitted, and optional fields default to None. AST nodes now have an __annotations__ attribute with the expected types of their attributes. Passing unrecognized extra arguments to AST nodes is deprecated and will become an error in Python 3.15. Omitting a required argument to an AST node is deprecated and will become an error in Python 3.15. Patch by Jelle Zijlstra. - gh-101860: Expose __name__ attribute on property. - gh-96497: Fix incorrect resolution of mangled class variables used in assignment expressions in comprehensions. - Library - gh-116600: Fix repr() for global Flag members. - gh-116349: platform.java_ver() is deprecated and will be removed in 3.15. It was largely untested, had a confusing API, and was only useful for Jython support. - gh-116143: Fix a race in pydoc _start_server, eliminating a window in which _start_server can return a thread that is “serving” but without a docserver set. - gh-116127: typing: implement PEP 705 which adds typing.ReadOnly support to typing.TypedDict. - gh-116325: typing: raise SyntaxError instead of AttributeError on forward references as empty strings. - gh-115957: When asyncio.TaskGroup.create_task is called on an inactive asyncio.TaskGroup, the given coroutine will be closed (which prevents a RuntimeWarning). - gh-115978: Disable preadv(), readv(), pwritev(), and writev() on WASI. Under wasmtime for WASI 0.2, these functions don’t pass test_posix (gh-bytecodealliance/wasmtime#7830). - gh-88352: Fix the computation of the next rollover time in the logging.TimedRotatingFileHandler handler. computeRollover() now always returns a timestamp larger than the specified time and works correctly during the DST change. doRollover() no longer overwrite the already rolled over file, saving from data loss when run at midnight or during repeated time at the DST change. - gh-87115: Set __main__.__spec__ to None when running a script with pdb - gh-76511: Fix UnicodeEncodeError in email.Message.as_string() that results when a message that claims to be in the ascii character set actually has non-ascii characters. Non-ascii characters are now replaced with the U+FFFD replacement character, like in the replace error handler. - gh-89547: Add support for nested typing special forms like Final[ClassVar[int]]. - gh-65824: Improve the less prompt in pydoc. - gh-116040: [Enum] fix by-value calls when second value is falsey; e.g. Cardinal(1, 0) - gh-115821: [Enum] Improve error message when calling super().__new__() in custom __new__. - gh-85644: Use the XDG_CURRENT_DESKTOP environment variable in webbrowser to check desktop. Prefer it to the deprecated GNOME_DESKTOP_SESSION_ID for GNOME detection. - gh-75988: Fixed unittest.mock.create_autospec() to pass the call through to the wrapped object to return the real result. - gh-115881: Fix issue where ast.parse() would incorrectly flag conditional context managers (such as with (x() if y else z()): ...) as invalid syntax if feature_version=(3, 8) was passed. This reverts changes to the grammar made as part of gh-94949. - gh-115886: Fix silent truncation of the name with an embedded null character in multiprocessing.shared_memory.SharedMemory. - gh-115532: Add kernel density estimation to the statistics module. - gh-115714: On WASI, the time module no longer get process time using times() or CLOCK_PROCESS_CPUTIME_ID, system API is that is unreliable and is likely to be removed from WASI. The affected clock functions fall back to calling clock(). - gh-115809: Improve algorithm for computing which rolled-over log files to delete in logging.TimedRotatingFileHandler. It is now reliable for handlers without namer and with arbitrary deterministic namer that leaves the datetime part in the file name unmodified. - gh-74668: urllib.parse functions parse_qs() and parse_qsl() now support bytes arguments containing raw and percent-encoded non-ASCII data. - gh-67044: csv.writer() now always quotes or escapes '\r' and '\n', regardless of lineterminator value. - gh-115712: Restore support of space delimiter with skipinitialspace=True in csv. csv.writer() now quotes empty fields if delimiter is a space and skipinitialspace is true and raises exception if quoting is not possible. - gh-112364: Fixed ast.unparse() to handle format_spec with ", ' or \\. Patched by Frank Hoffmann. - gh-112997: Stop logging potentially sensitive callback arguments in asyncio unless debug mode is active. - gh-114914: Fix an issue where an abandoned StreamWriter would not be garbage collected. - gh-111358: Fix a bug in asyncio.BaseEventLoop.shutdown_default_executor() to ensure the timeout passed to the coroutine behaves as expected. - gh-115618: Fix improper decreasing the reference count for None argument in property methods getter(), setter() and deleter(). - gh-112720: Refactor dis.ArgResolver to make it possible to subclass and change the way jump args are interpreted. - gh-112006: Fix inspect.unwrap() for types with the __wrapper__ data descriptor. Fix inspect.Signature.from_callable() for builtins classmethod() and staticmethod(). - gh-101293: Support callables with the __call__() method and types with __new__() and __init__() methods set to class methods, static methods, bound methods, partial functions, and other types of methods and descriptors in inspect.Signature.from_callable(). - gh-103092: Isolate _lsprof (apply PEP 687). - gh-113942: pydoc no longer skips global functions implemented as builtin methods, such as MethodDescriptorType and WrapperDescriptorType. - gh-115256: Added DeprecationWarning when accessing the tarfile attribute of TarInfo objects. The attribute is never used internally and is only attached to TarInfos when the tarfile is opened in write-mode, not read-mode. The attribute creates an unnecessary reference cycle which may cause corruption when not closing the handle after writing a tarfile. - gh-115197: urllib.request no longer resolves the hostname before checking it against the system’s proxy bypass list on macOS and Windows. - gh-113812: DatagramTransport.sendto() will now send zero-length datagrams if called with an empty bytes object. The transport flow control also now accounts for the datagram header when calculating the buffer size. - gh-114763: Protect modules loaded with importlib.util.LazyLoader from race conditions when multiple threads try to access attributes before the loading is complete. - gh-114709: posixpath.commonpath() now raises a ValueError exception when passed an empty iterable. Previously, IndexError was raised. posixpath.commonpath() now raises a TypeError exception when passed None. Previously, ValueError was raised. - gh-114610: Fix bug where pathlib.PurePath.with_stem() converted a non-empty path suffix to a stem when given an empty stem argument. It now raises ValueError, just like pathlib.PurePath.with_suffix() does when called on a path with an empty stem, given a non-empty suffix argument. - gh-107361: Add ssl.VERIFY_X509_PARTIAL_CHAIN and VERIFY_X509_STRICT to the default SSL context created with ssl.create_default_context(). - gh-112281: Allow creating union of types for typing.Annotated with unhashable metadata. - gh-111775: Fix importlib.resources.simple.ResourceHandle.open() for text mode, added missed stream argument. - gh-90095: Make .pdbrc and -c work with any valid pdb commands. - gh-107625: Raise configparser.ParsingError from read() and read_file() methods of configparser.ConfigParser if a key without a corresponding value is continued (that is, followed by an indented line). - gh-107155: Fix incorrect output of help(x) where x is a lambda function, which has an __annotations__ dictionary attribute with a "return" key. - gh-57141: Add option for non-shallow comparisons to filecmp.dircmp like filecmp.cmp(). Original patch by Steven Ward. Enhanced by Tobias Rautenkranz - gh-69990: Profile.print_stats() has been improved to accept multiple sort arguments. Patched by Chiu-Hsiang Hsu and Furkan Onder. - gh-104061: Add socket.SO_BINDTOIFINDEX constant. - gh-60346: Fix ArgumentParser inconsistent with parse_known_args. - gh-102389: Add windows_31j to aliases for cp932 codec - gh-72249: functools.partial`s of :func:`repr() has been improved to include the module name. Patched by Furkan Onder and Anilyka Barry. - gh-100985: Update HTTPSConnection to consistently wrap IPv6 Addresses when using a proxy. - gh-100884: email: fix misfolding of comma in address-lists over multiple lines in combination with unicode encoding. - gh-95782: Fix io.BufferedReader.tell(), io.BufferedReader.seek(), _pyio.BufferedReader.tell(), io.BufferedRandom.tell(), io.BufferedRandom.seek() and _pyio.BufferedRandom.tell() being able to return negative offsets. - gh-96310: Fix a traceback in argparse when all options in a mutually exclusive group are suppressed. - gh-93205: Fixed a bug in logging.handlers.TimedRotatingFileHandler where multiple rotating handler instances pointing to files with the same name but different extensions would conflict and not delete the correct files. - bpo-31116: Add Z85 encoding to base64. - bpo-44865: Add missing call to localization function in argparse. - bpo-43952: Fix multiprocessing.connection.Listener.accept() to accept empty bytes as authkey. Not accepting empty bytes as key causes it to hang indefinitely. - bpo-42125: linecache: get module name from __spec__ if available. This allows getting source code for the __main__ module when a custom loader is used. - bpo-41122: Failing to pass arguments properly to functools.singledispatchmethod() now throws a TypeError instead of hitting an index out of bounds internally. - bpo-40818: The asyncio REPL now runs sys.__interactivehook__ on startup. The default implementation of sys.__interactivehook__ provides auto-completion to the asyncio REPL. Patch contributed by Rémi Lapeyre. - bpo-33775: Add ‘default’ and ‘version’ help text for localization in argparse. - Documentation - gh-115399: Document CVE-2023-52425 of Expat <2.6.0 under “XML vulnerabilities”. - gh-109653: Improve import time of uuid on Linux. - Tests - gh-71052: Add test exclusions to support running the test suite on Android. - gh-71052: Enable test_concurrent_futures on platforms that support threading but not multiprocessing. - gh-115796: Make ‘_testinternalcapi.assemble_code_object’ construct the exception table for the code object. - gh-115720: Leak tests (-R, --huntrleaks) now show a summary of the number of leaks found in each iteration. - gh-115122: Add --bisect option to regrtest test runner: run failed tests with test.bisect_cmd to identify failing tests. Patch by Victor Stinner. - gh-115596: Fix ProgramPriorityTests in test_os permanently changing the process priority. - gh-115556: On Windows, commas passed in arguments to Tools\buildbot\test.bat and PCbuild\\rt.bat are now properly handled. - gh-115420: Fix translation of exception hander targets by _testinternalcapi.optimize_cfg. - gh-115376: Fix segfault in _testinternalcapi.compiler_codegen on bad input. ++++ python313-hatchling: - Clean up the SPEC file ------------------------------------------------------------------ ------------------ 2024-3-19 - Mar 19 2024 ------------------- ------------------------------------------------------------------ ++++ python313-hatchling: - update to version 1.22.3: * Fix the custom build hook when using dynamic dependencies ------------------------------------------------------------------ ------------------ 2024-3-17 - Mar 17 2024 ------------------- ------------------------------------------------------------------ ++++ python313-hatchling: - update to 1.22.2: * Fixed: + Fix regression when loading metadata from source distributions + Fix metadata hooks when building wheels from source distributions - additional changes from version 1.22.1: * Fixed: + Update the default version of core metadata to 2.3 - additional changes from version 1.22.0: * Deprecated: + The app build target has been renamed to binary to reduce ambiguity with the name of an upcoming feature. The former name will still be usable for several minor releases. * Added: + Metadata for the wheel target now defaults to the PKG-INFO metadata within source distributions + Add dependencies method to the build hook interface so that hooks can themselves dynamically define dependencies + Update the default version of core metadata to 2.2 + Update SPDX license information to version 3.23 + Improve error message for when the default heuristics for wheel file inclusion fail * Fixed: + Properly support core metadata version 2.2 + Remove editables as a direct dependency + Fix default wheel tag when the supported Python version declaration is strict + Load VCS ignore patterns first so that whitelisted patterns can be excluded by project configuration + Don't consider VCS ignore files that are outside of the VCS boundary + The sdist build target now gracefully ignores UNIX socket files + Begin ignoring certain files ubiquitously, like .DS_Store on macOS - remove editables from the required packages ------------------------------------------------------------------ ------------------ 2024-3-16 - Mar 16 2024 ------------------- ------------------------------------------------------------------ ++++ python313-packaging: - update to 24.0: * Do specifier matching correctly when the specifier contains an epoch number and has more components than the version (:issue:`683`) * Support the experimental --disable-gil builds in packaging.tags (:issue:`727`) * BREAKING: Make optional metadata.Metadata attributes default to None (:issue:`733`) * Fix errors when trying to access the description_content_type, keywords, and requires_python attributes on metadata.Metadata when those values have not been provided (:issue:`733`) * Fix a bug preventing the use of the built in ExceptionGroup on versions of Python that support it (:issue:`725`) ++++ python313-trove-classifiers: - update to 2024.3.3: * added more trove classifiers ++++ python313-userpath: - update to 1.9.2: * Fix import error on Windows ++++ python313-wheel: - update to 0.43.0: * Dropped support for Python 3.7 * Updated vendored packaging to 24.0 ------------------------------------------------------------------ ------------------ 2024-3-15 - Mar 15 2024 ------------------- ------------------------------------------------------------------ ++++ python-soupsieve: - Fix rpmlint warnings on SLE/Leap (jsc#PED-7572) * provide description longer than summary * Add back group ------------------------------------------------------------------ ------------------ 2024-3-14 - Mar 14 2024 ------------------- ------------------------------------------------------------------ ++++ python-google-auth: - Do not force transition to Python 3.11 it breaks SUMa ------------------------------------------------------------------ ------------------ 2024-3-12 - Mar 12 2024 ------------------- ------------------------------------------------------------------ ++++ python311: - Rewrite %prep to use %autosetup et al. for compatibility with rpm 4.20. - bsc#1221260 add bsc1221260-test_asyncio-ResourceWarning.patch to eliminate ResourceWarning which broke the test suite in test_asyncio. ++++ python311-core: - Rewrite %prep to use %autosetup et al. for compatibility with rpm 4.20. - bsc#1221260 add bsc1221260-test_asyncio-ResourceWarning.patch to eliminate ResourceWarning which broke the test suite in test_asyncio. ------------------------------------------------------------------ ------------------ 2024-3-7 - Mar 7 2024 ------------------- ------------------------------------------------------------------ ++++ python313-core: - Drop gh115133-XMLPullParserTest-fail.patch upstreamed now. ++++ python313: - Drop gh115133-XMLPullParserTest-fail.patch upstreamed now. ------------------------------------------------------------------ ------------------ 2024-3-6 - Mar 6 2024 ------------------- ------------------------------------------------------------------ ++++ python313-core: - Use the system-wide crypto-policies [bsc#1211301] * Use the system default cipher list instead of hardcoded values * Add the --with-ssl-default-suites=openssl configure option ++++ python311: - Use the system-wide crypto-policies [bsc#1211301] * Use the system default cipher list instead of hardcoded values * Add the --with-ssl-default-suites=openssl configure option ++++ python311-core: - Use the system-wide crypto-policies [bsc#1211301] * Use the system default cipher list instead of hardcoded values * Add the --with-ssl-default-suites=openssl configure option ++++ python313: - Use the system-wide crypto-policies [bsc#1211301] * Use the system default cipher list instead of hardcoded values * Add the --with-ssl-default-suites=openssl configure option ------------------------------------------------------------------ ------------------ 2024-3-5 - Mar 5 2024 ------------------- ------------------------------------------------------------------ ++++ python313-core: - Update to 3.13.0a4 - Security - gh-115399: Update bundled libexpat to 2.6.0 - gh-115243: Fix possible crashes in collections.deque.index() when the deque is concurrently modified. - Core and Builtins - gh-112087: For an empty reverse iterator for list will be reduced to reversed(). Patch by Donghee Na - gh-114570: Add PythonFinalizationError exception. This exception derived from RuntimeError is raised when an operation is blocked during the Python finalization. Patch by Victor Stinner. - gh-114695: Add sys._clear_internal_caches(), which clears all internal performance-related caches (and deprecate the less-general sys._clear_type_cache() function). - gh-114828: Fix compilation crashes in uncommon code examples using super() inside a comprehension in a class body. - gh-112069: Adapt set and frozenset methods to Argument Clinic. - gh-115011: Setters for members with an unsigned integer type now support the same range of valid values for objects that has a __index__() method as for int. - gh-114887: Changed socket type validation in create_datagram_endpoint() to accept all non-stream sockets. This fixes a regression in compatibility with raw sockets. - gh-114944: Fixes a race between PyParkingLot_Park and _PyParkingLot_UnparkAll. - gh-113462: Limit the number of versions that a single class can use. Prevents a few wayward classes using up all the version numbers. - gh-76763: The chr() builtin function now always raises ValueError for values outside the valid range. Previously it raised OverflowError for very large or small values. - gh-114806: No longer specialize calls to classes, if those classes have metaclasses. Fixes bug where the __call__ method of the metaclass was not being called. - gh-107944: Improve error message for function calls with bad keyword arguments via getargs - gh-112529: The free-threaded build no longer allocates space for the PyGC_Head structure in objects that support cyclic garbage collection. A number of other fields and data structures are used as replacements, including ob_gc_bits, ob_tid, and mimalloc internal data structures. - gh-114456: Lower the recursion limit under a debug build of WASI. - gh-114083: Compiler applies folding of LOAD_CONST with following instruction in a separate pass before other optimisations. This enables jump threading in certain circumstances. - gh-114388: Fix a RuntimeWarning emitted when assign an integer-like value that is not an instance of int to an attribute that corresponds to a C struct member of type T_UINT and T_ULONG. Fix a double RuntimeWarning emitted when assign a negative integer value to an attribute that corresponds to a C struct member of type T_UINT. - gh-114265: Compiler propagates line numbers before optimization, leading to more optimization opportunities and removing the need for the guarantee_lineno_for_exits hack. - gh-112529: The free-threaded build now has its own thread-safe GC implementation that uses mimalloc to find GC tracked objects. It is non-generational, unlike the existing GC implementation. - gh-114050: Fix segmentation fault caused by an incorrect format string in TypeError exception when more than two arguments are passed to int. - gh-112354: The END_FOR instruction now pops only one value. This is to better support side exits in loops. - gh-113884: Make queue.SimpleQueue thread safe when the GIL is disabled. - gh-114058: Implement the foundations of the Tier 2 redundancy eliminator. - gh-113939: frame.clear(): Clear frame.f_locals as well, and not only the fast locals. This is relevant once frame.f_locals was accessed, which would contain also references to all the locals. - gh-112050: Convert collections.deque to use Argument Clinic. - gh-112050: Make methods on collections.deque thread-safe when the GIL is disabled. - gh-113464: Add an option (--enable-experimental-jit for configure-based builds or --experimental-jit for PCbuild-based ones) to build an experimental just-in-time compiler, based on copy-and-patch - gh-113055: Make interp->obmalloc a pointer. For interpreters that share state with the main interpreter, this points to the same static memory structure. For interpreters with their own obmalloc state, it is heap allocated. Add free_obmalloc_arenas() which will free the obmalloc arenas and radix tree structures for interpreters with their own obmalloc state. - gh-55664: Add warning when creating type using a namespace dictionary with non-string keys. Patched by Daniel Urban and Furkan Onder. - gh-104530: Use native Win32 condition variables. - Library - gh-115392: Fix a bug in doctest where incorrect line numbers would be reported for decorated functions. - gh-114563: Fix several format() bugs when using the C implementation of Decimal: * memory leak in some rare cases when using the z format option (coerce negative 0) * incorrect output when applying the z format option to type F (fixed-point with capital NAN / INF) * incorrect output when applying the # format option (alternate form) - gh-102840: Fix confused traceback when floordiv, mod, or divmod operations happens between instances of fractions.Fraction and complex. - gh-115165: Most exceptions are now ignored when attempting to set the __orig_class__ attribute on objects returned when calling typing generic aliases (including generic aliases created using typing.Annotated). Previously only AttributeError was ignored. Patch by Dave Shawley. - gh-112903: Fix “issubclass() arg 1 must be a class” errors in certain cases of multiple inheritance with generic aliases (regression in early 3.13 alpha releases). - gh-115133: Fix tests for XMLPullParser with Expat 2.6.0. - gh-115059: io.BufferedRandom.read1() now flushes the underlying write buffer. - gh-79382: Trailing ** no longer allows to match files and non-existing paths in recursive glob(). - gh-67837: Avoid race conditions in the creation of directories during concurrent extraction in tarfile and zipfile. - gh-115060: Speed up pathlib.Path.glob() by removing redundant regex matching. - gh-97928: Partially revert the behavior of tkinter.Text.count(). By default it preserves the behavior of older Python versions, except that setting wantobjects to 0 no longer has effect. Add a new parameter return_ints: specifying return_ints=True makes Text.count() always returning the single count as an integer instead of a 1-tuple or None. - gh-114628: When csv.Error is raised when handling TypeError, do not print the TypeError traceback. - gh-85984: Added _POSIX_VDISABLE from C’s to termios. - gh-114965: Update bundled pip to 24.0 - gh-114959: tarfile no longer ignores errors when trying to extract a directory on top of a file. - gh-114894: Add array.array.clear(). - gh-114071: Support tuple subclasses using auto() for enum member value. - gh-109475: Fix support of explicit option value “–” in argparse (e.g. --option=--). - gh-49766: Fix date-datetime comparison. Now the special comparison methods like __eq__ and __lt__ return NotImplemented if one of comparands is date and other is datetime instead of ignoring the time part and the time zone or forcefully return “not equal” or raise TypeError. It makes comparison of date and datetime subclasses more symmetric and allows to change the default behavior by overriding the special comparison methods in subclasses. - gh-110190: Fix ctypes structs with array on Windows ARM64 platform by setting MAX_STRUCT_SIZE to 32 in stgdict. Patch by Diego Russo - gh-114678: Ensure that deprecation warning for ‘N’ specifier in Decimal format is not raised for cases where ‘N’ appears in other places in the format specifier. Based on patch by Stefan Krah. - gh-70303: Return both files and directories from pathlib.Path.glob() if a pattern ends with “**”. Previously only directories were returned. - gh-109653: Improve import time of importlib.metadata and email.utils. - gh-113280: Fix a leak of open socket in rare cases when error occurred in ssl.SSLSocket creation. - gh-77749: email.policy.EmailPolicy.fold() now always encodes non-ASCII characters in headers if utf8 is false. - gh-83383: Synchronization of the dbm.dumb database is now no-op if there was no modification since opening or last synchronization. The directory file for a newly created empty dbm.dumb database is now created immediately after opening instead of deferring this until synchronizing or closing. - gh-91602: Add filter keyword-only parameter to sqlite3.Connection.iterdump() for filtering database objects to dump. Patch by Mariusz Felisiak. - gh-112451: Prohibit subclassing pure-Python datetime.timezone. This is consistent with C-extension implementation. Patch by Mariusz Felisiak. - gh-69893: Add the close() method for the iterator returned by xml.etree.ElementTree.iterparse(). - gh-109653: Reduce the import time of threading module by ~50%. Patch by Daniel Hollas. - gh-114492: Make the result of termios.tcgetattr() reproducible on Alpine Linux. Previously it could leave a random garbage in some fields. - gh-114315: Make threading.Lock a real class, not a factory function. Add __new__ to _thread.lock type. - gh-100414: Add dbm.sqlite3 as a backend to dbm, and make it the new default dbm backend. Patch by Raymond Hettinger and Erlend E. Aasland. - gh-113267: Revert changes in gh-106584 which made calls of TestResult methods startTest() and stopTest() unbalanced. - gh-75128: Ignore an OSError in asyncio.BaseEventLoop.create_server() when IPv6 is available but the interface cannot actually support it. - gh-114423: _DummyThread entries in threading._active are now automatically removed when the related thread dies. - gh-114257: Dismiss the FileNotFound error in ctypes.util.find_library() and just return None on Linux. - gh-114321: Expose more platform specific constants in the fcntl module on Linux, macOS, FreeBSD and NetBSD. - gh-114328: The tty.setcbreak() and new tty.cfmakecbreak() no longer clears the terminal input ICRLF flag. This fixes a regression introduced in 3.12 that no longer matched how OSes define cbreak mode in their stty(1) manual pages. - gh-114281: Remove type hints from Lib/asyncio/staggered.py. The annotations in the typeshed project should be used instead. - gh-101438: Avoid reference cycle in ElementTree.iterparse. The iterator returned by ElementTree.iterparse may hold on to a file descriptor. The reference cycle prevented prompt clean-up of the file descriptor if the returned iterator was not exhausted. - gh-114198: The signature for the __replace__ method on dataclasses now has the first argument named self, rather than obj. - gh-104522: OSError raised when run a subprocess now only has filename attribute set to cwd if the error was caused by a failed attempt to change the current directory. - gh-114149: Enum: correctly handle tuple subclasses in custom __new__. - gh-83648: Support deprecation of options, positional arguments and subcommands in argparse. - gh-114087: Speed up dataclasses.asdict up to 1.35x. - gh-109534: Fix a reference leak in asyncio.selector_events.BaseSelectorEventLoop when SSL handshakes fail. Patch contributed by Jamie Phan. - gh-79634: Accept path-like objects as patterns in pathlib.Path.glob() and rglob(). - gh-112202: Ensure that a asyncio.Condition.notify() call does not get lost if the awakened Task is simultaneously cancelled or encounters any other error. - gh-113951: Fix the behavior of tag_unbind() methods of tkinter.Text and tkinter.Canvas classes with three arguments. Previously, widget.tag_unbind(tag, sequence, funcid) destroyed the current binding for sequence, leaving sequence unbound, and deleted the funcid command. Now it removes only funcid from the binding for sequence, keeping other commands, and deletes the funcid command. It leaves sequence unbound only if funcid was the last bound command. - gh-97959: Fix rendering class methods, bound methods, method and function aliases in pydoc. Class methods no longer have “method of builtins.type instance” note. Corresponding notes are now added for class and unbound methods. Method and function aliases now have references to the module or the class where the origin was defined if it differs from the current. Bound methods are now listed in the static methods section. Methods of builtin classes are now supported as well as methods of Python classes. - gh-113796: Add more validation checks in the csv.Dialect constructor. ValueError is now raised if the same character is used in different roles. - gh-113732: Fix support of QUOTE_NOTNULL and QUOTE_STRINGS in csv.reader(). - gh-113225: Speed up pathlib.Path.walk() by using os.DirEntry.path where possible. - gh-89039: When replace() method is called on a subclass of datetime, date or time, properly call derived constructor. Previously, only the base class’s constructor was called. - Also, make sure to pass non-zero fold values when creating subclasses in various methods. Previously, fold was silently ignored. - gh-112919: Speed-up datetime.datetime.replace(), datetime.date.replace() and datetime.time.replace(). - gh-59013: Set breakpoint on the first executable line of the function, instead of the line of function definition when the user do break func using pdb - gh-112343: Improve handling of pdb convenience variables to avoid replacing string contents. - gh-112240: Add option to calendar module CLI to specify the weekday to start each week. Patch by Steven Ward. - gh-111741: Recognise image/webp as a standard format in the mimetypes module. - gh-43457: Fix the tkinter widget method wm_attributes(). It now accepts the attribute name without the minus prefix to get window attributes and allows to specify attributes and values to set as keyword arguments. Add new optional keyword argument return_python_dict: calling w.wm_attributes(return_python_dict=True) returns the attributes as a dict instead of a tuple. Calling w.wm_attributes() now returns a tuple instead of string if wantobjects was set to 0. - gh-82626: Many functions now emit a warning if a boolean value is passed as a file descriptor argument. - gh-111051: Added check for file modification during debugging with pdb - gh-110345: Show the Tcl/Tk patchlevel (rather than version) in tkinter._test(). - gh-38807: Fix race condition in trace. Instead of checking if a directory exists and creating it, directly call os.makedirs() with the kwarg exist_ok=True. - gh-75705: Set unixfrom envelope in mailbox.mbox and mailbox.MMDF. - gh-106233: Fix stacklevel in InvalidTZPathWarning during zoneinfo module import. - gh-105102: Allow ctypes.Union to be nested in ctypes.Structure when the system endianness is the opposite of the classes. - gh-104282: Fix null pointer dereference in lzma._decode_filter_properties() due to improper handling of BCJ filters with properties of zero length. Patch by Radislav Chugunov. - gh-96471: Add queue.Queue termination with shutdown(). - gh-101599: Changed argparse flag options formatting to remove redundancy. - gh-85984: Add POSIX pseudo-terminal functions os.posix_openpt(), os.grantpt(), os.unlockpt(), and os.ptsname(). - gh-102512: When os.fork() is called from a foreign thread (aka _DummyThread), the type of the thread in a child process is changed to _MainThread. Also changed its name and daemonic status, it can be now joined. - gh-88569: Add os.path.isreserved(), which identifies reserved pathnames such as “NUL”, “AUX” and “CON”. This function is only available on Windows. - Deprecate pathlib.PurePath.is_reserved(). - bpo-38364: The inspect functions isgeneratorfunction, iscoroutinefunction, isasyncgenfunction now support functools.partialmethod wrapped functions the same way they support functools.partial. - Documentation - gh-115233: Fix an example for LoggerAdapter in the Logging Cookbook. - gh-114123: Move the csv module docstring to the csv module instead of reexporting it from the internal _csv module, and remove __doc__ from csv.__all__. - Move csv.__version__ to the csv module instead of reexporting it from the internal _csv module, and remove __version__ from csv.__all__. Test- s - gh-114099: Added test exclusions required to run the test suite on iOS. - gh-105089: Fix test.test_zipfile.test_core.TestWithDirectory.test_create_directory_with_write test in AIX by doing a bitwise AND of 0xFFFF on mode , so that it will be in sync with zinfo.external_attr Buil- d - gh-115167: Avoid vendoring vcruntime140_threads.dll when building with Visual Studio 2022 version 17.8. - gh-113632: Promote WASI to a tier 2 platform and drop Emscripten from tier 3 in configure.ac. - gh-114099: configure and Makefile were refactored to accomodate framework builds on Apple platforms other than macOS. - gh-114875: Add getgrent() as a prerequisite for building the grp module. Wind- ows - gh-115049: Fixes py.exe launcher failing when run as users without user profiles. - gh-115009: Update Windows installer to use SQLite 3.45.1. - gh-109991: Update Windows build to use OpenSSL 3.0.13. - gh-111239: Update Windows builds to use zlib v1.3.1. - gh-100107: The py.exe launcher will no longer attempt to run the Microsoft Store redirector when launching a script containing a /usr/bin/env shebang - gh-112984: Adds free-threaded binaries to Windows installer as an optional component. - gh-89240: Allows multiprocessing to create pools of greater than 62 processes. - IDLE - gh-96905: In idlelib code, stop redefining built-ins ‘dict’ and ‘object’. - gh-103820: Revise IDLE bindings so that events from mouse button 4/5 on non-X11 windowing systems (i.e. Win32 and Aqua) are not mistaken for scrolling. - Tools/Demos - gh-113516: Don’t set LDSHARED when building for WASI. - gh-109991: Update GitHub CI workflows to use OpenSSL 3.0.13 and multissltests to use 1.1.1w, 3.0.13, 3.1.5, and 3.2.1. - gh-115015: Fix a bug in Argument Clinic that generated incorrect code for methods with no parameters that use the METH_METHOD | METH_FASTCALL | METH_KEYWORDS calling convention. Only the positional parameter count was checked; any keyword argument passed would be silently accepted. - C API - gh-111140: Adds PyLong_AsNativeBytes(), PyLong_FromNativeBytes() and PyLong_FromUnsignedNativeBytes() functions. - gh-114685: PyBuffer_FillInfo() now raises a SystemError if called with PyBUF_READ or PyBUF_WRITE as flags. These flags should only be used with the PyMemoryView_* C API. - gh-114685: PyObject_GetBuffer() now raises a SystemError if called with PyBUF_READ or PyBUF_WRITE as flags. These flags should only be used with the PyMemoryView_* C API. - gh-114626: Add PyCFunctionFast and PyCFunctionFastWithKeywords typedefs (identical to the existing _PyCFunctionFast and _PyCFunctionFastWithKeywords typedefs, just without a leading _ prefix). - gh-114329: Add PyList_GetItemRef(), which is similar to PyList_GetItem() but returns a strong reference instead of a borrowed reference. - gh-110850: Add PyTime C API: * PyTime_t type. * PyTime_MIN and PyTime_MAX constants. * PyTime_AsSecondsDouble(), PyTime_Monotonic(), PyTime_PerfCounter(), and PyTime_Time() functions. - gh-112066: Add PyDict_SetDefaultRef(): insert a key and value into a dictionary if the key is not already present. This is similar to dict.setdefault(), but returns an integer value indicating if the key was already present. It is also similar to PyDict_SetDefault(), but returns a strong reference instead of a borrowed reference. ++++ python-google-auth: - Obsolete Python 3.6 build for SLE 15 SP4 and openSUSE Leap 15.4 and later ++++ python313: - Update to 3.13.0a4 - Security - gh-115399: Update bundled libexpat to 2.6.0 - gh-115243: Fix possible crashes in collections.deque.index() when the deque is concurrently modified. - Core and Builtins - gh-112087: For an empty reverse iterator for list will be reduced to reversed(). Patch by Donghee Na - gh-114570: Add PythonFinalizationError exception. This exception derived from RuntimeError is raised when an operation is blocked during the Python finalization. Patch by Victor Stinner. - gh-114695: Add sys._clear_internal_caches(), which clears all internal performance-related caches (and deprecate the less-general sys._clear_type_cache() function). - gh-114828: Fix compilation crashes in uncommon code examples using super() inside a comprehension in a class body. - gh-112069: Adapt set and frozenset methods to Argument Clinic. - gh-115011: Setters for members with an unsigned integer type now support the same range of valid values for objects that has a __index__() method as for int. - gh-114887: Changed socket type validation in create_datagram_endpoint() to accept all non-stream sockets. This fixes a regression in compatibility with raw sockets. - gh-114944: Fixes a race between PyParkingLot_Park and _PyParkingLot_UnparkAll. - gh-113462: Limit the number of versions that a single class can use. Prevents a few wayward classes using up all the version numbers. - gh-76763: The chr() builtin function now always raises ValueError for values outside the valid range. Previously it raised OverflowError for very large or small values. - gh-114806: No longer specialize calls to classes, if those classes have metaclasses. Fixes bug where the __call__ method of the metaclass was not being called. - gh-107944: Improve error message for function calls with bad keyword arguments via getargs - gh-112529: The free-threaded build no longer allocates space for the PyGC_Head structure in objects that support cyclic garbage collection. A number of other fields and data structures are used as replacements, including ob_gc_bits, ob_tid, and mimalloc internal data structures. - gh-114456: Lower the recursion limit under a debug build of WASI. - gh-114083: Compiler applies folding of LOAD_CONST with following instruction in a separate pass before other optimisations. This enables jump threading in certain circumstances. - gh-114388: Fix a RuntimeWarning emitted when assign an integer-like value that is not an instance of int to an attribute that corresponds to a C struct member of type T_UINT and T_ULONG. Fix a double RuntimeWarning emitted when assign a negative integer value to an attribute that corresponds to a C struct member of type T_UINT. - gh-114265: Compiler propagates line numbers before optimization, leading to more optimization opportunities and removing the need for the guarantee_lineno_for_exits hack. - gh-112529: The free-threaded build now has its own thread-safe GC implementation that uses mimalloc to find GC tracked objects. It is non-generational, unlike the existing GC implementation. - gh-114050: Fix segmentation fault caused by an incorrect format string in TypeError exception when more than two arguments are passed to int. - gh-112354: The END_FOR instruction now pops only one value. This is to better support side exits in loops. - gh-113884: Make queue.SimpleQueue thread safe when the GIL is disabled. - gh-114058: Implement the foundations of the Tier 2 redundancy eliminator. - gh-113939: frame.clear(): Clear frame.f_locals as well, and not only the fast locals. This is relevant once frame.f_locals was accessed, which would contain also references to all the locals. - gh-112050: Convert collections.deque to use Argument Clinic. - gh-112050: Make methods on collections.deque thread-safe when the GIL is disabled. - gh-113464: Add an option (--enable-experimental-jit for configure-based builds or --experimental-jit for PCbuild-based ones) to build an experimental just-in-time compiler, based on copy-and-patch - gh-113055: Make interp->obmalloc a pointer. For interpreters that share state with the main interpreter, this points to the same static memory structure. For interpreters with their own obmalloc state, it is heap allocated. Add free_obmalloc_arenas() which will free the obmalloc arenas and radix tree structures for interpreters with their own obmalloc state. - gh-55664: Add warning when creating type using a namespace dictionary with non-string keys. Patched by Daniel Urban and Furkan Onder. - gh-104530: Use native Win32 condition variables. - Library - gh-115392: Fix a bug in doctest where incorrect line numbers would be reported for decorated functions. - gh-114563: Fix several format() bugs when using the C implementation of Decimal: * memory leak in some rare cases when using the z format option (coerce negative 0) * incorrect output when applying the z format option to type F (fixed-point with capital NAN / INF) * incorrect output when applying the # format option (alternate form) - gh-102840: Fix confused traceback when floordiv, mod, or divmod operations happens between instances of fractions.Fraction and complex. - gh-115165: Most exceptions are now ignored when attempting to set the __orig_class__ attribute on objects returned when calling typing generic aliases (including generic aliases created using typing.Annotated). Previously only AttributeError was ignored. Patch by Dave Shawley. - gh-112903: Fix “issubclass() arg 1 must be a class” errors in certain cases of multiple inheritance with generic aliases (regression in early 3.13 alpha releases). - gh-115133: Fix tests for XMLPullParser with Expat 2.6.0. - gh-115059: io.BufferedRandom.read1() now flushes the underlying write buffer. - gh-79382: Trailing ** no longer allows to match files and non-existing paths in recursive glob(). - gh-67837: Avoid race conditions in the creation of directories during concurrent extraction in tarfile and zipfile. - gh-115060: Speed up pathlib.Path.glob() by removing redundant regex matching. - gh-97928: Partially revert the behavior of tkinter.Text.count(). By default it preserves the behavior of older Python versions, except that setting wantobjects to 0 no longer has effect. Add a new parameter return_ints: specifying return_ints=True makes Text.count() always returning the single count as an integer instead of a 1-tuple or None. - gh-114628: When csv.Error is raised when handling TypeError, do not print the TypeError traceback. - gh-85984: Added _POSIX_VDISABLE from C’s to termios. - gh-114965: Update bundled pip to 24.0 - gh-114959: tarfile no longer ignores errors when trying to extract a directory on top of a file. - gh-114894: Add array.array.clear(). - gh-114071: Support tuple subclasses using auto() for enum member value. - gh-109475: Fix support of explicit option value “–” in argparse (e.g. --option=--). - gh-49766: Fix date-datetime comparison. Now the special comparison methods like __eq__ and __lt__ return NotImplemented if one of comparands is date and other is datetime instead of ignoring the time part and the time zone or forcefully return “not equal” or raise TypeError. It makes comparison of date and datetime subclasses more symmetric and allows to change the default behavior by overriding the special comparison methods in subclasses. - gh-110190: Fix ctypes structs with array on Windows ARM64 platform by setting MAX_STRUCT_SIZE to 32 in stgdict. Patch by Diego Russo - gh-114678: Ensure that deprecation warning for ‘N’ specifier in Decimal format is not raised for cases where ‘N’ appears in other places in the format specifier. Based on patch by Stefan Krah. - gh-70303: Return both files and directories from pathlib.Path.glob() if a pattern ends with “**”. Previously only directories were returned. - gh-109653: Improve import time of importlib.metadata and email.utils. - gh-113280: Fix a leak of open socket in rare cases when error occurred in ssl.SSLSocket creation. - gh-77749: email.policy.EmailPolicy.fold() now always encodes non-ASCII characters in headers if utf8 is false. - gh-83383: Synchronization of the dbm.dumb database is now no-op if there was no modification since opening or last synchronization. The directory file for a newly created empty dbm.dumb database is now created immediately after opening instead of deferring this until synchronizing or closing. - gh-91602: Add filter keyword-only parameter to sqlite3.Connection.iterdump() for filtering database objects to dump. Patch by Mariusz Felisiak. - gh-112451: Prohibit subclassing pure-Python datetime.timezone. This is consistent with C-extension implementation. Patch by Mariusz Felisiak. - gh-69893: Add the close() method for the iterator returned by xml.etree.ElementTree.iterparse(). - gh-109653: Reduce the import time of threading module by ~50%. Patch by Daniel Hollas. - gh-114492: Make the result of termios.tcgetattr() reproducible on Alpine Linux. Previously it could leave a random garbage in some fields. - gh-114315: Make threading.Lock a real class, not a factory function. Add __new__ to _thread.lock type. - gh-100414: Add dbm.sqlite3 as a backend to dbm, and make it the new default dbm backend. Patch by Raymond Hettinger and Erlend E. Aasland. - gh-113267: Revert changes in gh-106584 which made calls of TestResult methods startTest() and stopTest() unbalanced. - gh-75128: Ignore an OSError in asyncio.BaseEventLoop.create_server() when IPv6 is available but the interface cannot actually support it. - gh-114423: _DummyThread entries in threading._active are now automatically removed when the related thread dies. - gh-114257: Dismiss the FileNotFound error in ctypes.util.find_library() and just return None on Linux. - gh-114321: Expose more platform specific constants in the fcntl module on Linux, macOS, FreeBSD and NetBSD. - gh-114328: The tty.setcbreak() and new tty.cfmakecbreak() no longer clears the terminal input ICRLF flag. This fixes a regression introduced in 3.12 that no longer matched how OSes define cbreak mode in their stty(1) manual pages. - gh-114281: Remove type hints from Lib/asyncio/staggered.py. The annotations in the typeshed project should be used instead. - gh-101438: Avoid reference cycle in ElementTree.iterparse. The iterator returned by ElementTree.iterparse may hold on to a file descriptor. The reference cycle prevented prompt clean-up of the file descriptor if the returned iterator was not exhausted. - gh-114198: The signature for the __replace__ method on dataclasses now has the first argument named self, rather than obj. - gh-104522: OSError raised when run a subprocess now only has filename attribute set to cwd if the error was caused by a failed attempt to change the current directory. - gh-114149: Enum: correctly handle tuple subclasses in custom __new__. - gh-83648: Support deprecation of options, positional arguments and subcommands in argparse. - gh-114087: Speed up dataclasses.asdict up to 1.35x. - gh-109534: Fix a reference leak in asyncio.selector_events.BaseSelectorEventLoop when SSL handshakes fail. Patch contributed by Jamie Phan. - gh-79634: Accept path-like objects as patterns in pathlib.Path.glob() and rglob(). - gh-112202: Ensure that a asyncio.Condition.notify() call does not get lost if the awakened Task is simultaneously cancelled or encounters any other error. - gh-113951: Fix the behavior of tag_unbind() methods of tkinter.Text and tkinter.Canvas classes with three arguments. Previously, widget.tag_unbind(tag, sequence, funcid) destroyed the current binding for sequence, leaving sequence unbound, and deleted the funcid command. Now it removes only funcid from the binding for sequence, keeping other commands, and deletes the funcid command. It leaves sequence unbound only if funcid was the last bound command. - gh-97959: Fix rendering class methods, bound methods, method and function aliases in pydoc. Class methods no longer have “method of builtins.type instance” note. Corresponding notes are now added for class and unbound methods. Method and function aliases now have references to the module or the class where the origin was defined if it differs from the current. Bound methods are now listed in the static methods section. Methods of builtin classes are now supported as well as methods of Python classes. - gh-113796: Add more validation checks in the csv.Dialect constructor. ValueError is now raised if the same character is used in different roles. - gh-113732: Fix support of QUOTE_NOTNULL and QUOTE_STRINGS in csv.reader(). - gh-113225: Speed up pathlib.Path.walk() by using os.DirEntry.path where possible. - gh-89039: When replace() method is called on a subclass of datetime, date or time, properly call derived constructor. Previously, only the base class’s constructor was called. - Also, make sure to pass non-zero fold values when creating subclasses in various methods. Previously, fold was silently ignored. - gh-112919: Speed-up datetime.datetime.replace(), datetime.date.replace() and datetime.time.replace(). - gh-59013: Set breakpoint on the first executable line of the function, instead of the line of function definition when the user do break func using pdb - gh-112343: Improve handling of pdb convenience variables to avoid replacing string contents. - gh-112240: Add option to calendar module CLI to specify the weekday to start each week. Patch by Steven Ward. - gh-111741: Recognise image/webp as a standard format in the mimetypes module. - gh-43457: Fix the tkinter widget method wm_attributes(). It now accepts the attribute name without the minus prefix to get window attributes and allows to specify attributes and values to set as keyword arguments. Add new optional keyword argument return_python_dict: calling w.wm_attributes(return_python_dict=True) returns the attributes as a dict instead of a tuple. Calling w.wm_attributes() now returns a tuple instead of string if wantobjects was set to 0. - gh-82626: Many functions now emit a warning if a boolean value is passed as a file descriptor argument. - gh-111051: Added check for file modification during debugging with pdb - gh-110345: Show the Tcl/Tk patchlevel (rather than version) in tkinter._test(). - gh-38807: Fix race condition in trace. Instead of checking if a directory exists and creating it, directly call os.makedirs() with the kwarg exist_ok=True. - gh-75705: Set unixfrom envelope in mailbox.mbox and mailbox.MMDF. - gh-106233: Fix stacklevel in InvalidTZPathWarning during zoneinfo module import. - gh-105102: Allow ctypes.Union to be nested in ctypes.Structure when the system endianness is the opposite of the classes. - gh-104282: Fix null pointer dereference in lzma._decode_filter_properties() due to improper handling of BCJ filters with properties of zero length. Patch by Radislav Chugunov. - gh-96471: Add queue.Queue termination with shutdown(). - gh-101599: Changed argparse flag options formatting to remove redundancy. - gh-85984: Add POSIX pseudo-terminal functions os.posix_openpt(), os.grantpt(), os.unlockpt(), and os.ptsname(). - gh-102512: When os.fork() is called from a foreign thread (aka _DummyThread), the type of the thread in a child process is changed to _MainThread. Also changed its name and daemonic status, it can be now joined. - gh-88569: Add os.path.isreserved(), which identifies reserved pathnames such as “NUL”, “AUX” and “CON”. This function is only available on Windows. - Deprecate pathlib.PurePath.is_reserved(). - bpo-38364: The inspect functions isgeneratorfunction, iscoroutinefunction, isasyncgenfunction now support functools.partialmethod wrapped functions the same way they support functools.partial. - Documentation - gh-115233: Fix an example for LoggerAdapter in the Logging Cookbook. - gh-114123: Move the csv module docstring to the csv module instead of reexporting it from the internal _csv module, and remove __doc__ from csv.__all__. - Move csv.__version__ to the csv module instead of reexporting it from the internal _csv module, and remove __version__ from csv.__all__. Test- s - gh-114099: Added test exclusions required to run the test suite on iOS. - gh-105089: Fix test.test_zipfile.test_core.TestWithDirectory.test_create_directory_with_write test in AIX by doing a bitwise AND of 0xFFFF on mode , so that it will be in sync with zinfo.external_attr Buil- d - gh-115167: Avoid vendoring vcruntime140_threads.dll when building with Visual Studio 2022 version 17.8. - gh-113632: Promote WASI to a tier 2 platform and drop Emscripten from tier 3 in configure.ac. - gh-114099: configure and Makefile were refactored to accomodate framework builds on Apple platforms other than macOS. - gh-114875: Add getgrent() as a prerequisite for building the grp module. Wind- ows - gh-115049: Fixes py.exe launcher failing when run as users without user profiles. - gh-115009: Update Windows installer to use SQLite 3.45.1. - gh-109991: Update Windows build to use OpenSSL 3.0.13. - gh-111239: Update Windows builds to use zlib v1.3.1. - gh-100107: The py.exe launcher will no longer attempt to run the Microsoft Store redirector when launching a script containing a /usr/bin/env shebang - gh-112984: Adds free-threaded binaries to Windows installer as an optional component. - gh-89240: Allows multiprocessing to create pools of greater than 62 processes. - IDLE - gh-96905: In idlelib code, stop redefining built-ins ‘dict’ and ‘object’. - gh-103820: Revise IDLE bindings so that events from mouse button 4/5 on non-X11 windowing systems (i.e. Win32 and Aqua) are not mistaken for scrolling. - Tools/Demos - gh-113516: Don’t set LDSHARED when building for WASI. - gh-109991: Update GitHub CI workflows to use OpenSSL 3.0.13 and multissltests to use 1.1.1w, 3.0.13, 3.1.5, and 3.2.1. - gh-115015: Fix a bug in Argument Clinic that generated incorrect code for methods with no parameters that use the METH_METHOD | METH_FASTCALL | METH_KEYWORDS calling convention. Only the positional parameter count was checked; any keyword argument passed would be silently accepted. - C API - gh-111140: Adds PyLong_AsNativeBytes(), PyLong_FromNativeBytes() and PyLong_FromUnsignedNativeBytes() functions. - gh-114685: PyBuffer_FillInfo() now raises a SystemError if called with PyBUF_READ or PyBUF_WRITE as flags. These flags should only be used with the PyMemoryView_* C API. - gh-114685: PyObject_GetBuffer() now raises a SystemError if called with PyBUF_READ or PyBUF_WRITE as flags. These flags should only be used with the PyMemoryView_* C API. - gh-114626: Add PyCFunctionFast and PyCFunctionFastWithKeywords typedefs (identical to the existing _PyCFunctionFast and _PyCFunctionFastWithKeywords typedefs, just without a leading _ prefix). - gh-114329: Add PyList_GetItemRef(), which is similar to PyList_GetItem() but returns a strong reference instead of a borrowed reference. - gh-110850: Add PyTime C API: * PyTime_t type. * PyTime_MIN and PyTime_MAX constants. * PyTime_AsSecondsDouble(), PyTime_Monotonic(), PyTime_PerfCounter(), and PyTime_Time() functions. - gh-112066: Add PyDict_SetDefaultRef(): insert a key and value into a dictionary if the key is not already present. This is similar to dict.setdefault(), but returns an integer value indicating if the key was already present. It is also similar to PyDict_SetDefault(), but returns a strong reference instead of a borrowed reference. ------------------------------------------------------------------ ------------------ 2024-3-4 - Mar 4 2024 ------------------- ------------------------------------------------------------------ ++++ python-boto3: - Drop Provides for SLE 15 SP4 and openSUSE Leap 15.4 and later ++++ python-botocore: - Drop Provides for SLE 15 SP4 and openSUSE Leap 15.4 and later ++++ python-s3transfer: - Drop Provides for SLE 15 SP4 and openSUSE Leap 15.4 and later ------------------------------------------------------------------ ------------------ 2024-3-1 - Mar 1 2024 ------------------- ------------------------------------------------------------------ ++++ python-lockfile: - Switch to autosetup and pyproject macros. ------------------------------------------------------------------ ------------------ 2024-2-28 - Feb 28 2024 ------------------- ------------------------------------------------------------------ ++++ python-Sphinx: - Disable test test_ext_imgconverter. ------------------------------------------------------------------ ------------------ 2024-2-26 - Feb 26 2024 ------------------- ------------------------------------------------------------------ ++++ python-google-auth: - Version update in SLE 15 SP4 and later (jsc#PED-6697) ++++ python-jmespath: - Remove the forced switch to Python 3.11 in SLE 15 SP4 and openSUSE Leap 15.4 and later. However the updated version will only be available as a Python 3.11 build. (jsc#PED-4514) ------------------------------------------------------------------ ------------------ 2024-2-23 - Feb 23 2024 ------------------- ------------------------------------------------------------------ ++++ python311: - (bsc#1219666, CVE-2023-6597) Add CVE-2023-6597-TempDir-cleaning-symlink.patch (patch from gh#python/cpython!99930) fixing symlink bug in cleanup of tempfile.TemporaryDirectory. ++++ python311-core: - (bsc#1219666, CVE-2023-6597) Add CVE-2023-6597-TempDir-cleaning-symlink.patch (patch from gh#python/cpython!99930) fixing symlink bug in cleanup of tempfile.TemporaryDirectory. ++++ python313-flit-core: - Use newly supported shrink{} on OBS to exclude python flavors will all python versions skipped. ------------------------------------------------------------------ ------------------ 2024-2-21 - Feb 21 2024 ------------------- ------------------------------------------------------------------ ++++ pgadmin4: - ExcludeArch: s390x ++++ python-Flask-Babel: - Update to 4.0.0: * Dropped support for end-of-life Python 3.7. Support PyPy 3.9 * Replace deprecated locked_cached_property decorator with cached_property. - Drop patch which is now included in 4.0.0 (which replaces deprecated locked_cached_property decorator): * support-flask-2.4.patch ------------------------------------------------------------------ ------------------ 2024-2-20 - Feb 20 2024 ------------------- ------------------------------------------------------------------ ++++ python313-core: - Add gh115133-XMLPullParserTest-fail.patch to make Python building with the current libexpat 2.6.0 (gh#python/cpython#115133). - Switch to %%autopatch. Let’s try it as an experiment, and if we need conditional patch, we should put condition inside of it. - Remove double definition of /usr/bin/idle%%{version} in %%files. ++++ python311: - Remove double definition of /usr/bin/idle%%{version} in %%files. ++++ python311-core: - Remove double definition of /usr/bin/idle%%{version} in %%files. ++++ python313: - Add gh115133-XMLPullParserTest-fail.patch to make Python building with the current libexpat 2.6.0 (gh#python/cpython#115133). - Switch to %%autopatch. Let’s try it as an experiment, and if we need conditional patch, we should put condition inside of it. - Remove double definition of /usr/bin/idle%%{version} in %%files. ++++ python313-pluggy: - Revert to 1.3.0 * Pytest 7 is not compatible with pluggy 1.4 but many packages are not compatible with pytest 8 yet ------------------------------------------------------------------ ------------------ 2024-2-19 - Feb 19 2024 ------------------- ------------------------------------------------------------------ ++++ pgadmin4: - Update to 8.3: * Supported Database Servers - PostgreSQL: 12, 13, 14, 15, and 16 - EDB Advanced Server: 12, 13, 14, 15, and 16 * Bundled PostgreSQL Utilities - psql, pg_dump, pg_dumpall, pg_restore: 16.0 * New features - Allow drag-n-drop columns collection tree node as comma separated columns. - Added support to rename columns in Views. - Added BYPASSRLS|NOBYPASSRLS option while creating a Role. - Added support for column storage syntax while creating table. - Use COOKIE_DEFAULT_PATH or SCRIPT_NAME in session cookie path. - Added configurable parameter to enable support for PasswordExecCommand in server mode. * Bug fixes - Fixed an issue where format sql was messing up operator. Included many other feature changes, more details here - Fixed an issue where formatting inserts empty lines in specific case. - Add support for selecting a schema in the backup database dialog with no tables, mviews, views or foreign tables. - Fixed a UI border issue on the dependencies tab for columns with icon. - Fixed an issue where multiple errors were showing if user does not have connect privileges. - Fixed an issue where group membership information was displayed incorrectly. - Ensure that the correct SQL is generated when changing the column data type to "char". - Fixed an issue pgAdmin fails to launch due to inconsistent PATH variable name on windows. - Fix a backend server error when creating a named restore point. - Fix wrong default for FORCE_LOWER in the FLASK_GRAVATAR module. ------------------------------------------------------------------ ------------------ 2024-2-15 - Feb 15 2024 ------------------- ------------------------------------------------------------------ ++++ python311: - Add upstream patch libexpat260.patch, Fix tests for XMLPullParser with Expat 2.6.0, gh#python/cpython#115289 ++++ python311-core: - Add upstream patch libexpat260.patch, Fix tests for XMLPullParser with Expat 2.6.0, gh#python/cpython#115289 ------------------------------------------------------------------ ------------------ 2024-2-11 - Feb 11 2024 ------------------- ------------------------------------------------------------------ ++++ python-Flask-Mail: - Update test syntax. - Skip two tests that have outdated expected results. ------------------------------------------------------------------ ------------------ 2024-2-10 - Feb 10 2024 ------------------- ------------------------------------------------------------------ ++++ libxml2-python: - Security fix (CVE-2024-25062, bsc#1219576) use-after-free in XMLReader * Added libxml2-CVE-2024-25062.patch ------------------------------------------------------------------ ------------------ 2024-2-9 - Feb 9 2024 ------------------- ------------------------------------------------------------------ ++++ pgadmin4: - Add node_modules.spec.inc as Source to satisfy factory-auto. ------------------------------------------------------------------ ------------------ 2024-2-8 - Feb 8 2024 ------------------- ------------------------------------------------------------------ ++++ python313-core: - Update to 3.13.0a3 - Security - gh-113659: Skip .pth files with names starting with a dot or hidden file attribute. - gh-112302: Created a Software Bill-of-Materials document and tooling for tracking dependencies. - Core and Builtins - gh-107901: Compiler duplicates basic blocks that have an eval breaker check, no line number, and multiple predecessors. - gh-107901: A jump leaving an exception handler back to normal code no longer checks the eval breaker. - gh-113655: Set the C recursion limit to 4000 on Windows, and 10000 on Linux/OSX. This seems to be near the sweet spot to maintain safety, but not compromise backwards compatibility. - gh-113710: Add typed stack effects to the interpreter DSL, along with various instruction annotations. - gh-77046: On Windows, file descriptors wrapping Windows handles are now created non inheritable by default (PEP 446). Patch by Zackery Spytz and Victor Stinner. - gh-113853: Guarantee that all executors make progress. This then guarantees that tier 2 execution always makes progress. - gh-113753: Fix an issue where the finalizer of PyAsyncGenASend objects might not be called if they were allocated from a free list. - gh-107901: Compiler changed so that synthetic jumps which are not at loop end no longer check the eval breaker. - gh-113703: Fix a regression in the codeop module that was causing it to incorrectly identify incomplete f-strings. Patch by Pablo Galindo - gh-89811: Check for a valid tp_version_tag before performing bytecode specializations that rely on this value being usable. - gh-111488: Changed error message in case of no ‘in’ keyword after ‘for’ in list comprehensions - gh-113657: Fix an issue that caused important instruction pointer updates to be optimized out of tier two traces. - gh-113603: Fixed bug where a redundant NOP is not removed, causing an assertion to fail in the compiler in debug mode. - gh-113602: Fix an error that was causing the parser to try to overwrite existing errors and crashing in the process. Patch by Pablo Galindo - gh-113486: No longer issue spurious PY_UNWIND events for optimized calls to classes. - gh-113297: Fix segfault in the compiler on with statement with 19 context managers. - gh-113212: Improve super error messages. - gh-111375: Only use NULL in the exception stack to indicate an exception was handled. Patch by Carey Metcalfe. - gh-112215: Increase the C recursion limit by a factor of 3 for non-debug builds, except for webassembly and s390 platforms which are unchanged. This mitigates some regressions in 3.12 with deep recursion mixing builtin (C) and Python code. - gh-113054: Fixed bug where a redundant NOP is not removed, causing an assertion to fail in the compiler in debug mode. - gh-106905: Use per AST-parser state rather than global state to track recursion depth within the AST parser to prevent potential race condition due to simultaneous parsing. - The issue primarily showed up in 3.11 by multithreaded users of ast.parse(). In 3.12 a change to when garbage collection can be triggered prevented the race condition from occurring. - gh-108866: Change the API and contract of _PyExecutorObject to return the next_instr pointer, instead of the frame, and to always execute at least one instruction. - gh-90350: Optimize builtin functions min() and max(). - gh-112943: Correctly compute end column offsets for multiline tokens in the tokenize module. Patch by Pablo Galindo - gh-112125: Fix None.__ne__(None) returning NotImplemented instead of False - gh-74616: input() now raises a ValueError when output on the terminal if the prompt contains embedded null characters instead of silently truncating it. - gh-112716: Fix SystemError in the import statement and in __reduce__() methods of builtin types when __builtins__ is not a dict. - gh-112730: Use color to highlight error locations in tracebacks. Patch by Pablo Galindo - gh-112625: Fixes a bug where a bytearray object could be cleared while iterating over an argument in the bytearray.join() method that could result in reading memory after it was freed. - gh-112660: Do not clear unexpected errors during formatting error messages for ImportError and AttributeError for modules. - gh-105967: Workaround a bug in Apple’s macOS platform zlib library where zlib.crc32() and binascii.crc32() could produce incorrect results on multi-gigabyte inputs. Including when using zipfile on zips containing large data. - gh-95754: Provide a better error message when accessing invalid attributes on partially initialized modules. The origin of the module being accessed is now included in the message to help with the common issue of shadowing other modules. - gh-112217: Add check for the type of __cause__ returned from calling the type T in raise from T. - gh-111058: Change coro.cr_frame/gen.gi_frame to return None after the coroutine/generator has been closed. This fixes a bug where getcoroutinestate() and getgeneratorstate() return the wrong state for a closed coroutine/generator. - gh-112388: Fix an error that was causing the parser to try to overwrite tokenizer errors. Patch by pablo Galindo - gh-112387: Fix error positions for decoded strings with backwards tokenize errors. Patch by Pablo Galindo - gh-99606: Make code generated for an empty f-string identical to the code of an empty normal string. - gh-112367: Avoid undefined behaviour when using the perf trampolines by not freeing the code arenas until shutdown. Patch by Pablo Galindo - gh-112320: The Tier 2 translator now tracks the confidence level for staying “on trace” (i.e. not exiting back to the Tier 1 interpreter) for branch instructions based on the number of bits set in the branch “counter”. Trace translation ends when the confidence drops below 1/3rd. - gh-109598: PyComplex_RealAsDouble()/PyComplex_ImagAsDouble() now tries to convert an object to a complex instance using its __complex__() method before falling back to the __float__() method. Patch by Sergey B Kirpichev. - gh-94606: Fix UnicodeEncodeError when email.message.get_payload() reads a message with a Unicode surrogate character and the message content is not well-formed for surrogateescape encoding. Patch by Sidney Markowitz. - bpo-21861: Use the object’s actual class name in _io.FileIO.__repr__(), _io._WindowsConsoleIO() and _io.TextIOWrapper.__repr__(), to make these methods subclass friendly. - bpo-45369: Remove LibreSSL workarounds as per PEP 644. - bpo-34392: Added sys._is_interned(). Libr- ary - gh-114077: Fix possible OverflowError in socket.socket.sendfile() when pass count larger than 2 GiB on 32-bit platform. - gh-111803: plistlib now supports loading more deeply nested lists in binary format. - gh-114014: Fixed a bug in fractions.Fraction where an invalid string using d in the decimals part creates a different error compared to other invalid letters/characters. Patch by Jeremiah Gabriel Pascual. - gh-108364: sqlite3.Connection.iterdump() now ensures that foreign key support is disabled before dumping the database schema, if there is any foreign key violation. Patch by Erlend E. Aasland and Mariusz Felisiak. - gh-113971: The zipfile.ZipInfo previously protected ._compresslevel attribute has been made public as .compress_level with the old _compresslevel name remaining available as a property to retain compatibility. - gh-113877: Fix tkinter method winfo_pathname() on 64-bit Windows. - gh-113868: Added mmap.MAP_NORESERVE, mmap.MAP_NOEXTEND, mmap.MAP_HASSEMAPHORE, mmap.MAP_NOCACHE, mmap.MAP_JIT, mmap.MAP_RESILIENT_CODESIGN, mmap.MAP_RESILIENT_MEDIA, mmap.MAP_32BIT, mmap.MAP_TRANSLATED_ALLOW_EXECUTE, mmap.MAP_UNIX03 and mmap.MAP_TPRO. All of them are mmap(2) flags on macOS. - gh-113848: asyncio.TaskGroup() and asyncio.timeout() context managers now handle CancelledError subclasses as well as exact CancelledError. - gh-113661: unittest runner: Don’t exit 5 if tests were skipped. The intention of exiting 5 was to detect issues where the test suite wasn’t discovered at all. If we skipped tests, it was correctly discovered. - gh-96037: Insert TimeoutError in the context of the exception that was raised during exiting an expired asyncio.timeout() block. - gh-113781: Silence unraisable AttributeError when warnings are emitted during Python finalization. - gh-113238: Add Anchor to importlib.resources (in order for the code to comply with the documentation) - gh-111693: asyncio.Condition.wait() now re-raises the same CancelledError instance that may have caused it to be interrupted. Fixed race condition in asyncio.Semaphore.aquire() when interrupted with a CancelledError. - gh-113791: Add CLOCK_MONOTONIC_RAW_APPROX and CLOCK_UPTIME_RAW_APPROX to time on macOS. These are clocks available on macOS 10.12 or later. - gh-112932: Restore the ability for zipfile to extractall from zip files with a “/” directory entry in them as is commonly added to zips by some wiki or bug tracker data exporters. - gh-113568: Raise deprecation warnings from pathlib.PurePath and not its private base class PurePathBase. - gh-113594: Fix UnicodeEncodeError in email when re-fold lines that contain unknown-8bit encoded part followed by non-unknown-8bit encoded part. - gh-113538: In asyncio.StreamReaderProtocol.connection_made(), there is callback that logs an error if the task wrapping the “connected callback” fails. This callback would itself fail if the task was cancelled. Prevent this by checking whether the task was cancelled first. If so, close the transport but don’t log an error. - gh-113626: Add support for the allow_code argument in the marshal module. Passing allow_code=False prevents serialization and de-serialization of code objects which is incompatible between Python versions. - gh-85567: Fix resource warnings for unclosed files in pickle and pickletools command line interfaces. - gh-113537: Support loads str in plistlib.loads(). - gh-89850: Add default implementations of pickle.Pickler.persistent_id() and pickle.Unpickler.persistent_load() methods in the C implementation. Calling super().persistent_id() and super().persistent_load() in subclasses of the C implementation of pickle.Pickler and pickle.Unpickler classes no longer causes infinite recursion. - gh-113569: Indicate if there were no actual calls in unittest assert_has_calls() failure. - gh-101225: Increase the backlog for multiprocessing.connection.Listener objects created by multiprocessing.manager and multiprocessing.resource_sharer to significantly reduce the risk of getting a connection refused error when creating a multiprocessing.connection.Connection to them. - gh-113568: Raise audit events from pathlib.Path and not its private base class PathBase. - gh-113543: Make sure that webbrowser.MacOSXOSAScript sends webbrowser.open audit event. - gh-113028: When a second reference to a string appears in the input to pickle, and the Python implementation is in use, we are guaranteed that a single copy gets pickled and a single object is shared when reloaded. Previously, in protocol 0, when a string contained certain characters (e.g. newline) it resulted in duplicate objects. - gh-113421: Fix multiprocessing logger for %(filename)s. - gh-111784: Fix segfaults in the _elementtree module. Fix first segfault during deallocation of _elementtree.XMLParser instances by keeping strong reference to pyexpat module in module state for capsule lifetime. Fix second segfault which happens in the same deallocation process by keeping strong reference to _elementtree module in XMLParser structure for _elementtree module lifetime. - gh-113407: Fix import of unittest.mock when CPython is built without docstrings. - gh-113320: Fix regression in Python 3.12 where Protocol classes that were not marked as runtime-checkable would be unnecessarily introspected, potentially causing exceptions to be raised if the protocol had problematic members. Patch by Alex Waygood. - gh-53502: Add a new option aware_datetime in plistlib to loads or dumps aware datetime. - gh-113358: Fix rendering tracebacks with exceptions with a broken __getattr__ - gh-113214: Fix an AttributeError during asyncio SSL protocol aborts in SSL-over-SSL scenarios. - gh-113246: Update bundled pip to 23.3.2. - gh-87264: Fixed tarfile list() method to show file type. - gh-112182: asyncio.futures.Future.set_exception() now transforms StopIteration into RuntimeError instead of hanging or other misbehavior. Patch contributed by Jamie Phan. - gh-113225: Speed up pathlib.Path.glob() by using os.DirEntry.path where possible. - gh-113149: Improve error message when a JSON array or object contains a trailing comma. Patch by Carson Radtke. - gh-113117: The subprocess module can now use the os.posix_spawn() function with close_fds=True on platforms where posix_spawn_file_actions_addclosefrom_np is available. Patch by Jakub Kulik. - gh-113199: Make http.client.HTTPResponse.read1 and http.client.HTTPResponse.readline close IO after reading all data when content length is known. Patch by Illia Volochii. - gh-113191: Add support of os.fchmod() and a file descriptor in os.chmod() on Windows. - gh-113188: Fix shutil.copymode() and shutil.copystat() on Windows. Previously they worked differenly if dst is a symbolic link: they modified the permission bits of dst itself rather than the file it points to if follow_symlinks is true or src is not a symbolic link, and did not modify the permission bits if follow_symlinks is false and src is a symbolic link. - gh-113119: os.posix_spawn() now accepts env=None, which makes the newly spawned process use the current process environment. Patch by Jakub Kulik. - gh-113202: Add a strict option to batched() in the itertools module. - gh-61648: Detect line numbers of properties in doctests. - gh-113175: Sync with importlib_metadata 7.0, including improved type annotations, fixed issue with symlinked packages in package_distributions, added EntryPoints.__repr__, introduced the diagnose script, added Distribution.origin property, and removed deprecated EntryPoint access by numeric index (tuple behavior). - gh-59616: Add support of os.lchmod() and the follow_symlinks argument in os.chmod() on Windows. Note that the default value of follow_symlinks in os.lchmod() is False on Windows. - gh-112559: signal.signal() and signal.getsignal() no longer call repr on callable handlers. asyncio.run() and asyncio.Runner.run() no longer call repr on the task results. Patch by Yilei Yang. - gh-112962: dis module functions add cache information to the Instruction instance rather than creating fake Instruction instances to represent the cache entries. - gh-112989: Reduce overhead to connect sockets with asyncio SelectorEventLoop. - gh-112970: Use closefrom() on Linux where available (e.g. glibc-2.34), rather than only FreeBSD. - gh-110190: Fix ctypes structs with array on PPC64LE platform by setting MAX_STRUCT_SIZE to 64 in stgdict. Patch by Diego Russo. - gh-112540: The statistics.geometric_mean() function now returns zero for datasets containing a zero. Formerly, it would raise an exception. - gh-87286: Added LOG_FTP, LOG_NETINFO, LOG_REMOTEAUTH, LOG_INSTALL, LOG_RAS, and LOG_LAUNCHD tot the syslog module, all of them constants on used on macOS. - gh-112800: Fix asyncio SubprocessTransport.close() not to throw PermissionError when used with setuid executables. - gh-51944: Add the following constants to the termios module. These values are present in macOS system headers: ALTWERASE, B14400, B28800, B7200, B76800, CCAR_OFLOW, CCTS_OFLOW, CDSR_OFLOW, CDTR_IFLOW, CIGNORE, CRTS_IFLOW, EXTPROC, IUTF8, MDMBUF, NL2, NL3, NOKERNINFO, ONOEOT, OXTABS, VDSUSP, VSTATUS. - gh-79325: Fix an infinite recursion error in tempfile.TemporaryDirectory() cleanup on Windows. - gh-94692: shutil.rmtree() now only catches OSError exceptions. Previously a symlink attack resistant version of shutil.rmtree() could ignore or pass to the error handler arbitrary exception when invalid arguments were provided. - gh-112736: The use of del-safe symbols in subprocess was refactored to allow for use in cross-platform build environments. - gh-112727: Speed up pathlib.Path.absolute(). Patch by Barney Gale. - gh-74690: Speedup issubclass() checks against simple runtime-checkable protocols by around 6%. Patch by Alex Waygood. - gh-74690: Speedup isinstance() checks by roughly 20% for runtime-checkable protocols that only have one callable member. Speedup issubclass() checks for these protocols by roughly 10%. Patch by Alex Waygood. - gh-112645: Remove deprecation error on passing onerror to shutil.rmtree(). - gh-112640: Add kwdefaults parameter to types.FunctionType to set default keyword argument values. - gh-112622: Ensure name parameter is passed to event loop in asyncio.create_task(). - gh-112618: Fix a caching bug relating to typing.Annotated. Annotated[str, True] is no longer identical to Annotated[str, 1]. - gh-112334: Fixed a performance regression in 3.12’s subprocess on Linux where it would no longer use the fast-path vfork() system call when it could have due to a logic bug, instead falling back to the safe but slower fork(). - Also fixed a second 3.12.0 potential security bug. If a value of extra_groups=[] was passed to subprocess.Popen or related APIs, the underlying setgroups(0, NULL) system call to clear the groups list would not be made in the child process prior to exec(). - This was identified via code inspection in the process of fixing the first bug. - gh-110190: Fix ctypes structs with array on Arm platform by setting MAX_STRUCT_SIZE to 32 in stgdict. Patch by Diego Russo. - gh-81194: Fix a crash in socket.if_indextoname() with specific value (UINT_MAX). Fix an integer overflow in socket.if_indextoname() on 64-bit non-Windows platforms. - gh-112578: Fix a spurious RuntimeWarning when executing the zipfile module. - gh-112516: Update the bundled copy of pip to version 23.3.1. - gh-112510: Add readline.backend for the backend readline uses (editline or readline) - gh-112328: [Enum] Make EnumDict, EnumDict.member_names, EnumType._add_alias_ and EnumType._add_value_alias_ public. - gh-112509: Fix edge cases that could cause a key to be present in both the __required_keys__ and __optional_keys__ attributes of a typing.TypedDict. Patch by Jelle Zijlstra. - gh-101336: Add keep_alive keyword parameter for AbstractEventLoop.create_server() and BaseEventLoop.create_server(). - gh-63284: Added support for TLS-PSK (pre-shared key) mode to the ssl module. - gh-112414: Fix regression in Python 3.12 where calling repr() on a module that had been imported using a custom loader could fail with AttributeError. Patch by Alex Waygood. - gh-112358: Revert change to struct.Struct initialization that broke some cases of subclassing. - gh-112405: Optimize pathlib.PurePath.relative_to(). Patch by Alex Waygood. - gh-94722: Fix bug where comparison between instances of DocTest fails if one of them has None as its lineno. - gh-112361: Speed up a small handful of pathlib methods by removing some temporary objects. - gh-112345: Improve error message when trying to call issubclass() against a typing.Protocol that has non-method members. Patch by Randolf Scholz. - gh-112137: Change dis output to display no-lineno as “–” instead of “None”. - gh-112332: Deprecate the exc_type field of traceback.TracebackException. Add exc_type_str to replace it. - gh-81620: Add extra tests for random.binomialvariate() - gh-112292: Fix a crash in readline when imported from a sub interpreter. Patch by Anthony Shaw - gh-77621: Slightly improve the import time of the pathlib module by deferring some imports. Patch by Barney Gale. - gh-112137: Change dis output to display logical labels for jump targets instead of offsets. - gh-112139: Add Signature.format() to format signatures to string with extra options. And use it in pydoc to render more readable signatures that have new lines between parameters. - gh-112105: Make readline.set_completer_delims() work with libedit - gh-106922: Display multiple lines with traceback when errors span multiple lines. - gh-111874: When creating a typing.NamedTuple class, ensure __set_name__() is called on all objects that define __set_name__ and exist in the values of the NamedTuple class’s class dictionary. Patch by Alex Waygood. - gh-68166: Add support of the “vsapi” element type in tkinter.ttk.Style.element_create(). - gh-110275: Named tuple’s methods _replace() and __replace__() now raise TypeError instead of ValueError for invalid keyword arguments. - gh-99367: Do not mangle sys.path[0] in pdb if safe_path is set - gh-111615: Fix a regression caused by a fix to gh-93162 whereby you couldn’t configure a QueueHandler without specifying handlers. - gh-75666: Fix the behavior of tkinter widget’s unbind() method with two arguments. Previously, widget.unbind(sequence, funcid) destroyed the current binding for sequence, leaving sequence unbound, and deleted the funcid command. Now it removes only funcid from the binding for sequence, keeping other commands, and deletes the funcid command. It leaves sequence unbound only if funcid was the last bound command. - gh-67790: Implement basic formatting support (minimum width, alignment, fill) for fractions.Fraction. - gh-111049: Fix crash during garbage collection of the io.BytesIO buffer object. - gh-102980: Redirect the output of interact command of pdb to the same channel as the debugger. Add tests and improve docs. - gh-102988: email.utils.getaddresses() and email.utils.parseaddr() now return ('', '') 2-tuples in more situations where invalid email addresses are encountered instead of potentially inaccurate values. Add optional strict parameter to these two functions: use strict=False to get the old behavior, accept malformed inputs. getattr(email.utils, 'supports_strict_parsing', False) can be use to check if the strict paramater is available. Patch by Thomas Dwyer and Victor Stinner to improve the CVE-2023-27043 fix (bsc#1210638). - gh-52161: cmd.Cmd.do_help() now cleans docstrings with inspect.cleandoc() before writing them. Patch by Filip Łapkiewicz. - gh-82300: Add track parameter to multiprocessing.shared_memory.SharedMemory that allows using shared memory blocks without having to register with the POSIX resource tracker that automatically releases them upon process exit. - gh-110109: Add private pathlib._PurePathBase class: a base class for pathlib.PurePath that omits certain magic methods. It may be made public (along with _PathBase) in future. - gh-109858: Protect zipfile from “quoted-overlap” zipbomb. It now raises BadZipFile when try to read an entry that overlaps with other entry or central directory. - gh-109786: Fix possible reference leaks and crash when re-enter the __next__() method of itertools.pairwise. - gh-91539: Small (10 - 20%) and trivial performance improvement of urrlib.request.getproxies_environment(), typically useful when there are many environment variables to go over. - gh-103363: Add follow_symlinks keyword-only argument to pathlib.Path.owner() and group(), defaulting to True. - gh-102130: Support tab completion in cmd for editline. - gh-99437: runpy.run_path() now decodes path-like objects, making sure __file__ and sys.argv[0] of the module being run are always strings. - gh-104003: Add warnings.deprecated(), a decorator to mark deprecated functions to static type checkers and to warn on usage of deprecated classes and functions. See PEP 702. Patch by Jelle Zijlstra. - gh-103708: Make hardcoded python name, a configurable parameter so that different implementations of python can override it instead of making huge diffs in sysconfig.py - gh-66515: mailbox.MH now supports folders that do not contain a .mh_sequences file (e.g. Claws Mail IMAP-cache folders). Patch by Serhiy Storchaka. - gh-83162: Renamed re.error to PatternError for clarity, and kept re.error for backward compatibility. Patch by Matthias Bussonnier and Adam Chhina. - gh-91133: Fix a bug in tempfile.TemporaryDirectory cleanup, which now no longer dereferences symlinks when working around file system permission errors. - bpo-43153: On Windows, tempfile.TemporaryDirectory previously masked a PermissionError with NotADirectoryError during directory cleanup. It now correctly raises PermissionError if errors are not ignored. Patch by Andrei Kulakov and Ken Jin. - bpo-32731: getpass.getuser() now raises OSError for all failures rather than ImportError on systems lacking the pwd module or KeyError if the password database is empty. - bpo-34321: mmap.mmap now has a trackfd parameter on Unix; if it is False, the file descriptor specified by fileno will not be duplicated. - bpo-35332: The shutil.rmtree() function now ignores errors when calling os.close() when ignore_errors is True, and os.close() no longer retried after error. - bpo-35928: io.TextIOWrapper now correctly handles the decoding buffer after read() and write(). - bpo-26791: shutil.move() now moves a symlink into a directory when that directory is the target of the symlink. This provides the same behavior as the mv shell command. The previous behavior raised an exception. Patch by Jeffrey Kintscher. - bpo-41422: Fixed memory leaks of pickle.Pickler and pickle.Unpickler involving cyclic references via the internal memo mapping. - bpo-19821: The pydoc.ispackage() function has been deprecated. - bpo-40262: The ssl.SSLSocket.recv_into() method no longer requires the buffer argument to implement __len__ and supports buffers with arbitrary item size. - bpo-39912: warnings.filterwarnings() and warnings.simplefilter() now raise appropriate exceptions instead of AssertionError. Patch contributed by Rémi Lapeyre. - bpo-37260: Fixed a race condition in shutil.rmtree() in which directory entries removed by another process or thread while shutil.rmtree() is running can cause it to raise FileNotFoundError. Patch by Jeffrey Kintscher. - bpo-36959: Fix some error messages for invalid ISO format string combinations in strptime() that referred to directives not contained in the format string. Patch by Gordon P. Hemsley. - bpo-18060: Fixed a class inheritance issue that can cause segfaults when deriving two or more levels of subclasses from a base class of Structure or Union. - bpo-29779: Add a new PYTHON_HISTORY environment variable to set the location of a .python_history file. - bpo-21360: mailbox.Maildir now ignores files with a leading dot. - Documentation - gh-111699: Relocate smtpd deprecation notice to its own section rather than under locale in What’s New in Python 3.12 document - gh-110746: Improved markup for valid options/values for methods ttk.treeview.column and ttk.treeview.heading, and for Layouts. - gh-95649: Document that the asyncio module contains code taken from v0.16.0 of the uvloop project, as well as the required MIT licensing information. - Tests - gh-111798: Disable test_super_deep() from test_call under pydebug builds on WASI; the stack depth is too small to make the test useful. - gh-111801: Lower the recursion limit in test_isinstance for test_infinitely_many_bases(). This prevents a stack overflow on a pydebug build of WASI. - gh-111802: Specify a low recursion depth for test_bad_getattr() in test.pickletester to avoid exhausting the stack under a pydebug build for WASI. - gh-44626: Fix os.path.isabs() incorrectly returning True when given a path that starts with exactly one (back)slash on Windows. - Fix pathlib.PureWindowsPath.is_absolute() incorrectly returning False for some paths beginning with two (back)slashes. - gh-113633: Use module state for the _testcapi extension module. - gh-109980: Fix test_tarfile_vs_tar in test_shutil for macOS, where system tar can include more information in the archive than shutil.make_archive. - gh-112769: The tests now correctly compare zlib version when zlib.ZLIB_RUNTIME_VERSION contains non-integer suffixes. For example zlib-ng defines the version as 1.3.0.zlib-ng. - gh-112334: Adds a regression test to verify that vfork() is used when expected by subprocess on vfork enabled POSIX systems (Linux). - gh-108927: Fixed order dependence in running tests in the same process when a test that has submodules (e.g. test_importlib) follows a test that imports its submodule (e.g. test_importlib.util) and precedes a test (e.g. test_unittest or test_compileall) that uses that submodule. - bpo-40648: Test modes that file can get with chmod() on Windows. - Build - gh-114013: Fix Tools/wasm/wasi.py to not include the path to python.wasm as part of HOSTRUNNER. The environment variable is meant to specify how to run the WASI host only, having python.wasm and relevant flags appended to the HOSTRUNNER. This fixes make test work. - gh-113258: Changed the Windows build to write out generated frozen modules into the build tree instead of the source tree. - gh-112305: Fixed the check-clean-src step performed on out of tree builds to detect errant $(srcdir)/Python/frozen_modules/*.h files and recommend appropriate source tree cleanup steps to get a working build again. - gh-112536: Add support for thread sanitizer (TSAN) - gh-112867: Fix the build for the case that WITH_PYMALLOC_RADIX_TREE=0 set. - gh-103065: Introduce Tools/wasm/wasi.py to simplify doing a WASI build. - bpo-11102: The os.major(), os.makedev(), and os.minor() functions are now available on HP-UX v3. - bpo-36351: Do not set ipv6type when cross-compiling. - IDLE - gh-72284: Improve the lists of features, editor key bindings, and shell key bingings in the IDLE doc. - gh-113903: Fix rare failure of test.test_idle, in test_configdialog. - gh-113729: Fix the “Help -> IDLE Doc” menu bug in 3.11.7 and 3.12.1. - gh-113269: Fix test_editor hang on macOS Catalina. - gh-112898: Fix processing unsaved files when quitting IDLE on macOS. - bpo-13586: Enter the selected text when opening the “Replace” dialog. - C API - gh-106560: Fix redundant declarations in the public C API. Declare PyBool_Type, PyLong_Type and PySys_Audit() only once. Patch by Victor Stinner. - gh-112438: Fix support of format units “es”, “et”, “es#”, and “et#” in nested tuples in PyArg_ParseTuple()-like functions. - gh-111545: Add Py_HashPointer() function to hash a pointer. Patch by Victor Stinner. - gh-65210: Change the declaration of the keywords parameter of PyArg_ParseTupleAndKeywords() and PyArg_VaParseTupleAndKeywords() for better compatibility with C++. - Refresh all patches - F00251-change-user-install-location.patch - bpo-31046_ensurepip_honours_prefix.patch - fix_configure_rst.patch - no-skipif-doctests.patch - python-3.3.0b1-fix_date_time_compiler.patch - python-3.3.0b1-localpath.patch - python-3.3.0b1-test-posix_fadvise.patch - skip-test_pyobject_freed_is_freed.patch - subprocess-raise-timeout.patch ++++ pgadmin4: - Fix shebang of pgadmin4-desktop to use python3.11 ++++ python311: - Update to 3.11.8: - Security - gh-113659: Skip .pth files with names starting with a dot or hidden file attribute. - Core and Builtins - gh-114887: Changed socket type validation in create_datagram_endpoint() to accept all non-stream sockets. This fixes a regression in compatibility with raw sockets. - gh-114388: Fix a RuntimeWarning emitted when assign an integer-like value that is not an instance of int to an attribute that corresponds to a C struct member of type T_UINT and T_ULONG. Fix a double RuntimeWarning emitted when assign a negative integer value to an attribute that corresponds to a C struct member of type T_UINT. - gh-89811: Check for a valid tp_version_tag before performing bytecode specializations that rely on this value being usable. - gh-113602: Fix an error that was causing the parser to try to overwrite existing errors and crashing in the process. Patch by Pablo Galindo - gh-113566: Fix a 3.11-specific crash when the repr of a Future is requested after the module has already been garbage-collected. - gh-106905: Use per AST-parser state rather than global state to track recursion depth within the AST parser to prevent potential race condition due to simultaneous parsing. - The issue primarily showed up in 3.11 by multithreaded users of ast.parse(). In 3.12 a change to when garbage collection can be triggered prevented the race condition from occurring. - gh-112716: Fix SystemError in the import statement and in __reduce__() methods of builtin types when __builtins__ is not a dict. - gh-105967: Workaround a bug in Apple’s macOS platform zlib library where zlib.crc32() and binascii.crc32() could produce incorrect results on multi-gigabyte inputs. Including when using zipfile on zips containing large data. - gh-94606: Fix UnicodeEncodeError when email.message.get_payload() reads a message with a Unicode surrogate character and the message content is not well-formed for surrogateescape encoding. Patch by Sidney Markowitz. - Library - gh-114965: Update bundled pip to 24.0 - gh-114959: tarfile no longer ignores errors when trying to extract a directory on top of a file. - gh-109475: Fix support of explicit option value “–” in argparse (e.g. --option=--). - gh-110190: Fix ctypes structs with array on Windows ARM64 platform by setting MAX_STRUCT_SIZE to 32 in stgdict. Patch by Diego Russo - gh-113280: Fix a leak of open socket in rare cases when error occurred in ssl.SSLSocket creation. - gh-77749: email.policy.EmailPolicy.fold() now always encodes non-ASCII characters in headers if utf8 is false. - gh-114492: Make the result of termios.tcgetattr() reproducible on Alpine Linux. Previously it could leave a random garbage in some fields. - gh-75128: Ignore an OSError in asyncio.BaseEventLoop.create_server() when IPv6 is available but the interface cannot actually support it. - gh-114257: Dismiss the FileNotFound error in ctypes.util.find_library() and just return None on Linux. - gh-101438: Avoid reference cycle in ElementTree.iterparse. The iterator returned by ElementTree.iterparse may hold on to a file descriptor. The reference cycle prevented prompt clean-up of the file descriptor if the returned iterator was not exhausted. - gh-104522: OSError raised when run a subprocess now only has filename attribute set to cwd if the error was caused by a failed attempt to change the current directory. - gh-109534: Fix a reference leak in asyncio.selector_events.BaseSelectorEventLoop when SSL handshakes fail. Patch contributed by Jamie Phan. - gh-114077: Fix possible OverflowError in socket.socket.sendfile() when pass count larger than 2 GiB on 32-bit platform. - gh-114014: Fixed a bug in fractions.Fraction where an invalid string using d in the decimals part creates a different error compared to other invalid letters/characters. Patch by Jeremiah Gabriel Pascual. - gh-113951: Fix the behavior of tag_unbind() methods of tkinter.Text and tkinter.Canvas classes with three arguments. Previously, widget.tag_unbind(tag, sequence, funcid) destroyed the current binding for sequence, leaving sequence unbound, and deleted the funcid command. Now it removes only funcid from the binding for sequence, keeping other commands, and deletes the funcid command. It leaves sequence unbound only if funcid was the last bound command. - gh-113877: Fix tkinter method winfo_pathname() on 64-bit Windows. - gh-113781: Silence unraisable AttributeError when warnings are emitted during Python finalization. - gh-113594: Fix UnicodeEncodeError in email when re-fold lines that contain unknown-8bit encoded part followed by non-unknown-8bit encoded part. - gh-113538: In asyncio.StreamReaderProtocol.connection_made(), there is callback that logs an error if the task wrapping the “connected callback” fails. This callback would itself fail if the task was cancelled. Prevent this by checking whether the task was cancelled first. If so, close the transport but don’t log an error. - gh-85567: Fix resource warnings for unclosed files in pickle and pickletools command line interfaces. - gh-101225: Increase the backlog for multiprocessing.connection.Listener objects created by multiprocessing.manager and multiprocessing.resource_sharer to significantly reduce the risk of getting a connection refused error when creating a multiprocessing.connection.Connection to them. - gh-113543: Make sure that webbrowser.MacOSXOSAScript sends webbrowser.open audit event. - gh-113028: When a second reference to a string appears in the input to pickle, and the Python implementation is in use, we are guaranteed that a single copy gets pickled and a single object is shared when reloaded. Previously, in protocol 0, when a string contained certain characters (e.g. newline) it resulted in duplicate objects. - gh-113421: Fix multiprocessing logger for %(filename)s. - gh-113358: Fix rendering tracebacks for exceptions with a broken __getattr__. - gh-113214: Fix an AttributeError during asyncio SSL protocol aborts in SSL-over-SSL scenarios. - gh-113246: Update bundled pip to 23.3.2. - gh-113199: Make http.client.HTTPResponse.read1 and http.client.HTTPResponse.readline close IO after reading all data when content length is known. Patch by Illia Volochii. - gh-113188: Fix shutil.copymode() and shutil.copystat() on Windows. Previously they worked differenly if dst is a symbolic link: they modified the permission bits of dst itself rather than the file it points to if follow_symlinks is true or src is not a symbolic link, and did not modify the permission bits if follow_symlinks is false and src is a symbolic link. - gh-61648: Detect line numbers of properties in doctests. - gh-112559: signal.signal() and signal.getsignal() no longer call repr on callable handlers. asyncio.run() and asyncio.Runner.run() no longer call repr on the task results. Patch by Yilei Yang. - gh-110190: Fix ctypes structs with array on PPC64LE platform by setting MAX_STRUCT_SIZE to 64 in stgdict. Patch by Diego Russo. - gh-79429: Ignore FileNotFoundError when remove a temporary directory in the multiprocessing finalizer. - gh-79325: Fix an infinite recursion error in tempfile.TemporaryDirectory() cleanup on Windows. - gh-110190: Fix ctypes structs with array on Arm platform by setting MAX_STRUCT_SIZE to 32 in stgdict. Patch by Diego Russo. - gh-81194: Fix a crash in socket.if_indextoname() with specific value (UINT_MAX). Fix an integer overflow in socket.if_indextoname() on 64-bit non-Windows platforms. - gh-75666: Fix the behavior of tkinter widget’s unbind() method with two arguments. Previously, widget.unbind(sequence, funcid) destroyed the current binding for sequence, leaving sequence unbound, and deleted the funcid command. Now it removes only funcid from the binding for sequence, keeping other commands, and deletes the funcid command. It leaves sequence unbound only if funcid was the last bound command. - gh-110345: Show the Tcl/Tk patchlevel (rather than version) in tkinter._test(). - gh-109858: Protect zipfile from “quoted-overlap” zipbomb. It now raises BadZipFile when try to read an entry that overlaps with other entry or central directory (bsc#1221854, CVE-2024-0450). - gh-38807: Fix race condition in trace. Instead of checking if a directory exists and creating it, directly call os.makedirs() with the kwarg exist_ok=True. - gh-75705: Set unixfrom envelope in mailbox.mbox and mailbox.MMDF. - gh-105102: Allow ctypes.Union to be nested in ctypes.Structure when the system endianness is the opposite of the classes. - gh-104282: Fix null pointer dereference in lzma._decode_filter_properties() due to improper handling of BCJ filters with properties of zero length. Patch by Radislav Chugunov. - gh-102512: When os.fork() is called from a foreign thread (aka _DummyThread), the type of the thread in a child process is changed to _MainThread. Also changed its name and daemonic status, it can be now joined. - gh-91133: Fix a bug in tempfile.TemporaryDirectory cleanup, which now no longer dereferences symlinks when working around file system permission errors. - bpo-43153: On Windows, tempfile.TemporaryDirectory previously masked a PermissionError with NotADirectoryError during directory cleanup. It now correctly raises PermissionError if errors are not ignored. Patch by Andrei Kulakov and Ken Jin. - bpo-35332: The shutil.rmtree() function now ignores errors when calling os.close() when ignore_errors is True, and os.close() no longer retried after error. - bpo-35928: io.TextIOWrapper now correctly handles the decoding buffer after read() and write(). - bpo-26791: shutil.move() now moves a symlink into a directory when that directory is the target of the symlink. This provides the same behavior as the mv shell command. The previous behavior raised an exception. Patch by Jeffrey Kintscher. - bpo-36959: Fix some error messages for invalid ISO format string combinations in strptime() that referred to directives not contained in the format string. Patch by Gordon P. Hemsley. - bpo-18060: Fixed a class inheritance issue that can cause segfaults when deriving two or more levels of subclasses from a base class of Structure or Union. - Documentation - gh-110746: Improved markup for valid options/values for methods ttk.treeview.column and ttk.treeview.heading, and for Layouts. - gh-95649: Document that the asyncio module contains code taken from v0.16.0 of the uvloop project, as well as the required MIT licensing information. - Tests - gh-109980: Fix test_tarfile_vs_tar in test_shutil for macOS, where system tar can include more information in the archive than shutil.make_archive. - gh-112769: The tests now correctly compare zlib version when zlib.ZLIB_RUNTIME_VERSION contains non-integer suffixes. For example zlib-ng defines the version as 1.3.0.zlib-ng. - gh-105089: Fix test.test_zipfile.test_core.TestWithDirectory.test_create_directory_with_write test in AIX by doing a bitwise AND of 0xFFFF on mode , so that it will be in sync with zinfo.external_attr - bpo-40648: Test modes that file can get with chmod() on Windows. - Build - gh-101778: Fix build error when there’s a dangling symlink in the directory containing ffi.h. - gh-112305: Fixed the check-clean-src step performed on out of tree builds to detect errant $(srcdir)/Python/frozen_modules/*.h files and recommend appropriate source tree cleanup steps to get a working build again. - bpo-11102: The os.major(), os.makedev(), and os.minor() functions are now available on HP-UX v3. - bpo-36351: Do not set ipv6type when cross-compiling. - IDLE - gh-96905: In idlelib code, stop redefining built-ins ‘dict’ and ‘object’. - gh-72284: Improve the lists of features, editor key bindings, and shell key bingings in the IDLE doc. - gh-113903: Fix rare failure of test.test_idle, in test_configdialog. - gh-113729: Fix the “Help -> IDLE Doc” menu bug in 3.11.7 and 3.12.1. - gh-113269: Fix test_editor hang on macOS Catalina. - gh-112898: Fix processing unsaved files when quitting IDLE on macOS. - gh-103820: Revise IDLE bindings so that events from mouse button 4/5 on non-X11 windowing systems (i.e. Win32 and Aqua) are not mistaken for scrolling. - bpo-13586: Enter the selected text when opening the “Replace” dialog. - Tools/Demos - gh-109991: Update GitHub CI workflows to use OpenSSL 3.0.13 and multissltests to use 1.1.1w, 3.0.13, 3.1.5, and 3.2.1. - gh-115015: Fix a bug in Argument Clinic that generated incorrect code for methods with no parameters that use the METH_METHOD | METH_FASTCALL | METH_KEYWORDS calling convention. Only the positional parameter count was checked; any keyword argument passed would be silently accepted. - Remove upstreamed patches: - CVE-2024-0450-zipfile-avoid-quoted-overlap-zipbomb.patch - Refresh all patches: - CVE-2023-27043-email-parsing-errors.patch - F00251-change-user-install-location.patch - bpo-31046_ensurepip_honours_prefix.patch - distutils-reproducible-compile.patch - fix_configure_rst.patch - python-3.3.0b1-fix_date_time_compiler.patch - python-3.3.0b1-localpath.patch - python-3.3.0b1-test-posix_fadvise.patch - skip_if_buildbot-extend.patch - subprocess-raise-timeout.patch - support-expat-CVE-2022-25236-patched.patch ++++ python311-core: - Update to 3.11.8: - Security - gh-113659: Skip .pth files with names starting with a dot or hidden file attribute. - Core and Builtins - gh-114887: Changed socket type validation in create_datagram_endpoint() to accept all non-stream sockets. This fixes a regression in compatibility with raw sockets. - gh-114388: Fix a RuntimeWarning emitted when assign an integer-like value that is not an instance of int to an attribute that corresponds to a C struct member of type T_UINT and T_ULONG. Fix a double RuntimeWarning emitted when assign a negative integer value to an attribute that corresponds to a C struct member of type T_UINT. - gh-89811: Check for a valid tp_version_tag before performing bytecode specializations that rely on this value being usable. - gh-113602: Fix an error that was causing the parser to try to overwrite existing errors and crashing in the process. Patch by Pablo Galindo - gh-113566: Fix a 3.11-specific crash when the repr of a Future is requested after the module has already been garbage-collected. - gh-106905: Use per AST-parser state rather than global state to track recursion depth within the AST parser to prevent potential race condition due to simultaneous parsing. - The issue primarily showed up in 3.11 by multithreaded users of ast.parse(). In 3.12 a change to when garbage collection can be triggered prevented the race condition from occurring. - gh-112716: Fix SystemError in the import statement and in __reduce__() methods of builtin types when __builtins__ is not a dict. - gh-105967: Workaround a bug in Apple’s macOS platform zlib library where zlib.crc32() and binascii.crc32() could produce incorrect results on multi-gigabyte inputs. Including when using zipfile on zips containing large data. - gh-94606: Fix UnicodeEncodeError when email.message.get_payload() reads a message with a Unicode surrogate character and the message content is not well-formed for surrogateescape encoding. Patch by Sidney Markowitz. - Library - gh-114965: Update bundled pip to 24.0 - gh-114959: tarfile no longer ignores errors when trying to extract a directory on top of a file. - gh-109475: Fix support of explicit option value “–” in argparse (e.g. --option=--). - gh-110190: Fix ctypes structs with array on Windows ARM64 platform by setting MAX_STRUCT_SIZE to 32 in stgdict. Patch by Diego Russo - gh-113280: Fix a leak of open socket in rare cases when error occurred in ssl.SSLSocket creation. - gh-77749: email.policy.EmailPolicy.fold() now always encodes non-ASCII characters in headers if utf8 is false. - gh-114492: Make the result of termios.tcgetattr() reproducible on Alpine Linux. Previously it could leave a random garbage in some fields. - gh-75128: Ignore an OSError in asyncio.BaseEventLoop.create_server() when IPv6 is available but the interface cannot actually support it. - gh-114257: Dismiss the FileNotFound error in ctypes.util.find_library() and just return None on Linux. - gh-101438: Avoid reference cycle in ElementTree.iterparse. The iterator returned by ElementTree.iterparse may hold on to a file descriptor. The reference cycle prevented prompt clean-up of the file descriptor if the returned iterator was not exhausted. - gh-104522: OSError raised when run a subprocess now only has filename attribute set to cwd if the error was caused by a failed attempt to change the current directory. - gh-109534: Fix a reference leak in asyncio.selector_events.BaseSelectorEventLoop when SSL handshakes fail. Patch contributed by Jamie Phan. - gh-114077: Fix possible OverflowError in socket.socket.sendfile() when pass count larger than 2 GiB on 32-bit platform. - gh-114014: Fixed a bug in fractions.Fraction where an invalid string using d in the decimals part creates a different error compared to other invalid letters/characters. Patch by Jeremiah Gabriel Pascual. - gh-113951: Fix the behavior of tag_unbind() methods of tkinter.Text and tkinter.Canvas classes with three arguments. Previously, widget.tag_unbind(tag, sequence, funcid) destroyed the current binding for sequence, leaving sequence unbound, and deleted the funcid command. Now it removes only funcid from the binding for sequence, keeping other commands, and deletes the funcid command. It leaves sequence unbound only if funcid was the last bound command. - gh-113877: Fix tkinter method winfo_pathname() on 64-bit Windows. - gh-113781: Silence unraisable AttributeError when warnings are emitted during Python finalization. - gh-113594: Fix UnicodeEncodeError in email when re-fold lines that contain unknown-8bit encoded part followed by non-unknown-8bit encoded part. - gh-113538: In asyncio.StreamReaderProtocol.connection_made(), there is callback that logs an error if the task wrapping the “connected callback” fails. This callback would itself fail if the task was cancelled. Prevent this by checking whether the task was cancelled first. If so, close the transport but don’t log an error. - gh-85567: Fix resource warnings for unclosed files in pickle and pickletools command line interfaces. - gh-101225: Increase the backlog for multiprocessing.connection.Listener objects created by multiprocessing.manager and multiprocessing.resource_sharer to significantly reduce the risk of getting a connection refused error when creating a multiprocessing.connection.Connection to them. - gh-113543: Make sure that webbrowser.MacOSXOSAScript sends webbrowser.open audit event. - gh-113028: When a second reference to a string appears in the input to pickle, and the Python implementation is in use, we are guaranteed that a single copy gets pickled and a single object is shared when reloaded. Previously, in protocol 0, when a string contained certain characters (e.g. newline) it resulted in duplicate objects. - gh-113421: Fix multiprocessing logger for %(filename)s. - gh-113358: Fix rendering tracebacks for exceptions with a broken __getattr__. - gh-113214: Fix an AttributeError during asyncio SSL protocol aborts in SSL-over-SSL scenarios. - gh-113246: Update bundled pip to 23.3.2. - gh-113199: Make http.client.HTTPResponse.read1 and http.client.HTTPResponse.readline close IO after reading all data when content length is known. Patch by Illia Volochii. - gh-113188: Fix shutil.copymode() and shutil.copystat() on Windows. Previously they worked differenly if dst is a symbolic link: they modified the permission bits of dst itself rather than the file it points to if follow_symlinks is true or src is not a symbolic link, and did not modify the permission bits if follow_symlinks is false and src is a symbolic link. - gh-61648: Detect line numbers of properties in doctests. - gh-112559: signal.signal() and signal.getsignal() no longer call repr on callable handlers. asyncio.run() and asyncio.Runner.run() no longer call repr on the task results. Patch by Yilei Yang. - gh-110190: Fix ctypes structs with array on PPC64LE platform by setting MAX_STRUCT_SIZE to 64 in stgdict. Patch by Diego Russo. - gh-79429: Ignore FileNotFoundError when remove a temporary directory in the multiprocessing finalizer. - gh-79325: Fix an infinite recursion error in tempfile.TemporaryDirectory() cleanup on Windows. - gh-110190: Fix ctypes structs with array on Arm platform by setting MAX_STRUCT_SIZE to 32 in stgdict. Patch by Diego Russo. - gh-81194: Fix a crash in socket.if_indextoname() with specific value (UINT_MAX). Fix an integer overflow in socket.if_indextoname() on 64-bit non-Windows platforms. - gh-75666: Fix the behavior of tkinter widget’s unbind() method with two arguments. Previously, widget.unbind(sequence, funcid) destroyed the current binding for sequence, leaving sequence unbound, and deleted the funcid command. Now it removes only funcid from the binding for sequence, keeping other commands, and deletes the funcid command. It leaves sequence unbound only if funcid was the last bound command. - gh-110345: Show the Tcl/Tk patchlevel (rather than version) in tkinter._test(). - gh-109858: Protect zipfile from “quoted-overlap” zipbomb. It now raises BadZipFile when try to read an entry that overlaps with other entry or central directory (bsc#1221854, CVE-2024-0450). - gh-38807: Fix race condition in trace. Instead of checking if a directory exists and creating it, directly call os.makedirs() with the kwarg exist_ok=True. - gh-75705: Set unixfrom envelope in mailbox.mbox and mailbox.MMDF. - gh-105102: Allow ctypes.Union to be nested in ctypes.Structure when the system endianness is the opposite of the classes. - gh-104282: Fix null pointer dereference in lzma._decode_filter_properties() due to improper handling of BCJ filters with properties of zero length. Patch by Radislav Chugunov. - gh-102512: When os.fork() is called from a foreign thread (aka _DummyThread), the type of the thread in a child process is changed to _MainThread. Also changed its name and daemonic status, it can be now joined. - gh-91133: Fix a bug in tempfile.TemporaryDirectory cleanup, which now no longer dereferences symlinks when working around file system permission errors. - bpo-43153: On Windows, tempfile.TemporaryDirectory previously masked a PermissionError with NotADirectoryError during directory cleanup. It now correctly raises PermissionError if errors are not ignored. Patch by Andrei Kulakov and Ken Jin. - bpo-35332: The shutil.rmtree() function now ignores errors when calling os.close() when ignore_errors is True, and os.close() no longer retried after error. - bpo-35928: io.TextIOWrapper now correctly handles the decoding buffer after read() and write(). - bpo-26791: shutil.move() now moves a symlink into a directory when that directory is the target of the symlink. This provides the same behavior as the mv shell command. The previous behavior raised an exception. Patch by Jeffrey Kintscher. - bpo-36959: Fix some error messages for invalid ISO format string combinations in strptime() that referred to directives not contained in the format string. Patch by Gordon P. Hemsley. - bpo-18060: Fixed a class inheritance issue that can cause segfaults when deriving two or more levels of subclasses from a base class of Structure or Union. - Documentation - gh-110746: Improved markup for valid options/values for methods ttk.treeview.column and ttk.treeview.heading, and for Layouts. - gh-95649: Document that the asyncio module contains code taken from v0.16.0 of the uvloop project, as well as the required MIT licensing information. - Tests - gh-109980: Fix test_tarfile_vs_tar in test_shutil for macOS, where system tar can include more information in the archive than shutil.make_archive. - gh-112769: The tests now correctly compare zlib version when zlib.ZLIB_RUNTIME_VERSION contains non-integer suffixes. For example zlib-ng defines the version as 1.3.0.zlib-ng. - gh-105089: Fix test.test_zipfile.test_core.TestWithDirectory.test_create_directory_with_write test in AIX by doing a bitwise AND of 0xFFFF on mode , so that it will be in sync with zinfo.external_attr - bpo-40648: Test modes that file can get with chmod() on Windows. - Build - gh-101778: Fix build error when there’s a dangling symlink in the directory containing ffi.h. - gh-112305: Fixed the check-clean-src step performed on out of tree builds to detect errant $(srcdir)/Python/frozen_modules/*.h files and recommend appropriate source tree cleanup steps to get a working build again. - bpo-11102: The os.major(), os.makedev(), and os.minor() functions are now available on HP-UX v3. - bpo-36351: Do not set ipv6type when cross-compiling. - IDLE - gh-96905: In idlelib code, stop redefining built-ins ‘dict’ and ‘object’. - gh-72284: Improve the lists of features, editor key bindings, and shell key bingings in the IDLE doc. - gh-113903: Fix rare failure of test.test_idle, in test_configdialog. - gh-113729: Fix the “Help -> IDLE Doc” menu bug in 3.11.7 and 3.12.1. - gh-113269: Fix test_editor hang on macOS Catalina. - gh-112898: Fix processing unsaved files when quitting IDLE on macOS. - gh-103820: Revise IDLE bindings so that events from mouse button 4/5 on non-X11 windowing systems (i.e. Win32 and Aqua) are not mistaken for scrolling. - bpo-13586: Enter the selected text when opening the “Replace” dialog. - Tools/Demos - gh-109991: Update GitHub CI workflows to use OpenSSL 3.0.13 and multissltests to use 1.1.1w, 3.0.13, 3.1.5, and 3.2.1. - gh-115015: Fix a bug in Argument Clinic that generated incorrect code for methods with no parameters that use the METH_METHOD | METH_FASTCALL | METH_KEYWORDS calling convention. Only the positional parameter count was checked; any keyword argument passed would be silently accepted. - Remove upstreamed patches: - CVE-2024-0450-zipfile-avoid-quoted-overlap-zipbomb.patch - Refresh all patches: - CVE-2023-27043-email-parsing-errors.patch - F00251-change-user-install-location.patch - bpo-31046_ensurepip_honours_prefix.patch - distutils-reproducible-compile.patch - fix_configure_rst.patch - python-3.3.0b1-fix_date_time_compiler.patch - python-3.3.0b1-localpath.patch - python-3.3.0b1-test-posix_fadvise.patch - skip_if_buildbot-extend.patch - subprocess-raise-timeout.patch - support-expat-CVE-2022-25236-patched.patch ++++ python313: - Update to 3.13.0a3 - Security - gh-113659: Skip .pth files with names starting with a dot or hidden file attribute. - gh-112302: Created a Software Bill-of-Materials document and tooling for tracking dependencies. - Core and Builtins - gh-107901: Compiler duplicates basic blocks that have an eval breaker check, no line number, and multiple predecessors. - gh-107901: A jump leaving an exception handler back to normal code no longer checks the eval breaker. - gh-113655: Set the C recursion limit to 4000 on Windows, and 10000 on Linux/OSX. This seems to be near the sweet spot to maintain safety, but not compromise backwards compatibility. - gh-113710: Add typed stack effects to the interpreter DSL, along with various instruction annotations. - gh-77046: On Windows, file descriptors wrapping Windows handles are now created non inheritable by default (PEP 446). Patch by Zackery Spytz and Victor Stinner. - gh-113853: Guarantee that all executors make progress. This then guarantees that tier 2 execution always makes progress. - gh-113753: Fix an issue where the finalizer of PyAsyncGenASend objects might not be called if they were allocated from a free list. - gh-107901: Compiler changed so that synthetic jumps which are not at loop end no longer check the eval breaker. - gh-113703: Fix a regression in the codeop module that was causing it to incorrectly identify incomplete f-strings. Patch by Pablo Galindo - gh-89811: Check for a valid tp_version_tag before performing bytecode specializations that rely on this value being usable. - gh-111488: Changed error message in case of no ‘in’ keyword after ‘for’ in list comprehensions - gh-113657: Fix an issue that caused important instruction pointer updates to be optimized out of tier two traces. - gh-113603: Fixed bug where a redundant NOP is not removed, causing an assertion to fail in the compiler in debug mode. - gh-113602: Fix an error that was causing the parser to try to overwrite existing errors and crashing in the process. Patch by Pablo Galindo - gh-113486: No longer issue spurious PY_UNWIND events for optimized calls to classes. - gh-113297: Fix segfault in the compiler on with statement with 19 context managers. - gh-113212: Improve super error messages. - gh-111375: Only use NULL in the exception stack to indicate an exception was handled. Patch by Carey Metcalfe. - gh-112215: Increase the C recursion limit by a factor of 3 for non-debug builds, except for webassembly and s390 platforms which are unchanged. This mitigates some regressions in 3.12 with deep recursion mixing builtin (C) and Python code. - gh-113054: Fixed bug where a redundant NOP is not removed, causing an assertion to fail in the compiler in debug mode. - gh-106905: Use per AST-parser state rather than global state to track recursion depth within the AST parser to prevent potential race condition due to simultaneous parsing. - The issue primarily showed up in 3.11 by multithreaded users of ast.parse(). In 3.12 a change to when garbage collection can be triggered prevented the race condition from occurring. - gh-108866: Change the API and contract of _PyExecutorObject to return the next_instr pointer, instead of the frame, and to always execute at least one instruction. - gh-90350: Optimize builtin functions min() and max(). - gh-112943: Correctly compute end column offsets for multiline tokens in the tokenize module. Patch by Pablo Galindo - gh-112125: Fix None.__ne__(None) returning NotImplemented instead of False - gh-74616: input() now raises a ValueError when output on the terminal if the prompt contains embedded null characters instead of silently truncating it. - gh-112716: Fix SystemError in the import statement and in __reduce__() methods of builtin types when __builtins__ is not a dict. - gh-112730: Use color to highlight error locations in tracebacks. Patch by Pablo Galindo - gh-112625: Fixes a bug where a bytearray object could be cleared while iterating over an argument in the bytearray.join() method that could result in reading memory after it was freed. - gh-112660: Do not clear unexpected errors during formatting error messages for ImportError and AttributeError for modules. - gh-105967: Workaround a bug in Apple’s macOS platform zlib library where zlib.crc32() and binascii.crc32() could produce incorrect results on multi-gigabyte inputs. Including when using zipfile on zips containing large data. - gh-95754: Provide a better error message when accessing invalid attributes on partially initialized modules. The origin of the module being accessed is now included in the message to help with the common issue of shadowing other modules. - gh-112217: Add check for the type of __cause__ returned from calling the type T in raise from T. - gh-111058: Change coro.cr_frame/gen.gi_frame to return None after the coroutine/generator has been closed. This fixes a bug where getcoroutinestate() and getgeneratorstate() return the wrong state for a closed coroutine/generator. - gh-112388: Fix an error that was causing the parser to try to overwrite tokenizer errors. Patch by pablo Galindo - gh-112387: Fix error positions for decoded strings with backwards tokenize errors. Patch by Pablo Galindo - gh-99606: Make code generated for an empty f-string identical to the code of an empty normal string. - gh-112367: Avoid undefined behaviour when using the perf trampolines by not freeing the code arenas until shutdown. Patch by Pablo Galindo - gh-112320: The Tier 2 translator now tracks the confidence level for staying “on trace” (i.e. not exiting back to the Tier 1 interpreter) for branch instructions based on the number of bits set in the branch “counter”. Trace translation ends when the confidence drops below 1/3rd. - gh-109598: PyComplex_RealAsDouble()/PyComplex_ImagAsDouble() now tries to convert an object to a complex instance using its __complex__() method before falling back to the __float__() method. Patch by Sergey B Kirpichev. - gh-94606: Fix UnicodeEncodeError when email.message.get_payload() reads a message with a Unicode surrogate character and the message content is not well-formed for surrogateescape encoding. Patch by Sidney Markowitz. - bpo-21861: Use the object’s actual class name in _io.FileIO.__repr__(), _io._WindowsConsoleIO() and _io.TextIOWrapper.__repr__(), to make these methods subclass friendly. - bpo-45369: Remove LibreSSL workarounds as per PEP 644. - bpo-34392: Added sys._is_interned(). Libr- ary - gh-114077: Fix possible OverflowError in socket.socket.sendfile() when pass count larger than 2 GiB on 32-bit platform. - gh-111803: plistlib now supports loading more deeply nested lists in binary format. - gh-114014: Fixed a bug in fractions.Fraction where an invalid string using d in the decimals part creates a different error compared to other invalid letters/characters. Patch by Jeremiah Gabriel Pascual. - gh-108364: sqlite3.Connection.iterdump() now ensures that foreign key support is disabled before dumping the database schema, if there is any foreign key violation. Patch by Erlend E. Aasland and Mariusz Felisiak. - gh-113971: The zipfile.ZipInfo previously protected ._compresslevel attribute has been made public as .compress_level with the old _compresslevel name remaining available as a property to retain compatibility. - gh-113877: Fix tkinter method winfo_pathname() on 64-bit Windows. - gh-113868: Added mmap.MAP_NORESERVE, mmap.MAP_NOEXTEND, mmap.MAP_HASSEMAPHORE, mmap.MAP_NOCACHE, mmap.MAP_JIT, mmap.MAP_RESILIENT_CODESIGN, mmap.MAP_RESILIENT_MEDIA, mmap.MAP_32BIT, mmap.MAP_TRANSLATED_ALLOW_EXECUTE, mmap.MAP_UNIX03 and mmap.MAP_TPRO. All of them are mmap(2) flags on macOS. - gh-113848: asyncio.TaskGroup() and asyncio.timeout() context managers now handle CancelledError subclasses as well as exact CancelledError. - gh-113661: unittest runner: Don’t exit 5 if tests were skipped. The intention of exiting 5 was to detect issues where the test suite wasn’t discovered at all. If we skipped tests, it was correctly discovered. - gh-96037: Insert TimeoutError in the context of the exception that was raised during exiting an expired asyncio.timeout() block. - gh-113781: Silence unraisable AttributeError when warnings are emitted during Python finalization. - gh-113238: Add Anchor to importlib.resources (in order for the code to comply with the documentation) - gh-111693: asyncio.Condition.wait() now re-raises the same CancelledError instance that may have caused it to be interrupted. Fixed race condition in asyncio.Semaphore.aquire() when interrupted with a CancelledError. - gh-113791: Add CLOCK_MONOTONIC_RAW_APPROX and CLOCK_UPTIME_RAW_APPROX to time on macOS. These are clocks available on macOS 10.12 or later. - gh-112932: Restore the ability for zipfile to extractall from zip files with a “/” directory entry in them as is commonly added to zips by some wiki or bug tracker data exporters. - gh-113568: Raise deprecation warnings from pathlib.PurePath and not its private base class PurePathBase. - gh-113594: Fix UnicodeEncodeError in email when re-fold lines that contain unknown-8bit encoded part followed by non-unknown-8bit encoded part. - gh-113538: In asyncio.StreamReaderProtocol.connection_made(), there is callback that logs an error if the task wrapping the “connected callback” fails. This callback would itself fail if the task was cancelled. Prevent this by checking whether the task was cancelled first. If so, close the transport but don’t log an error. - gh-113626: Add support for the allow_code argument in the marshal module. Passing allow_code=False prevents serialization and de-serialization of code objects which is incompatible between Python versions. - gh-85567: Fix resource warnings for unclosed files in pickle and pickletools command line interfaces. - gh-113537: Support loads str in plistlib.loads(). - gh-89850: Add default implementations of pickle.Pickler.persistent_id() and pickle.Unpickler.persistent_load() methods in the C implementation. Calling super().persistent_id() and super().persistent_load() in subclasses of the C implementation of pickle.Pickler and pickle.Unpickler classes no longer causes infinite recursion. - gh-113569: Indicate if there were no actual calls in unittest assert_has_calls() failure. - gh-101225: Increase the backlog for multiprocessing.connection.Listener objects created by multiprocessing.manager and multiprocessing.resource_sharer to significantly reduce the risk of getting a connection refused error when creating a multiprocessing.connection.Connection to them. - gh-113568: Raise audit events from pathlib.Path and not its private base class PathBase. - gh-113543: Make sure that webbrowser.MacOSXOSAScript sends webbrowser.open audit event. - gh-113028: When a second reference to a string appears in the input to pickle, and the Python implementation is in use, we are guaranteed that a single copy gets pickled and a single object is shared when reloaded. Previously, in protocol 0, when a string contained certain characters (e.g. newline) it resulted in duplicate objects. - gh-113421: Fix multiprocessing logger for %(filename)s. - gh-111784: Fix segfaults in the _elementtree module. Fix first segfault during deallocation of _elementtree.XMLParser instances by keeping strong reference to pyexpat module in module state for capsule lifetime. Fix second segfault which happens in the same deallocation process by keeping strong reference to _elementtree module in XMLParser structure for _elementtree module lifetime. - gh-113407: Fix import of unittest.mock when CPython is built without docstrings. - gh-113320: Fix regression in Python 3.12 where Protocol classes that were not marked as runtime-checkable would be unnecessarily introspected, potentially causing exceptions to be raised if the protocol had problematic members. Patch by Alex Waygood. - gh-53502: Add a new option aware_datetime in plistlib to loads or dumps aware datetime. - gh-113358: Fix rendering tracebacks with exceptions with a broken __getattr__ - gh-113214: Fix an AttributeError during asyncio SSL protocol aborts in SSL-over-SSL scenarios. - gh-113246: Update bundled pip to 23.3.2. - gh-87264: Fixed tarfile list() method to show file type. - gh-112182: asyncio.futures.Future.set_exception() now transforms StopIteration into RuntimeError instead of hanging or other misbehavior. Patch contributed by Jamie Phan. - gh-113225: Speed up pathlib.Path.glob() by using os.DirEntry.path where possible. - gh-113149: Improve error message when a JSON array or object contains a trailing comma. Patch by Carson Radtke. - gh-113117: The subprocess module can now use the os.posix_spawn() function with close_fds=True on platforms where posix_spawn_file_actions_addclosefrom_np is available. Patch by Jakub Kulik. - gh-113199: Make http.client.HTTPResponse.read1 and http.client.HTTPResponse.readline close IO after reading all data when content length is known. Patch by Illia Volochii. - gh-113191: Add support of os.fchmod() and a file descriptor in os.chmod() on Windows. - gh-113188: Fix shutil.copymode() and shutil.copystat() on Windows. Previously they worked differenly if dst is a symbolic link: they modified the permission bits of dst itself rather than the file it points to if follow_symlinks is true or src is not a symbolic link, and did not modify the permission bits if follow_symlinks is false and src is a symbolic link. - gh-113119: os.posix_spawn() now accepts env=None, which makes the newly spawned process use the current process environment. Patch by Jakub Kulik. - gh-113202: Add a strict option to batched() in the itertools module. - gh-61648: Detect line numbers of properties in doctests. - gh-113175: Sync with importlib_metadata 7.0, including improved type annotations, fixed issue with symlinked packages in package_distributions, added EntryPoints.__repr__, introduced the diagnose script, added Distribution.origin property, and removed deprecated EntryPoint access by numeric index (tuple behavior). - gh-59616: Add support of os.lchmod() and the follow_symlinks argument in os.chmod() on Windows. Note that the default value of follow_symlinks in os.lchmod() is False on Windows. - gh-112559: signal.signal() and signal.getsignal() no longer call repr on callable handlers. asyncio.run() and asyncio.Runner.run() no longer call repr on the task results. Patch by Yilei Yang. - gh-112962: dis module functions add cache information to the Instruction instance rather than creating fake Instruction instances to represent the cache entries. - gh-112989: Reduce overhead to connect sockets with asyncio SelectorEventLoop. - gh-112970: Use closefrom() on Linux where available (e.g. glibc-2.34), rather than only FreeBSD. - gh-110190: Fix ctypes structs with array on PPC64LE platform by setting MAX_STRUCT_SIZE to 64 in stgdict. Patch by Diego Russo. - gh-112540: The statistics.geometric_mean() function now returns zero for datasets containing a zero. Formerly, it would raise an exception. - gh-87286: Added LOG_FTP, LOG_NETINFO, LOG_REMOTEAUTH, LOG_INSTALL, LOG_RAS, and LOG_LAUNCHD tot the syslog module, all of them constants on used on macOS. - gh-112800: Fix asyncio SubprocessTransport.close() not to throw PermissionError when used with setuid executables. - gh-51944: Add the following constants to the termios module. These values are present in macOS system headers: ALTWERASE, B14400, B28800, B7200, B76800, CCAR_OFLOW, CCTS_OFLOW, CDSR_OFLOW, CDTR_IFLOW, CIGNORE, CRTS_IFLOW, EXTPROC, IUTF8, MDMBUF, NL2, NL3, NOKERNINFO, ONOEOT, OXTABS, VDSUSP, VSTATUS. - gh-79325: Fix an infinite recursion error in tempfile.TemporaryDirectory() cleanup on Windows. - gh-94692: shutil.rmtree() now only catches OSError exceptions. Previously a symlink attack resistant version of shutil.rmtree() could ignore or pass to the error handler arbitrary exception when invalid arguments were provided. - gh-112736: The use of del-safe symbols in subprocess was refactored to allow for use in cross-platform build environments. - gh-112727: Speed up pathlib.Path.absolute(). Patch by Barney Gale. - gh-74690: Speedup issubclass() checks against simple runtime-checkable protocols by around 6%. Patch by Alex Waygood. - gh-74690: Speedup isinstance() checks by roughly 20% for runtime-checkable protocols that only have one callable member. Speedup issubclass() checks for these protocols by roughly 10%. Patch by Alex Waygood. - gh-112645: Remove deprecation error on passing onerror to shutil.rmtree(). - gh-112640: Add kwdefaults parameter to types.FunctionType to set default keyword argument values. - gh-112622: Ensure name parameter is passed to event loop in asyncio.create_task(). - gh-112618: Fix a caching bug relating to typing.Annotated. Annotated[str, True] is no longer identical to Annotated[str, 1]. - gh-112334: Fixed a performance regression in 3.12’s subprocess on Linux where it would no longer use the fast-path vfork() system call when it could have due to a logic bug, instead falling back to the safe but slower fork(). - Also fixed a second 3.12.0 potential security bug. If a value of extra_groups=[] was passed to subprocess.Popen or related APIs, the underlying setgroups(0, NULL) system call to clear the groups list would not be made in the child process prior to exec(). - This was identified via code inspection in the process of fixing the first bug. - gh-110190: Fix ctypes structs with array on Arm platform by setting MAX_STRUCT_SIZE to 32 in stgdict. Patch by Diego Russo. - gh-81194: Fix a crash in socket.if_indextoname() with specific value (UINT_MAX). Fix an integer overflow in socket.if_indextoname() on 64-bit non-Windows platforms. - gh-112578: Fix a spurious RuntimeWarning when executing the zipfile module. - gh-112516: Update the bundled copy of pip to version 23.3.1. - gh-112510: Add readline.backend for the backend readline uses (editline or readline) - gh-112328: [Enum] Make EnumDict, EnumDict.member_names, EnumType._add_alias_ and EnumType._add_value_alias_ public. - gh-112509: Fix edge cases that could cause a key to be present in both the __required_keys__ and __optional_keys__ attributes of a typing.TypedDict. Patch by Jelle Zijlstra. - gh-101336: Add keep_alive keyword parameter for AbstractEventLoop.create_server() and BaseEventLoop.create_server(). - gh-63284: Added support for TLS-PSK (pre-shared key) mode to the ssl module. - gh-112414: Fix regression in Python 3.12 where calling repr() on a module that had been imported using a custom loader could fail with AttributeError. Patch by Alex Waygood. - gh-112358: Revert change to struct.Struct initialization that broke some cases of subclassing. - gh-112405: Optimize pathlib.PurePath.relative_to(). Patch by Alex Waygood. - gh-94722: Fix bug where comparison between instances of DocTest fails if one of them has None as its lineno. - gh-112361: Speed up a small handful of pathlib methods by removing some temporary objects. - gh-112345: Improve error message when trying to call issubclass() against a typing.Protocol that has non-method members. Patch by Randolf Scholz. - gh-112137: Change dis output to display no-lineno as “–” instead of “None”. - gh-112332: Deprecate the exc_type field of traceback.TracebackException. Add exc_type_str to replace it. - gh-81620: Add extra tests for random.binomialvariate() - gh-112292: Fix a crash in readline when imported from a sub interpreter. Patch by Anthony Shaw - gh-77621: Slightly improve the import time of the pathlib module by deferring some imports. Patch by Barney Gale. - gh-112137: Change dis output to display logical labels for jump targets instead of offsets. - gh-112139: Add Signature.format() to format signatures to string with extra options. And use it in pydoc to render more readable signatures that have new lines between parameters. - gh-112105: Make readline.set_completer_delims() work with libedit - gh-106922: Display multiple lines with traceback when errors span multiple lines. - gh-111874: When creating a typing.NamedTuple class, ensure __set_name__() is called on all objects that define __set_name__ and exist in the values of the NamedTuple class’s class dictionary. Patch by Alex Waygood. - gh-68166: Add support of the “vsapi” element type in tkinter.ttk.Style.element_create(). - gh-110275: Named tuple’s methods _replace() and __replace__() now raise TypeError instead of ValueError for invalid keyword arguments. - gh-99367: Do not mangle sys.path[0] in pdb if safe_path is set - gh-111615: Fix a regression caused by a fix to gh-93162 whereby you couldn’t configure a QueueHandler without specifying handlers. - gh-75666: Fix the behavior of tkinter widget’s unbind() method with two arguments. Previously, widget.unbind(sequence, funcid) destroyed the current binding for sequence, leaving sequence unbound, and deleted the funcid command. Now it removes only funcid from the binding for sequence, keeping other commands, and deletes the funcid command. It leaves sequence unbound only if funcid was the last bound command. - gh-67790: Implement basic formatting support (minimum width, alignment, fill) for fractions.Fraction. - gh-111049: Fix crash during garbage collection of the io.BytesIO buffer object. - gh-102980: Redirect the output of interact command of pdb to the same channel as the debugger. Add tests and improve docs. - gh-102988: email.utils.getaddresses() and email.utils.parseaddr() now return ('', '') 2-tuples in more situations where invalid email addresses are encountered instead of potentially inaccurate values. Add optional strict parameter to these two functions: use strict=False to get the old behavior, accept malformed inputs. getattr(email.utils, 'supports_strict_parsing', False) can be use to check if the strict paramater is available. Patch by Thomas Dwyer and Victor Stinner to improve the CVE-2023-27043 fix (bsc#1210638). - gh-52161: cmd.Cmd.do_help() now cleans docstrings with inspect.cleandoc() before writing them. Patch by Filip Łapkiewicz. - gh-82300: Add track parameter to multiprocessing.shared_memory.SharedMemory that allows using shared memory blocks without having to register with the POSIX resource tracker that automatically releases them upon process exit. - gh-110109: Add private pathlib._PurePathBase class: a base class for pathlib.PurePath that omits certain magic methods. It may be made public (along with _PathBase) in future. - gh-109858: Protect zipfile from “quoted-overlap” zipbomb. It now raises BadZipFile when try to read an entry that overlaps with other entry or central directory. - gh-109786: Fix possible reference leaks and crash when re-enter the __next__() method of itertools.pairwise. - gh-91539: Small (10 - 20%) and trivial performance improvement of urrlib.request.getproxies_environment(), typically useful when there are many environment variables to go over. - gh-103363: Add follow_symlinks keyword-only argument to pathlib.Path.owner() and group(), defaulting to True. - gh-102130: Support tab completion in cmd for editline. - gh-99437: runpy.run_path() now decodes path-like objects, making sure __file__ and sys.argv[0] of the module being run are always strings. - gh-104003: Add warnings.deprecated(), a decorator to mark deprecated functions to static type checkers and to warn on usage of deprecated classes and functions. See PEP 702. Patch by Jelle Zijlstra. - gh-103708: Make hardcoded python name, a configurable parameter so that different implementations of python can override it instead of making huge diffs in sysconfig.py - gh-66515: mailbox.MH now supports folders that do not contain a .mh_sequences file (e.g. Claws Mail IMAP-cache folders). Patch by Serhiy Storchaka. - gh-83162: Renamed re.error to PatternError for clarity, and kept re.error for backward compatibility. Patch by Matthias Bussonnier and Adam Chhina. - gh-91133: Fix a bug in tempfile.TemporaryDirectory cleanup, which now no longer dereferences symlinks when working around file system permission errors. - bpo-43153: On Windows, tempfile.TemporaryDirectory previously masked a PermissionError with NotADirectoryError during directory cleanup. It now correctly raises PermissionError if errors are not ignored. Patch by Andrei Kulakov and Ken Jin. - bpo-32731: getpass.getuser() now raises OSError for all failures rather than ImportError on systems lacking the pwd module or KeyError if the password database is empty. - bpo-34321: mmap.mmap now has a trackfd parameter on Unix; if it is False, the file descriptor specified by fileno will not be duplicated. - bpo-35332: The shutil.rmtree() function now ignores errors when calling os.close() when ignore_errors is True, and os.close() no longer retried after error. - bpo-35928: io.TextIOWrapper now correctly handles the decoding buffer after read() and write(). - bpo-26791: shutil.move() now moves a symlink into a directory when that directory is the target of the symlink. This provides the same behavior as the mv shell command. The previous behavior raised an exception. Patch by Jeffrey Kintscher. - bpo-41422: Fixed memory leaks of pickle.Pickler and pickle.Unpickler involving cyclic references via the internal memo mapping. - bpo-19821: The pydoc.ispackage() function has been deprecated. - bpo-40262: The ssl.SSLSocket.recv_into() method no longer requires the buffer argument to implement __len__ and supports buffers with arbitrary item size. - bpo-39912: warnings.filterwarnings() and warnings.simplefilter() now raise appropriate exceptions instead of AssertionError. Patch contributed by Rémi Lapeyre. - bpo-37260: Fixed a race condition in shutil.rmtree() in which directory entries removed by another process or thread while shutil.rmtree() is running can cause it to raise FileNotFoundError. Patch by Jeffrey Kintscher. - bpo-36959: Fix some error messages for invalid ISO format string combinations in strptime() that referred to directives not contained in the format string. Patch by Gordon P. Hemsley. - bpo-18060: Fixed a class inheritance issue that can cause segfaults when deriving two or more levels of subclasses from a base class of Structure or Union. - bpo-29779: Add a new PYTHON_HISTORY environment variable to set the location of a .python_history file. - bpo-21360: mailbox.Maildir now ignores files with a leading dot. - Documentation - gh-111699: Relocate smtpd deprecation notice to its own section rather than under locale in What’s New in Python 3.12 document - gh-110746: Improved markup for valid options/values for methods ttk.treeview.column and ttk.treeview.heading, and for Layouts. - gh-95649: Document that the asyncio module contains code taken from v0.16.0 of the uvloop project, as well as the required MIT licensing information. - Tests - gh-111798: Disable test_super_deep() from test_call under pydebug builds on WASI; the stack depth is too small to make the test useful. - gh-111801: Lower the recursion limit in test_isinstance for test_infinitely_many_bases(). This prevents a stack overflow on a pydebug build of WASI. - gh-111802: Specify a low recursion depth for test_bad_getattr() in test.pickletester to avoid exhausting the stack under a pydebug build for WASI. - gh-44626: Fix os.path.isabs() incorrectly returning True when given a path that starts with exactly one (back)slash on Windows. - Fix pathlib.PureWindowsPath.is_absolute() incorrectly returning False for some paths beginning with two (back)slashes. - gh-113633: Use module state for the _testcapi extension module. - gh-109980: Fix test_tarfile_vs_tar in test_shutil for macOS, where system tar can include more information in the archive than shutil.make_archive. - gh-112769: The tests now correctly compare zlib version when zlib.ZLIB_RUNTIME_VERSION contains non-integer suffixes. For example zlib-ng defines the version as 1.3.0.zlib-ng. - gh-112334: Adds a regression test to verify that vfork() is used when expected by subprocess on vfork enabled POSIX systems (Linux). - gh-108927: Fixed order dependence in running tests in the same process when a test that has submodules (e.g. test_importlib) follows a test that imports its submodule (e.g. test_importlib.util) and precedes a test (e.g. test_unittest or test_compileall) that uses that submodule. - bpo-40648: Test modes that file can get with chmod() on Windows. - Build - gh-114013: Fix Tools/wasm/wasi.py to not include the path to python.wasm as part of HOSTRUNNER. The environment variable is meant to specify how to run the WASI host only, having python.wasm and relevant flags appended to the HOSTRUNNER. This fixes make test work. - gh-113258: Changed the Windows build to write out generated frozen modules into the build tree instead of the source tree. - gh-112305: Fixed the check-clean-src step performed on out of tree builds to detect errant $(srcdir)/Python/frozen_modules/*.h files and recommend appropriate source tree cleanup steps to get a working build again. - gh-112536: Add support for thread sanitizer (TSAN) - gh-112867: Fix the build for the case that WITH_PYMALLOC_RADIX_TREE=0 set. - gh-103065: Introduce Tools/wasm/wasi.py to simplify doing a WASI build. - bpo-11102: The os.major(), os.makedev(), and os.minor() functions are now available on HP-UX v3. - bpo-36351: Do not set ipv6type when cross-compiling. - IDLE - gh-72284: Improve the lists of features, editor key bindings, and shell key bingings in the IDLE doc. - gh-113903: Fix rare failure of test.test_idle, in test_configdialog. - gh-113729: Fix the “Help -> IDLE Doc” menu bug in 3.11.7 and 3.12.1. - gh-113269: Fix test_editor hang on macOS Catalina. - gh-112898: Fix processing unsaved files when quitting IDLE on macOS. - bpo-13586: Enter the selected text when opening the “Replace” dialog. - C API - gh-106560: Fix redundant declarations in the public C API. Declare PyBool_Type, PyLong_Type and PySys_Audit() only once. Patch by Victor Stinner. - gh-112438: Fix support of format units “es”, “et”, “es#”, and “et#” in nested tuples in PyArg_ParseTuple()-like functions. - gh-111545: Add Py_HashPointer() function to hash a pointer. Patch by Victor Stinner. - gh-65210: Change the declaration of the keywords parameter of PyArg_ParseTupleAndKeywords() and PyArg_VaParseTupleAndKeywords() for better compatibility with C++. - Refresh all patches - F00251-change-user-install-location.patch - bpo-31046_ensurepip_honours_prefix.patch - fix_configure_rst.patch - no-skipif-doctests.patch - python-3.3.0b1-fix_date_time_compiler.patch - python-3.3.0b1-localpath.patch - python-3.3.0b1-test-posix_fadvise.patch - skip-test_pyobject_freed_is_freed.patch - subprocess-raise-timeout.patch ------------------------------------------------------------------ ------------------ 2024-2-6 - Feb 6 2024 ------------------- ------------------------------------------------------------------ ++++ pgadmin4: - New pgadmin4-cloud subpackage that includes now the cloud dependencies and make the pgadmin4-cloud package optional so it's now optional to depend on the azure/aws/google python packages. - Add patch to let pgadmin4 work without cloud support: * make-cloud-packages-optional.patch ------------------------------------------------------------------ ------------------ 2024-2-5 - Feb 5 2024 ------------------- ------------------------------------------------------------------ ++++ python313-pip: - Fix shebang path for "pip3.XX" binaries ------------------------------------------------------------------ ------------------ 2024-2-4 - Feb 4 2024 ------------------- ------------------------------------------------------------------ ++++ python-google-auth: - update to 2.27.0: * Add optional account association for Authorized User credentials. * Allow custom universe domain for gce creds * Conditionally import requests only if no request was passed by the caller. ------------------------------------------------------------------ ------------------ 2024-2-2 - Feb 2 2024 ------------------- ------------------------------------------------------------------ ++++ pgadmin4: - Add a optipng script that actually uses pngcrush to compress png images so we don't depend on optipng which is not available in SLE. - Fix pgadmin4-desktop to use a timer instead of threads. It seems there's an issue the way python threads were used with Qt5 that made the script fail to update the systray menu when pgadmin was started. - Add missing python-typer dependency - Add pgadmin4-user.conf file to create the pgadmin user/group using systemd with the new system-user-pgadmin package. ------------------------------------------------------------------ ------------------ 2024-2-1 - Feb 1 2024 ------------------- ------------------------------------------------------------------ ++++ python-jmespath: - Switch users of SLE 15 SP4 and openSUSE Leap 15.4 and later to the Python 3.11 build (jsc#PCT-371). The Python 3.6 build will no longer be maintained - switch to PEP517 / wheel build ++++ python313-platformdirs: - update to 4.2.0: * Fix 2 typos about XDG_DATA_DIR * Add convenience methods to `PlatformDirsAPI` that allow iterating over both user and site dirs/paths. ++++ python313-pluggy: - update to 1.4.0: * A warning :class:`~pluggy.PluggyTeardownRaisedWarning` is now issued when an old-style hookwrapper raises an exception during teardown. See the warning documentation for more details. * Add :func:`PluginManager.unblock ` method to unblock a plugin by plugin name. * Fix :func:`~pluggy.HookCaller.call_extra()` extra methods getting ordered before everything else in some circumstances. Regressed in pluggy 1.1.0. * Fix plugins registering other plugins in a hook when the other plugins implement the same hook itself. Regressed in pluggy 1.1.0. ------------------------------------------------------------------ ------------------ 2024-1-31 - Jan 31 2024 ------------------- ------------------------------------------------------------------ ++++ python-boto3: - Switch to Python 3.11 build in SLE 15 SP4 and openSUSE Leap 15.4 and later (jsc#PCT-371) - Switch to wheel build - Update to 1.34.31 * api-change:``datazone``: [``botocore``] Add new skipDeletionCheck to DeleteDomain. Add new skipDeletionCheck to DeleteProject which also automatically deletes dependent objects * api-change:``route53``: [``botocore``] Update the SDKs for text changes in the APIs. - From 1.34.30 * api-change:``autoscaling``: [``botocore``] EC2 Auto Scaling customersi who use attribute based instance-type selection can now intuitively define their Spot instances price protection limit as a percentage of the lowest priced On-Demand instance type. * api-change:``comprehend``: [``botocore``] Comprehend PII analysis now supports Spanish input documents. * api-change:``ec2``: [``botocore``] EC2 Fleet customers who use attribute based instance-type selection can now intuitively define their Spot instances price protection limit as a percentage of the lowest priced On-Demand instance type. * api-change:``mwaa``: [``botocore``] This release adds MAINTENANCE environment status for Amazon MWAA environments. * api-change:``rds``: [``botocore``] Introduced support for the InsufficientDBInstanceCapacityFault error in the RDS RestoreDBClusterFromSnapshot and RestoreDBClusterToPointInTime API methods. This provides enhanced error handling, ensuring a more robust experience. * api-change:``snowball``: [``botocore``] Modified description of createaddress to include direction to add path when providing a JSON file. - From 1.34.29 * api-change:``connect``: [``botocore``] Update list and string length limits for predefined attributes. * api-change:``inspector2``: [``botocore``] This release adds ECR container image scanning based on their lastRecordedPullTime. * api-change:``sagemaker``: [``botocore``] Amazon SageMaker Automatic Model Tuning now provides an API to programmatically delete tuning jobs. - From 1.34.28 * api-change:``acm-pca``: [``botocore``] AWS Private CA now supports an option to omit the CDP extension from issued certificates, when CRL revocation is enabled. * api-change:``lightsail``: [``botocore``] This release adds support for IPv6-only instance plans. - From 1.34.27 * api-change:``ec2``: [``botocore``] Introduced a new clientToken request parameter on CreateNetworkAcl and CreateRouteTable APIs. The clientToken parameter allows idempotent operations on the APIs. * api-change:``ecs``: [``botocore``] Documentation updates for Amazon ECS. * api-change:``outposts``: [``botocore``] DeviceSerialNumber parameter is now optional in StartConnection API * api-change:``rds``: [``botocore``] This release adds support for Aurora Limitless Database. * api-change:``storagegateway``: [``botocore``] Add DeprecationDate and SoftwareVersion to response of ListGateways. - From 1.34.26 * api-change:``inspector2``: [``botocore``] This release adds support for CIS scans on EC2 instances. - From 1.34.25 * enhancement:documentation: [``botocore``] Updates the GitHub issue creation link in our README - From 1.34.24 * api-change:``appconfigdata``: [``botocore``] Fix FIPS Endpoints in aws-us-gov. * api-change:``cloud9``: [``botocore``] Doc-only update around removing AL1 from list of available AMIs for Cloud9 * api-change:``cloudfront-keyvaluestore``: [``botocore``] This release improves upon the DescribeKeyValueStore API by returning two additional fields, Status of the KeyValueStore and the FailureReason in case of failures during creation of KeyValueStore. * api-change:``connectcases``: [``botocore``] This release adds the ability to view audit history on a case and introduces a new parameter, performedBy, for CreateCase and UpdateCase API's. * api-change:``ec2``: [``botocore``] Documentation updates for Amazon EC2. * api-change:``ecs``: [``botocore``] This release adds support for Transport Layer Security (TLS) and Configurable Timeout to ECS Service Connect. TLS facilitates privacy and data security for inter-service communications, while Configurable Timeout allows customized per-request timeout and idle timeout for Service Connect services. * api-change:``finspace``: [``botocore``] Allow customer to set zip default through command line arguments. * api-change:``organizations``: [``botocore``] Doc only update for quota increase change * api-change:``rds``: [``botocore``] Introduced support for the InsufficientDBInstanceCapacityFault error in the RDS CreateDBCluster API method. This provides enhanced error handling, ensuring a more robust experience when creating database clusters with insufficient instance capacity. * api-change:``endpoint-rules``: [``botocore``] Update endpoint-rules client to latest version - From 1.34.23 * api-change:``athena``: [``botocore``] Introducing new NotebookS3LocationUri parameter to Athena ImportNotebook API. Payload is no longer required and either Payload or NotebookS3LocationUri needs to be provided (not both) for a successful ImportNotebook API call. If both are provided, an InvalidRequestException will be thrown. * api-change:``codebuild``: [``botocore``] Release CodeBuild Reserved Capacity feature * api-change:``dynamodb``: [``botocore``] This release adds support for including ApproximateCreationDateTimePrecision configurations in EnableKinesisStreamingDestination API, adds the same as an optional field in the response of DescribeKinesisStreamingDestination, and adds support for a new UpdateKinesisStreamingDestination API. * api-change:``qconnect``: [``botocore``] Increased Quick Response name max length to 100 - From 1.34.22 * api-change:``b2bi``: [``botocore``] Increasing TestMapping inputFileContent file size limit to 5MB and adding file size limit 250KB for TestParsing input file. This release also includes exposing InternalServerException for Tag APIs. * api-change:``cloudtrail``: [``botocore``] This release adds a new API ListInsightsMetricData to retrieve metric data from CloudTrail Insights. * api-change:``connect``: [``botocore``] GetMetricDataV2 now supports 3 groupings * api-change:``drs``: [``botocore``] Removed invalid and unnecessary default values. * api-change:``firehose``: [``botocore``] Allow support for Snowflake as a Kinesis Data Firehose delivery destination. * api-change:``sagemaker-featurestore-runtime``: [``botocore``] Increase BatchGetRecord limits from 10 items to 100 items - From 1.34.21 * api-change:``dynamodb``: [``botocore``] Updating note for enabling streams for UpdateTable. * api-change:``keyspaces``: [``botocore``] This release adds support for Multi-Region Replication with provisioned tables, and Keyspaces auto scaling APIs - From 1.34.20 * api-change:``iot``: [``botocore``] Revert release of LogTargetTypes * api-change:``iotfleetwise``: [``botocore``] Updated APIs: SignalNodeType query parameter has been added to ListSignalCatalogNodesRequest and ListVehiclesResponse has been extended with attributes field. * api-change:``macie2``: [``botocore``] This release adds support for analyzing Amazon S3 objects that are encrypted using dual-layer server-side encryption with AWS KMS keys (DSSE-KMS). It also adds support for reporting DSSE-KMS details in statistics and metadata about encryption settings for S3 buckets and objects. * api-change:``payment-cryptography``: [``botocore``] Provide an additional option for key exchange using RSA wrap/unwrap in addition to tr-34/tr-31 in ImportKey and ExportKey operations. Added new key usage (type) TR31_M1_ISO_9797_1_MAC_KEY, for use with Generate/VerifyMac dataplane operations with ISO9797 Algorithm 1 MAC calculations. * api-change:``personalize-runtime``: [``botocore``] Documentation updates for Amazon Personalize * api-change:``personalize``: [``botocore``] Documentation updates for Amazon Personalize. * api-change:``rekognition``: [``botocore``] This release adds ContentType and TaxonomyLevel attributes to DetectModerationLabels and GetMediaAnalysisJob API responses. * api-change:``securityhub``: [``botocore``] Documentation updates for AWS Security Hub - From 1.34.19 * api-change:``sagemaker``: [``botocore``] This release will have ValidationException thrown if certain invalid app types are provided. The release will also throw ValidationException if more than 10 account ids are provided in VpcOnlyTrustedAccounts. - From 1.34.18 * api-change:``connect``: [``botocore``] Supervisor Barge for Chat is now supported through the MonitorContact API. * api-change:``connectparticipant``: [``botocore``] Introduce new Supervisor participant role * api-change:``location``: [``botocore``] Location SDK documentation update. Added missing fonts to the MapConfiguration data type. Updated note for the SubMunicipality property in the place data type. * api-change:``mwaa``: [``botocore``] This Amazon MWAA feature release includes new fields in CreateWebLoginToken response model. The new fields IamIdentity and AirflowIdentity will let you match identifications, as the Airflow identity length is currently hashed to 64 characters. * api-change:``s3control``: [``botocore``] S3 On Outposts team adds dualstack endpoints support for S3Control and S3Outposts API calls. * api-change:``supplychain``: [``botocore``] This release includes APIs CreateBillOfMaterialsImportJob and GetBillOfMaterialsImportJob. * api-change:``transfer``: [``botocore``] AWS Transfer Family now supports static IP addresses for SFTP & AS2 connectors and for async MDNs on AS2 servers. * api-change:``endpoint-rules``: [``botocore``] Update endpoint-rules client to latest version - From 1.34.17 * api-change:``ec2``: [``botocore``] This release adds support for adding an ElasticBlockStorage volume configurations in ECS RunTask/StartTask/CreateService/UpdateService APIs. The configuration allows for attaching EBS volumes to ECS Tasks. * api-change:``ecs``: [``botocore``] This release adds support for adding an ElasticBlockStorage volume configurations in ECS RunTask/StartTask/CreateService/UpdateService APIs. The configuration allows for attaching EBS volumes to ECS Tasks. * api-change:``events``: [``botocore``] Update events client to latest version * api-change:``iot``: [``botocore``] Add ConflictException to Update APIs of AWS IoT Software Package Catalog * api-change:``iotfleetwise``: [``botocore``] The following dataTypes have been removed: CUSTOMER_DECODED_INTERFACE in NetworkInterfaceType; CUSTOMER_DECODED_SIGNAL_INFO_IS_NULL in SignalDecoderFailureReason; CUSTOMER_DECODED_SIGNAL_NETWORK_INTERFACE_INFO_IS_NULL in NetworkInterfaceFailureReason; CUSTOMER_DECODED_SIGNAL in SignalDecoderType * api-change:``secretsmanager``: [``botocore``] Doc only update for Secrets Manager * api-change:``workspaces``: [``botocore``] Added AWS Workspaces RebootWorkspaces API - Extended Reboot documentation update - From 1.34.16 * api-change:``connectcampaigns``: [``botocore``] Minor pattern updates for Campaign and Dial Request API fields. * api-change:``location``: [``botocore``] This release adds API support for custom layers for the maps service APIs: CreateMap, UpdateMap, DescribeMap. * api-change:``logs``: [``botocore``] Add support for account level subscription filter policies to PutAccountPolicy, DescribeAccountPolicies, and DeleteAccountPolicy APIs. Additionally, PutAccountPolicy has been modified with new optional "selectionCriteria" parameter for resource selection. * api-change:``qconnect``: [``botocore``] QueryAssistant and GetRecommendations will be discontinued starting June 1, 2024. To receive generative responses after March 1, 2024 you will need to create a new Assistant in the Connect console and integrate the Amazon Q in Connect JavaScript library (amazon-q-connectjs) into your applications. * api-change:``redshift-serverless``: [``botocore``] Updates to ConfigParameter for RSS workgroup, removal of use_fips_ssl * api-change:``route53``: [``botocore``] Route53 now supports geoproximity routing in AWS regions * api-change:``wisdom``: [``botocore``] QueryAssistant and GetRecommendations will be discontinued starting June 1, 2024. To receive generative responses after March 1, 2024 you will need to create a new Assistant in the Connect console and integrate the Amazon Q in Connect JavaScript library (amazon-q-connectjs) into your applications. - From 1.34.15 * api-change:``codebuild``: [``botocore``] Aws CodeBuild now supports new compute type BUILD_GENERAL1_XLARGE * api-change:``ec2``: [``botocore``] Amazon EC2 R7iz bare metal instances are powered by custom 4th generation Intel Xeon Scalable processors. * api-change:``route53resolver``: [``botocore``] This release adds support for query type configuration on firewall rules that enables customers for granular action (ALLOW, ALERT, BLOCK) by DNS query type. - From 1.34.14 * api-change:``connect``: [``botocore``] Minor trait updates for User APIs * api-change:``kms``: [``botocore``] Documentation updates for AWS Key Management Service (KMS). * api-change:``redshift-serverless``: [``botocore``] use_fips_ssl and require_ssl parameter support for Workgroup, UpdateWorkgroup, and CreateWorkgroup -From 1.34.13 * api-change:``config``: [``botocore``] Updated ResourceType enum with new resource types onboarded by AWS Config in November and December 2023. * api-change:``docdb``: [``botocore``] Adding PerformanceInsightsEnabled and PerformanceInsightsKMSKeyId fields to DescribeDBInstances Response. * api-change:``ecs``: [``botocore``] This release adds support for managed instance draining which facilitates graceful termination of Amazon ECS instances. * api-change:``es``: [``botocore``] This release adds support for new or existing Amazon OpenSearch domains to enable TLS 1.3 or TLS 1.2 with perfect forward secrecy cipher suites for domain endpoints. * api-change:``lightsail``: [``botocore``] This release adds support to set up an HTTPS endpoint on an instance. * api-change:``opensearch``: [``botocore``] This release adds support for new or existing Amazon OpenSearch domains to enable TLS 1.3 or TLS 1.2 with perfect forward secrecy cipher suites for domain endpoints. * api-change:``sagemaker``: [``botocore``] Adding support for provisioned throughput mode for SageMaker Feature Groups * api-change:``servicecatalog``: [``botocore``] Added Idempotency token support to Service Catalog AssociateServiceActionWithProvisioningArtifact, DisassociateServiceActionFromProvisioningArtifact, DeleteServiceAction API * api-change:``endpoint-rules``: [``botocore``] Update endpoint-rules client to latest version - From 1.34.12 * api-change:``connect``: [``botocore``] Amazon Connect, Contact Lens Evaluation API increase evaluation notes max length to 3072. * api-change:``mediaconvert``: [``botocore``] This release includes video engine updates including HEVC improvements, support for ingesting VP9 encoded video in MP4 containers, and support for user-specified 3D LUTs. - From 1.34.11 * api-change:``apprunner``: [``botocore``] AWS App Runner adds Python 3.11 and Node.js 18 runtimes. * api-change:``location``: [``botocore``] This release introduces a new parameter to bypasses an API key's expiry conditions and delete the key. * api-change:``quicksight``: [``botocore``] Add LinkEntityArn support for different partitions; Add UnsupportedUserEditionException in UpdateDashboardLinks API; Add support for New Reader Experience Topics - From 1.34.10 * api-change:``codestar-connections``: [``botocore``] New integration with the GitLab self-managed provider type. * api-change:``kinesis-video-archived-media``: [``botocore``] NoDataRetentionException thrown when GetImages requested for a Stream that does not retain data (that is, has a DataRetentionInHours of 0). * api-change:``sagemaker``: [``botocore``] Amazon SageMaker Studio now supports Docker access from within app container - From 1.34.9 * api-change:``emr``: [``botocore``] Update emr client to latest version - From 1.34.8 * api-change:``iam``: [``botocore``] Documentation updates for AWS Identity and Access Management (IAM). * api-change:``endpoint-rules``: [``botocore``] Update endpoint-rules client to latest version - From 1.34.7 * api-change:``bedrock-agent``: [``botocore``] Adding Claude 2.1 support to Bedrock Agents * api-change:``glue``: [``botocore``] This release adds additional configurations for Query Session Context on the following APIs: GetUnfilteredTableMetadata, GetUnfilteredPartitionMetadata, GetUnfilteredPartitionsMetadata. * api-change:``lakeformation``: [``botocore``] This release adds additional configurations on GetTemporaryGlueTableCredentials for Query Session Context. * api-change:``mediaconnect``: [``botocore``] This release adds the DescribeSourceMetadata API. This API can be used to view the stream information of the flow's source. * api-change:``networkmonitor``: [``botocore``] CloudWatch Network Monitor is a new service within CloudWatch that will help network administrators and operators continuously monitor network performance metrics such as round-trip-time and packet loss between their AWS-hosted applications and their on-premises locations. * api-change:``omics``: [``botocore``] Provides minor corrections and an updated description of APIs. * api-change:``secretsmanager``: [``botocore``] Update endpoint rules and examples. * api-change:``endpoint-rules``: [``botocore``] Update endpoint-rules client to latest version - From 1.34.6 * enhancement:AWSCRT: [``botocore``] Update awscrt version to 0.19.19 * api-change:``amp``: [``botocore``] This release updates Amazon Managed Service for Prometheus APIs to support customer managed KMS keys. * api-change:``appintegrations``: [``botocore``] The Amazon AppIntegrations service adds DeleteApplication API for deleting applications, and updates APIs to support third party applications reacting to workspace events and make data requests to Amazon Connect for agent and contact events. * api-change:``bedrock-agent``: [``botocore``] This release introduces Amazon Aurora as a vector store on Knowledge Bases for Amazon Bedrock * api-change:``codecommit``: [``botocore``] AWS CodeCommit now supports customer managed keys from AWS Key Management Service. UpdateRepositoryEncryptionKey is added for updating the key configuration. CreateRepository, GetRepository, BatchGetRepositories are updated with new input or output parameters. * api-change:``connect``: [``botocore``] Adds APIs to manage User Proficiencies and Predefined Attributes. Enhances StartOutboundVoiceContact API input. Introduces SearchContacts API. Enhances DescribeContact API. Adds an API to update Routing Attributes in QueuePriority and QueueTimeAdjustmentSeconds. * api-change:``medialive``: [``botocore``] MediaLive now supports the ability to configure the audio that an AWS Elemental Link UHD device produces, when the device is configured as the source for a flow in AWS Elemental MediaConnect. * api-change:``neptune-graph``: [``botocore``] Adds Waiters for successful creation and deletion of Graph, Graph Snapshot, Import Task and Private Endpoints for Neptune Analytics * api-change:``rds-data``: [``botocore``] This release adds support for using RDS Data API with Aurora PostgreSQL Serverless v2 and provisioned DB clusters. * api-change:``rds``: [``botocore``] This release adds support for using RDS Data API with Aurora PostgreSQL Serverless v2 and provisioned DB clusters. * api-change:``sagemaker``: [``botocore``] Amazon SageMaker Training now provides model training container access for debugging purposes. Amazon SageMaker Search now provides the ability to use visibility conditions to limit resource access to a single domain or multiple domains. - From 1.34.5 * api-change:``appstream``: [``botocore``] This release introduces configurable clipboard, allowing admins to specify the maximum length of text that can be copied by the users from their device to the remote session and vice-versa. * api-change:``eks``: [``botocore``] Add support for cluster insights, new EKS capability that surfaces potentially upgrade impacting issues. * api-change:``guardduty``: [``botocore``] This release 1) introduces a new API: GetOrganizationStatistics , and 2) adds a new UsageStatisticType TOP_ACCOUNTS_BY_FEATURE for GetUsageStatistics API * api-change:``managedblockchain-query``: [``botocore``] Adding Confirmation Status and Execution Status to GetTransaction Response. * api-change:``mediatailor``: [``botocore``] Adds the ability to configure time shifting on MediaTailor channels using the TimeShiftConfiguration field * api-change:``route53``: [``botocore``] Amazon Route 53 now supports the Canada West (Calgary) Region (ca-west-1) for latency records, geoproximity records, and private DNS for Amazon VPCs in that region. * api-change:``endpoint-rules``: [``botocore``] Update endpoint-rules client to latest version - From 1.34.4 * api-change:``appsync``: [``botocore``] This release adds additional configurations on GraphQL APIs for limits on query depth, resolver count, and introspection * api-change:``chime-sdk-meetings``: [``botocore``] Add meeting features to specify a maximum camera resolution, a maximum content sharing resolution, and a maximum number of attendees for a given meeting. * api-change:``ec2``: [``botocore``] Provision BYOIPv4 address ranges and advertise them by specifying the network border groups option in Los Angeles, Phoenix and Dallas AWS Local Zones. * api-change:``fsx``: [``botocore``] Added support for FSx for OpenZFS on-demand data replication across AWS accounts and/or regions.Added the IncludeShared attribute for DescribeSnapshots.Added the CopyStrategy attribute for OpenZFSVolumeConfiguration. * api-change:``marketplace-catalog``: [``botocore``] AWS Marketplace now supports a new API, BatchDescribeEntities, which returns metadata and content for multiple entities. * api-change:``rds``: [``botocore``] RDS - The release adds two new APIs: DescribeDBRecommendations and ModifyDBRecommendation - From 1.34.3 * api-change:``cognito-idp``: [``botocore``] Amazon Cognito now supports trigger versions that define the fields in the request sent to pre token generation Lambda triggers. * api-change:``eks``: [``botocore``] Add support for EKS Cluster Access Management. * api-change:``quicksight``: [``botocore``] A docs-only release to add missing entities to the API reference. * api-change:``route53resolver``: [``botocore``] Add DOH protocols in resolver endpoints. - From 1.34.2 * api-change:``cloud9``: [``botocore``] Updated Cloud9 API documentation for AL2023 release * api-change:``connect``: [``botocore``] Adds relatedContactId field to StartOutboundVoiceContact API input. Introduces PauseContact API and ResumeContact API for Task contacts. Adds pause duration, number of pauses, timestamps for last paused and resumed events to DescribeContact API response. Adds new Rule type and new Rule action. * api-change:``connectcases``: [``botocore``] Increase number of fields that can be included in CaseEventIncludedData from 50 to 200 * api-change:``kms``: [``botocore``] Documentation updates for AWS Key Management Service * api-change:``rds``: [``botocore``] Updates Amazon RDS documentation by adding code examples * api-change:``sagemaker``: [``botocore``] This release 1) introduces a new API: DeleteCompilationJob , and 2) adds InfraCheckConfig for Create/Describe training job API - From 1.34.1 * api-change:``appstream``: [``botocore``] This release includes support for images of Windows Server 2022 platform. * api-change:``b2bi``: [``botocore``] Documentation updates for AWS B2B Data Interchange * api-change:``billingconductor``: [``botocore``] Billing Conductor is releasing a new API, GetBillingGroupCostReport, which provides the ability to retrieve/view the Billing Group Cost Report broken down by attributes for a specific billing group. * api-change:``connect``: [``botocore``] This release adds support for more granular billing using tags (key:value pairs) * api-change:``controltower``: [``botocore``] Documentation updates for AWS Control Tower. * api-change:``firehose``: [``botocore``] This release, 1) adds configurable buffering hints for the Splunk destination, and 2) reduces the minimum configurable buffering interval for supported destinations * api-change:``gamelift``: [``botocore``] Amazon GameLift adds the ability to add and update the game properties of active game sessions. * api-change:``iot``: [``botocore``] This release adds the ability to self-manage certificate signing in AWS IoT Core fleet provisioning using the new certificate provider resource. * api-change:``neptune-graph``: [``botocore``] This is the initial SDK release for Amazon Neptune Analytics * api-change:``opensearch``: [``botocore``] Updating documentation for Amazon OpenSearch Service support for new zero-ETL integration with Amazon S3. * api-change:``quicksight``: [``botocore``] Update Dashboard Links support; SingleAxisOptions support; Scatterplot Query limit support. * api-change:``workspaces``: [``botocore``] Updated note to ensure customers understand running modes. * api-change:``endpoint-rules``: [``botocore``] Update endpoint-rules client to latest version - From 1.34.0 * feature:Python: End of support for Python 3.7 * feature:Python: [``botocore``] End of support for Python 3.7 * api-change:``drs``: [``botocore``] Adding AgentVersion to SourceServer and RecoveryInstance structures - From 1.33.13 * api-change:``imagebuilder``: [``botocore``] This release adds the Image Workflows feature to give more flexibility and control over the image building and testing process. * api-change:``location``: [``botocore``] This release 1) adds sub-municipality field in Places API for searching and getting places information, and 2) allows optimizing route calculation based on expected arrival time. * api-change:``logs``: [``botocore``] This release introduces the StartLiveTail API to tail ingested logs in near real time. - From 1.33.12 * api-change:``neptune``: [``botocore``] This release adds a new parameter configuration setting to the Neptune cluster related APIs that can be leveraged to switch between the underlying supported storage modes. * api-change:``pinpoint``: [``botocore``] This release includes Amazon Pinpoint API documentation updates pertaining to campaign message sending rate limits. * api-change:``securityhub``: [``botocore``] Added new resource detail objects to ASFF, including resources for AwsDynamoDbTable, AwsEc2ClientVpnEndpoint, AwsMskCluster, AwsS3AccessPoint, AwsS3Bucket * api-change:``endpoint-rules``: [``botocore``] Update endpoint-rules client to latest version ++++ python-botocore: - Switch to Python 3.11 build in SLE 15 SP4 and openSUSE Leap 15.4 and later (jsc#PCT-371). - Switch to wheel build - Update to 1.34.31 * api-change:``datazone``: Add new skipDeletionCheck to DeleteDomain. Add new skipDeletionCheck to DeleteProject which also automatically deletes dependent objects * api-change:``route53``: Update the SDKs for text changes in the APIs. - From 1.34.30 * api-change:``autoscaling``: EC2 Auto Scaling customers who use attribute based instance-type selection can now intuitively define their Spot instances price protection limit as a percentage of the lowest priced On-Demand instance type. * api-change:``comprehend``: Comprehend PII analysis now supports Spanish input documents. * api-change:``ec2``: EC2 Fleet customers who use attribute based instance-type selection can now intuitively define their Spot instances price protection limit as a percentage of the lowest priced On-Demand instance type. * api-change:``mwaa``: This release adds MAINTENANCE environment status for Amazon MWAA environments. * api-change:``rds``: Introduced support for the InsufficientDBInstanceCapacityFault error in the RDS RestoreDBClusterFromSnapshot and RestoreDBClusterToPointInTime API methods. This provides enhanced error handling, ensuring a more robust experience. * api-change:``snowball``: Modified description of createaddress to include direction to add path when providing a JSON file. - From 1.34.29 * api-change:``connect``: Update list and string length limits for predefined attributes. * api-change:``inspector2``: This release adds ECR container image scanning based on their lastRecordedPullTime. * api-change:``sagemaker``: Amazon SageMaker Automatic Model Tuning now provides an API to programmatically delete tuning jobs. - From 1.34.28 * api-change:``acm-pca``: AWS Private CA now supports an option to omit the CDP extension from issued certificates, when CRL revocation is enabled. * api-change:``lightsail``: This release adds support for IPv6-only instance plans. - From 1.34.27 * api-change:``ec2``: Introduced a new clientToken request parameter on CreateNetworkAcl and CreateRouteTable APIs. The clientToken parameter allows idempotent operations on the APIs. * api-change:``ecs``: Documentation updates for Amazon ECS. * api-change:``outposts``: DeviceSerialNumber parameter is now optional in StartConnection API * api-change:``rds``: This release adds support for Aurora Limitless Database. * api-change:``storagegateway``: Add DeprecationDate and SoftwareVersion to response of ListGateways. - From 1.34.26 * api-change:``inspector2``: This release adds support for CIS scans on EC2 instances. - From 1.34.25 * enhancement:documentation: Updates the GitHub issue creation link in our README - From 1.34.24 * api-change:``appconfigdata``: Fix FIPS Endpoints in aws-us-gov. * api-change:``cloud9``: Doc-only update around removing AL1 from list of available AMIs for Cloud9 * api-change:``cloudfront-keyvaluestore``: This release improves upon the DescribeKeyValueStore API by returning two additional fields, Status of the KeyValueStore and the FailureReason in case of failures during creation of KeyValueStore. * api-change:``connectcases``: This release adds the ability to view audit history on a case and introduces a new parameter, performedBy, for CreateCase and UpdateCase API's. * api-change:``ec2``: Documentation updates for Amazon EC2. * api-change:``ecs``: This release adds support for Transport Layer Security (TLS) and Configurable Timeout to ECS Service Connect. TLS facilitates privacy and data security for inter-service communications, while Configurable Timeout allows customized per-request timeout and idle timeout for Service Connect services. * api-change:``finspace``: Allow customer to set zip default through command line arguments. * api-change:``organizations``: Doc only update for quota increase change * api-change:``rds``: Introduced support for the InsufficientDBInstanceCapacityFault error in the RDS CreateDBCluster API method. This provides enhanced error handling, ensuring a more robust experience when creating database clusters with insufficient instance capacity. * api-change:``endpoint-rules``: Update endpoint-rules client to latest version - Frome 1.34.23 * api-change:``athena``: Introducing new NotebookS3LocationUri parameter to Athena ImportNotebook API. Payload is no longer required and either Payload or NotebookS3LocationUri needs to be provided (not both) for a successful ImportNotebook API call. If both are provided, an InvalidRequestException will be thrown. * api-change:``codebuild``: Release CodeBuild Reserved Capacity feature * api-change:``dynamodb``: This release adds support for including ApproximateCreationDateTimePrecision configurations in EnableKinesisStreamingDestination API, adds the same as an optional field in the response of DescribeKinesisStreamingDestination, and adds support for a new UpdateKinesisStreamingDestination API. * api-change:``qconnect``: Increased Quick Response name max length to 100 - From 1.34.22 * api-change:``b2bi``: Increasing TestMapping inputFileContent file size limit to 5MB and adding file size limit 250KB for TestParsing input file. This release also includes exposing InternalServerException for Tag APIs. * api-change:``cloudtrail``: This release adds a new API ListInsightsMetricData to retrieve metric data from CloudTrail Insights. * api-change:``connect``: GetMetricDataV2 now supports 3 groupings * api-change:``drs``: Removed invalid and unnecessary default values. * api-change:``firehose``: Allow support for Snowflake as a Kinesis Data Firehose delivery destination. * api-change:``sagemaker-featurestore-runtime``: Increase BatchGetRecord limits from 10 items to 100 items - From 1.34.21 * api-change:``dynamodb``: Updating note for enabling streams for UpdateTable. * api-change:``keyspaces``: This release adds support for Multi-Region Replication with provisioned tables, and Keyspaces auto scaling APIs - From 1.34.20 * api-change:``iot``: Revert release of LogTargetTypes * api-change:``iotfleetwise``: Updated APIs: SignalNodeType query parameter has been added to ListSignalCatalogNodesRequest and ListVehiclesResponse has been extended with attributes field. * api-change:``macie2``: This release adds support for analyzing Amazon S3 objects that are encrypted using dual-layer server-side encryption with AWS KMS keys (DSSE-KMS). It also adds support for reporting DSSE-KMS details in statistics and metadata about encryption settings for S3 buckets and objects. * api-change:``payment-cryptography``: Provide an additional option for key exchange using RSA wrap/unwrap in addition to tr-34/tr-31 in ImportKey and ExportKey operations. Added new key usage (type) TR31_M1_ISO_9797_1_MAC_KEY, for use with Generate/VerifyMac dataplane operations with ISO9797 Algorithm 1 MAC calculations. * api-change:``personalize-runtime``: Documentation updates for Amazon Personalize * api-change:``personalize``: Documentation updates for Amazon Personalize. * api-change:``rekognition``: This release adds ContentType and TaxonomyLevel attributes to DetectModerationLabels and GetMediaAnalysisJob API responses. * api-change:``securityhub``: Documentation updates for AWS Security Hub - From 1.34.19 * api-change:``sagemaker``: This release will have ValidationException thrown if certain invalid app types are provided. The release will also throw ValidationException if more than 10 account ids are provided in VpcOnlyTrustedAccounts. - From 1.34.18 * api-change:``connect``: Supervisor Barge for Chat is now supported through the MonitorContact API. * api-change:``connectparticipant``: Introduce new Supervisor participant role * api-change:``endpoint-rules``: Update endpoint-rules client to latest version * api-change:``location``: Location SDK documentation update. Added missing fonts to the MapConfiguration data type. Updated note for the SubMunicipality property in the place data type. * api-change:``mwaa``: This Amazon MWAA feature release includes new fields in CreateWebLoginToken response model. The new fields IamIdentity and AirflowIdentity will let you match identifications, as the Airflow identity length is currently hashed to 64 characters. * api-change:``s3control``: S3 On Outposts team adds dualstack endpoints support for S3Control and S3Outposts API calls. * api-change:``supplychain``: This release includes APIs CreateBillOfMaterialsImportJob and GetBillOfMaterialsImportJob. * api-change:``transfer``: AWS Transfer Family now supports static IP addresses for SFTP & AS2 connectors and for async MDNs on AS2 servers. - From 1.34.17 * api-change:``ec2``: This release adds support for adding an ElasticBlockStorage volume configurations in ECS RunTask/StartTask/CreateService/UpdateService APIs. The configuration allows for attaching EBS volumes to ECS Tasks. * api-change:``ecs``: This release adds support for adding an ElasticBlockStorage volume configurations in ECS RunTask/StartTask/CreateService/UpdateService APIs. The configuration allows for attaching EBS volumes to ECS Tasks. * api-change:``events``: Update events client to latest version * api-change:``iot``: Add ConflictException to Update APIs of AWS IoT Software Package Catalog * api-change:``iotfleetwise``: The following dataTypes have been removed: CUSTOMER_DECODED_INTERFACE in NetworkInterfaceType; CUSTOMER_DECODED_SIGNAL_INFO_IS_NULL in SignalDecoderFailureReason; CUSTOMER_DECODED_SIGNAL_NETWORK_INTERFACE_INFO_IS_NULL in NetworkInterfaceFailureReason; CUSTOMER_DECODED_SIGNAL in SignalDecoderType * api-change:``secretsmanager``: Doc only update for Secrets Manager * api-change:``workspaces``: Added AWS Workspaces RebootWorkspaces API - Extended Reboot documentation update - From 1.34.16 * api-change:``connectcampaigns``: Minor pattern updates for Campaign and Dial Request API fields. * api-change:``location``: This release adds API support for custom layers for the maps service APIs: CreateMap, UpdateMap, DescribeMap. * api-change:``logs``: Add support for account level subscription filter policies to PutAccountPolicy, DescribeAccountPolicies, and DeleteAccountPolicy APIs. Additionally, PutAccountPolicy has been modified with new optional "selectionCriteria" parameter for resource selection. * api-change:``qconnect``: QueryAssistant and GetRecommendations will be discontinued starting June 1, 2024. To receive generative responses after March 1, 2024 you will need to create a new Assistant in the Connect console and integrate the Amazon Q in Connect JavaScript library (amazon-q-connectjs) into your applications. * api-change:``redshift-serverless``: Updates to ConfigParameter for RSS workgroup, removal of use_fips_ssl * api-change:``route53``: Route53 now supports geoproximity routing in AWS regions * api-change:``wisdom``: QueryAssistant and GetRecommendations will be discontinued starting June 1, 2024. To receive generative responses after March 1, 2024 you will need to create a new Assistant in the Connect console and integrate the Amazon Q in Connect JavaScript library (amazon-q-connectjs) into your applications. - From 1.34.15 * api-change:``codebuild``: Aws CodeBuild now supports new compute type BUILD_GENERAL1_XLARGE * api-change:``ec2``: Amazon EC2 R7iz bare metal instances are powered by custom 4th generation Intel Xeon Scalable processors. * api-change:``route53resolver``: This release adds support for query type configuration on firewall rules that enables customers for granular action (ALLOW, ALERT, BLOCK) by DNS query type. - From 1.34.14 * api-change:``connect``: Minor trait updates for User APIs * api-change:``kms``: Documentation updates for AWS Key Management Service (KMS). * api-change:``redshift-serverless``: use_fips_ssl and require_ssl parameter support for Workgroup, UpdateWorkgroup, and CreateWorkgroup - From 1.34.13 * api-change:``config``: Updated ResourceType enum with new resource types onboarded by AWS Config in November and December 2023. * api-change:``docdb``: Adding PerformanceInsightsEnabled and PerformanceInsightsKMSKeyId fields to DescribeDBInstances Response. * api-change:``ecs``: This release adds support for managed instance draining which facilitates graceful termination of Amazon ECS instances. * api-change:``es``: This release adds support for new or existing Amazon OpenSearch domains to enable TLS 1.3 or TLS 1.2 with perfect forward secrecy cipher suites for domain endpoints. * api-change:``lightsail``: This release adds support to set up an HTTPS endpoint on an instance. * api-change:``opensearch``: This release adds support for new or existing Amazon OpenSearch domains to enable TLS 1.3 or TLS 1.2 with perfect forward secrecy cipher suites for domain endpoints. * api-change:``sagemaker``: Adding support for provisioned throughput mode for SageMaker Feature Groups * api-change:``servicecatalog``: Added Idempotency token support to Service Catalog AssociateServiceActionWithProvisioningArtifact, DisassociateServiceActionFromProvisioningArtifact, DeleteServiceAction API * api-change:``endpoint-rules``: Update endpoint-rules client to latest version - From 1.34.12 * api-change:``connect``: Amazon Connect, Contact Lens Evaluation API increase evaluation notes max length to 3072. * api-change:``mediaconvert``: This release includes video engine updates including HEVC improvements, support for ingesting VP9 encoded video in MP4 containers, and support for user-specified 3D LUTs. - From 1.34.11 * api-change:``apprunner``: AWS App Runner adds Python 3.11 and Node.js 18 runtimes. * api-change:``location``: This release introduces a new parameter to bypasses an API key's expiry conditions and delete the key. * api-change:``quicksight``: Add LinkEntityArn support for different partitions; Add UnsupportedUserEditionException in UpdateDashboardLinks API; Add support for New Reader Experience Topics - From 1.34.10 * api-change:``codestar-connections``: New integration with the GitLab self-managed provider type. * api-change:``kinesis-video-archived-media``: NoDataRetentionException thrown when GetImages requested for a Stream that does not retain data (that is, has a DataRetentionInHours of 0). * api-change:``sagemaker``: Amazon SageMaker Studio now supports Docker access from within app container - From 1.34.9 * api-change:``emr``: Update emr client to latest version - From 1.34.8 * api-change:``iam``: Documentation updates for AWS Identity and Access Management (IAM). * api-change:``endpoint-rules``: Update endpoint-rules client to latest version - From 1.34.7 * api-change:``bedrock-agent``: Adding Claude 2.1 support to Bedrock Agents * api-change:``glue``: This release adds additional configurations for Query Session Context on the following APIs: GetUnfilteredTableMetadata, GetUnfilteredPartitionMetadata, GetUnfilteredPartitionsMetadata. * api-change:``lakeformation``: This release adds additional configurations on GetTemporaryGlueTableCredentials for Query Session Context. * api-change:``mediaconnect``: This release adds the DescribeSourceMetadata API. This API can be used to view the stream information of the flow's source. * api-change:``networkmonitor``: CloudWatch Network Monitor is a new service within CloudWatch that will help network administrators and operators continuously monitor network performance metrics such as round-trip-time and packet loss between their AWS-hosted applications and their on-premises locations. * api-change:``omics``: Provides minor corrections and an updated description of APIs. * api-change:``secretsmanager``: Update endpoint rules and examples. * api-change:``endpoint-rules``: Update endpoint-rules client to latest version - From 1.34.6 * enhancement:AWSCRT: Update awscrt version to 0.19.19 * api-change:``amp``: This release updates Amazon Managed Service for Prometheus APIs to support customer managed KMS keys. * api-change:``appintegrations``: The Amazon AppIntegrations service adds DeleteApplication API for deleting applications, and updates APIs to support third party applications reacting to workspace events and make data requests to Amazon Connect for agent and contact events. * api-change:``bedrock-agent``: This release introduces Amazon Aurora as a vector store on Knowledge Bases for Amazon Bedrock * api-change:``codecommit``: AWS CodeCommit now supports customer managed keys from AWS Key Management Service. UpdateRepositoryEncryptionKey is added for updating the key configuration. CreateRepository, GetRepository, BatchGetRepositories are updated with new input or output parameters. * api-change:``connect``: Adds APIs to manage User Proficiencies and Predefined Attributes. Enhances StartOutboundVoiceContact API input. Introduces SearchContacts API. Enhances DescribeContact API. Adds an API to update Routing Attributes in QueuePriority and QueueTimeAdjustmentSeconds. * api-change:``medialive``: MediaLive now supports the ability to configure the audio that an AWS Elemental Link UHD device produces, when the device is configured as the source for a flow in AWS Elemental MediaConnect. * api-change:``neptune-graph``: Adds Waiters for successful creation and deletion of Graph, Graph Snapshot, Import Task and Private Endpoints for Neptune Analytics * api-change:``rds-data``: This release adds support for using RDS Data API with Aurora PostgreSQL Serverless v2 and provisioned DB clusters. * api-change:``rds``: This release adds support for using RDS Data API with Aurora PostgreSQL Serverless v2 and provisioned DB clusters. * api-change:``sagemaker``: Amazon SageMaker Training now provides model training container access for debugging purposes. Amazon SageMaker Search now provides the ability to use visibility conditions to limit resource access to a single domain or multiple domains. - From 1.34.5 * api-change:``appstream``: This release introduces configurable clipboard, allowing admins to specify the maximum length of text that can be copied by the users from their device to the remote session and vice-versa. * api-change:``eks``: Add support for cluster insights, new EKS capability that surfaces potentially upgrade impacting issues. * api-change:``guardduty``: This release 1) introduces a new API: GetOrganizationStatistics , and 2) adds a new UsageStatisticType TOP_ACCOUNTS_BY_FEATURE for GetUsageStatistics API * api-change:``managedblockchain-query``: Adding Confirmation Status and Execution Status to GetTransaction Response. * api-change:``mediatailor``: Adds the ability to configure time shifting on MediaTailor channels using the TimeShiftConfiguration field * api-change:``route53``: Amazon Route 53 now supports the Canada West (Calgary) Region (ca-west-1) for latency records, geoproximity records, and private DNS for Amazon VPCs in that region. * api-change:``endpoint-rules``: Update endpoint-rules client to latest version - From 1.34.4 * api-change:``appsync``: This release adds additional configurations on GraphQL APIs for limits on query depth, resolver count, and introspection * api-change:``chime-sdk-meetings``: Add meeting features to specify a maximum camera resolution, a maximum content sharing resolution, and a maximum number of attendees for a given meeting. * api-change:``ec2``: Provision BYOIPv4 address ranges and advertise them by specifying the network border groups option in Los Angeles, Phoenix and Dallas AWS Local Zones. * api-change:``fsx``: Added support for FSx for OpenZFS on-demand data replication across AWS accounts and/or regions.Added the IncludeShared attribute for DescribeSnapshots.Added the CopyStrategy attribute for OpenZFSVolumeConfiguration. * api-change:``marketplace-catalog``: AWS Marketplace now supports a new API, BatchDescribeEntities, which returns metadata and content for multiple entities. * api-change:``rds``: RDS - The release adds two new APIs: DescribeDBRecommendations and ModifyDBRecommendation - From 1.34.3 * api-change:``cognito-idp``: Amazon Cognito now supports trigger versions that define the fields in the request sent to pre token generation Lambda triggers. * api-change:``eks``: Add support for EKS Cluster Access Management. * api-change:``quicksight``: A docs-only release to add missing entities to the API reference. * api-change:``route53resolver``: Add DOH protocols in resolver endpoints. - From 1.34.2 * api-change:``cloud9``: Updated Cloud9 API documentation for AL2023 release * api-change:``connect``: Adds relatedContactId field to StartOutboundVoiceContact API input. Introduces PauseContact API and ResumeContact API for Task contacts. Adds pause duration, number of pauses, timestamps for last paused and resumed events to DescribeContact API response. Adds new Rule type and new Rule action. * api-change:``connectcases``: Increase number of fields that can be included in CaseEventIncludedData from 50 to 200 * api-change:``kms``: Documentation updates for AWS Key Management Service * api-change:``rds``: Updates Amazon RDS documentation by adding code examples * api-change:``sagemaker``: This release 1) introduces a new API: DeleteCompilationJob , and 2) adds InfraCheckConfig for Create/Describe training job API - From 1.34.1 * api-change:``appstream``: This release includes support for images of Windows Server 2022 platform. * api-change:``b2bi``: Documentation updates for AWS B2B Data Interchange * api-change:``billingconductor``: Billing Conductor is releasing a new API, GetBillingGroupCostReport, which provides the ability to retrieve/view the Billing Group Cost Report broken down by attributes for a specific billing group. * api-change:``connect``: This release adds support for more granular billing using tags (key:value pairs) * api-change:``controltower``: Documentation updates for AWS Control Tower. * api-change:``firehose``: This release, 1) adds configurable buffering hints for the Splunk destination, and 2) reduces the minimum configurable buffering interval for supported destinations * api-change:``gamelift``: Amazon GameLift adds the ability to add and update the game properties of active game sessions. * api-change:``iot``: This release adds the ability to self-manage certificate signing in AWS IoT Core fleet provisioning using the new certificate provider resource. * api-change:``neptune-graph``: This is the initial SDK release for Amazon Neptune Analytics * api-change:``opensearch``: Updating documentation for Amazon OpenSearch Service support for new zero-ETL integration with Amazon S3. * api-change:``quicksight``: Update Dashboard Links support; SingleAxisOptions support; Scatterplot Query limit support. * api-change:``workspaces``: Updated note to ensure customers understand running modes. * api-change:``endpoint-rules``: Update endpoint-rules client to latest version - From 1.34.0 * feature:Python: End of support for Python 3.7 * api-change:``drs``: Adding AgentVersion to SourceServer and RecoveryInstance structures - From 1.33.13 * api-change:``imagebuilder``: This release adds the Image Workflows feature to give more flexibility and control over the image building and testing process. * api-change:``location``: This release 1) adds sub-municipality field in Places API for searching and getting places information, and 2) allows optimizing route calculation based on expected arrival time. * api-change:``logs``: This release introduces the StartLiveTail API to tail ingested logs in near real time. - From 1.33.12 * api-change:``neptune``: This release adds a new parameter configuration setting to the Neptune cluster related APIs that can be leveraged to switch between the underlying supported storage modes. * api-change:``pinpoint``: This release includes Amazon Pinpoint API documentation updates pertaining to campaign message sending rate limits. * api-change:``securityhub``: Added new resource detail objects to ASFF, including resources for AwsDynamoDbTable, AwsEc2ClientVpnEndpoint, AwsMskCluster, AwsS3AccessPoint, AwsS3Bucket * api-change:``endpoint-rules``: Update endpoint-rules client to latest version ++++ python-s3transfer: - Switch to Python 3.11 build in SLE 15 SP4 and openSUSE Leap 15.4 and later (jsc#PCT-371). - Switch to wheel build - Update to 0.10.0 * feature:``s3``: Added CRT support for S3 Express One Zone - From 0.9.0 * feature:Python: End of support for Python 3.7 ++++ python313-pipx: - Update to 1.4.3 * Add macos shebang workaround description * Introduce towncrier * Potential fix for pylauncher with python version * fix: nicer tracebacks in run mode on scripts ------------------------------------------------------------------ ------------------ 2024-1-30 - Jan 30 2024 ------------------- ------------------------------------------------------------------ ++++ python-aiohttp: - Update to version 3.9.3 * Fixed backwards compatibility breakage (in 3.9.2) of ``ssl`` parameter when set outside of ``ClientSession`` (e.g. directly in ``TCPConnector``) * Improved test suite handling of paths and temp files to consistently use pathlib and pytest fixtures. - from version 3.9.2 (bsc#1219341, CVE-2024-23334, bsc#1219342, CVE-2024-23829) * Fixed server-side websocket connection leak. * Fixed ``web.FileResponse`` doing blocking I/O in the event loop. * Fixed double compress when compression enabled and compressed file exists in server file responses. * Added runtime type check for ``ClientSession`` ``timeout`` parameter. * Fixed an unhandled exception in the Python HTTP parser on header lines starting with a colon. * Improved validation of paths for static resources requests to the server. * Added support for passing :py:data:`True` to ``ssl`` parameter in ``ClientSession`` while deprecating :py:data:`None`. * Fixed an unhandled exception in the Python HTTP parser on header lines starting with a colon. * Fixed examples of ``fallback_charset_resolver`` function in the :doc:`client_advanced` document. * The Sphinx setup was updated to avoid showing the empty changelog draft section in the tagged release documentation builds on Read The Docs. * The changelog categorization was made clearer. The contributors can now mark their fragment files more accurately. * Updated :ref:`contributing/Tests coverage ` section to show how we use ``codecov``. * Replaced all ``tmpdir`` fixtures with ``tmp_path`` in test suite. - Refresh patches for new version * remove-re-assert.patch ++++ python-argcomplete: - update to 3.2.2: * Expand tilde in zsh ++++ python-ldap3: - Fix (C) line in spec file ++++ nftables: - port python-single-spec logic from Factory package to allow shipment of python311 modules as well (bsc#1219253). ++++ python313-argcomplete: - update to 3.2.2: * Expand tilde in zsh ------------------------------------------------------------------ ------------------ 2024-1-29 - Jan 29 2024 ------------------- ------------------------------------------------------------------ ++++ pgadmin4: - Replace yarn (which is not available in SLE) with local-npm-registry. - Add node_modules service and node_modules.obscpio / node_modules.spec.inc source files which replace vendor.tar.xz that is now removed. - package_deps.patch - dependency fixes - package_git_local.patch - dependency fixes that are needed *after* generating package-lock.json since only registry-supplied packages are available locally. - Update update-vendor.sh script. ------------------------------------------------------------------ ------------------ 2024-1-26 - Jan 26 2024 ------------------- ------------------------------------------------------------------ ++++ python-aiohttp: - Disable broken tests with openssl 3.2 and python < 3.11 bsc#1217782 ------------------------------------------------------------------ ------------------ 2024-1-25 - Jan 25 2024 ------------------- ------------------------------------------------------------------ ++++ python-CherryPy: - Disable more flaky tests in s390x, bsc#1218602 ++++ python313-hatchling: - update to 1.21.1: * Fix loading of local plugins to account for newly released versions of a dependency ------------------------------------------------------------------ ------------------ 2024-1-24 - Jan 24 2024 ------------------- ------------------------------------------------------------------ ++++ python-M2Crypto: - Disable broken tests with openssl 3.2, bsc#1217782 ------------------------------------------------------------------ ------------------ 2024-1-23 - Jan 23 2024 ------------------- ------------------------------------------------------------------ ++++ python-Authlib: - Remove the file containing a Commercial license otherwise licensedigger rejects the dual-licensed package. See https://docs.authlib.org/en/latest/community/licenses.html . ++++ python-Pillow: - Add CVE-2023-50447-environment-keys-filtering.patch: * Filter out builtins from the environment. (CVE-2023-50447, bsc#1219048) ------------------------------------------------------------------ ------------------ 2024-1-21 - Jan 21 2024 ------------------- ------------------------------------------------------------------ ++++ python313-trove-classifiers: - update to 2024.1.8: * added more CAN classifiers ------------------------------------------------------------------ ------------------ 2024-1-20 - Jan 20 2024 ------------------- ------------------------------------------------------------------ ++++ python-Flask-Compress: - update to 1.14: * Add `text/javascript` mimetype. See #41 * Use brotlicffi for PyPy ++++ python-Flask-Migrate: - update to 4.0.5: * Compatiblity fixes for Flask-SQLAlchemy >= 3.1 * Allow process_revision_directives option to be configurable * Stop testing Python 3.7, as Flask-SQLAlchemy 3.1 stopped supporting it ------------------------------------------------------------------ ------------------ 2024-1-19 - Jan 19 2024 ------------------- ------------------------------------------------------------------ ++++ csp-billing-adapter: - Update to version 0.9.0: * Add metering archive feature ++++ csp-billing-adapter-local: - Update to version 0.5.0: * Attempt to backup archive before saving * Add get_archive_location function * Add metering archive hook implementations ------------------------------------------------------------------ ------------------ 2024-1-18 - Jan 18 2024 ------------------- ------------------------------------------------------------------ ++++ python-kubernetes: - Add kubernetes-client-python-pr2178-assertEqual-py312.patch gh#kubernetes-client/python#2178 fixing a python3.12 test error - Remove deprecated setup.py usage, switch to PEP517 ------------------------------------------------------------------ ------------------ 2024-1-16 - Jan 16 2024 ------------------- ------------------------------------------------------------------ ++++ python-CherryPy: - Increase timeouts for tests for s390x architecture, bsc#1218602 ------------------------------------------------------------------ ------------------ 2024-1-15 - Jan 15 2024 ------------------- ------------------------------------------------------------------ ++++ pgadmin4: - Update to 8.2 * Supported Database Servers - PostgreSQL: 12, 13, 14, 15, and 16 - EDB Advanced Server: 12, 13, 14, 15, and 16 * Bundled PostgreSQL Utilities - psql, pg_dump, pg_dumpall, pg_restore: 16.0 * New features - Administer pgAdmin Users and Preferences Using the Command Line Interface (CLI). - Allow users to convert View/Edit table into a Query tool to enable editing the SQL generated. - Added copy server support, allowing the duplication of existing servers with the option to make certain modifications. - Added keep-alive support for SSH sessions when connecting to a PostgreSQL server via an SSH tunnel. * Housekeeping - Ensure that eventlet's subprocess should be used following the resolution of an issue with Python 3.12 by eventlet. * Bug fixes - Fixed an issue where query tool title did not change after "Save As" until any new change is made. - Fixed an issue where export servers was not adding extension if not specified. - Fixed an issue where pgAdmin imports servers to the wrong accounts for the external authentication. - Fixed an issue where an error occurred in the SQL tab when using an extended index(pgroonga). - Fixed an issue where changes done to a node using edit dialog are not reflecting on the properties tab if the properties tab is active. - Fixed an issue where DB Restrictions were not visible on the server dialog. - Ensure that the 'Dbo' schema is displayed as a regular schema rather than a system catalog schema. - Introduce LDAP configuration parameter LDAP_IGNORE_MALFORMED_SCHEMA to ignore fetching schema from the LDAP server. - Fixed an error-'amname' when generating ERD for database containing partition tables. - Fixed an issue where object explorer last tree state was not saving. - Fixed an issue where pgAgent job schedule dialog is not opening for edit. - Fixed an issue where user is not able to cancel or terminate active queries from dashboard. - Fixed browser autocomplete related issues on pgAdmin authentication related pages. - Fixed an issue where auto commit/rollback setting not persisting across query tool connection change. - Fixed an issue where Schema Diff not generating difference for missing columns. - Update to 8.1 * Supported Database Servers - PostgreSQL: 12, 13, 14, 15, and 16 - EDB Advanced Server: 12, 13, 14, 15, and 16 * Bundled PostgreSQL Utilities - psql, pg_dump, pg_dumpall, pg_restore: 16.0 * New features - Add support for generating ERD for a schema. - Add support for creating a function with custom return type. * Housekeeping - Fixed several accessibility-related issues for enhanced usability. * Bug fixes - Ensure focus is not changed to ssh tunnel password input when user explicitly focus on server password input. - Provide a way to bypass the SSL cert verification for OAuth2 provider. - Fixed an issue where database name was missing in an error message if name contains any special characters. - Ensure that indexes created by constraints are visible in the object explorer when "Show system objects" is enabled. - Fixed an issue where reading process logs throws an error when DATA_DIR is moved to a networked drive. - Remove the 'Close Window' submenu specifically for OSX to prevent unintended closure of the entire application. - Rename all references of 'Execute query' to 'Execute script' to be more relevant. - Fixed an issue where syntax error was not highlighting in query tool. - Fixed an issue where on entering full screen, the option label is not changed to 'Exit Full Screen' in desktop mode. - Ensure that the Authentication Source in the drop-down of the UserManagement dialog aligns with the entries specified for AUTHENTICATION_SOURCES in the configuration file. - Reverse engineer serial columns when generating ERD for database/table. - Fixed an issue where the Schema was not visible in the dropdown for table properties or when creating a new table. - Fixed an issue where option key was not registering in PSQL tool. - Fixed an issue where the Vacuum option INDEX_CLEANUP have an incorrect value ('AUTO') for database versions < 14. - Fixed an issue where the pgAdmin page went blank when clicking the delete button in the User Management dialog. - Ensure that correct timezone is set for Docker deployments. - Fixed an issue where all rows and filter rows buttons of object explorer toolbar were disabled for views and other supported nodes. - Fixed an issue where schema diff tool is not loading preferences on start. ++++ python-Flask-Mail: - Use %{?sle15_python_module_pythons} ++++ python-bidict: - Remove BuildRequires that aren't really used: sortedcollections and sortedcontainers ++++ python-httpagentparser: - Use %sle15_python_module_pythons ++++ python-psycopg: - Use %sle15_python_module_pythons - Update to 3.1.17: * Fix multiple connection attempts when a host name resolve to multiple IP addresses (:ticket:`699`). * Use `typing.Self` as a more correct return value annotation of context managers and other self-returning methods (see :ticket:`708`). - Add patch fix-pool-import.patch: * Correct where we are importing from due to new pool release. ++++ python-psycopg-c: - Use %sle15_python_module_pythons ++++ python-sshtunnel: - Use %sle15_python_module_pythons ++++ python-user-agents: - Use %sle15_python_module_pythons ++++ python313-pipx: - Update to 1.4.2 * Print more user friendly error when --python version not found * Allow skipping maintenance tasks for list command * Use modern PEP 723 syntax, fix mistake in name * Modernize toml * Verify if script name provided is a file before running it * Fix python path resolution on linux https://github.com/pypa/pipx/releases/tag/1.4.2 ------------------------------------------------------------------ ------------------ 2024-1-14 - Jan 14 2024 ------------------- ------------------------------------------------------------------ ++++ python-CherryPy: - update to 18.9.0: * Various changes. - drop use-read_file-not-readfp.patch (upstream) ++++ python-sphinxcontrib-jquery: - drop tests-with-sphinx-72.patch in order to - add tests-with-sphinx-72-python312.patch: build with python 312+ ------------------------------------------------------------------ ------------------ 2024-1-11 - Jan 11 2024 ------------------- ------------------------------------------------------------------ ++++ python-google-auth: - Update to 2.26.2 * Read universe_domain for external account authorized user (#1450) ------------------------------------------------------------------ ------------------ 2024-1-10 - Jan 10 2024 ------------------- ------------------------------------------------------------------ ++++ python-cheroot: - Disable failing tests with openssl 3.2 ++++ python-gevent: - Clean obsolete old python and old distribution directives * Only 15.5+ with the sle15 python module and Tumbleweed have the required Python 3.8+ * Drop fix-no-return-in-nonvoid-function.patch - Update test suite execution * Use -u-network flag to disable network tests * Add gevent-opensuse-nocolor-tests.patch -- Avoid colorization of test output in obs runners * Add gevent-fix-unittest-returncode-py312-c1.patch and gevent-fix-unittest-returncode-py312-c2.patch gh#gevent/gevent#2012 ++++ python-greenlet: - Update to 3.0.3 * Python 3.12: Restore the full ability to walk the stack of a suspended greenlet; previously only the innermost frame was exposed. See issue 388. Fix by Joshua Oreman in PR 393. - Disable building the docs: Now requires the furo theme, which is not available. ------------------------------------------------------------------ ------------------ 2024-1-9 - Jan 9 2024 ------------------- ------------------------------------------------------------------ ++++ python-rtslib-fb: - Drop downstream-only LIO target_core_rbd support (bsc#1218634) * rbd-support-disable_emulate_legacy_capacity.patch * rbd-support.patch ------------------------------------------------------------------ ------------------ 2024-1-8 - Jan 8 2024 ------------------- ------------------------------------------------------------------ ++++ python-Authlib: - update to 1.3.0: * Restore AuthorizationServer.create_authorization_response behavior, via :PR:`558` * Include leeway in validate_iat() for JWT, via :PR:`565` * Fix encode_client_secret_basic, via :PR:`594` * Use single key in JWK if JWS does not specify kid, via :PR:`596` * Fix error when RFC9068 JWS has no scope field, via :PR:`598` * Get werkzeug version using importlib, via :PR:`591` * New features: * RFC9068 implementation, via :PR:`586`, by @azmeuk. * Breaking changes: * End support for python 3.7 ------------------------------------------------------------------ ------------------ 2024-1-7 - Jan 7 2024 ------------------- ------------------------------------------------------------------ ++++ python-netaddr: - update to 0.10.1: * Get rid of some warnings * Add an :data:`INET_ATON` flag to explicitly request ``inet_aton()`` IPv4 parsing semantics from :class:`IPAddress`. * Add an :meth:`IPAddress.is_ipv4_private_use` convenience method. * Add an :meth:`IPAddress.is_global` convenience method to allow determining if an address is considered globally reachable. * Add an :meth:`IPAddress.is_ipv6_unique_local` convenience method. * Improve Python 3.13 compatibility, thank you John Eckersberg. * Deprecate Python 3.7 support. * Deprecate abbreviated CIDR format support in :class:`IPNetwork` * Deprecate accepting leading zeros when parsing IPv4 addresses in :data:`INET_PTON` mode (it's been allowed on some platforms). If you need to allow and discard leading zeros use the :data:`ZEROFILL` flag. * Raise an exception if invalid flags are passed to ``IPAddress``, ``IPNetwork`` or ``IPRange``. * Improve the documentation substantially. * Update the DB files to the latest versions (2023-12-23). ++++ python-psycopg-c: - update to 3.1.17: * add missing enum entries ++++ python-urllib3_1: - Skip tests which hang during SSL handshakes in python312 - Switch to PEP517 build ------------------------------------------------------------------ ------------------ 2024-1-6 - Jan 6 2024 ------------------- ------------------------------------------------------------------ ++++ python-Flask-Security-Too: - Update to 5.3.3: Fix for CVE-2023-49438 (bsc#1218412). - Refresh patches: - no-mongodb.patch - use-pyqrcodeng.patch ------------------------------------------------------------------ ------------------ 2024-1-5 - Jan 5 2024 ------------------- ------------------------------------------------------------------ ++++ python-psycopg: - update to 3.1.16: * Fix empty ports handling in async multiple connection attempts ++++ python-psycopg-c: - update to 3.1.16: * version only update ++++ python-pyflakes: - update to 3.2.0: * Add support for *T (TypeVarTuple) and **P (ParamSpec) in PEP 695 annotations. ++++ python-pyzmq: - update to 25.1.2: * Fix builds with some recent compilers and bundled libzmq * Fix builds with upcoming Cython 3.1 ------------------------------------------------------------------ ------------------ 2024-1-4 - Jan 4 2024 ------------------- ------------------------------------------------------------------ ++++ python-google-auth: - Update to 2.26.1 * Ensure that refresh worker is pickle-able. (#1447) - from version 2.26.0 * Add optional non blocking refresh for sync auth code (a6dc2c3) * Add optional non blocking refresh for sync auth code (#1368) * External account user cred universe domain support (#1437) * Guard delete statements. Add default fallback for _use_non_blocking_refresh. (#1445) - Refresh patches for new version * python-google-auth-no-mock.patch ------------------------------------------------------------------ ------------------ 2024-1-3 - Jan 3 2024 ------------------- ------------------------------------------------------------------ ++++ python-M2Crypto: - require setuptools ++++ python-argcomplete: - Remove coverage check - Fix zsh test failures: avoid coloring terminal ++++ python-cheroot: - Add patch to increase tests timeouts in s390x where tests take a bit longer to run: * increase-tests-timeouts.patch ++++ python-greenlet: - require setuptools ++++ python313-argcomplete: - Remove coverage check - Fix zsh test failures: avoid coloring terminal ------------------------------------------------------------------ ------------------ 2024-1-2 - Jan 2 2024 ------------------- ------------------------------------------------------------------ ++++ python-poetry-core: - update to 1.8.1: * Fix an issue where git URLs starting with `git+` could not be parsed anymore (#657). * Add `3.12` to the list of available Python versions (#631). * Add support for creating packages dynamically in the build script * Improve marker logic for `extra` markers (#636). * Update list of supported licenses (#635, * #646). * Deprecate `Dependency.transitive_python_versions` (#648). * Deprecate `Dependency.transitive_python_constraint` (#649). * Fix an issue where projects with extension modules were not installed in editable mode (#633). * Fix an issue where the wrong or no `lib` folder was added to the wheel (#634). * Replace `jsonschema` with `fastjsonschema`. * `lark==1.1.8` * `packaging==23.2` ++++ protobuf: - update to 25.1: * Raise warnings for deprecated python syntax usages * Add support for extensions in CRuby, JRuby, and FFI Ruby * Add support for options in CRuby, JRuby and FFI (#14594) - update to 25.0: * Implement proto2/proto3 with editions * Defines Protobuf compiler version strings as macros and separates out suffix string definition. * Add utf8_validation feature back to the global feature set. * Setting up version updater to prepare for poison pills and embedding version info into C++, Python and Java gencode. * Merge the protobuf and upb Bazel repos * Editions: Introduce functionality to protoc for generating edition feature set defaults. * Editions: Migrate edition strings to enum in C++ code. * Create a reflection helper for ExtensionIdentifier. * Editions: Provide an API for C++ generators to specify their features. * Editions: Refactor feature resolution to use an intermediate message. * Publish extension declarations with declaration verifications. * Editions: Stop propagating partially resolved feature sets to plugins. * Editions: Migrate string_field_validation to a C++ feature * Editions: Include defaults for any features in the generated pool. * Protoc: parser rejects explicit use of map_entry option * Protoc: validate that reserved range start is before end * Protoc: support identifiers as reserved names in addition to string literals (only in editions) * Drop support for Bazel 5. * Allow code generators to specify whether or not they support editions. [#] C++ * Set `PROTOBUF_EXPORT` on `InternalOutOfLineDeleteMessageLite()` * Update stale checked-in files * Apply PROTOBUF_NOINLINE to declarations of some functions that want it. * Implement proto2/proto3 with editions * Make JSON UTF-8 boundary check inclusive of the largest possible UTF-8 character. * Reduce `Map::size_type` to 32-bits. Protobuf containers can't have more than that * Defines Protobuf compiler version strings as macros and separates out suffix string definition. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated oneof accessors. * Fix bug in reflection based Swap of map fields. * Add utf8_validation feature back to the global feature set. * Setting up version updater to prepare for poison pills and embedding version info into C++, Python and Java gencode. * Add prefetching to arena allocations. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated repeated and map field accessors. * Editions: Migrate edition strings to enum in C++ code. * Create a reflection helper for ExtensionIdentifier. * Editions: Provide an API for C++ generators to specify their features. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated string field accessors. * Editions: Refactor feature resolution to use an intermediate message. * Fixes for 32-bit MSVC. * Publish extension declarations with declaration verifications. * Export the constants in protobuf's any.h to support DLL builds. * Implement AbslStringify for the Descriptor family of types. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated message field accessors. * Editions: Stop propagating partially resolved feature sets to plugins. * Editions: Migrate string_field_validation to a C++ feature * Editions: Include defaults for any features in the generated pool. * Introduce C++ feature for UTF8 validation. * Protoc: validate that reserved range start is before end * Remove option to disable the table-driven parser in protoc. * Lock down ctype=CORD in proto file. * Support split repeated fields. * In OSS mode omit some extern template specializations. * Allow code generators to specify whether or not they support editions. [#] Java * Implement proto2/proto3 with editions * Remove synthetic oneofs from Java gencode field accessor tables. * Timestamps.parse: Add error handling for invalid hours/minutes in the timezone offset. * Defines Protobuf compiler version strings as macros and separates out suffix string definition. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated oneof accessors. * Add missing debugging version info to Protobuf Java gencode when multiple files are generated. * Fix a bad cast in putBuilderIfAbsent when already present due to using the result of put() directly (which is null if it currently has no value) * Setting up version updater to prepare for poison pills and embedding version info into C++, Python and Java gencode. * Fix a NPE in putBuilderIfAbsent due to using the result of put() directly (which is null if it currently has no value) * Update Kotlin compiler to escape package names * Add MapFieldBuilder and change codegen to generate it and the put{field}BuilderIfAbsent method. * Introduce recursion limit in Java text format parsing * Consider the protobuf.Any invalid if typeUrl.split("/") returns an empty array. * Mark `FieldDescriptor.hasOptionalKeyword()` as deprecated. * Fixed Python memory leak in map lookup. * Loosen upb for json name conflict check in proto2 between json name and field * Defines Protobuf compiler version strings as macros and separates out suffix string definition. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated oneof accessors. * Ensure Timestamp.ToDatetime(tz) has correct offset * Do not check required field for upb python MergeFrom * Setting up version updater to prepare for poison pills and embedding version info into C++, Python and Java gencode. * Merge the protobuf and upb Bazel repos * Comparing a proto message with an object of unknown returns NotImplemented * Emit __slots__ in pyi output as a tuple rather than a list for --pyi_out. * Fix a bug that strips options from descriptor.proto in Python. * Raise warings for message.UnknownFields() usages and navigate to the new add * Add protobuf python keyword support in path for stub generator. * Add tuple support to set Struct * ### Python C-Extension (Default) * Comparing a proto message with an object of unknown returns NotImplemented * Check that ffi-compiler loads before using it to define tasks. [#] UPB (Python/PHP/Ruby C-Extension) * Include .inc files directly instead of through a filegroup * Loosen upb for json name conflict check in proto2 between json name and field * Add utf8_validation feature back to the global feature set. * Do not check required field for upb python MergeFrom * Merge the protobuf and upb Bazel repos * Added malloc_trim() calls to Python allocator so RSS will decrease when memory is freed * Upb: fix a Python memory leak in ByteSize() * Support ASAN detection on clang * Upb: bugfix for importing a proto3 enum from within a proto2 file * Expose methods needed by Ruby FFI using UPB_API * Fix `PyUpb_Message_MergeInternal` segfault ++++ python313-pipx: - update to 1.4.1: * Set default logging level to WARNING * Remove `-q` from `list --json` test - update to 1.4.0: * Fix minor grammar error in comparisons.md * Add Scoop installation instructions * Update the installation instructions in docs * Be more user-friendly by pointing to PyPA specifications instead of PEPs * Update troubleshooting URL in bug report template * Allow installing multiple applications at once * [pre-commit.ci] pre-commit autoupdate * Pass real paths when running subprocesses ++++ python313-setuptools: - update to 69.0.3: * Bugfixes - Retain valid names with underscores in egg_info. ------------------------------------------------------------------ ------------------ 2024-1-1 - Jan 1 2024 ------------------- ------------------------------------------------------------------ ++++ python313-platformdirs: - update to 4.1.0: * docs: fix Linux user_log_dir example in README * Drop support for EOL Python 3.7 - update to 4.0.0: * site_cache_dir: Use `/var/cache` again instead of `/var/tmp` on UNIX ------------------------------------------------------------------ ------------------ 2023-12-29 - Dec 29 2023 ------------------- ------------------------------------------------------------------ ++++ python-Flask-Login: - Use %{?sle15_python_module_pythons} ++++ python-argcomplete: - update to 3.2.1: * Allow explicit zsh global completion activation (#467) * Fix and test global completion in zsh (#463, #466) * Add –yes option to activate-global-python-argcomplete (#461) * Test suite improvements - drop without_zsh.patch: obsolete ++++ python-cheroot: - update to 10.0.0: * Cheroot now accepts a ``reuse_port`` parameter on the ``HTTPServer`` object. * Subclasses overriding ``prepare_socket`` will no longer work and will need to adapt to the new interface. - drop python-cheroot-no-six.patch (upstream) ++++ python-fastjsonschema: - update to 2.19.1: * Fixed date format to accept only two digit months and days ++++ python-zc.lockfile: - update to 3.0.post1: * Add ``python_requires`` to ``setup.py`` to prevent installing on not supported old Python versions. * Add support for Python 3.9, 3.10, 3.11. * Drop support for Python 2.7, 3.5, 3.6. * Drop support for deprecated ``python setup.py test``. ++++ python313-argcomplete: - update to 3.2.1: * Allow explicit zsh global completion activation (#467) * Fix and test global completion in zsh (#463, #466) * Add –yes option to activate-global-python-argcomplete (#461) * Test suite improvements - drop without_zsh.patch: obsolete ------------------------------------------------------------------ ------------------ 2023-12-27 - Dec 27 2023 ------------------- ------------------------------------------------------------------ ++++ python-alembic: - update to 1.13.1: * Fixed :class:`.Rewriter` so that more than two instances could be chained together correctly, also allowing multiple ``process_revision_directives`` callables to be chained. * Fixed issue where the method :meth:`.EnvironmentContext.get_x_argument` using the :paramref:`.EnvironmentContext.get_x_argument.as_dictionary` parameter would fail if an argument key were passed on the command line as a name alone, that is, without an equal sign ``=`` or a value. Behavior is repaired where this condition is detected and will return a blank string for the given key, consistent with the behavior where the ``=`` sign is present and no value. * Fixed issue where the "unique" flag of an ``Index`` would not be maintained when generating downgrade migrations. * Fixed bug in versioning model where a downgrade across a revision with two down revisions with one down revision depending on the other, would produce an erroneous state in the alembic_version table, making upgrades impossible without manually repairing the table. * Updated pep-484 typing to pass mypy "strict" mode, however including per-module qualifications for specific typing elements not yet complete. * This allows us to catch specific typing issues that have been ongoing such as import symbols not properly exported. ++++ python-distro: - update to 1.9.0: * Refactor distro.info() method to return an InfoDict [#360] * Ignore the file '/etc/board-release' [#353] * Ignore the file '/etc/ec2_version' [#359] * Test on modern versions of CPython and PyPy and macOS [#362] * Add support for ALT Linux Server 10.1 distribution [#354] * Add Debian Testing to the tests [#356] * Update archlinux resource for tests [#352] ++++ python-docker: - update to 7.0.0: * Removed SSL version (`ssl_version`) and explicit hostname check (`assert_hostname`) options (#3185) * Python 3.7+ supports TLSv1.3 by default * Websocket support is no longer included by default (#3123) * Use `pip install docker[websockets]` to include `websocket- client` dependency * By default, `docker-py` hijacks the TCP connection and does not use Websockets * Websocket client is only required to use `attach_socket(container, ws=True)` * Python 3.7 no longer supported (reached end-of-life June 2023) (#3187) * Python 3.12 support (#3185) * Full `networking_config` support for `containers.create()` * Replaces `network_driver_opt` (added in 6.1.0) * Add `health()` property to container that returns status (e.g. `unhealthy`) * Add `pause` option to `container.commit()` (#3159) * Add support for bind mount propagation (e.g. `rshared`, `private`) * Add support for `filters`, `keep_storage`, and `all` in `prune_builds()` on API v1.39+ (#3192) * Consistently return `docker.errors.NotFound` on 404 responses * Validate tag format before push (#3191) ++++ python-opentelemetry-api: - update to 1.22.0: * Prometheus exporter sanitize info metric (#3572) * Remove Jaeger exporters (#3554) * Log stacktrace on `UNKNOWN` status OTLP export error (#3536) * Fix OTLPExporterMixin shutdown timeout period (#3524) * Handle `taskName` `logrecord` attribute (#3557) ++++ python-typing_extensions: - update to 4.9.0: * This feature release adds `typing_extensions.ReadOnly`, as specified by PEP 705, and makes various other improvements, especially to `@typing_extensions.deprecated()`. * Add support for PEP 705, adding `typing_extensions.ReadOnly`. * All parameters on `NewType.__call__` are now positional-only. This means that the signature of `typing_extensions.NewType.__call__` now exactly matches the * signature of `typing.NewType.__call__`. * Fix bug with using `@deprecated` on a mixin class. * Exclude `__match_args__` from `Protocol` members. * When creating a `typing_extensions.NamedTuple` class, ensure `__set_name__` is called on all objects that define `__set_name__` and exist in the values of the `NamedTuple` class's class dictionary. ++++ python313-trove-classifiers: - update to 2023.11.13: * Update release.yml * Added PySimpleGUI versions 4 and 5 as a Framework * Add Odoo 17 trove classifier ------------------------------------------------------------------ ------------------ 2023-12-26 - Dec 26 2023 ------------------- ------------------------------------------------------------------ ++++ python-pyotp: - Add %{?sle15_python_module_pythons} ------------------------------------------------------------------ ------------------ 2023-12-22 - Dec 22 2023 ------------------- ------------------------------------------------------------------ ++++ python-Flask-Mail: - Switch to pyproject and autosetup macros. - Stop using greedy globs in %files. ++++ python-aiohttp: - Fix pytest call - Update requirements ++++ python-wheel: - Update to 0.42.0 * Allowed removing build tag with wheel tags --build "" * Fixed wheel pack and wheel tags writing updated WHEEL fields after a blank line, causing other tools to ignore them * Fixed wheel pack and wheel tags writing WHEEL with CRLF line endings or a mix of CRLF and LF * Fixed wheel pack --build-number "" not removing build tag from WHEEL (above changes by Benjamin Gilbert) - Release 0.41.3 * Updated vendored packaging to 23.2 * Fixed ABI tag generation for CPython 3.13a1 on Windows (PR by Sam Gross) - Remove pip dependency for easier bootstrap ++++ python313-pip: - Drop deprecated setup.py installmethod, bootstrap PEP517 with built-in pip instead - python3XX-pip-wheel can now be a regular subpackage - Drop obsolete python2 directives in specfile ++++ python313-setuptools: - Drop fix-get-python-lib-python38.patch: No Python <3.9 built - Drop ugly allow-only-direct-compilation.patch in favor of proper PEP517 compliant bootstrap, using a built-in pip and the wheel package - Add patch allow-only-direct-compilation.patch: * Allow forcing direct compilation. ++++ python313-wheel: - Update to 0.42.0 * Allowed removing build tag with wheel tags --build "" * Fixed wheel pack and wheel tags writing updated WHEEL fields after a blank line, causing other tools to ignore them * Fixed wheel pack and wheel tags writing WHEEL with CRLF line endings or a mix of CRLF and LF * Fixed wheel pack --build-number "" not removing build tag from WHEEL (above changes by Benjamin Gilbert) - Release 0.41.3 * Updated vendored packaging to 23.2 * Fixed ABI tag generation for CPython 3.13a1 on Windows (PR by Sam Gross) - Remove pip dependency for easier bootstrap ------------------------------------------------------------------ ------------------ 2023-12-21 - Dec 21 2023 ------------------- ------------------------------------------------------------------ ++++ protobuf: - build against modern python on sle15 ++++ python313-hatchling: - update to 1.21.0: * Add parent context modifier for path fields ------------------------------------------------------------------ ------------------ 2023-12-20 - Dec 20 2023 ------------------- ------------------------------------------------------------------ ++++ python-Sphinx: - Add upstream patch fix-autodoc-tests-python-3117.patch to make it work with python 3.11.7 gh#sphinx-doc/sphinx#11793 ++++ python-paramiko: - Update to 3.4.0: (CVE-2023-48795, bsc#1218168) * Transport grew a new packetizer_class kwarg for overriding the packet-handler class used internally. * Address CVE 2023-48795 (aka the "Terrapin Attack", a vulnerability found in the SSH protocol re: treatment of packet sequence numbers) as follows: + The vulnerability only impacts encrypt-then-MAC digest algorithms in tandem with CBC ciphers, and ChaCha20-poly1305; of these, Paramiko currently only implements hmac-sha2-(256|512)-etm in tandem with AES-CBC. + As the fix for the vulnerability requires both ends of the connection to cooperate, the below changes will only take effect when the remote end is OpenSSH >= 9.6 (or equivalent, such as Paramiko in server mode, as of this patch version) and configured to use the new "strict kex" mode. + Paramiko will now raise an SSHException subclass (MessageOrderError) when protocol messages are received in unexpected order. This includes situations like receiving MSG_DEBUG or MSG_IGNORE during initial key exchange, which are no longer allowed during strict mode. + Key (re)negotiation -- i.e. MSG_NEWKEYS, whenever it is encountered -- now resets packet sequence numbers. (This should be invisible to users during normal operation, only causing exceptions if the exploit is encountered, which will usually result in, again, MessageOrderError.) + Sequence number rollover will now raise SSHException if it occurs during initial key exchange (regardless of strict mode status). * Tweak ext-info-(c|s) detection during KEXINIT protocol phase; the original implementation made assumptions based on an OpenSSH implementation detail. - Add patch use-64-bit-maxsize-everywhere.patch: * Use the 64-bit value of sys.maxsize. ------------------------------------------------------------------ ------------------ 2023-12-19 - Dec 19 2023 ------------------- ------------------------------------------------------------------ ++++ python311: - Update patch fix_configure_rst.patch - Update to 3.11.7: - Core and Builtins - gh-112625: Fixes a bug where a bytearray object could be cleared while iterating over an argument in the bytearray.join() method that could result in reading memory after it was freed. - gh-112388: Fix an error that was causing the parser to try to overwrite tokenizer errors. Patch by pablo Galindo - gh-112387: Fix error positions for decoded strings with backwards tokenize errors. Patch by Pablo Galindo - gh-112266: Change docstrings of __dict__ and __weakref__. - gh-109181: Speed up Traceback object creation by lazily compute the line number. Patch by Pablo Galindo - gh-102388: Fix a bug where iso2022_jp_3 and iso2022_jp_2004 codecs read out of bounds - gh-111366: Fix an issue in the codeop that was causing SyntaxError exceptions raised in the presence of invalid syntax to not contain precise error messages. Patch by Pablo Galindo - gh-111380: Fix a bug that was causing SyntaxWarning to appear twice when parsing if invalid syntax is encountered later. Patch by Pablo galindo - gh-88116: Traceback location ranges involving wide unicode characters (like emoji and asian characters) now are properly highlighted. Patch by Batuhan Taskaya and Pablo Galindo. - gh-94438: Fix a regression that prevented jumping across is None and is not None when debugging. Patch by Savannah Ostrowski. - gh-110696: Fix incorrect error message for invalid argument unpacking. Patch by Pablo Galindo - gh-110237: Fix missing error checks for calls to PyList_Append in _PyEval_MatchClass. - gh-109216: Fix possible memory leak in BUILD_MAP. - Library - gh-112618: Fix a caching bug relating to typing.Annotated. Annotated[str, True] is no longer identical to Annotated[str, 1]. - gh-112509: Fix edge cases that could cause a key to be present in both the __required_keys__ and __optional_keys__ attributes of a typing.TypedDict. Patch by Jelle Zijlstra. - gh-94722: Fix bug where comparison between instances of DocTest fails if one of them has None as its lineno. - gh-112105: Make readline.set_completer_delims() work with libedit - gh-111942: Fix SystemError in the TextIOWrapper constructor with non-encodable “errors” argument in non-debug mode. - gh-109538: Issue warning message instead of having RuntimeError be displayed when event loop has already been closed at StreamWriter.__del__(). - gh-111942: Fix crashes in io.TextIOWrapper.reconfigure() when pass invalid arguments, e.g. non-string encoding. - gh-111804: Remove posix.fallocate() under WASI as the underlying posix_fallocate() is not available in WASI preview2. - gh-111841: Fix truncating arguments on an embedded null character in os.putenv() and os.unsetenv() on Windows. - gh-111541: Fix doctest for SyntaxError not-builtin subclasses. - gh-110894: Call loop exception handler for exceptions in client_connected_cb of asyncio.start_server() so that applications can handle it. Patch by Kumar Aditya. - gh-111531: Fix reference leaks in bind_class() and bind_all() methods of tkinter widgets. - gh-111356: Added io.text_encoding(), io.DEFAULT_BUFFER_SIZE, and io.IncrementalNewlineDecoder to io.__all__. - gh-68166: Remove mention of not supported “vsapi” element type in tkinter.ttk.Style.element_create(). Add tests for element_create() and other ttk.Style methods. Add examples for element_create() in the documentation. - gh-111251: Fix _blake2 not checking for errors when initializing. - gh-111174: Fix crash in io.BytesIO.getbuffer() called repeatedly for empty BytesIO. - gh-111187: Postpone removal version for locale.getdefaultlocale() to Python 3.15. - gh-111159: Fix doctest output comparison for exceptions with notes. - gh-110910: Fix invalid state handling in asyncio.TaskGroup and asyncio.Timeout. They now raise proper RuntimeError if they are improperly used and are left in consistent state after this. - gh-111092: Make turtledemo run without default root enabled. - gh-110590: Fix a bug in _sre.compile() where TypeError would be overwritten by OverflowError when the code argument was a list of non-ints. - gh-65052: Prevent pdb from crashing when trying to display undisplayable objects - gh-110519: Deprecation warning about non-integer number in gettext now alwais refers to the line in the user code where gettext function or method is used. Previously it could refer to a line in gettext code. - gh-110378: contextmanager() and asynccontextmanager() context managers now close an invalid underlying generator object that yields more then one value. - gh-110365: Fix termios.tcsetattr() bug that was overwritting existing errors during parsing integers from term list. - gh-110196: Add __reduce__ method to IPv6Address in order to keep scope_id - gh-109747: Improve errors for unsupported look-behind patterns. Now re.error is raised instead of OverflowError or RuntimeError for too large width of look-behind pattern. - gh-109786: Fix possible reference leaks and crash when re-enter the __next__() method of itertools.pairwise. - gh-108791: Improved error handling in pdb command line interface, making it produce more concise error messages. - gh-73561: Omit the interface scope from an IPv6 address when used as Host header by http.client. - gh-86826: zipinfo now supports the full range of values in the TZ string determined by RFC 8536 and detects all invalid formats. Both Python and C implementations now raise exceptions of the same type on invalid data. - bpo-41422: Fixed memory leaks of pickle.Pickler and pickle.Unpickler involving cyclic references via the internal memo mapping. - bpo-40262: The ssl.SSLSocket.recv_into() method no longer requires the buffer argument to implement __len__ and supports buffers with arbitrary item size. - bpo-35191: Fix unexpected integer truncation in socket.setblocking() which caused it to interpret multiples of 2**32 as False. - Documentation - gh-108826: dis module command-line interface is now mentioned in documentation. - Tests - gh-110367: Make regrtest --verbose3 option compatible with - -huntrleaks -jN options. The ./python -m test -j1 -R 3:3 - -verbose3 command now works as expected. Patch by Victor Stinner. - gh-111309: distutils tests can now be run via unittest. - gh-111165: Remove no longer used functions run_unittest() and run_doctest() and class BasicTestRunner from the test.support module. - gh-110932: Fix regrtest if the SOURCE_DATE_EPOCH environment variable is defined: use the variable value as the random seed. Patch by Victor Stinner. - gh-110995: test_gdb: Fix detection of gdb built without Python scripting support. Patch by Victor Stinner. - gh-110918: Test case matching patterns specified by options - -match, --ignore, --matchfile and --ignorefile are now tested in the order of specification, and the last match determines whether the test case be run or ignored. - gh-110647: Fix test_stress_modifying_handlers() of test_signal. Patch by Victor Stinner. - gh-103053: Fix test_tools.test_freeze on FreeBSD: run “make distclean” instead of “make clean” in the copied source directory to remove also the “python” program. Patch by Victor Stinner. - gh-110167: Fix a deadlock in test_socket when server fails with a timeout but the client is still running in its thread. Don’t hold a lock to call cleanup functions in doCleanups(). One of the cleanup function waits until the client completes, whereas the client could deadlock if it called addCleanup() in such situation. Patch by Victor Stinner. - gh-110388: Add tests for tty. - gh-81002: Add tests for termios. - gh-110267: Add tests for pickling and copying PyStructSequence objects. Patched by Xuehai Pan. - gh-109974: Fix race conditions in test_threading lock tests. Wait until a condition is met rather than using time.sleep() with a hardcoded number of seconds. Patch by Victor Stinner. - gh-109972: Split test_gdb.py file into a test_gdb package made of multiple tests, so tests can now be run in parallel. Patch by Victor Stinner. - gh-104736: Fix test_gdb on Python built with LLVM clang 16 on Linux ppc64le (ex: Fedora 38). Search patterns in gdb “bt” command output to detect when gdb fails to retrieve the traceback. For example, skip a test if Backtrace stopped: frame did not save the PC is found. Patch by Victor Stinner. - gh-108927: Fixed order dependence in running tests in the same process when a test that has submodules (e.g. test_importlib) follows a test that imports its submodule (e.g. test_importlib.util) and precedes a test (e.g. test_unittest or test_compileall) that uses that submodule. - Build - gh-103053: “make check-clean-src” now also checks if the “python” program is found in the source directory: fail with an error if it does exist. Patch by Victor Stinner. - gh-109191: Fix compile error when building with recent versions of libedit. - IDLE - bpo-35668: Add docstrings to the IDLE debugger module. Fix two bugs: initialize Idb.botframe (should be in Bdb); in Idb.in_rpc_code, check whether prev_frame is None before trying to use it. Greatly expand test_debugger. - C API - gh-112438: Fix support of format units “es”, “et”, “es#”, and “et#” in nested tuples in PyArg_ParseTuple()-like functions. - gh-109521: PyImport_GetImporter() now sets RuntimeError if it fails to get sys.path_hooks or sys.path_importer_cache or they are not list and dict correspondingly. Previously it could return NULL without setting error in obscure cases, crash or raise SystemError if these attributes have wrong type. ++++ python311-core: - Update patch fix_configure_rst.patch - Update to 3.11.7: - Core and Builtins - gh-112625: Fixes a bug where a bytearray object could be cleared while iterating over an argument in the bytearray.join() method that could result in reading memory after it was freed. - gh-112388: Fix an error that was causing the parser to try to overwrite tokenizer errors. Patch by pablo Galindo - gh-112387: Fix error positions for decoded strings with backwards tokenize errors. Patch by Pablo Galindo - gh-112266: Change docstrings of __dict__ and __weakref__. - gh-109181: Speed up Traceback object creation by lazily compute the line number. Patch by Pablo Galindo - gh-102388: Fix a bug where iso2022_jp_3 and iso2022_jp_2004 codecs read out of bounds - gh-111366: Fix an issue in the codeop that was causing SyntaxError exceptions raised in the presence of invalid syntax to not contain precise error messages. Patch by Pablo Galindo - gh-111380: Fix a bug that was causing SyntaxWarning to appear twice when parsing if invalid syntax is encountered later. Patch by Pablo galindo - gh-88116: Traceback location ranges involving wide unicode characters (like emoji and asian characters) now are properly highlighted. Patch by Batuhan Taskaya and Pablo Galindo. - gh-94438: Fix a regression that prevented jumping across is None and is not None when debugging. Patch by Savannah Ostrowski. - gh-110696: Fix incorrect error message for invalid argument unpacking. Patch by Pablo Galindo - gh-110237: Fix missing error checks for calls to PyList_Append in _PyEval_MatchClass. - gh-109216: Fix possible memory leak in BUILD_MAP. - Library - gh-112618: Fix a caching bug relating to typing.Annotated. Annotated[str, True] is no longer identical to Annotated[str, 1]. - gh-112509: Fix edge cases that could cause a key to be present in both the __required_keys__ and __optional_keys__ attributes of a typing.TypedDict. Patch by Jelle Zijlstra. - gh-94722: Fix bug where comparison between instances of DocTest fails if one of them has None as its lineno. - gh-112105: Make readline.set_completer_delims() work with libedit - gh-111942: Fix SystemError in the TextIOWrapper constructor with non-encodable “errors” argument in non-debug mode. - gh-109538: Issue warning message instead of having RuntimeError be displayed when event loop has already been closed at StreamWriter.__del__(). - gh-111942: Fix crashes in io.TextIOWrapper.reconfigure() when pass invalid arguments, e.g. non-string encoding. - gh-111804: Remove posix.fallocate() under WASI as the underlying posix_fallocate() is not available in WASI preview2. - gh-111841: Fix truncating arguments on an embedded null character in os.putenv() and os.unsetenv() on Windows. - gh-111541: Fix doctest for SyntaxError not-builtin subclasses. - gh-110894: Call loop exception handler for exceptions in client_connected_cb of asyncio.start_server() so that applications can handle it. Patch by Kumar Aditya. - gh-111531: Fix reference leaks in bind_class() and bind_all() methods of tkinter widgets. - gh-111356: Added io.text_encoding(), io.DEFAULT_BUFFER_SIZE, and io.IncrementalNewlineDecoder to io.__all__. - gh-68166: Remove mention of not supported “vsapi” element type in tkinter.ttk.Style.element_create(). Add tests for element_create() and other ttk.Style methods. Add examples for element_create() in the documentation. - gh-111251: Fix _blake2 not checking for errors when initializing. - gh-111174: Fix crash in io.BytesIO.getbuffer() called repeatedly for empty BytesIO. - gh-111187: Postpone removal version for locale.getdefaultlocale() to Python 3.15. - gh-111159: Fix doctest output comparison for exceptions with notes. - gh-110910: Fix invalid state handling in asyncio.TaskGroup and asyncio.Timeout. They now raise proper RuntimeError if they are improperly used and are left in consistent state after this. - gh-111092: Make turtledemo run without default root enabled. - gh-110590: Fix a bug in _sre.compile() where TypeError would be overwritten by OverflowError when the code argument was a list of non-ints. - gh-65052: Prevent pdb from crashing when trying to display undisplayable objects - gh-110519: Deprecation warning about non-integer number in gettext now alwais refers to the line in the user code where gettext function or method is used. Previously it could refer to a line in gettext code. - gh-110378: contextmanager() and asynccontextmanager() context managers now close an invalid underlying generator object that yields more then one value. - gh-110365: Fix termios.tcsetattr() bug that was overwritting existing errors during parsing integers from term list. - gh-110196: Add __reduce__ method to IPv6Address in order to keep scope_id - gh-109747: Improve errors for unsupported look-behind patterns. Now re.error is raised instead of OverflowError or RuntimeError for too large width of look-behind pattern. - gh-109786: Fix possible reference leaks and crash when re-enter the __next__() method of itertools.pairwise. - gh-108791: Improved error handling in pdb command line interface, making it produce more concise error messages. - gh-73561: Omit the interface scope from an IPv6 address when used as Host header by http.client. - gh-86826: zipinfo now supports the full range of values in the TZ string determined by RFC 8536 and detects all invalid formats. Both Python and C implementations now raise exceptions of the same type on invalid data. - bpo-41422: Fixed memory leaks of pickle.Pickler and pickle.Unpickler involving cyclic references via the internal memo mapping. - bpo-40262: The ssl.SSLSocket.recv_into() method no longer requires the buffer argument to implement __len__ and supports buffers with arbitrary item size. - bpo-35191: Fix unexpected integer truncation in socket.setblocking() which caused it to interpret multiples of 2**32 as False. - Documentation - gh-108826: dis module command-line interface is now mentioned in documentation. - Tests - gh-110367: Make regrtest --verbose3 option compatible with - -huntrleaks -jN options. The ./python -m test -j1 -R 3:3 - -verbose3 command now works as expected. Patch by Victor Stinner. - gh-111309: distutils tests can now be run via unittest. - gh-111165: Remove no longer used functions run_unittest() and run_doctest() and class BasicTestRunner from the test.support module. - gh-110932: Fix regrtest if the SOURCE_DATE_EPOCH environment variable is defined: use the variable value as the random seed. Patch by Victor Stinner. - gh-110995: test_gdb: Fix detection of gdb built without Python scripting support. Patch by Victor Stinner. - gh-110918: Test case matching patterns specified by options - -match, --ignore, --matchfile and --ignorefile are now tested in the order of specification, and the last match determines whether the test case be run or ignored. - gh-110647: Fix test_stress_modifying_handlers() of test_signal. Patch by Victor Stinner. - gh-103053: Fix test_tools.test_freeze on FreeBSD: run “make distclean” instead of “make clean” in the copied source directory to remove also the “python” program. Patch by Victor Stinner. - gh-110167: Fix a deadlock in test_socket when server fails with a timeout but the client is still running in its thread. Don’t hold a lock to call cleanup functions in doCleanups(). One of the cleanup function waits until the client completes, whereas the client could deadlock if it called addCleanup() in such situation. Patch by Victor Stinner. - gh-110388: Add tests for tty. - gh-81002: Add tests for termios. - gh-110267: Add tests for pickling and copying PyStructSequence objects. Patched by Xuehai Pan. - gh-109974: Fix race conditions in test_threading lock tests. Wait until a condition is met rather than using time.sleep() with a hardcoded number of seconds. Patch by Victor Stinner. - gh-109972: Split test_gdb.py file into a test_gdb package made of multiple tests, so tests can now be run in parallel. Patch by Victor Stinner. - gh-104736: Fix test_gdb on Python built with LLVM clang 16 on Linux ppc64le (ex: Fedora 38). Search patterns in gdb “bt” command output to detect when gdb fails to retrieve the traceback. For example, skip a test if Backtrace stopped: frame did not save the PC is found. Patch by Victor Stinner. - gh-108927: Fixed order dependence in running tests in the same process when a test that has submodules (e.g. test_importlib) follows a test that imports its submodule (e.g. test_importlib.util) and precedes a test (e.g. test_unittest or test_compileall) that uses that submodule. - Build - gh-103053: “make check-clean-src” now also checks if the “python” program is found in the source directory: fail with an error if it does exist. Patch by Victor Stinner. - gh-109191: Fix compile error when building with recent versions of libedit. - IDLE - bpo-35668: Add docstrings to the IDLE debugger module. Fix two bugs: initialize Idb.botframe (should be in Bdb); in Idb.in_rpc_code, check whether prev_frame is None before trying to use it. Greatly expand test_debugger. - C API - gh-112438: Fix support of format units “es”, “et”, “es#”, and “et#” in nested tuples in PyArg_ParseTuple()-like functions. - gh-109521: PyImport_GetImporter() now sets RuntimeError if it fails to get sys.path_hooks or sys.path_importer_cache or they are not list and dict correspondingly. Previously it could return NULL without setting error in obscure cases, crash or raise SystemError if these attributes have wrong type. ------------------------------------------------------------------ ------------------ 2023-12-18 - Dec 18 2023 ------------------- ------------------------------------------------------------------ ++++ python311: - Refresh CVE-2023-27043-email-parsing-errors.patch to gh#python/cpython!111116, fixing bsc#1210638 (CVE-2023-27043). - Thus we can remove Revert-gh105127-left-tests.patch, which is now useless. ++++ python-Flask-SocketIO: - update to 5.3.6: * Fixes in the test client to support recent changes in Socket.IO dependencies ++++ python311-core: - Refresh CVE-2023-27043-email-parsing-errors.patch to gh#python/cpython!111116, fixing bsc#1210638 (CVE-2023-27043). - Thus we can remove Revert-gh105127-left-tests.patch, which is now useless. ++++ python313-pip: - update to 23.3.2: * Fix a bug in extras handling for link requirements (`#12372 * Fix mercurial revision "parse error": use ``--rev={ref}`` instead of ``-r={ref}`` (`#12373 ++++ python313-setuptools: - update to 69.0.2: * Added missing estimated date for removing ``setuptools.dep_util`` (deprecated in v69.0.0). * Fixed imports of ``setuptools.dep_util.newer_group``. * A deprecation warning is issued instead of a hard failure. * Include type information (``py.typed``, ``*.pyi``) by default (#3136) -- by :user:`Danie-1`, * Exported ``distutils.dep_util`` and ``setuptools.dep_util`` through ``setuptools.modified`` * Merged with pypa/distutils@7a04cbda0fc714. * Replaced hardcoded numeric values with :obj:`dis.opmap`, fixing problem with 3.13.0a1. (#4094) * Configuring project ``version`` and ``egg_info.tag_*`` in such a way that results in invalid version strings (according to :pep:`440`) is no longer permitted. (#4066) * Removed deprecated ``egg_base`` option from ``dist_info``. * The parsing of the deprecated ``metadata.license_file`` and ``metadata.requires`` fields in ``setup.cfg`` is no longer supported. * Users are expected to move to ``metadata.license_files`` and ``options.install_requires`` (respectively). (#4066) * Passing ``config_settings`` to ``setuptools.build_meta`` with deprecated values for ``--global-option`` is no longer allowed. (#4066) * Removed deprecated ``namespace-packages`` from ``pyproject.toml``. * Added strict enforcement for ``project.dynamic`` in ``pyproject.toml``. This removes the transitional ability of users configuring certain parameters via ``setup.py`` without making the necessary changes to ``pyproject.toml`` * Removed handling of ``--config-settings["--build-option"]`` in ``setuptools.build_meta`` from build-backend API hooks * other than* ``build_wheel``. * Improve backwards compatibility with deprecated CLI practices. (#4048) * Avoid using caching attributes in ``Distribution.metadata`` for requirements. This is done for backwards compatibility with customizations that attempt to modify ``install_requires`` or ``extras_require`` at a late point (still not recommended). * Rework how ``setuptools`` internally handles ``dependencies/install_requires`` and ``optional-dependencies/extras_require``. (#3903) * Improve the generated ``PKG-INFO`` files, by adding ``Requires-Dist`` fields. * Previously, these fields would be omitted in favour of a non- standard ``*.egg-info/requires.txt`` file (which is still generated for the time being). (#3904) * Improve atomicity when writing ``PKG-INFO`` files to avoid race conditions with ``importlib.metadata``. (#3904) * Fix the name given to the ``*-nspkg.pth`` files in editable installs, ensuring they are unique per distribution. (#4041) * Workaround some limitations on ``pkg_resources``-style legacy namespaces in the meta path finder for editable installations. - drop sphinx72.patch (upstream) ------------------------------------------------------------------ ------------------ 2023-12-17 - Dec 17 2023 ------------------- ------------------------------------------------------------------ ++++ python-greenlet: - update to 3.0.2: * Packaging: Add a minimal ``pyproject.toml`` to sdists. * Packaging: Various updates to macOS wheels. * Fix a test case on Arm32. Note that this is not a supported platform (there is no CI for it) and support is best effort; ++++ python-jaraco.text: - update to 3.12.0: * Require Python 3.8 or later. ------------------------------------------------------------------ ------------------ 2023-12-16 - Dec 16 2023 ------------------- ------------------------------------------------------------------ ++++ python-google-auth: - update to 2.25.2: * Fix user cred universe domain issue (#1436) ++++ python-jaraco.collections: - update to 5.0.0: * Moved collections into a package and declared as typed. * Deprecations and Removals * Removed DictFilter. ------------------------------------------------------------------ ------------------ 2023-12-15 - Dec 15 2023 ------------------- ------------------------------------------------------------------ ++++ python-pycurl: - Add patch pause-unpause-xfail.patch: * XFAIL a test due to gh#pycurl/pycurl#729 (bsc#1218062) ------------------------------------------------------------------ ------------------ 2023-12-14 - Dec 14 2023 ------------------- ------------------------------------------------------------------ ++++ python-alembic: - update to 1.13.0: * Fixed issue where the ``alembic check`` command did not function correctly with upgrade structures that have multiple, top-level elements, as are generated from the "multi-env" environment template. * Updated logic introduced in :ticket:`151` to allow ``if_exists`` and ``if_not_exists`` on index operations also on SQLAlchemy 1.4 series. Previously this feature was mistakenly requiring the 2.0 series. * Replaced ``python-dateutil`` with the standard library module zoneinfo. * Alembic 1.13 now supports Python 3.8 and above. * Fixed autogenerate issue where ``create_table_comment()`` and ``drop_table_comment()`` rendering in a batch table modify would include the "table" and "schema" arguments, which are not accepted in batch as these are already part of the top level block. * Additional fixes to PostgreSQL expression index compare feature. The compare now correctly accommodates casts and differences in spacing. * Added detection logic for operation clauses inside the expression, skipping the compare of these expressions. * To accommodate these changes the logic for the comparison of the indexes and unique constraints was moved to the dialect implementation, allowing greater flexibility. ++++ python-psycopg: - update to 3.1.15: * Fix use of ``service`` in connection string (regression in 3.1.13, :ticket:`#694`). * Fix async connection to hosts resolving to multiple IP addresses (regression in 3.1.13, :ticket:`#695`). * Respect the :envvar:`PGCONNECT_TIMEOUT` environment variable to determine the connection timeout. * Fix :ref:`interaction with gevent ` (:ticket:`#527`). * Add support for PyPy (:ticket:`#686`). ++++ python-psycopg-c: - update to 3.1.15: * Fix use of service in connection string * Fix async connection to hosts resolving to multiple IP addresses * Respect the PGCONNECT_TIMEOUT environment variable to determine the connection timeout. * Psycopg 3.1.14 * Fix interaction with gevent (ticket #527). * Add support for PyPy (ticket #686). ++++ python-pyotp: - update to 2.9.0: * Add `parse_uri()` support for Steam TOTP (#153) * Test and documentation improvements ------------------------------------------------------------------ ------------------ 2023-12-13 - Dec 13 2023 ------------------- ------------------------------------------------------------------ ++++ python313-hatchling: - update to 1.20.0: * Added: + Add bypass-selection option to the wheel build target to allow for empty (metadata-only) wheels * Fixed: + Fix regression in 1.19.1 that allowed exclude to count toward inclusion selection, thus bypassing the default inclusion selection heuristics + Fix writing optional dependency core metadata in situations where there are multiple environment markers - additional changes from version 1.19.1: * Fixed: + Add better error message when the wheel build target cannot determine what to ship + Consider forced inclusion patterns and build-time artifacts as file selection since some build hooks generate the entire wheel contents without user configuration - additional changes from version 1.19.0: * Changed: + An error will now be raised if a force-included path does not exist + An error will now be raised for the wheel build target if no file selection options are defined * Added: + Officially support Python 3.12 + Allow using an empty string for the sources option to add a prefix to distribution paths * Fixed: + Properly handle non-zero version epoch for the standard version scheme + Fix the wheel build target for case insensitive file systems when the project metadata name does not match the directory name on disk + The app build target no longer has suppressed output + Prevent duplicate paths when projects require the sources option while build hooks overwrite included paths + Properly escape spaces for URI context formatting ++++ python313-userpath: - update to 1.9.1: * Temporarily revert the change on non-Windows systems where only login shells are modified ------------------------------------------------------------------ ------------------ 2023-12-12 - Dec 12 2023 ------------------- ------------------------------------------------------------------ ++++ python313-pathspec: - update to 0.12.1: * `Issue #84`_: PathSpec.match_file() returns None since 0.12.0. * Major changes: * Dropped support of EOL Python 3.7. See `Pull #82`_. * API changes: * Signature of protected method `pathspec.pathspec.PathSpec._match_file()` (with a leading underscore) has been changed from `def _match_file(patterns: Iterable[Pattern], file: str) -> bool` to `def _match_file(patterns: Iterable[Tuple[int, Pattern]], file: str) -> Tuple[Optional[bool], Optional[int]]`. * Added `pathspec.pathspec.PathSpec.check_*()` methods. These methods behave similarly to `.match_*()` but return additional information in the `pathspec.util.CheckResult` objects (e.g., `CheckResult.index` indicates the index of the last pattern that matched the file). * Added `pathspec.pattern.RegexPattern.pattern` attribute which stores the original, uncompiled pattern. * Mark Python 3.12 as supported. * Improve test debugging. * Improve type hint on *on_error* parameter on `pathspec.pathspec.PathSpec.match_tree_entries()`. * Improve type hint on *on_error* parameter on `pathspec.util.iter_tree_entries()`. ------------------------------------------------------------------ ------------------ 2023-12-11 - Dec 11 2023 ------------------- ------------------------------------------------------------------ ++++ python-boto3: - Update to 1.33.11: * api-change:``cloudwatch``: [``botocore``] Update cloudwatch client to latest version * api-change:``ec2``: [``botocore``] M2 Mac instances are built on Apple M2 Mac mini computers. I4i instances are powered by 3rd generation Intel Xeon Scalable processors. C7i compute optimized, M7i general purpose and R7i memory optimized instances are powered by custom 4th Generation Intel Xeon Scalable processors. * api-change:``finspace``: [``botocore``] Releasing Scaling Group, Dataview, and Volume APIs - from version 1.33.10 * api-change:``codedeploy``: [``botocore``] This release adds support for two new CodeDeploy features: 1) zonal deployments for Amazon EC2 in-place deployments, 2) deployments triggered by Auto Scaling group termination lifecycle hook events. - from version 1.33.9 * api-change:``backup``: [``botocore``] AWS Backup - Features: Add VaultType to the output of DescribeRecoveryPoint, ListRecoveryPointByBackupVault API and add ResourceType to the input of ListRestoreJobs API * api-change:``comprehend``: [``botocore``] Documentation updates for Trust and Safety features. * api-change:``connect``: [``botocore``] Releasing Tagging Support for Instance Management APIS * api-change:``ec2``: [``botocore``] Releasing the new cpuManufacturer attribute within the DescribeInstanceTypes API response which notifies our customers with information on who the Manufacturer is for the processor attached to the instance, for example: Intel. * api-change:``payment-cryptography``: [``botocore``] AWS Payment Cryptography IPEK feature release - from version 1.33.8 * api-change:``athena``: [``botocore``] Adding IdentityCenter enabled request for interactive query * api-change:``cleanroomsml``: [``botocore``] Updated service title from cleanroomsml to CleanRoomsML. * api-change:``cloudformation``: [``botocore``] Documentation update, December 2023 * api-change:``ec2``: [``botocore``] Adds A10G, T4G, and H100 as accelerator name options and Habana as an accelerator manufacturer option for attribute based selection - from version 1.33.7 * api-change:``billingconductor``: [``botocore``] This release adds the ability to specify a linked account of the billing group for the custom line item resource. * api-change:``braket``: [``botocore``] This release enhances service support to create quantum tasks and hybrid jobs associated with Braket Direct Reservations. * api-change:``cloud9``: [``botocore``] This release adds the requirement to include the imageId parameter in the CreateEnvironmentEC2 API call. * api-change:``cloudformation``: [``botocore``] Including UPDATE_* states as a success status for CreateStack waiter. * api-change:``finspace``: [``botocore``] Release General Purpose type clusters * api-change:``medialive``: [``botocore``] Adds support for custom color correction on channels using 3D LUT files. * api-change:``servicecatalog-appregistry``: [``botocore``] Documentation-only updates for Dawn * api-change:``endpoint-rules``: [``botocore``] Update endpoint-rules client to latest version - from version 1.33.6 * api-change:``qconnect``: [``botocore``] This release adds the PutFeedback API and allows providing feedback against the specified assistant for the specified target. * api-change:``rbin``: [``botocore``] Added resource identifier in the output and updated error handling. * api-change:``verifiedpermissions``: [``botocore``] Adds description field to PolicyStore API's and namespaces field to GetSchema. - from version 1.33.5 * api-change:``arc-zonal-shift``: [``botocore``] This release adds a new capability, zonal autoshift. You can configure zonal autoshift so that AWS shifts traffic for a resource away from an Availability Zone, on your behalf, when AWS determines that there is an issue that could potentially affect customers in the Availability Zone. * api-change:``glue``: [``botocore``] Adds observation and analyzer support to the GetDataQualityResult and BatchGetDataQualityResult APIs. * api-change:``sagemaker``: [``botocore``] This release adds support for 1/ Code Editor, based on Code-OSS, Visual Studio Code Open Source, a new fully managed IDE option in SageMaker Studio 2/ JupyterLab, a new fully managed JupyterLab IDE experience in SageMaker Studio - from version 1.33.4 * bugfix:``s3transfer``: Raise floor for ``s3transfer`` to 0.8.2 to avoid any conflicts with the awscrt * api-change:``marketplace-agreement``: [``botocore``] The AWS Marketplace Agreement Service provides an API interface that helps AWS Marketplace sellers manage their agreements, including listing, filtering, and viewing details about their agreements. * api-change:``marketplace-catalog``: [``botocore``] This release enhances the ListEntities API to support new entity type-specific strongly typed filters in the request and entity type-specific strongly typed summaries in the response. * api-change:``marketplace-deployment``: [``botocore``] AWS Marketplace Deployment is a new service that provides essential features that facilitate the deployment of software, data, and services procured through AWS Marketplace. * api-change:``redshift-serverless``: [``botocore``] This release adds the following support for Amazon Redshift Serverless: 1) cross-account cross-VPCs, 2) copying snapshots across Regions, 3) scheduling snapshot creation, and 4) restoring tables from a recovery point. * api-change:``endpoint-rules``: [``botocore``] Update endpoint-rules client to latest version - from version 1.33.3 * api-change:``application-autoscaling``: [``botocore``] Amazon SageMaker customers can now use Application Auto Scaling to automatically scale the number of Inference Component copies across an endpoint to meet the varying demand of their workloads. * api-change:``cleanrooms``: [``botocore``] AWS Clean Rooms now provides differential privacy to protect against user-identification attempts and machine learning modeling to allow two parties to identify similar users in their data. * api-change:``cleanroomsml``: [``botocore``] Public Preview SDK release of AWS Clean Rooms ML APIs * api-change:``opensearch``: [``botocore``] Launching Amazon OpenSearch Service support for new zero-ETL integration with Amazon S3. Customers can now manage their direct query data sources to Amazon S3 programatically * api-change:``opensearchserverless``: [``botocore``] Amazon OpenSearch Serverless collections support an additional attribute called standby-replicas. This allows to specify whether a collection should have redundancy enabled. * api-change:``sagemaker-runtime``: [``botocore``] Update sagemaker-runtime client to latest version * api-change:``sagemaker``: [``botocore``] This release adds following support 1/ Improved SDK tooling for model deployment. 2/ New Inference Component based features to lower inference costs and latency 3/ SageMaker HyperPod management. 4/ Additional parameters for FM Fine Tuning in Autopilot * api-change:``sts``: [``botocore``] Documentation updates for AWS Security Token Service. * api-change:``endpoint-rules``: [``botocore``] Update endpoint-rules client to latest version - from version 1.33.2 * api-change:``accessanalyzer``: [``botocore``] This release adds support for external access findings for S3 directory buckets to help you easily identify cross-account access. Updated service API, documentation, and paginators. * api-change:``bedrock-agent-runtime``: [``botocore``] This release introduces Agents for Amazon Bedrock Runtime * api-change:``bedrock-agent``: [``botocore``] This release introduces Agents for Amazon Bedrock * api-change:``bedrock-runtime``: [``botocore``] This release adds support for minor versions/aliases for invoke model identifier. * api-change:``bedrock``: [``botocore``] This release adds support for customization types, model life cycle status and minor versions/aliases for model identifiers. * api-change:``connect``: [``botocore``] Added support for following capabilities: Amazon Connect's in-app, web, and video calling. Two-way SMS integrations. Contact Lens real-time chat analytics feature. Amazon Connect Analytics Datalake capability. Capability to configure real time chat rules. * api-change:``customer-profiles``: [``botocore``] This release introduces DetectProfileObjectType API to auto generate object type mapping. * api-change:``qbusiness``: [``botocore``] Amazon Q - a generative AI powered application that your employees can use to ask questions and get answers from knowledge spread across disparate content repositories, summarize reports, write articles, take actions, and much more - all within their company's connected content repositories. * api-change:``qconnect``: [``botocore``] Amazon Q in Connect, an LLM-enhanced evolution of Amazon Connect Wisdom. This release adds generative AI support to Amazon Q Connect QueryAssistant and GetRecommendations APIs. * api-change:``s3``: [``botocore``] Adds support for S3 Express One Zone. * api-change:``s3control``: [``botocore``] Adds support for S3 Express One Zone, and InvocationSchemaVersion 2.0 for S3 Batch Operations. * api-change:``endpoint-rules``: [``botocore``] Update endpoint-rules client to latest version - from version 1.33.1 * api-change:``elasticache``: [``botocore``] Launching Amazon ElastiCache Serverless that enables you to create a cache in under a minute without any capacity management. ElastiCache Serverless monitors the cache's memory, CPU, and network usage and scales both vertically and horizontally to support your application's requirements. - from version 1.33.0 * enhancement:Versioning: Bump boto3 from 1.29.7 to 1.33.0 to match Botocore versioning scheme. * feature:``s3``: Boto3 will now opt into using the awscrt on select EC2 instance types for s3 transfers. * feature:Versioning: [``botocore``] With the release of Botocore 1.33.0, Boto3 and Botocore will share the same version number. * api-change:``appsync``: [``botocore``] This update enables introspection of Aurora cluster databases using the RDS Data API * api-change:``b2bi``: [``botocore``] This is the initial SDK release for AWS B2B Data Interchange. * api-change:``backup``: [``botocore``] AWS Backup now supports restore testing, a new feature that allows customers to automate restore testing and validating their backups. Additionally, this release adds support for EBS Snapshots Archive tier. * api-change:``controltower``: [``botocore``] This release adds the following support: 1. The EnableControl API can configure controls that are configurable. 2. The GetEnabledControl API shows the configured parameters on an enabled control. 3. The new UpdateEnabledControl API can change parameters on an enabled control. * api-change:``efs``: [``botocore``] Update efs client to latest version * api-change:``fis``: [``botocore``] AWS FIS adds support for multi-account experiments & empty target resolution. This release also introduces the CreateTargetAccountConfiguration API that allows experiments across multiple AWS accounts, and the ListExperimentResolvedTargets API to list target details. * api-change:``glue``: [``botocore``] add observations support to DQ CodeGen config model + update document for connectiontypes supported by ConnectorData entities * api-change:``rds``: [``botocore``] Updates Amazon RDS documentation for support for RDS for Db2. * api-change:``securityhub``: [``botocore``] Adds and updates APIs to support central configuration. This feature allows the Security Hub delegated administrator to configure Security Hub for their entire AWS Org across multiple regions from a home Region. With this release, findings also include account name and application metadata. * api-change:``transcribe``: [``botocore``] This release adds support for AWS HealthScribe APIs within Amazon Transcribe * api-change:``endpoint-rules``: [``botocore``] Update endpoint-rules client to latest version - from version 1.29.7 * enhancement:AWSCRT: [``botocore``] Update awscrt version to 0.19.17 * api-change:``accessanalyzer``: [``botocore``] IAM Access Analyzer now continuously monitors IAM roles and users in your AWS account or organization to generate findings for unused access. Additionally, IAM Access Analyzer now provides custom policy checks to validate that IAM policies adhere to your security standards ahead of deployments. * api-change:``amp``: [``botocore``] This release adds support for the Amazon Managed Service for Prometheus collector, a fully managed, agentless Prometheus metrics scraping capability. * api-change:``bcm-data-exports``: [``botocore``] Users can create, read, update, delete Exports of billing and cost management data. Users can get details of Export Executions and details of Tables for exporting. Tagging support is provided for Exports * api-change:``cloudtrail``: [``botocore``] CloudTrail Lake now supports federating event data stores. giving users the ability to run queries against their event data using Amazon Athena. * api-change:``codestar-connections``: [``botocore``] This release adds support for the CloudFormation Git sync feature. Git sync enables updating a CloudFormation stack from a template stored in a Git repository. * api-change:``compute-optimizer``: [``botocore``] This release enables AWS Compute Optimizer to analyze and generate recommendations with customization and discounts preferences. * api-change:``config``: [``botocore``] Support Periodic Recording for Configuration Recorder * api-change:``controltower``: [``botocore``] Add APIs to create and manage a landing zone. * api-change:``cost-optimization-hub``: [``botocore``] This release launches Cost Optimization Hub, a new AWS Billing and Cost Management feature that helps you consolidate and prioritize cost optimization recommendations across your AWS Organizations member accounts and AWS Regions, so that you can get the most out of your AWS spend. * api-change:``detective``: [``botocore``] Added new APIs in Detective to support resource investigations * api-change:``ecs``: [``botocore``] Adds a new 'type' property to the Setting structure. Adds a new AccountSetting - guardDutyActivate for ECS. * api-change:``efs``: [``botocore``] Update efs client to latest version * api-change:``eks-auth``: [``botocore``] This release adds support for EKS Pod Identity feature. EKS Pod Identity makes it easy for customers to obtain IAM permissions for their applications running in the EKS clusters. * api-change:``eks``: [``botocore``] This release adds support for EKS Pod Identity feature. EKS Pod Identity makes it easy for customers to obtain IAM permissions for the applications running in their EKS clusters. * api-change:``elbv2``: [``botocore``] Update elbv2 client to latest version * api-change:``freetier``: [``botocore``] This is the initial SDK release for the AWS Free Tier GetFreeTierUsage API * api-change:``fsx``: [``botocore``] Added support for FSx for ONTAP scale-out file systems and FlexGroup volumes. Added the HAPairs field and ThroughputCapacityPerHAPair for filesystem. Added AggregateConfiguration (containing Aggregates and ConstituentsPerAggregate) and SizeInBytes for volume. * api-change:``guardduty``: [``botocore``] Add support for Runtime Monitoring for ECS and ECS-EC2. * api-change:``iotfleetwise``: [``botocore``] AWS IoT FleetWise introduces new APIs for vision system data, such as data collected from cameras, radars, and lidars. You can now model and decode complex data types. * api-change:``lakeformation``: [``botocore``] This release adds four new APIs "DescribeLakeFormationIdentityCenterConfiguration", "CreateLakeFormationIdentityCenterConfiguration", "DescribeLakeFormationIdentityCenterConfiguration", and "DeleteLakeFormationIdentityCenterConfiguration", and also updates the corresponding documentation. * api-change:``lexv2-models``: [``botocore``] Update lexv2-models client to latest version * api-change:``lexv2-runtime``: [``botocore``] Update lexv2-runtime client to latest version * api-change:``logs``: [``botocore``] Added APIs to Create, Update, Get, List and Delete LogAnomalyDetectors and List and Update Anomalies in Detector. Added LogGroupClass attribute for LogGroups to classify loggroup as Standard loggroup with all capabilities or InfrequentAccess loggroup with limited capabilities. * api-change:``managedblockchain``: [``botocore``] Add optional NetworkType property to Accessor APIs * api-change:``personalize-events``: [``botocore``] This release enables PutActions and PutActionInteractions * api-change:``personalize-runtime``: [``botocore``] Enables metadata in recommendations and next best action recommendations * api-change:``personalize``: [``botocore``] Enables metadata in recommendations, recommendations with themes, and next best action recommendations * api-change:``quicksight``: [``botocore``] This release launches new APIs for trusted identity propagation setup and supports creating datasources using trusted identity propagation as authentication method for QuickSight accounts configured with IAM Identity Center. * api-change:``redshift``: [``botocore``] This release adds support for multi-data warehouse writes through data sharing. * api-change:``repostspace``: [``botocore``] Initial release of AWS re:Post Private * api-change:``s3``: [``botocore``] Adding new params - Key and Prefix, to S3 API operations for supporting S3 Access Grants. Note - These updates will not change any of the existing S3 API functionality. * api-change:``s3control``: [``botocore``] Introduce Amazon S3 Access Grants, a new S3 access control feature that maps identities in directories such as Active Directory, or AWS Identity and Access Management (IAM) Principals, to datasets in S3. * api-change:``secretsmanager``: [``botocore``] AWS Secrets Manager has released the BatchGetSecretValue API, which allows customers to fetch up to 20 Secrets with a single request using a list of secret names or filters. * api-change:``securityhub``: [``botocore``] Adds and updates APIs to support customizable security controls. This feature allows Security Hub customers to provide custom parameters for security controls. With this release, findings for controls that support custom parameters will include the parameters used to generate the findings. * api-change:``stepfunctions``: [``botocore``] Update stepfunctions client to latest version * api-change:``transcribe``: [``botocore``] This release adds support for transcriptions from audio sources in 64 new languages and introduces generative call summarization in Transcribe Call Analytics (Post call) * api-change:``workspaces-thin-client``: [``botocore``] Initial release of Amazon WorkSpaces Thin Client * api-change:``workspaces``: [``botocore``] The release introduces Multi-Region Resilience one-way data replication that allows you to replicate data from your primary WorkSpace to a standby WorkSpace in another AWS Region. DescribeWorkspaces now returns the status of data replication. * api-change:``endpoint-rules``: [``botocore``] Update endpoint-rules client to latest version - Update BuildRequires and Requires from setup.py ++++ python-botocore: - Update to 1.33.11: * api-change:``cloudwatch``: Update cloudwatch client to latest version * api-change:``ec2``: M2 Mac instances are built on Apple M2 Mac mini computers. I4i instances are powered by 3rd generation Intel Xeon Scalable processors. C7i compute optimized, M7i general purpose and R7i memory optimized instances are powered by custom 4th Generation Intel Xeon Scalable processors. * api-change:``finspace``: Releasing Scaling Group, Dataview, and Volume APIs - from version 1.33.10 * api-change:``codedeploy``: This release adds support for two new CodeDeploy features: 1) zonal deployments for Amazon EC2 in-place deployments, 2) deployments triggered by Auto Scaling group termination lifecycle hook events. - from version 1.33.9 * api-change:``backup``: AWS Backup - Features: Add VaultType to the output of DescribeRecoveryPoint, ListRecoveryPointByBackupVault API and add ResourceType to the input of ListRestoreJobs API * api-change:``comprehend``: Documentation updates for Trust and Safety features. * api-change:``connect``: Releasing Tagging Support for Instance Management APIS * api-change:``ec2``: Releasing the new cpuManufacturer attribute within the DescribeInstanceTypes API response which notifies our customers with information on who the Manufacturer is for the processor attached to the instance, for example: Intel. * api-change:``payment-cryptography``: AWS Payment Cryptography IPEK feature release - from version 1.33.8 * api-change:``athena``: Adding IdentityCenter enabled request for interactive query * api-change:``cleanroomsml``: Updated service title from cleanroomsml to CleanRoomsML. * api-change:``cloudformation``: Documentation update, December 2023 * api-change:``ec2``: Adds A10G, T4G, and H100 as accelerator name options and Habana as an accelerator manufacturer option for attribute based selection - from version 1.33.7 * api-change:``billingconductor``: This release adds the ability to specify a linked account of the billing group for the custom line item resource. * api-change:``braket``: This release enhances service support to create quantum tasks and hybrid jobs associated with Braket Direct Reservations. * api-change:``cloud9``: This release adds the requirement to include the imageId parameter in the CreateEnvironmentEC2 API call. * api-change:``cloudformation``: Including UPDATE_* states as a success status for CreateStack waiter. * api-change:``finspace``: Release General Purpose type clusters * api-change:``medialive``: Adds support for custom color correction on channels using 3D LUT files. * api-change:``servicecatalog-appregistry``: Documentation-only updates for Dawn * api-change:``endpoint-rules``: Update endpoint-rules client to latest version - from version 1.33.6 * api-change:``qconnect``: This release adds the PutFeedback API and allows providing feedback against the specified assistant for the specified target. * api-change:``rbin``: Added resource identifier in the output and updated error handling. * api-change:``verifiedpermissions``: Adds description field to PolicyStore API's and namespaces field to GetSchema. - from version 1.33.5 * api-change:``arc-zonal-shift``: This release adds a new capability, zonal autoshift. You can configure zonal autoshift so that AWS shifts traffic for a resource away from an Availability Zone, on your behalf, when AWS determines that there is an issue that could potentially affect customers in the Availability Zone. * api-change:``glue``: Adds observation and analyzer support to the GetDataQualityResult and BatchGetDataQualityResult APIs. * api-change:``sagemaker``: This release adds support for 1/ Code Editor, based on Code-OSS, Visual Studio Code Open Source, a new fully managed IDE option in SageMaker Studio 2/ JupyterLab, a new fully managed JupyterLab IDE experience in SageMaker Studio - from version 1.33.4 * api-change:``marketplace-agreement``: The AWS Marketplace Agreement Service provides an API interface that helps AWS Marketplace sellers manage their agreements, including listing, filtering, and viewing details about their agreements. * api-change:``marketplace-catalog``: This release enhances the ListEntities API to support new entity type-specific strongly typed filters in the request and entity type-specific strongly typed summaries in the response. * api-change:``marketplace-deployment``: AWS Marketplace Deployment is a new service that provides essential features that facilitate the deployment of software, data, and services procured through AWS Marketplace. * api-change:``redshift-serverless``: This release adds the following support for Amazon Redshift Serverless: 1) cross-account cross-VPCs, 2) copying snapshots across Regions, 3) scheduling snapshot creation, and 4) restoring tables from a recovery point. * api-change:``endpoint-rules``: Update endpoint-rules client to latest version - from version 1.33.3 * api-change:``application-autoscaling``: Amazon SageMaker customers can now use Application Auto Scaling to automatically scale the number of Inference Component copies across an endpoint to meet the varying demand of their workloads. * api-change:``cleanrooms``: AWS Clean Rooms now provides differential privacy to protect against user-identification attempts and machine learning modeling to allow two parties to identify similar users in their data. * api-change:``cleanroomsml``: Public Preview SDK release of AWS Clean Rooms ML APIs * api-change:``opensearch``: Launching Amazon OpenSearch Service support for new zero-ETL integration with Amazon S3. Customers can now manage their direct query data sources to Amazon S3 programatically * api-change:``opensearchserverless``: Amazon OpenSearch Serverless collections support an additional attribute called standby-replicas. This allows to specify whether a collection should have redundancy enabled. * api-change:``sagemaker-runtime``: Update sagemaker-runtime client to latest version * api-change:``sagemaker``: This release adds following support 1/ Improved SDK tooling for model deployment. 2/ New Inference Component based features to lower inference costs and latency 3/ SageMaker HyperPod management. 4/ Additional parameters for FM Fine Tuning in Autopilot * api-change:``sts``: Documentation updates for AWS Security Token Service. * api-change:``endpoint-rules``: Update endpoint-rules client to latest version - from version 1.33.2 * api-change:``accessanalyzer``: This release adds support for external access findings for S3 directory buckets to help you easily identify cross-account access. Updated service API, documentation, and paginators. * api-change:``bedrock``: This release adds support for customization types, model life cycle status and minor versions/aliases for model identifiers. * api-change:``bedrock-agent``: This release introduces Agents for Amazon Bedrock * api-change:``bedrock-agent-runtime``: This release introduces Agents for Amazon Bedrock Runtime * api-change:``bedrock-runtime``: This release adds support for minor versions/aliases for invoke model identifier. * api-change:``connect``: Added support for following capabilities: Amazon Connect's in-app, web, and video calling. Two-way SMS integrations. Contact Lens real-time chat analytics feature. Amazon Connect Analytics Datalake capability. Capability to configure real time chat rules. * api-change:``customer-profiles``: This release introduces DetectProfileObjectType API to auto generate object type mapping. * api-change:``endpoint-rules``: Update endpoint-rules client to latest version * api-change:``qbusiness``: Amazon Q - a generative AI powered application that your employees can use to ask questions and get answers from knowledge spread across disparate content repositories, summarize reports, write articles, take actions, and much more - all within their company's connected content repositories. * api-change:``qconnect``: Amazon Q in Connect, an LLM-enhanced evolution of Amazon Connect Wisdom. This release adds generative AI support to Amazon Q Connect QueryAssistant and GetRecommendations APIs. * api-change:``s3``: Adds support for S3 Express One Zone. * api-change:``s3control``: Adds support for S3 Express One Zone, and InvocationSchemaVersion 2.0 for S3 Batch Operations. - from version 1.33.1 * api-change:``elasticache``: Launching Amazon ElastiCache Serverless that enables you to create a cache in under a minute without any capacity management. ElastiCache Serverless monitors the cache's memory, CPU, and network usage and scales both vertically and horizontally to support your application's requirements. - from version 1.33.0 * feature:Versioning: With the release of Botocore 1.33.0, Boto3 and Botocore will share the same version number. * api-change:``appsync``: This update enables introspection of Aurora cluster databases using the RDS Data API * api-change:``b2bi``: This is the initial SDK release for AWS B2B Data Interchange. * api-change:``backup``: AWS Backup now supports restore testing, a new feature that allows customers to automate restore testing and validating their backups. Additionally, this release adds support for EBS Snapshots Archive tier. * api-change:``controltower``: This release adds the following support: 1. The EnableControl API can configure controls that are configurable. 2. The GetEnabledControl API shows the configured parameters on an enabled control. 3. The new UpdateEnabledControl API can change parameters on an enabled control. * api-change:``efs``: Update efs client to latest version * api-change:``fis``: AWS FIS adds support for multi-account experiments & empty target resolution. This release also introduces the CreateTargetAccountConfiguration API that allows experiments across multiple AWS accounts, and the ListExperimentResolvedTargets API to list target details. * api-change:``glue``: add observations support to DQ CodeGen config model + update document for connectiontypes supported by ConnectorData entities * api-change:``rds``: Updates Amazon RDS documentation for support for RDS for Db2. * api-change:``securityhub``: Adds and updates APIs to support central configuration. This feature allows the Security Hub delegated administrator to configure Security Hub for their entire AWS Org across multiple regions from a home Region. With this release, findings also include account name and application metadata. * api-change:``transcribe``: This release adds support for AWS HealthScribe APIs within Amazon Transcribe * api-change:``endpoint-rules``: Update endpoint-rules client to latest version - from version 1.32.7 * api-change:``accessanalyzer``: IAM Access Analyzer now continuously monitors IAM roles and users in your AWS account or organization to generate findings for unused access. Additionally, IAM Access Analyzer now provides custom policy checks to validate that IAM policies adhere to your security standards ahead of deployments. * api-change:``amp``: This release adds support for the Amazon Managed Service for Prometheus collector, a fully managed, agentless Prometheus metrics scraping capability. * api-change:``bcm-data-exports``: Users can create, read, update, delete Exports of billing and cost management data. Users can get details of Export Executions and details of Tables for exporting. Tagging support is provided for Exports * api-change:``cloudtrail``: CloudTrail Lake now supports federating event data stores. giving users the ability to run queries against their event data using Amazon Athena. * api-change:``codestar-connections``: This release adds support for the CloudFormation Git sync feature. Git sync enables updating a CloudFormation stack from a template stored in a Git repository. * api-change:``compute-optimizer``: This release enables AWS Compute Optimizer to analyze and generate recommendations with customization and discounts preferences. * api-change:``config``: Support Periodic Recording for Configuration Recorder * api-change:``controltower``: Add APIs to create and manage a landing zone. * api-change:``cost-optimization-hub``: This release launches Cost Optimization Hub, a new AWS Billing and Cost Management feature that helps you consolidate and prioritize cost optimization recommendations across your AWS Organizations member accounts and AWS Regions, so that you can get the most out of your AWS spend. * api-change:``detective``: Added new APIs in Detective to support resource investigations * api-change:``ecs``: Adds a new 'type' property to the Setting structure. Adds a new AccountSetting - guardDutyActivate for ECS. * api-change:``efs``: Update efs client to latest version * api-change:``eks``: This release adds support for EKS Pod Identity feature. EKS Pod Identity makes it easy for customers to obtain IAM permissions for the applications running in their EKS clusters. * api-change:``eks-auth``: This release adds support for EKS Pod Identity feature. EKS Pod Identity makes it easy for customers to obtain IAM permissions for their applications running in the EKS clusters. * api-change:``elbv2``: Update elbv2 client to latest version * api-change:``endpoint-rules``: Update endpoint-rules client to latest version * api-change:``freetier``: This is the initial SDK release for the AWS Free Tier GetFreeTierUsage API * api-change:``fsx``: Added support for FSx for ONTAP scale-out file systems and FlexGroup volumes. Added the HAPairs field and ThroughputCapacityPerHAPair for filesystem. Added AggregateConfiguration (containing Aggregates and ConstituentsPerAggregate) and SizeInBytes for volume. * api-change:``guardduty``: Add support for Runtime Monitoring for ECS and ECS-EC2. * api-change:``iotfleetwise``: AWS IoT FleetWise introduces new APIs for vision system data, such as data collected from cameras, radars, and lidars. You can now model and decode complex data types. * api-change:``lakeformation``: This release adds four new APIs "DescribeLakeFormationIdentityCenterConfiguration", "CreateLakeFormationIdentityCenterConfiguration", "DescribeLakeFormationIdentityCenterConfiguration", and "DeleteLakeFormationIdentityCenterConfiguration", and also updates the corresponding documentation. * api-change:``lexv2-models``: Update lexv2-models client to latest version * api-change:``lexv2-runtime``: Update lexv2-runtime client to latest version * api-change:``logs``: Added APIs to Create, Update, Get, List and Delete LogAnomalyDetectors and List and Update Anomalies in Detector. Added LogGroupClass attribute for LogGroups to classify loggroup as Standard loggroup with all capabilities or InfrequentAccess loggroup with limited capabilities. * api-change:``managedblockchain``: Add optional NetworkType property to Accessor APIs * api-change:``personalize``: Enables metadata in recommendations, recommendations with themes, and next best action recommendations * api-change:``personalize-events``: This release enables PutActions and PutActionInteractions * api-change:``personalize-runtime``: Enables metadata in recommendations and next best action recommendations * api-change:``quicksight``: This release launches new APIs for trusted identity propagation setup and supports creating datasources using trusted identity propagation as authentication method for QuickSight accounts configured with IAM Identity Center. * api-change:``redshift``: This release adds support for multi-data warehouse writes through data sharing. * api-change:``repostspace``: Initial release of AWS re:Post Private * api-change:``s3``: Adding new params - Key and Prefix, to S3 API operations for supporting S3 Access Grants. Note - These updates will not change any of the existing S3 API functionality. * api-change:``s3control``: Introduce Amazon S3 Access Grants, a new S3 access control feature that maps identities in directories such as Active Directory, or AWS Identity and Access Management (IAM) Principals, to datasets in S3. * api-change:``secretsmanager``: AWS Secrets Manager has released the BatchGetSecretValue API, which allows customers to fetch up to 20 Secrets with a single request using a list of secret names or filters. * api-change:``securityhub``: Adds and updates APIs to support customizable security controls. This feature allows Security Hub customers to provide custom parameters for security controls. With this release, findings for controls that support custom parameters will include the parameters used to generate the findings. * api-change:``stepfunctions``: Update stepfunctions client to latest version * api-change:``transcribe``: This release adds support for transcriptions from audio sources in 64 new languages and introduces generative call summarization in Transcribe Call Analytics (Post call) * api-change:``workspaces``: The release introduces Multi-Region Resilience one-way data replication that allows you to replicate data from your primary WorkSpace to a standby WorkSpace in another AWS Region. DescribeWorkspaces now returns the status of data replication. * api-change:``workspaces-thin-client``: Initial release of Amazon WorkSpaces Thin Client * enhancement:AWSCRT: Update awscrt version to 0.19.17 ++++ python-s3transfer: - Update 0.8.2 * bugfix:Subscribers: Added caching for Subscribers to improve throughput by up to 24% in high volume transfer - from version 0.8.1 * enhancement:``s3``: Added support for defaulting checksums to CRC32 for s3express. - from version 0.8.0 * enhancement:``crt``: Automatically configure CRC32 checksums for uploads and checksum validation for downloads through the CRT transfer manager. * feature:``crt``: S3transfer now supports a wider range of CRT functionality for uploads to improve throughput in the CLI/Boto3. * enhancement:``Botocore``: S3Transfer now requires Botocore >=1.32.7 * enhancement:``crt``: Update ``target_throughput`` defaults. If not configured, s3transfer will use the AWS CRT to attempt to determine a recommended target throughput to use based on the system. If there is no recommended throughput, s3transfer now falls back to ten gigabits per second. * enhancement:``crt``: Add support for uploading and downloading file-like objects using CRT transfer manager. It supports both seekable and non-seekable file-like objects. - Update BuildRequires and Requires from setup.py ------------------------------------------------------------------ ------------------ 2023-12-10 - Dec 10 2023 ------------------- ------------------------------------------------------------------ ++++ python-opentelemetry-api: - update to 1.21.0: * Fix `SumAggregation`  (#3390) * Fix handling of empty metric collection cycles (#3335) * Fix error when no LoggerProvider configured for LoggingHandler (#3423) * Make `opentelemetry_metrics_exporter` entrypoint support pull exporters (#3428) * Allow instrument names to have '/' and up to 255 characters (#3442) * Do not load Resource on sdk import (#3447) * Update semantic conventions to version 1.21.0 (#3251) * Add missing schema_url in global api for logging and metrics (#3251) * Prometheus exporter support for auto instrumentation (#3413) * Modify Prometheus exporter to translate non-monotonic Sums into Gauges (#3306) * Update the body type in the log ($3343) * Add max_scale option to Exponential Bucket Histogram Aggregation (#3323) * Use BoundedAttributes instead of raw dict to extract attributes from LogRecord (#3310) * Support dropped_attributes_count in LogRecord and exporters (#3351) * Add unit to view instrument selection criteria (#3341) * Upgrade opentelemetry-proto to 0.20 and regen #3355) * Include endpoint in Grpc transient error warning #3362) * Fixed bug where logging export is tracked as trace #3375) * Select histogram aggregation with an environment variable * Move Protobuf encoding to its own package (#3169) * Add experimental feature to detect resource detectors in auto instrumentation (#3181) * Fix exporting of ExponentialBucketHistogramAggregation from opentelemetry.sdk.metrics.view (#3240) * Fix headers types mismatch for OTLP Exporters (#3226) * Fix suppress instrumentation for log batch processor (#3223) * Add speced out environment variables and arguments for BatchLogRecordProcessor (#3237) ------------------------------------------------------------------ ------------------ 2023-12-8 - Dec 8 2023 ------------------- ------------------------------------------------------------------ ++++ python-resolvelib: - update to 1.0.1: * Fix calls to opaque objects and use provider interface calls instead. `#126 * Implement backjumping to significantly speed up the resolution process by skipping over irrelevant parts of the resolution search space. `#113 * A new reporter hook ``rejecting_candidate`` is added, replacing ``backtracking``. * The hook is called every time the resolver rejects a conflicting candidate before trying out the next one in line. * Some valid states that were previously rejected are now accepted. This affects states where multiple candidates for the same dependency conflict with each other. The ``information`` argument passed to ``AbstractProvider.get_preference`` may now contain empty iterators. This has always been allowed by the method definition but it was previously not possible in practice. ++++ python-ua-parser: - update to 0.18.0: * handle firefox version without patch segment * remove unnecessary line space * Add Oculus Browser * Add PetalBot ++++ python313-pipx: - Upstream version 1.3.3 - Require python 3.8 or newer ------------------------------------------------------------------ ------------------ 2023-12-7 - Dec 7 2023 ------------------- ------------------------------------------------------------------ ++++ python-Mako: - update to 1.3.0: * Mako 1.3.0 bumps the minimum Python version to 3.8 * Python 3.12 is now supported explicitly. ++++ python-google-auth: - update to 2.25.1: * Fix vm universe_domain bug (#1433) (8683520) * Add custom tls signer for ECP Provider. (39eb287) * Add custom tls signer for ECP Provider. (#1402) (39eb287) * Add with_universe_domain (#1408) (505910c) * Fixes issue where Python37DeprecationWarning cannot be filtered (#1428) (f22f767) * Remove broken link in Python37DeprecationWarning (#1430) * Add support for Python 3.12 (#1421) (307916c) * Add universe domain support for VM cred (#1409) (7ab0fce) * Modify the token refresh window (#1419) (c6af1d6) * Add missing before request to async oauth2 credentials. (#1420) (8eaa878) * Auto create self signed jwt cred (#1418) (6c610a5) * Migrate datetime.utcnow for python 3.12 (#1413) (e4d9c27) * Update user cred doc (#1414) (3f426bc) ++++ python-looseversion: - update to 1.3.0: * Restore Python 3 semantics for `LooseVersion`, creating `LooseVersion2` to restore Python 2 semantics. * Test on Python 3.12 * Enable installation on Python 2+ * Ensure consistent semantics between Python 2 and 3 ------------------------------------------------------------------ ------------------ 2023-12-5 - Dec 5 2023 ------------------- ------------------------------------------------------------------ ++++ python-Sphinx: - avoid xdist - not used by upstream and unstable (and not improving the build time by more than 25%) ++++ libxml2-python: - Update to version 2.12.2: * Regressions: - parser: . Fix invalid free in xmlParseBalancedChunkMemoryRecover . Make CRLF increment line number - globals: Disable TLS in static Windows builds - html: Reenable buggy detection of XML declarations - tree: Fix regression when copying DTDs * Build fixes - build: Disable compiler TLS by default - cmake: Update config.h.cmake.in - tests: Fix tests --with-valid --without-xinclude ------------------------------------------------------------------ ------------------ 2023-12-4 - Dec 4 2023 ------------------- ------------------------------------------------------------------ ++++ python-waitress: - Add BuildRequires on python-setuptools for both flavors. ++++ python-waitress-doc: - Add BuildRequires on python-setuptools for both flavors. ------------------------------------------------------------------ ------------------ 2023-12-1 - Dec 1 2023 ------------------- ------------------------------------------------------------------ ++++ python-Flask-SocketIO: - Add %{?sle15_python_module_pythons} ++++ python-Sphinx: - remove setuptools requires ++++ python-bidict: - Add %{?sle15_python_module_pythons} ++++ python-python-engineio: - Add %{?sle15_python_module_pythons} ++++ python-python-socketio: - Add %{?sle15_python_module_pythons} ------------------------------------------------------------------ ------------------ 2023-11-30 - Nov 30 2023 ------------------- ------------------------------------------------------------------ ++++ pgadmin4: - Changes in the spec file so it can be used in Factory as well as in SLE - Modify the pgadmin4-desktop helper to use PyQt5 instead of PyQt6 since the latter is not available in SLE ++++ python-Flask-Babel: - Add %{?sle15_python_module_pythons} ++++ python-Flask-Compress: - Add %{?sle15_python_module_pythons} - Add %{?sle15_python_module_pythons} ++++ python-Flask-Paranoid: - Add %{?sle15_python_module_pythons} - Add %{?sle15_python_module_pythons} ++++ python-Flask-Security-Too: - Add %{?sle15_python_module_pythons} ++++ libselinux-bindings: - Also build python3-selinux for toolchain compability on SLE ------------------------------------------------------------------ ------------------ 2023-11-28 - Nov 28 2023 ------------------- ------------------------------------------------------------------ ++++ python-cryptography: - Add CVE-2023-49083.patch to fix A null-pointer-dereference and segfault could occur when loading certificates from a PKCS#7 bundle. bsc#1217592 ------------------------------------------------------------------ ------------------ 2023-11-27 - Nov 27 2023 ------------------- ------------------------------------------------------------------ ++++ python-Flask-Security-Too: - Update to 5.3.2: * Update Quickstart to show how to properly handle SQLAlchemy connections. * Auth Token not returned from /tf-validate. * Fix for latest email_validator deprecation - bump minimum to 2.0.0 * Deprecate passing in the anonymous_user class * Compatability with Flask 3.0 * Revert change in 5.3.0 that added a Referrer-Policy header. * Fix 'next' propagation when passed as form.next - Drop patch filterwarnings-ignore-pkg_resources.patch, no longer needed ++++ python-Flask-WTF: - Use %{?sle15_python_module_pythons} - Update to 1.2.1: * Fix a bug introduced with #556 in 1.2.0 where file validators were editing the file fields content. - Update to 1.2.0: * Add field MultipleFileField. FileRequired, FileAllowed, FileSize now can be used to validate multiple files - Update to 1.1.2: * Fixed Flask 2.3 deprecations of werkzeug.urls.url_encode and flask.Markup * Stop support for python 3.7 * Use pyproject.toml instead of setup.cfg * Fixed nested blueprint CSRF exemption - Drop patch already included upstream: * flask-2.3-support.patch ++++ python-WTForms: - Use %{?sle15_python_module_pythons} - Update to 3.1.1: - Display Flags values in their repr. - ~SelectField and SelectMultipleField choices can be None if validate_choice is False - Documentation improvements - Unit tests improvements - Python 3.12 support - Restored support for 3-items tuple return value from iter_choices - Update to 3.1.0: - Documentation improvements - Translation improvements - Implement :class:~fields.ColorField - Delayed import of email_validator. -