Changelog

Python next

Release date: XXXX-XX-XX

Library

  • gh-142783: Fix zoneinfo use-after-free with descriptor _weak_cache. a descriptor as _weak_cache could cause crashes during object creation. The fix ensures proper reference counting for descriptor-provided objects.

  • gh-142594: Fix crash in TextIOWrapper.close() when the underlying buffer’s closed property calls detach().

  • gh-142451: hmac: Ensure that the HMAC.block_size attribute is correctly copied by HMAC.copy. Patch by Bénédikt Tran.

  • gh-142495: collections.defaultdict now prioritizes __setitem__() when inserting default values from default_factory. This prevents race conditions where a default value would overwrite a value set before default_factory returns.

  • gh-142651: unittest.mock: fix a thread safety issue where Mock.call_count may return inaccurate values when the mock is called concurrently from multiple threads.

  • gh-142595: Added type check during initialization of the decimal module to prevent a crash in case of broken stdlib. Patch by Sergey B Kirpichev.

  • gh-142556: Fix crash when a task gets re-registered during finalization in asyncio. Patch by Kumar Aditya.

  • gh-123241: Avoid reference count operations in garbage collection of ctypes objects.

  • gh-112527: The help text for required options in argparse no longer extended with “ (default: None)”.

  • gh-142346: Fix usage formatting for mutually exclusive groups in argparse when they are preceded by positional arguments or followed or intermixed with other optional arguments.

  • gh-142315: Pdb can now run scripts from anonymous pipes used in process substitution. Patch by Bartosz Sławecki.

  • gh-142332: Fix usage formatting for positional arguments in mutually exclusive groups in argparse. in argparse.

  • gh-142282: Fix winreg.QueryValueEx() to not accidentally read garbage buffer under race condition.

  • gh-75949: Fix argparse to preserve | separators in mutually exclusive groups when the usage line wraps due to length.

  • gh-142267: Improve argparse performance by caching the formatter used for argument validation.

  • gh-68552: MisplacedEnvelopeHeaderDefect and Missing header name defects are now correctly passed to the handle_defect method of policy in FeedParser.

  • gh-142006: Fix a bug in the email.policy.default folding algorithm which incorrectly resulted in a doubled newline when a line ending at exactly max_line_length was followed by an unfoldable token.

  • gh-105836: Fix asyncio.run_coroutine_threadsafe() leaving underlying cancelled asyncio task running.

Core and Builtins

  • gh-142737: Tracebacks will be displayed in fallback mode even if io.open() is lost. Previously, this would crash the interpreter. Patch by Bartosz Sławecki.

  • gh-142554: Fix a crash in divmod() when _pylong.int_divmod() does not return a tuple of length two exactly. Patch by Bénédikt Tran.

  • gh-142531: Fix a free-threaded GC performance regression. If there are many untracked tuples, the GC will run too often, resulting in poor performance. The fix is to include untracked tuples in the “long lived” object count. The number of frozen objects is also now included since the free-threaded GC must scan those too.

  • gh-142402: Fix reference counting when adjacent literal parts are merged while constructing string.templatelib.Template, preventing the displaced string object from leaking.

  • gh-133932: Fix crash in the free threading build when clearing frames that hold tagged integers.

  • gh-142343: Fix SIGILL crash on m68k due to incorrect assembly constraint.

  • gh-137007: Fix a bug during JIT compilation failure which caused garbage collection debug assertions to fail.

C API

Build

  • gh-142454: When calculating the digest of the JIT stencils input, sort the hashed files by filenames before adding their content to the hasher. This ensures deterministic hash input and hence deterministic hash, independent on filesystem order.

  • gh-141808: When running make clean-retain-profile, keep the generated JIT stencils. That way, the stencils are not generated twice when Profile-guided optimization (PGO) is used. It also allows distributors to supply their own pre-built JIT stencils.

  • gh-138061: Ensure reproducible builds by making JIT stencil header generation deterministic.

Python 3.14.2 final

Release date: 2025-12-05

Security

  • gh-142145: Remove quadratic behavior in xml.minidom node ID cache clearing.

  • gh-119452: Fix a potential memory denial of service in the http.server module. When a malicious user is connected to the CGI server on Windows, it could cause an arbitrary amount of memory to be allocated. This could have led to symptoms including a MemoryError, swapping, out of memory (OOM) killed processes or containers, or even system crashes.

Library

  • gh-140797: Revert changes to the undocumented re.Scanner class. Capturing groups are still allowed for backward compatibility, although using them can lead to incorrect result. They will be forbidden in future Python versions.

  • gh-142206: The resource tracker in the multiprocessing module now uses the original communication protocol, as in Python 3.14.0 and below, by default. This avoids issues with upgrading Python while it is running. (Note that such ‘in-place’ upgrades are not tested.) The tracker remains compatible with subprocesses that use new protocol (that is, subprocesses using Python 3.13.10, 3.14.1 and 3.15).

  • gh-142214: Fix two regressions in dataclasses in Python 3.14.1 related to annotations.

    • An exception is no longer raised if slots=True is used and the __init__ method does not have an __annotate__ attribute (likely because init=False was used).

    • An exception is no longer raised if annotations are requested on the __init__ method and one of the fields is not present in the class annotations. This can occur in certain dynamic scenarios.

    Patch by Jelle Zijlstra.

Core and Builtins

  • gh-142218: Fix crash when inserting into a split table dictionary with a non str key that matches an existing key.

Library

  • gh-116738: Fix cmath data race when initializing trigonometric tables with subinterpreters.

Python 3.14.1 final

Release date: 2025-12-02

Windows

  • gh-139810: Installing with py install 3[.x]-dev will now select final versions as well as prereleases.

Tools/Demos

  • gh-141692: Each slice of an iOS XCframework now contains a lib folder that contains a symlink to the libpython dylib. This allows binary modules to be compiled for iOS using dynamic libreary linking, rather than Framework linking.

  • gh-141442: The iOS testbed now correctly handles test arguments that contain spaces.

  • gh-140702: The iOS testbed app will now expose the GITHUB_ACTIONS environment variable to iOS apps being tested.

  • gh-137484: Have Tools/wasm/wasi put the build Python into a directory named after the build triple instead of “build”.

  • gh-137248: Add a --logdir option to Tools/wasm/wasi for specifying where to write log files.

  • gh-137243: Have Tools/wasm/wasi detect a WASI SDK install in /opt when it was directly extracted from a release tarball.

Tests

  • gh-140482: Preserve and restore the state of stty echo as part of the test environment.

  • gh-140082: Update python -m test to set FORCE_COLOR=1 when being run with color enabled so that unittest which is run by it with redirected output will output in color.

  • gh-139208: Fix regrtest --fast-ci --verbose: don’t ignore the --verbose option anymore. Patch by Victor Stinner.

  • gh-136442: Use exitcode 1 instead of 5 if unittest.TestCase.setUpClass() raises an exception

Security

  • gh-139700: Check consistency of the zip64 end of central directory record. Support records with “zip64 extensible data” if there are no bytes prepended to the ZIP file.

  • gh-139283: sqlite3: correctly handle maximum number of rows to fetch in Cursor.fetchmany and reject negative values for Cursor.arraysize. Patch by Bénédikt Tran.

  • gh-137836: Add support of the “plaintext” element, RAWTEXT elements “xmp”, “iframe”, “noembed” and “noframes”, and optionally RAWTEXT element “noscript” in html.parser.HTMLParser.

  • gh-136063: email.message: ensure linear complexity for legacy HTTP parameters parsing. Patch by Bénédikt Tran.

  • gh-136065: Fix quadratic complexity in os.path.expandvars().

  • gh-119451: Fix a potential memory denial of service in the http.client module. When connecting to a malicious server, it could cause an arbitrary amount of memory to be allocated. This could have led to symptoms including a MemoryError, swapping, out of memory (OOM) killed processes or containers, or even system crashes.

  • gh-119342: Fix a potential memory denial of service in the plistlib module. When reading a Plist file received from untrusted source, it could cause an arbitrary amount of memory to be allocated. This could have led to symptoms including a MemoryError, swapping, out of memory (OOM) killed processes or containers, or even system crashes.

Library

IDLE

  • gh-96491: Deduplicate version number in IDLE shell title bar after saving to a file.

  • gh-139742: Colorize t-string prefixes for template strings in IDLE, as done for f-string prefixes.

Documentation

Core and Builtins

  • gh-142048: Fix quadratically increasing garbage collection delays in free-threaded build.

Library

  • gh-116738: Fix thread safety issue with re scanner objects in free-threaded builds.

Core and Builtins

  • gh-141930: When importing a module, use Python’s regular file object to ensure that writes to .pyc files are complete or an appropriate error is raised.

  • gh-120158: Fix inconsistent state when enabling or disabling monitoring events too many times.

  • gh-139653: Only raise a RecursionError or trigger a fatal error if the stack pointer is both below the limit pointer and above the stack base. If outside of these bounds assume that it is OK. This prevents false positives when user-space threads swap stacks.

  • gh-139103: Improve multithreaded scaling of dataclasses on the free-threaded build.

  • gh-141579: Fix sys.activate_stack_trampoline() to properly support the perf_jit backend. Patch by Pablo Galindo.

  • gh-114203: Skip locking if object is already locked by two-mutex critical section.

  • gh-141528: Suggest using concurrent.interpreters.Interpreter.close() instead of the private _interpreters.destroy function when warning about remaining subinterpreters. Patch by Sergey Miryanov.

  • gh-141312: Fix the assertion failure in the __setstate__ method of the range iterator when a non-integer argument is passed. Patch by Sergey Miryanov.

Library

Core and Builtins

Library

  • gh-140260: Fix struct data race in endian table initialization with subinterpreters. Patch by Shamil Abdulaev.

Core and Builtins

Library

Core and Builtins

  • gh-140406: Fix memory leak when an object’s __hash__() method returns an object that isn’t an int.

  • gh-140358: Restore elapsed time and unreachable object count in GC debug output. These were inadvertently removed during a refactor of gc.c. The debug log now again reports elapsed collection time and the number of unreachable objects. Contributed by Pål Grønås Drange.

  • gh-140306: Fix memory leaks in cross-interpreter channel operations and shared namespace handling.

  • gh-140301: Fix memory leak of PyConfig in subinterpreters.

  • gh-140257: Fix data race between interpreter_clear() and take_gil() on eval_breaker during finalization with daemon threads.

  • gh-139951: Fixes a regression in GC performance for a growing heap composed mostly of small tuples.

    • Counts number of actually tracked objects, instead of trackable objects. This ensures that untracking tuples has the desired effect of reducing GC overhead.

    • Does not track most untrackable tuples during creation. This prevents large numbers of small tuples causing excessive GCs.

  • gh-140104: Fix a bug with exception handling in the JIT. Patch by Ken Jin. Bug reported by Daniel Diniz.

  • gh-140061: Fixing the checking of whether an object is uniquely referenced to ensure free-threaded compatibility. Patch by Sergey Miryanov.

  • gh-140067: Fix memory leak in sub-interpreter creation.

  • gh-140000: Fix potential memory leak when a reference cycle exists between an instance of typing.TypeAliasType, typing.TypeVar, typing.ParamSpec, or typing.TypeVarTuple and its __name__ attribute. Patch by Mikhail Efimov.

  • gh-139914: Restore support for HP PA-RISC, which has an upwards-growing stack.

  • gh-139988: Fix a memory leak when failing to create a Union type. Patch by Bénédikt Tran.

  • gh-139748: Fix reference leaks in error branches of functions accepting path strings or bytes such as compile() and os.system(). Patch by Bénédikt Tran.

  • gh-139516: Fix lambda colon erroneously start format spec in f-string in tokenizer.

  • gh-139640: ast.parse() no longer emits syntax warnings for return/break/continue in finally (see PEP 765) – they are only emitted during compilation.

  • gh-139640: Fix swallowing some syntax warnings in different modules if they accidentally have the same message and are emitted from the same line. Fix duplicated warnings in the finally block.

  • gh-63161: Support non-UTF-8 shebang and comments in Python source files if non-UTF-8 encoding is specified. Detect decoding error in comments for default (UTF-8) encoding. Show the line and position of decoding error for default encoding in a traceback. Show the line containing the coding cookie when it conflicts with the BOM in a traceback.

Library

Core and Builtins

  • gh-138558: Fix handling of unusual t-string annotations in annotationlib. Patch by Dave Peck.

  • gh-134466: Don’t run PyREPL in a degraded environment where setting termios attributes is not allowed.

  • gh-138944: Fix