head	1.17;
access;
symbols
	pkgsrc-2026Q3:1.17.0.2
	pkgsrc-2026Q3-base:1.17
	pkgsrc-2026Q2:1.16.0.4
	pkgsrc-2026Q2-base:1.16
	pkgsrc-2026Q1:1.16.0.2
	pkgsrc-2026Q1-base:1.16
	pkgsrc-2025Q4:1.15.0.2
	pkgsrc-2025Q4-base:1.15
	pkgsrc-2025Q3:1.14.0.4
	pkgsrc-2025Q3-base:1.14
	pkgsrc-2025Q2:1.14.0.2
	pkgsrc-2025Q2-base:1.14
	pkgsrc-2025Q1:1.12.0.4
	pkgsrc-2025Q1-base:1.12
	pkgsrc-2024Q4:1.12.0.2
	pkgsrc-2024Q4-base:1.12
	pkgsrc-2024Q3:1.11.0.2
	pkgsrc-2024Q3-base:1.11
	pkgsrc-2024Q2:1.10.0.2
	pkgsrc-2024Q2-base:1.10
	pkgsrc-2024Q1:1.9.0.2
	pkgsrc-2024Q1-base:1.9
	pkgsrc-2023Q4:1.8.0.2
	pkgsrc-2023Q4-base:1.8
	pkgsrc-2023Q3:1.6.0.2
	pkgsrc-2023Q3-base:1.6
	pkgsrc-2023Q2:1.5.0.2
	pkgsrc-2023Q2-base:1.5
	pkgsrc-2023Q1:1.3.0.2
	pkgsrc-2023Q1-base:1.3
	pkgsrc-2022Q4:1.2.0.2
	pkgsrc-2022Q4-base:1.2;
locks; strict;
comment	@# @;


1.17
date	2026.08.13.12.26.36;	author adam;	state Exp;
branches;
next	1.16;
commitid	uK5mcbH3OK1PstRG;

1.16
date	2026.03.04.06.51.45;	author adam;	state Exp;
branches;
next	1.15;
commitid	YGZczgUfr9NLOCwG;

1.15
date	2025.10.10.12.57.12;	author adam;	state Exp;
branches;
next	1.14;
commitid	nJ7VhcBRGcs4v1eG;

1.14
date	2025.06.04.14.14.17;	author adam;	state Exp;
branches;
next	1.13;
commitid	QGsnv8s0FZxH2AXF;

1.13
date	2025.04.09.14.47.58;	author adam;	state Exp;
branches;
next	1.12;
commitid	0IRavEVzlaBB1oQF;

1.12
date	2024.12.05.07.51.12;	author adam;	state Exp;
branches;
next	1.11;
commitid	aVLjViiPBheYJhAF;

1.11
date	2024.09.09.15.50.30;	author adam;	state Exp;
branches;
next	1.10;
commitid	pNKjnwfx6xQHb9pF;

1.10
date	2024.04.08.12.49.33;	author adam;	state Exp;
branches;
next	1.9;
commitid	81Mu3aXP9tch8l5F;

1.9
date	2024.02.07.08.02.11;	author adam;	state Exp;
branches;
next	1.8;
commitid	xBoC3o5ZZmjuvtXE;

1.8
date	2023.12.11.10.23.43;	author adam;	state Exp;
branches;
next	1.7;
commitid	sjBbPNM5hn6B92QE;

1.7
date	2023.10.02.19.59.04;	author adam;	state Exp;
branches;
next	1.6;
commitid	i3hUMTWH7gatA5HE;

1.6
date	2023.08.25.08.28.22;	author adam;	state Exp;
branches;
next	1.5;
commitid	mw3wi7aDwRq4Z8CE;

1.5
date	2023.06.08.10.04.26;	author adam;	state Exp;
branches;
next	1.4;
commitid	JBWxLUIUyv9V18sE;

1.4
date	2023.04.06.11.30.37;	author adam;	state Exp;
branches;
next	1.3;
commitid	R8CnuF9kkk6Mw2kE;

1.3
date	2023.02.09.10.48.15;	author adam;	state Exp;
branches;
next	1.2;
commitid	7KlrD9YLEJvN5QcE;

1.2
date	2022.12.07.11.55.37;	author adam;	state Exp;
branches;
next	1.1;
commitid	FjXv9wnktKcgwC4E;

1.1
date	2022.10.31.09.50.40;	author adam;	state Exp;
branches;
next	;
commitid	dJ2usVQFvHvi1RZD;


desc
@@


1.17
log
@python311 py311-html-docs: updated to 3.11.16

3.11.16

macOS
gh-137586: Invoke osascript with absolute path in webbrowser and turtledemo.
Tests
gh-149776: Fix test_socket on Linux kernel 7.1 and newer: skip UDP Lite tests if it’s not supported. Patch by Victor Stinner.
Security
gh-155558: Update bundled libexpat to version 2.8.3 for the fix to CVE-2026-72522.
gh-153030: Fixed quadratic complexity in incremental parsing of long unterminated constructs (such as tags or comments) in html.parser.HTMLParser, which could be exploited for a denial of service.
gh-152674: The xml.etree.ElementTree.Element methods findall(), iterfind() and find() avoid quadratic behavior when using XPath index predicates ([1], [last()], [last()-N]) on XML documents with many same-tag siblings.
gh-152216: Update bundled libexpat to version 2.8.2.
gh-151987: The tarfile.TarFile.extract() method now applies the given filter when it extracts a link target from the archive as a fallback.
gh-151981: In tarfile, seeking a stream now stops when end of the stream is reached.
gh-151544: Modules/Setup.local is no longer used as a landmark to discover whether Python is running in a source tree, as it could potentially affect actual installs. The pybuilddir.txt file is now the sole indicator of running in a source tree.
gh-151558: Fixed an vulnerability in the tarfile data and tar extraction filters where crafted archives could create a symlink pointing outside the destination directory. This was a bypass of CVE-2025-4330.
gh-150599: Fix a possible stack buffer overflow in bz2 when a bz2.BZ2Decompressor is reused after a decompression error. The decompressor now becomes unusable after libbz2 reports an error.
gh-150743: http.client now limits the number of chunked-response trailer lines it will read to 100, and the number of interim (1xx) responses it will skip to 100. A malicious or broken server could previously stream trailer lines or 100 Continue responses forever, hanging the client even when a socket timeout was in use. Reported by @@YLChen-007 via GHSA-w4q2-g22w-6fr4.
gh-149698: Update bundled libexpat to version 2.8.1 for the fix for CVE-2026-45186.
gh-87451: The ftplib module’s undocumented ftpcp function no longer trusts the IPv4 address value returned from the source server in response to the PASV command by default, completing the fix for CVE-2021-4189. As with ftplib.FTP, the former behavior can be re-enabled by setting the trust_server_pasv_ipv4_address attribute on the source ftplib.FTP instance to True. Thanks to Qi Deng at Aurascape AI for the report.
gh-149486: tarfile.data_filter() now validates link targets using the same normalised value that is written to disk, strips trailing separators from the member name when resolving a symlink’s directory, and rejects link members that would replace the destination directory itself. This closes several path-traversal bypasses of the data extraction filter.
gh-149079: Fix a potential denial of service in unicodedata.normalize(). The canonical ordering step of Unicode normalization used a quadratic-time insertion sort for reordering combining characters, which could be exploited with crafted input containing many combining characters in non-canonical order. Replaced with a linear-time counting sort for long runs.
gh-149018: Improved protection against XML hash-flooding attacks in xml.parsers.expat and xml.etree.ElementTree when Python is compiled with libExpat 2.8.0 or later.
gh-149017: Update bundled libexpat to version 2.8.0.
gh-148808: Added buffer boundary check when using nbytes parameter with asyncio.AbstractEventLoop.sock_recvfrom_into(). Only relevant for Windows and the asyncio.ProactorEventLoop.
gh-148395: Fix a dangling input pointer in lzma.LZMADecompressor, and bz2.BZ2Decompressor when memory allocation fails with MemoryError, which could let a subsequent decompress() call read or write through a stale pointer to the already-released caller buffer.
gh-148169: A bypass in webbrowser allowed URLs prefixed with %action to pass the dash-prefix safety check.
gh-146581: Fix vulnerability in shutil.unpack_archive() for ZIP files on Windows which allowed to write files outside of the destination tree if the patch in the archive contains a Windows drive prefix. Now such invalid paths will be skipped. Files containing “..” in the name (like “foo..bar”) are no longer skipped.
gh-146333: Fix quadratic backtracking in configparser.RawConfigParser option parsing regexes (OPTCRE and OPTCRE_NV). A crafted configuration line with many whitespace characters could cause excessive CPU usage.
gh-146211: Reject CR/LF characters in tunnel request headers for the HTTPConnection.set_tunnel() method.
gh-145986: xml.parsers.expat: Fixed a crash caused by unbounded C recursion when converting deeply nested XML content models with ElementDeclHandler(). This addresses CVE-2026-4224.
gh-145599: Reject control characters in http.cookies.Morsel update() and js_output(). This addresses CVE-2026-3644.
gh-145506: Fixes CVE-2026-2297 by ensuring that SourcelessFileLoader uses io.open_code() when opening .pyc files.
gh-144370: Disallow usage of control characters in status in wsgiref.handlers to prevent HTTP header injections. Patch by Benedikt Johannes.
gh-143930: Reject leading dashes in URLs passed to webbrowser.open().
gh-143927: Normalize all line endings (CR, CRLF, and LF) to LF+TAB when writing multi-line configparser values.
Library
gh-109638: Fix exponential time in csv.Sniffer.sniff() for a sample which contains many quote characters. A doubled quote character is now also detected in a field which contains the delimiter or a line break.
gh-98820: Fix quadratic time in csv.Sniffer.sniff() for a sample which contains quoted fields, in particular for a single column of quoted fields.
gh-149231: In tomllib, the number of parts in TOML keys is now limited.
gh-146083: Update bundled libexpat to version 2.7.5.
gh-141707: Don’t change tarfile.TarInfo type from AREGTYPE to DIRTYPE when parsing GNU long name or link headers.
gh-90949: Add SetBillionLaughsAttackProtectionActivationThreshold() and SetBillionLaughsAttackProtectionMaximumAmplification() to xmlparser objects to tune protections against billion laughs attacks. Patch by Bénédikt Tran.
gh-100372: ssl.SSLContext.load_verify_locations() no longer incorrectly accepts some cases of trailing data when parsing DER.
Build
gh-153438: Update Windows build and installer tooling and documentation to use the current download URL for nuget.exe.
@
text
@# $NetBSD: Makefile,v 1.16 2026/03/04 06:51:45 adam Exp $

VERS=		3.11.16
DISTNAME=	python-${VERS}-docs-html
PKGNAME=	py311-html-docs-${VERS}
CATEGORIES=	lang python
MASTER_SITES=	https://www.python.org/ftp/python/doc/${VERS}/
EXTRACT_SUFX=	.tar.bz2

MAINTAINER=	leot@@NetBSD.org
HOMEPAGE=	https://www.python.org/doc/
COMMENT=	HTML documentation for Python 3.11
LICENSE=	python-software-foundation

USE_TOOLS+=	pax

NO_CONFIGURE=	yes
NO_BUILD=	yes

HTMLDIR=	share/doc/python3.11

INSTALLATION_DIRS=	${HTMLDIR}

do-install:
	cd ${WRKSRC} && ${PAX} -rw -pp . ${DESTDIR}${PREFIX}/${HTMLDIR}

.include "../../mk/bsd.pkg.mk"
@


1.16
log
@python311 py311-html-docs: updated to 3.11.15

Python 3.11.15

Security

gh-144125: BytesGenerator will now refuse to serialize (write) headers that are unsafely folded or delimited; see verify_generated_headers. (Contributed by Bas Bloemsaat and Petr Viktorin in gh-121650).
gh-143935: Fixed a bug in the folding of comments when flattening an email message using a modern email policy. Comments consisting of a very long sequence of non-foldable characters could trigger a forced line wrap that omitted the required leading space on the continuation line, causing the remainder of the comment to be interpreted as a new header field. This enabled header injection with carefully crafted inputs.
gh-143925: Reject control characters in data: URL media types.
gh-143919: Reject control characters in http.cookies.Morsel fields and values.
gh-143916: Reject C0 control characters within wsgiref.headers.Headers fields, values, and parameters.
gh-142145: Remove quadratic behavior in xml.minidom node ID cache clearing. In order to do this without breaking existing users, we also add the ownerDocument attribute to xml.dom.minidom elements and attributes created by directly instantiating the Element or Attr class. Note that this way of creating nodes is not supported; creator functions like xml.dom.Document.documentElement() should be used instead.
gh-137836: Add support of the “plaintext” element, RAWTEXT elements “xmp”, “iframe”, “noembed” and “noframes”, and optionally RAWTEXT element “noscript” in html.parser.HTMLParser.
gh-136063: email.message: ensure linear complexity for legacy HTTP parameters parsing. Patch by Bénédikt Tran.
gh-136065: Fix quadratic complexity in os.path.expandvars().
gh-119451: Fix a potential memory denial of service in the http.client module. When connecting to a malicious server, it could cause an arbitrary amount of memory to be allocated. This could have led to symptoms including a MemoryError, swapping, out of memory (OOM) killed processes or containers, or even system crashes.
gh-119452: Fix a potential memory denial of service in the http.server module. When a malicious user is connected to the CGI server on Windows, it could cause an arbitrary amount of memory to be allocated. This could have led to symptoms including a MemoryError, swapping, out of memory (OOM) killed processes or containers, or even system crashes.
gh-119342: Fix a potential memory denial of service in the plistlib module. When reading a Plist file received from untrusted source, it could cause an arbitrary amount of memory to be allocated. This could have led to symptoms including a MemoryError, swapping, out of memory (OOM) killed processes or containers, or even system crashes.

Library

gh-144833: Fixed a use-after-free in ssl when SSL_new() returns NULL in newPySSLSocket(). The error was reported via a dangling pointer after the object had already been freed.
gh-144363: Update bundled libexpat to 2.7.4
gh-90949: Add SetAllocTrackerActivationThreshold() and SetAllocTrackerMaximumAmplification() to xmlparser objects to prevent use of disproportional amounts of dynamic memory from within an Expat parser. Patch by Bénédikt Tran.

Core and Builtins

gh-120384: Fix an array out of bounds crash in list_ass_subscript, which could be invoked via some specificly tailored input: including concurrent modification of a list object, where one thread assigns a slice and another clears it.
gh-120298: Fix use-after free in list_richcompare_impl which can be invoked via some specificly tailored evil input.
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.15 2025/10/10 12:57:12 adam Exp $
d3 1
a3 1
VERS=		3.11.15
@


1.15
log
@python311 py311-html-docs: updated to 3.11.14

Python 3.11.14

Security

gh-139700: Check consistency of the zip64 end of central directory record. Support records with “zip64 extensible data” if there are no bytes prepended to the ZIP file.
gh-139400: xml.parsers.expat: Make sure that parent Expat parsers are only garbage-collected once they are no longer referenced by subparsers created by ExternalEntityParserCreate(). Patch by Sebastian Pipping.
gh-135661: Fix parsing start and end tags in html.parser.HTMLParser according to the HTML5 standard.
Whitespaces no longer accepted between </ and the tag name. E.g. </ script> does not end the script section.
Vertical tabulation (\v) and non-ASCII whitespaces no longer recognized as whitespaces. The only whitespaces are \t\n\r\f and space.
Null character (U+0000) no longer ends the tag name.
Attributes and slashes after the tag name in end tags are now ignored, instead of terminating after the first > in quoted attribute value. E.g. </script/foo=">"/>.
Multiple slashes and whitespaces between the last attribute and closing > are now ignored in both start and end tags. E.g. <a foo=bar/ //>.
Multiple = between attribute name and value are no longer collapsed. E.g. <a foo==bar> produces attribute “foo” with value “=bar”.
gh-135661: Fix CDATA section parsing in html.parser.HTMLParser according to the HTML5 standard: ] ]> and ]] > no longer end the CDATA section. Add private method _set_support_cdata() which can be used to specify how to parse <[CDATA[ — as a CDATA section in foreign content (SVG or MathML) or as a bogus comment in the HTML namespace.
gh-102555: Fix comment parsing in html.parser.HTMLParser according to the HTML5 standard. --!> now ends the comment. -- > no longer ends the comment. Support abnormally ended empty comments <--> and <--->.
gh-135462: Fix quadratic complexity in processing specially crafted input in html.parser.HTMLParser. End-of-file errors are now handled according to the HTML5 specs – comments and declarations are automatically closed, tags are ignored.
gh-118350: Fix support of escapable raw text mode (elements “textarea” and “title”) in html.parser.HTMLParser.
gh-86155: html.parser.HTMLParser.close() no longer loses data when the <script> tag is not closed. Patch by Waylan Limberg.

Library

gh-139312: Upgrade bundled libexpat to 2.7.3
gh-138998: Update bundled libexpat to 2.7.2
gh-130577: tarfile now validates archives to ensure member offsets are non-negative. (Contributed by Alexander Enrique Urieles Nieto in gh-130577.)
gh-135374: Update the bundled copy of setuptools to 79.0.1.
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.14 2025/06/04 14:14:17 adam Exp $
d3 1
a3 1
VERS=		3.11.14
@


1.14
log
@python311 py311-html-docs: updated to 3.11.13

Python 3.11.13 final

Security

gh-135034: Fixes multiple issues that allowed tarfile extraction filters (filter="data" and filter="tar") to be bypassed using crafted symlinks and hard links.

Addresses CVE 2024-12718, CVE 2025-4138, CVE 2025-4330, and CVE 2025-4517.

gh-133767: Fix use-after-free in the “unicode-escape” decoder with a non-“strict” error handler.

gh-128840: Short-circuit the processing of long IPv6 addresses early in ipaddress to prevent excessive memory consumption and a minor denial-of-service.

Library

gh-128840: Fix parsing long IPv6 addresses with embedded IPv4 address.
gh-134062: ipaddress: fix collisions in __hash__() for IPv4Network and IPv6Network objects.
gh-123409: Fix ipaddress.IPv6Address.reverse_pointer output according to RFC 3596, §2.5. Patch by Bénédikt Tran.
bpo-43633: Improve the textual representation of IPv4-mapped IPv6 addresses (RFC 4291 Sections 2.2, 2.5.5.2) in ipaddress. Patch by Oleksandr Pavliuk.
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.13 2025/04/09 14:47:58 adam Exp $
d3 1
a3 1
VERS=		3.11.13
@


1.13
log
@python311 py311-html-docs: updated to 3.11.12

Python 3.11.12 final

Security

gh-131809: Update bundled libexpat to 2.7.1
gh-131261: Upgrade to libexpat 2.7.0
gh-105704: When using urllib.parse.urlsplit() and urllib.parse.urlparse() host parsing would not reject domain names containing square brackets ([ and ]). Square brackets are only valid for IPv6 and IPvFuture hosts according to RFC 3986 Section 3.2.2.
gh-121284: Fix bug in the folding of rfc2047 encoded-words when flattening an email message using a modern email policy. Previously when an encoded-word was too long for a line, it would be decoded, split across lines, and re-encoded. But commas and other special characters in the original text could be left unencoded and unquoted. This could theoretically be used to spoof header lines using a carefully constructed encoded-word if the resulting rendered email was transmitted or re-parsed.
gh-80222: Fix bug in the folding of quoted strings when flattening an email message using a modern email policy. Previously when a quoted string was folded so that it spanned more than one line, the surrounding quotes and internal escapes would be omitted. This could theoretically be used to spoof header lines using a carefully constructed quoted string if the resulting rendered email was transmitted or re-parsed.
gh-119511: Fix a potential denial of service in the imaplib module. When connecting to a malicious server, it could cause an arbitrary amount of memory to be allocated. On many systems this is harmless as unused virtual memory is only a mapping, but if this hit a virtual address size limit it could lead to a MemoryError or other process crash. On unusual systems or builds where all allocated memory is touched and backed by actual ram or storage it could’ve consumed resources doing so until similarly crashing.

Library

gh-127257: In ssl, system call failures that OpenSSL reports using ERR_LIB_SYS are now raised as OSError.

Documentation

gh-121277: Writers of CPython’s documentation can now use next as the version for the versionchanged, versionadded, deprecated directives.

C API

gh-106883: Disable GC during the _PyThread_CurrentFrames() and _PyThread_CurrentExceptions() calls to avoid the interpreter to deadlock.
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.12 2024/12/05 07:51:12 adam Exp $
d3 1
a3 1
VERS=		3.11.12
@


1.12
log
@python311 py311-html-docs: updated to 3.11.11

Python 3.11.11

Tools/Demos

gh-123418: Update GitHub CI workflows to use OpenSSL 3.0.15 and multissltests to use 3.0.15, 3.1.7, and 3.2.3.

Tests

gh-125041: Re-enable skipped tests for zlib on the s390x architecture: only skip checks of the compressed bytes, which can be different between zlib’s software implementation and the hardware-accelerated implementation.

Security

gh-126623: Upgrade libexpat to 2.6.4
gh-122792: Changed IPv4-mapped ipaddress.IPv6Address to consistently use the mapped IPv4 address value for deciding properties. Properties which have their behavior fixed are is_multicast, is_reserved, is_link_local, is_global, and is_unspecified.

Library

gh-124651: Properly quote template strings in venv activation scripts.
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.11 2024/09/09 15:50:30 adam Exp $
d3 1
a3 1
VERS=		3.11.11
@


1.11
log
@python311 py311-html-docs: updated to 3.11.10

Python 3.11.10 final

Windows

gh-123418: Updated Windows build to use OpenSSL 3.0.15.
gh-119690: Fixes data type confusion in audit event raised by _winapi.CreateNamedPipe.

Security

gh-123678: Upgrade libexpat to 2.6.3

gh-121957: Fixed missing audit events around interactive use of Python, now also properly firing for python -i, as well as for python -m asyncio. The event in question is cpython.run_stdin.

gh-122133: Authenticate the socket connection for the socket.socketpair() fallback on platforms where AF_UNIX is not available like Windows.

Patch by Gregory P. Smith <greg@@krypto.org> and Seth Larson <seth@@python.org>. Reported by Ellie <el@@horse64.org>

gh-121285: Remove backtracking from tarfile header parsing for hdrcharset, PAX, and GNU sparse headers.

gh-118486: os.mkdir() on Windows now accepts mode of 0o700 to restrict the new directory to the current user. This fixes CVE-2024-4030 affecting tempfile.mkdtemp() in scenarios where the base temporary directory is more permissive than the default.

gh-116741: Update bundled libexpat to 2.6.2

Library

gh-123270: Applied a more surgical fix for malformed payloads in zipfile.Path causing infinite loops (gh-122905) without breaking contents using legitimate characters.

gh-123067: Fix quadratic complexity in parsing "-quoted cookie values with backslashes by http.cookies.

gh-122905: zipfile.Path objects now sanitize names from the zipfile.

gh-121650: email headers with embedded newlines are now quoted on output. The generator will now refuse to serialize (write) headers that are unsafely folded or delimited; see verify_generated_headers. (Contributed by Bas Bloemsaat and Petr Viktorin in gh-121650.)

gh-119506: Fix io.TextIOWrapper.write() method breaks internal buffer when the method is called again during flushing internal buffer.

gh-118643: Fix an AttributeError in the email module when re-fold a long address list. Also fix more cases of incorrect encoding of the address separator in the address list.

gh-113171: Fixed various false positives and false negatives in

ipaddress.IPv4Address.is_private (see these docs for details)
ipaddress.IPv4Address.is_global
ipaddress.IPv6Address.is_private
ipaddress.IPv6Address.is_global
Also in the corresponding ipaddress.IPv4Network and ipaddress.IPv6Network attributes.

gh-102988: email.utils.getaddresses() and email.utils.parseaddr() now return ('', '') 2-tuples in more situations where invalid email addresses are encountered instead of potentially inaccurate values. Add optional strict parameter to these two functions: use strict=False to get the old behavior, accept malformed inputs. getattr(email.utils, 'supports_strict_parsing', False) can be use to check if the strict paramater is available. Patch by Thomas Dwyer and Victor Stinner to improve the CVE-2023-27043 fix.

gh-67693: Fix urllib.parse.urlunparse() and urllib.parse.urlunsplit() for URIs with path starting with multiple slashes and no authority. Based on patch by Ashwin Ramaswami.

Core and Builtins

gh-112275: A deadlock involving pystate.c’s HEAD_LOCK in posixmodule.c at fork is now fixed. Patch by ChuBoning based on previous Python 3.12 fix by Victor Stinner.
gh-109120: Added handle of incorrect star expressions, e.g f(3, *). Patch by Grigoryev Semyon
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.10 2024/04/08 12:49:33 adam Exp $
d3 1
a3 1
VERS=		3.11.10
@


1.10
log
@python311 py311-html-docs: updated to 3.11.9

Python 3.11.9 final
Release date: 2024-04-02

Security

gh-115398: Allow controlling Expat >=2.6.0 reparse deferral (CVE-2023-52425) by adding five new methods:
xml.etree.ElementTree.XMLParser.flush()
xml.etree.ElementTree.XMLPullParser.flush()
xml.parsers.expat.xmlparser.GetReparseDeferralEnabled()
xml.parsers.expat.xmlparser.SetReparseDeferralEnabled()
xml.sax.expatreader.ExpatParser.flush()
gh-115399: Update bundled libexpat to 2.6.0
gh-115243: Fix possible crashes in collections.deque.index() when the deque is concurrently modified.
gh-114572: ssl.SSLContext.cert_store_stats() and ssl.SSLContext.get_ca_certs() now correctly lock access to the certificate store, when the ssl.SSLContext is shared across multiple threads.

Core and Builtins

gh-116296: Fix possible refleak in object.__reduce__() internal error handling.
gh-116034: Fix location of the error on a failed assertion.
gh-115823: Properly calculate error ranges in the parser when raising SyntaxError exceptions caused by invalid byte sequences. Patch by Pablo Galindo
gh-112087: For an empty reverse iterator for list will be reduced to reversed(). Patch by Donghee Na.
gh-115011: Setters for members with an unsigned integer type now support the same range of valid values for objects that has a __index__() method as for int.
gh-96497: Fix incorrect resolution of mangled class variables used in assignment expressions in comprehensions.

Library

gh-117310: Fixed an unlikely early & extra Py_DECREF triggered crash in ssl when creating a new _ssl._SSLContext if CPython was built implausibly such that the default cipher list is empty or the SSL library it was linked against reports a failure from its C SSL_CTX_set_cipher_list() API.

gh-117178: Fix regression in lazy loading of self-referential modules, introduced in gh-114781.

gh-117084: Fix zipfile extraction for directory entries with the name containing backslashes on Windows.

gh-117110: Fix a bug that prevents subclasses of typing.Any to be instantiated with arguments. Patch by Chris Fu.

gh-90872: On Windows, subprocess.Popen.wait() no longer calls WaitForSingleObject() with a negative timeout: pass 0 ms if the timeout is negative. Patch by Victor Stinner.

gh-116957: configparser: Don’t leave ConfigParser values in an invalid state (stored as a list instead of a str) after an earlier read raised DuplicateSectionError or DuplicateOptionError.

gh-90095: Ignore empty lines and comments in .pdbrc

gh-116764: Restore support of None and other false values in urllib.parse functions parse_qs() and parse_qsl(). Also, they now raise a TypeError for non-zero integers and non-empty sequences.

gh-116811: In PathFinder.invalidate_caches, delegate to MetadataPathFinder.invalidate_caches.

gh-116600: Fix repr() for global Flag members.

gh-116484: Change automatically generated tkinter.Checkbutton widget names to avoid collisions with automatically generated tkinter.ttk.Checkbutton widget names within the same parent widget.

gh-116401: Fix blocking os.fwalk() and shutil.rmtree() on opening named pipe.

gh-116143: Fix a race in pydoc _start_server, eliminating a window in which _start_server can return a thread that is “serving” but without a docserver set.

gh-116325: typing: raise SyntaxError instead of AttributeError on forward references as empty strings.

gh-90535: Fix support of interval values > 1 in logging.TimedRotatingFileHandler for when='MIDNIGHT' and when='Wx'.

gh-115978: Disable preadv(), readv(), pwritev(), and writev() on WASI.

Under wasmtime for WASI 0.2, these functions don’t pass test_posix (https://github.com/bytecodealliance/wasmtime/issues/7830).

gh-88352: Fix the computation of the next rollover time in the logging.TimedRotatingFileHandler handler. computeRollover() now always returns a timestamp larger than the specified time and works correctly during the DST change. doRollover() no longer overwrite the already rolled over file, saving from data loss when run at midnight or during repeated time at the DST change.

gh-87115: Set __main__.__spec__ to None when running a script with pdb

gh-76511: Fix UnicodeEncodeError in email.Message.as_string() that results when a message that claims to be in the ascii character set actually has non-ascii characters. Non-ascii characters are now replaced with the U+FFFD replacement character, like in the replace error handler.

gh-75988: Fixed unittest.mock.create_autospec() to pass the call through to the wrapped object to return the real result.

gh-115881: Fix issue where ast.parse() would incorrectly flag conditional context managers (such as with (x() if y else z()): ...) as invalid syntax if feature_version=(3, 8) was passed. This reverts changes to the grammar made as part of gh-94949.

gh-115886: Fix silent truncation of the name with an embedded null character in multiprocessing.shared_memory.SharedMemory.

gh-115809: Improve algorithm for computing which rolled-over log files to delete in logging.TimedRotatingFileHandler. It is now reliable for handlers without namer and with arbitrary deterministic namer that leaves the datetime part in the file name unmodified.

gh-74668: urllib.parse functions parse_qs() and parse_qsl() now support bytes arguments containing raw and percent-encoded non-ASCII data.

gh-67044: csv.writer() now always quotes or escapes '\r' and '\n', regardless of lineterminator value.

gh-115712: csv.writer() now quotes empty fields if delimiter is a space and skipinitialspace is true and raises exception if quoting is not possible.

gh-115618: Fix improper decreasing the reference count for None argument in property methods getter(), setter() and deleter().

gh-115570: A DeprecationWarning is no longer omitted on access to the __doc__ attributes of the deprecated typing.io and typing.re pseudo-modules.

gh-112006: Fix inspect.unwrap() for types with the __wrapper__ data descriptor.

gh-101293: Support callables with the __call__() method and types with __new__() and __init__() methods set to class methods, static methods, bound methods, partial functions, and other types of methods and descriptors in inspect.Signature.from_callable().

gh-115392: Fix a bug in doctest where incorrect line numbers would be reported for decorated functions.

gh-114563: Fix several format() bugs when using the C implementation of Decimal: * memory leak in some rare cases when using the z format option (coerce negative 0) * incorrect output when applying the z format option to type F (fixed-point with capital NAN / INF) * incorrect output when applying the # format option (alternate form)

gh-115197: urllib.request no longer resolves the hostname before checking it against the system’s proxy bypass list on macOS and Windows.

gh-115198: Fix support of Docutils >= 0.19 in distutils.

gh-115165: Most exceptions are now ignored when attempting to set the __orig_class__ attribute on objects returned when calling typing generic aliases (including generic aliases created using typing.Annotated). Previously only AttributeError was ignored. Patch by Dave Shawley.

gh-115133: Fix tests for XMLPullParser with Expat 2.6.0.

gh-115059: io.BufferedRandom.read1() now flushes the underlying write buffer.

gh-79382: Trailing ** no longer allows to match files and non-existing paths in recursive glob().

gh-114763: Protect modules loaded with importlib.util.LazyLoader from race conditions when multiple threads try to access attributes before the loading is complete.

gh-97959: Fix rendering class methods, bound methods, method and function aliases in pydoc. Class methods no longer have “method of builtins.type instance” note. Corresponding notes are now added for class and unbound methods. Method and function aliases now have references to the module or the class where the origin was defined if it differs from the current. Bound methods are now listed in the static methods section. Methods of builtin classes are now supported as well as methods of Python classes.

gh-112281: Allow creating union of types for typing.Annotated with unhashable metadata.

gh-111775: Fix importlib.resources.simple.ResourceHandle.open() for text mode, added missed stream argument.

gh-90095: Make .pdbrc and -c work with any valid pdb commands.

gh-107155: Fix incorrect output of help(x) where x is a lambda function, which has an __annotations__ dictionary attribute with a "return" key.

gh-105866: Fixed _get_slots bug which caused error when defining dataclasses with slots and a weakref_slot.

gh-60346: Fix ArgumentParser inconsistent with parse_known_args.

gh-100985: Update HTTPSConnection to consistently wrap IPv6 Addresses when using a proxy.

gh-100884: email: fix misfolding of comma in address-lists over multiple lines in combination with unicode encoding.

gh-95782: Fix io.BufferedReader.tell(), io.BufferedReader.seek(), _pyio.BufferedReader.tell(), io.BufferedRandom.tell(), io.BufferedRandom.seek() and _pyio.BufferedRandom.tell() being able to return negative offsets.

gh-96310: Fix a traceback in argparse when all options in a mutually exclusive group are suppressed.

gh-93205: Fixed a bug in logging.handlers.TimedRotatingFileHandler where multiple rotating handler instances pointing to files with the same name but different extensions would conflict and not delete the correct files.

bpo-44865: Add missing call to localization function in argparse.

bpo-43952: Fix multiprocessing.connection.Listener.accept() to accept empty bytes as authkey. Not accepting empty bytes as key causes it to hang indefinitely.

bpo-42125: linecache: get module name from __spec__ if available. This allows getting source code for the __main__ module when a custom loader is used.

gh-66543: Make mimetypes.guess_type() properly parsing of URLs with only a host name, URLs containing fragment or query, and filenames with only a UNC sharepoint on Windows. Based on patch by Dong-hee Na.

bpo-33775: Add ‘default’ and ‘version’ help text for localization in argparse.

Documentation

gh-115399: Document CVE-2023-52425 of Expat <2.6.0 under “XML vulnerabilities”.
gh-115233: Fix an example for LoggerAdapter in the Logging Cookbook.

Tests

gh-83434: Disable JUnit XML output (--junit-xml=FILE command line option) in regrtest when hunting for reference leaks (-R option). Patch by Victor Stinner.
gh-117187: Fix XML tests for vanilla Expat <2.6.0.
gh-115979: Update test_importlib so that it passes under WASI SDK 21.
gh-116307: Added import helper isolated_modules as CleanImport does not remove modules imported during the context.
gh-115720: Leak tests (-R, --huntrleaks) now show a summary of the number of leaks found in each iteration.
gh-115122: Add --bisect option to regrtest test runner: run failed tests with test.bisect_cmd to identify failing tests. Patch by Victor Stinner.
gh-115596: Fix ProgramPriorityTests in test_os permanently changing the process priority.
gh-115198: Fix test_check_metadata_deprecate in distutils tests with a newer Docutils.

Build

gh-116313: Get WASI builds to work under wasmtime 18 w/ WASI 0.2/preview2 primitives.
gh-115167: Avoid vendoring vcruntime140_threads.dll when building with Visual Studio 2022 version 17.8.

Windows

gh-116773: Fix instances of <_overlapped.Overlapped object at 0xXXX> still has pending operation at deallocation, the process may crash.
gh-91227: Fix the asyncio ProactorEventLoop implementation so that sending a datagram to an address that is not listening does not prevent receiving any more datagrams.
gh-115554: The installer now has more strict rules about updating the Python Launcher for Windows. In general, most users only have a single launcher installed and will see no difference. When multiple launchers have been installed, the option to install the launcher is disabled until all but one have been removed. Downgrading the launcher (which was never allowed) is now more obviously blocked.
gh-115543: Python Launcher for Windows can now detect Python 3.13 when installed from the Microsoft Store, and will install Python 3.12 by default when PYLAUNCHER_ALLOW_INSTALL is set.
gh-115009: Update Windows installer to use SQLite 3.45.1.

IDLE

gh-88516: On macOS show a proxy icon in the title bar of editor windows to match platform behaviour.

Tools/Demos

gh-113516: Don’t set LDSHARED when building for WASI.

C API

gh-117021: Fix integer overflow in PyLong_AsPid() on non-Windows 64-bit platforms.
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.9 2024/02/07 08:02:11 adam Exp $
d3 1
a3 1
VERS=		3.11.9
@


1.9
log
@python311 py311-html-docs: updated to 3.11.8

Python 3.11.8 final

Security
gh-113659: Skip .pth files with names starting with a dot or hidden file attribute.
Core and Builtins
gh-114887: Changed socket type validation in create_datagram_endpoint() to accept all non-stream sockets. This fixes a regression in compatibility with raw sockets.

gh-114388: Fix a RuntimeWarning emitted when assign an integer-like value that is not an instance of int to an attribute that corresponds to a C struct member of type T_UINT and T_ULONG. Fix a double RuntimeWarning emitted when assign a negative integer value to an attribute that corresponds to a C struct member of type T_UINT.

gh-89811: Check for a valid tp_version_tag before performing bytecode specializations that rely on this value being usable.

gh-113602: Fix an error that was causing the parser to try to overwrite existing errors and crashing in the process. Patch by Pablo Galindo

gh-113566: Fix a 3.11-specific crash when the repr of a Future is requested after the module has already been garbage-collected.

gh-106905: Use per AST-parser state rather than global state to track recursion depth within the AST parser to prevent potential race condition due to simultaneous parsing.

The issue primarily showed up in 3.11 by multithreaded users of ast.parse(). In 3.12 a change to when garbage collection can be triggered prevented the race condition from occurring.

gh-112716: Fix SystemError in the import statement and in __reduce__() methods of builtin types when __builtins__ is not a dict.

gh-105967: Workaround a bug in Apple’s macOS platform zlib library where zlib.crc32() and binascii.crc32() could produce incorrect results on multi-gigabyte inputs. Including when using zipfile on zips containing large data.

gh-94606: Fix UnicodeEncodeError when email.message.get_payload() reads a message with a Unicode surrogate character and the message content is not well-formed for surrogateescape encoding. Patch by Sidney Markowitz.
Library
gh-114965: Update bundled pip to 24.0
gh-114959: tarfile no longer ignores errors when trying to extract a directory on top of a file.
gh-109475: Fix support of explicit option value “–” in argparse (e.g. --option=--).
gh-110190: Fix ctypes structs with array on Windows ARM64 platform by setting MAX_STRUCT_SIZE to 32 in stgdict. Patch by Diego Russo
gh-113280: Fix a leak of open socket in rare cases when error occurred in ssl.SSLSocket creation.
gh-77749: email.policy.EmailPolicy.fold() now always encodes non-ASCII characters in headers if utf8 is false.
gh-114492: Make the result of termios.tcgetattr() reproducible on Alpine Linux. Previously it could leave a random garbage in some fields.
gh-75128: Ignore an OSError in asyncio.BaseEventLoop.create_server() when IPv6 is available but the interface cannot actually support it.
gh-114257: Dismiss the FileNotFound error in ctypes.util.find_library() and just return None on Linux.
gh-101438: Avoid reference cycle in ElementTree.iterparse. The iterator returned by ElementTree.iterparse may hold on to a file descriptor. The reference cycle prevented prompt clean-up of the file descriptor if the returned iterator was not exhausted.
gh-104522: OSError raised when run a subprocess now only has filename attribute set to cwd if the error was caused by a failed attempt to change the current directory.
gh-109534: Fix a reference leak in asyncio.selector_events.BaseSelectorEventLoop when SSL handshakes fail. Patch contributed by Jamie Phan.
gh-114077: Fix possible OverflowError in socket.socket.sendfile() when pass count larger than 2 GiB on 32-bit platform.
gh-114014: Fixed a bug in fractions.Fraction where an invalid string using d in the decimals part creates a different error compared to other invalid letters/characters. Patch by Jeremiah Gabriel Pascual.
gh-113951: Fix the behavior of tag_unbind() methods of tkinter.Text and tkinter.Canvas classes with three arguments. Previously, widget.tag_unbind(tag, sequence, funcid) destroyed the current binding for sequence, leaving sequence unbound, and deleted the funcid command. Now it removes only funcid from the binding for sequence, keeping other commands, and deletes the funcid command. It leaves sequence unbound only if funcid was the last bound command.
gh-113877: Fix tkinter method winfo_pathname() on 64-bit Windows.
gh-113781: Silence unraisable AttributeError when warnings are emitted during Python finalization.
gh-113594: Fix UnicodeEncodeError in email when re-fold lines that contain unknown-8bit encoded part followed by non-unknown-8bit encoded part.
gh-113538: In asyncio.StreamReaderProtocol.connection_made(), there is callback that logs an error if the task wrapping the “connected callback” fails. This callback would itself fail if the task was cancelled. Prevent this by checking whether the task was cancelled first. If so, close the transport but don’t log an error.
gh-85567: Fix resource warnings for unclosed files in pickle and pickletools command line interfaces.
gh-101225: Increase the backlog for multiprocessing.connection.Listener objects created by multiprocessing.manager and multiprocessing.resource_sharer to significantly reduce the risk of getting a connection refused error when creating a multiprocessing.connection.Connection to them.
gh-113543: Make sure that webbrowser.MacOSXOSAScript sends webbrowser.open audit event.
gh-113028: When a second reference to a string appears in the input to pickle, and the Python implementation is in use, we are guaranteed that a single copy gets pickled and a single object is shared when reloaded. Previously, in protocol 0, when a string contained certain characters (e.g. newline) it resulted in duplicate objects.
gh-113421: Fix multiprocessing logger for %(filename)s.
gh-113358: Fix rendering tracebacks for exceptions with a broken __getattr__.
gh-113214: Fix an AttributeError during asyncio SSL protocol aborts in SSL-over-SSL scenarios.
gh-113246: Update bundled pip to 23.3.2.
gh-113199: Make http.client.HTTPResponse.read1 and http.client.HTTPResponse.readline close IO after reading all data when content length is known. Patch by Illia Volochii.
gh-113188: Fix shutil.copymode() and shutil.copystat() on Windows. Previously they worked differenly if dst is a symbolic link: they modified the permission bits of dst itself rather than the file it points to if follow_symlinks is true or src is not a symbolic link, and did not modify the permission bits if follow_symlinks is false and src is a symbolic link.
gh-61648: Detect line numbers of properties in doctests.
gh-112559: signal.signal() and signal.getsignal() no longer call repr on callable handlers. asyncio.run() and asyncio.Runner.run() no longer call repr on the task results. Patch by Yilei Yang.
gh-110190: Fix ctypes structs with array on PPC64LE platform by setting MAX_STRUCT_SIZE to 64 in stgdict. Patch by Diego Russo.
gh-79429: Ignore FileNotFoundError when remove a temporary directory in the multiprocessing finalizer.
gh-79325: Fix an infinite recursion error in tempfile.TemporaryDirectory() cleanup on Windows.
gh-110190: Fix ctypes structs with array on Arm platform by setting MAX_STRUCT_SIZE to 32 in stgdict. Patch by Diego Russo.
gh-81194: Fix a crash in socket.if_indextoname() with specific value (UINT_MAX). Fix an integer overflow in socket.if_indextoname() on 64-bit non-Windows platforms.
gh-75666: Fix the behavior of tkinter widget’s unbind() method with two arguments. Previously, widget.unbind(sequence, funcid) destroyed the current binding for sequence, leaving sequence unbound, and deleted the funcid command. Now it removes only funcid from the binding for sequence, keeping other commands, and deletes the funcid command. It leaves sequence unbound only if funcid was the last bound command.
gh-110345: Show the Tcl/Tk patchlevel (rather than version) in tkinter._test().
gh-109858: Protect zipfile from “quoted-overlap” zipbomb. It now raises BadZipFile when try to read an entry that overlaps with other entry or central directory.
gh-38807: Fix race condition in trace. Instead of checking if a directory exists and creating it, directly call os.makedirs() with the kwarg exist_ok=True.
gh-75705: Set unixfrom envelope in mailbox.mbox and mailbox.MMDF.
gh-105102: Allow ctypes.Union to be nested in ctypes.Structure when the system endianness is the opposite of the classes.
gh-104282: Fix null pointer dereference in lzma._decode_filter_properties() due to improper handling of BCJ filters with properties of zero length. Patch by Radislav Chugunov.
gh-102512: When os.fork() is called from a foreign thread (aka _DummyThread), the type of the thread in a child process is changed to _MainThread. Also changed its name and daemonic status, it can be now joined.
gh-91133: Fix a bug in tempfile.TemporaryDirectory cleanup, which now no longer dereferences symlinks when working around file system permission errors.
bpo-43153: On Windows, tempfile.TemporaryDirectory previously masked a PermissionError with NotADirectoryError during directory cleanup. It now correctly raises PermissionError if errors are not ignored. Patch by Andrei Kulakov and Ken Jin.
bpo-35332: The shutil.rmtree() function now ignores errors when calling os.close() when ignore_errors is True, and os.close() no longer retried after error.
bpo-35928: io.TextIOWrapper now correctly handles the decoding buffer after read() and write().
bpo-26791: shutil.move() now moves a symlink into a directory when that directory is the target of the symlink. This provides the same behavior as the mv shell command. The previous behavior raised an exception. Patch by Jeffrey Kintscher.
bpo-36959: Fix some error messages for invalid ISO format string combinations in strptime() that referred to directives not contained in the format string. Patch by Gordon P. Hemsley.
bpo-18060: Fixed a class inheritance issue that can cause segfaults when deriving two or more levels of subclasses from a base class of Structure or Union.
Documentation
gh-110746: Improved markup for valid options/values for methods ttk.treeview.column and ttk.treeview.heading, and for Layouts.
gh-95649: Document that the asyncio module contains code taken from v0.16.0 of the uvloop project, as well as the required MIT licensing information.
Tests
gh-109980: Fix test_tarfile_vs_tar in test_shutil for macOS, where system tar can include more information in the archive than shutil.make_archive.
gh-112769: The tests now correctly compare zlib version when zlib.ZLIB_RUNTIME_VERSION contains non-integer suffixes. For example zlib-ng defines the version as 1.3.0.zlib-ng.
gh-105089: Fix test.test_zipfile.test_core.TestWithDirectory.test_create_directory_with_write test in AIX by doing a bitwise AND of 0xFFFF on mode , so that it will be in sync with zinfo.external_attr
bpo-40648: Test modes that file can get with chmod() on Windows.
Build
gh-101778: Fix build error when there’s a dangling symlink in the directory containing ffi.h.
gh-112305: Fixed the check-clean-src step performed on out of tree builds to detect errant $(srcdir)/Python/frozen_modules/*.h files and recommend appropriate source tree cleanup steps to get a working build again.
bpo-11102: The os.major(), os.makedev(), and os.minor() functions are now available on HP-UX v3.
bpo-36351: Do not set ipv6type when cross-compiling.
Windows
gh-109991: Update Windows build to use OpenSSL 3.0.13.
gh-111239: Update Windows builds to use zlib v1.3.1.
gh-100107: The py.exe launcher will no longer attempt to run the Microsoft Store redirector when launching a script containing a /usr/bin/env shebang
gh-114096: Process privileges that are activated for creating directory junctions are now restored afterwards, avoiding behaviour changes in other parts of the program.
gh-113009: multiprocessing: On Windows, fix a race condition in Process.terminate(): no longer set the returncode attribute to always call WaitForSingleObject() in Process.wait(). Previously, sometimes the process was still running after TerminateProcess() even if GetExitCodeProcess() is not STILL_ACTIVE. Patch by Victor Stinner.
gh-87868: Correctly sort and remove duplicate environment variables in _winapi.CreateProcess().
bpo-37308: Fix mojibake in mmap.mmap when using a non-ASCII tagname argument on Windows.
macOS
gh-115009: Update macOS installer to use SQLite 3.45.1.
gh-109991: Update macOS installer to use OpenSSL 3.0.13.
gh-74573: Document that dbm.ndbm can silently corrupt DBM files on updates when exceeding undocumented platform limits, and can crash (segmentation fault) when reading such a corrupted file. (FB8919203)
gh-65701: The freeze tool doesn’t work with framework builds of Python. Document this and bail out early when running the tool with such a build.
gh-102362: Make sure the result of sysconfig.get_plaform() includes at least a major and minor versions, even if MACOSX_DEPLOYMENT_TARGET is set to only a major version during build to match the format expected by pip.
gh-110017: Disable a signal handling stress test on macOS due to a bug in macOS (FB13453490).
gh-109981: Use /dev/fd on macOS to determine the number of open files in test.support.os_helper.fd_count to avoid a crash with “guarded” file descriptors when probing for open files.
IDLE
gh-96905: In idlelib code, stop redefining built-ins ‘dict’ and ‘object’.
gh-72284: Improve the lists of features, editor key bindings, and shell key bingings in the IDLE doc.
gh-113903: Fix rare failure of test.test_idle, in test_configdialog.
gh-113729: Fix the “Help -> IDLE Doc” menu bug in 3.11.7 and 3.12.1.
gh-113269: Fix test_editor hang on macOS Catalina.
gh-112898: Fix processing unsaved files when quitting IDLE on macOS.
gh-103820: Revise IDLE bindings so that events from mouse button 4/5 on non-X11 windowing systems (i.e. Win32 and Aqua) are not mistaken for scrolling.
bpo-13586: Enter the selected text when opening the “Replace” dialog.
Tools/Demos
gh-109991: Update GitHub CI workflows to use OpenSSL 3.0.13 and multissltests to use 1.1.1w, 3.0.13, 3.1.5, and 3.2.1.
gh-115015: Fix a bug in Argument Clinic that generated incorrect code for methods with no parameters that use the METH_METHOD | METH_FASTCALL | METH_KEYWORDS calling convention. Only the positional parameter count was checked; any keyword argument passed would be silently accepted.
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.8 2023/12/11 10:23:43 adam Exp $
d3 1
a3 1
VERS=		3.11.8
@


1.8
log
@python311 py311-html-docs: updated to 3.11.7

Python 3.11.7 final

Core and Builtins

gh-112625: Fixes a bug where a bytearray object could be cleared while iterating over an argument in the bytearray.join() method that could result in reading memory after it was freed.
gh-112388: Fix an error that was causing the parser to try to overwrite tokenizer errors. Patch by pablo Galindo
gh-112387: Fix error positions for decoded strings with backwards tokenize errors. Patch by Pablo Galindo
gh-112266: Change docstrings of __dict__ and __weakref__.
gh-109181: Speed up Traceback object creation by lazily compute the line number. Patch by Pablo Galindo
gh-102388: Fix a bug where iso2022_jp_3 and iso2022_jp_2004 codecs read out of bounds
gh-111366: Fix an issue in the codeop that was causing SyntaxError exceptions raised in the presence of invalid syntax to not contain precise error messages. Patch by Pablo Galindo
gh-111380: Fix a bug that was causing SyntaxWarning to appear twice when parsing if invalid syntax is encountered later. Patch by Pablo galindo
gh-88116: Traceback location ranges involving wide unicode characters (like emoji and asian characters) now are properly highlighted. Patch by Batuhan Taskaya and Pablo Galindo.
gh-94438: Fix a regression that prevented jumping across is None and is not None when debugging. Patch by Savannah Ostrowski.
gh-110696: Fix incorrect error message for invalid argument unpacking. Patch by Pablo Galindo
gh-110237: Fix missing error checks for calls to PyList_Append in _PyEval_MatchClass.
gh-109216: Fix possible memory leak in BUILD_MAP.
Library
gh-112618: Fix a caching bug relating to typing.Annotated. Annotated[str, True] is no longer identical to Annotated[str, 1].
gh-112509: Fix edge cases that could cause a key to be present in both the __required_keys__ and __optional_keys__ attributes of a typing.TypedDict. Patch by Jelle Zijlstra.
gh-94722: Fix bug where comparison between instances of DocTest fails if one of them has None as its lineno.
gh-112105: Make readline.set_completer_delims() work with libedit
gh-111942: Fix SystemError in the TextIOWrapper constructor with non-encodable “errors” argument in non-debug mode.
gh-109538: Issue warning message instead of having RuntimeError be displayed when event loop has already been closed at StreamWriter.__del__().
gh-111942: Fix crashes in io.TextIOWrapper.reconfigure() when pass invalid arguments, e.g. non-string encoding.
gh-111804: Remove posix.fallocate() under WASI as the underlying posix_fallocate() is not available in WASI preview2.
gh-111841: Fix truncating arguments on an embedded null character in os.putenv() and os.unsetenv() on Windows.
gh-111541: Fix doctest for SyntaxError not-builtin subclasses.
gh-110894: Call loop exception handler for exceptions in client_connected_cb of asyncio.start_server() so that applications can handle it. Patch by Kumar Aditya.
gh-111531: Fix reference leaks in bind_class() and bind_all() methods of tkinter widgets.
gh-111356: Added io.text_encoding(), io.DEFAULT_BUFFER_SIZE, and io.IncrementalNewlineDecoder to io.__all__.
gh-68166: Remove mention of not supported “vsapi” element type in tkinter.ttk.Style.element_create(). Add tests for element_create() and other ttk.Style methods. Add examples for element_create() in the documentation.
gh-111251: Fix _blake2 not checking for errors when initializing.
gh-111174: Fix crash in io.BytesIO.getbuffer() called repeatedly for empty BytesIO.
gh-111187: Postpone removal version for locale.getdefaultlocale() to Python 3.15.
gh-111159: Fix doctest output comparison for exceptions with notes.
gh-110910: Fix invalid state handling in asyncio.TaskGroup and asyncio.Timeout. They now raise proper RuntimeError if they are improperly used and are left in consistent state after this.
gh-111092: Make turtledemo run without default root enabled.
gh-110590: Fix a bug in _sre.compile() where TypeError would be overwritten by OverflowError when the code argument was a list of non-ints.
gh-65052: Prevent pdb from crashing when trying to display undisplayable objects
gh-110519: Deprecation warning about non-integer number in gettext now alwais refers to the line in the user code where gettext function or method is used. Previously it could refer to a line in gettext code.
gh-110378: contextmanager() and asynccontextmanager() context managers now close an invalid underlying generator object that yields more then one value.
gh-110365: Fix termios.tcsetattr() bug that was overwritting existing errors during parsing integers from term list.
gh-110196: Add __reduce__ method to IPv6Address in order to keep scope_id
gh-109747: Improve errors for unsupported look-behind patterns. Now re.error is raised instead of OverflowError or RuntimeError for too large width of look-behind pattern.
gh-109786: Fix possible reference leaks and crash when re-enter the __next__() method of itertools.pairwise.
gh-108791: Improved error handling in pdb command line interface, making it produce more concise error messages.
gh-73561: Omit the interface scope from an IPv6 address when used as Host header by http.client.
gh-86826: zipinfo now supports the full range of values in the TZ string determined by RFC 8536 and detects all invalid formats. Both Python and C implementations now raise exceptions of the same type on invalid data.
bpo-41422: Fixed memory leaks of pickle.Pickler and pickle.Unpickler involving cyclic references via the internal memo mapping.
bpo-40262: The ssl.SSLSocket.recv_into() method no longer requires the buffer argument to implement __len__ and supports buffers with arbitrary item size.
bpo-35191: Fix unexpected integer truncation in socket.setblocking() which caused it to interpret multiples of 2**32 as False.

Documentation

gh-108826: dis module command-line interface is now mentioned in documentation.

Tests

gh-110367: Make regrtest --verbose3 option compatible with --huntrleaks -jN options. The ./python -m test -j1 -R 3:3 --verbose3 command now works as expected. Patch by Victor Stinner.
gh-111309: distutils tests can now be run via unittest.
gh-111165: Remove no longer used functions run_unittest() and run_doctest() and class BasicTestRunner from the test.support module.
gh-110932: Fix regrtest if the SOURCE_DATE_EPOCH environment variable is defined: use the variable value as the random seed. Patch by Victor Stinner.
gh-110995: test_gdb: Fix detection of gdb built without Python scripting support. Patch by Victor Stinner.
gh-110918: Test case matching patterns specified by options --match, --ignore, --matchfile and --ignorefile are now tested in the order of specification, and the last match determines whether the test case be run or ignored.
gh-110647: Fix test_stress_modifying_handlers() of test_signal. Patch by Victor Stinner.
gh-103053: Fix test_tools.test_freeze on FreeBSD: run “make distclean” instead of “make clean” in the copied source directory to remove also the “python” program. Patch by Victor Stinner.
gh-110167: Fix a deadlock in test_socket when server fails with a timeout but the client is still running in its thread. Don’t hold a lock to call cleanup functions in doCleanups(). One of the cleanup function waits until the client completes, whereas the client could deadlock if it called addCleanup() in such situation. Patch by Victor Stinner.
gh-110388: Add tests for tty.
gh-81002: Add tests for termios.
gh-110267: Add tests for pickling and copying PyStructSequence objects. Patched by Xuehai Pan.
gh-109974: Fix race conditions in test_threading lock tests. Wait until a condition is met rather than using time.sleep() with a hardcoded number of seconds. Patch by Victor Stinner.
gh-109972: Split test_gdb.py file into a test_gdb package made of multiple tests, so tests can now be run in parallel. Patch by Victor Stinner.
gh-104736: Fix test_gdb on Python built with LLVM clang 16 on Linux ppc64le (ex: Fedora 38). Search patterns in gdb “bt” command output to detect when gdb fails to retrieve the traceback. For example, skip a test if Backtrace stopped: frame did not save the PC is found. Patch by Victor Stinner.
gh-108927: Fixed order dependence in running tests in the same process when a test that has submodules (e.g. test_importlib) follows a test that imports its submodule (e.g. test_importlib.util) and precedes a test (e.g. test_unittest or test_compileall) that uses that submodule.

Build

gh-103053: “make check-clean-src” now also checks if the “python” program is found in the source directory: fail with an error if it does exist. Patch by Victor Stinner.
gh-109191: Fix compile error when building with recent versions of libedit.

Windows

gh-110913: WindowsConsoleIO now correctly chunks large buffers without splitting up UTF-8 sequences.
gh-110437: Allows overriding the source of VC redistributables so that releases can be guaranteed to never downgrade between updates.
gh-109286: Update Windows installer to use SQLite 3.43.1.

macOS

gh-110950: Update macOS installer to include an upstream Tcl/Tk fix for the Secure coding is not enabled for restorable state! warning encountered in Tkinter on macOS 14 Sonoma.
gh-111015: Ensure that IDLE.app and Python Launcher.app are installed with appropriate permissions on macOS builds.
gh-109286: Update macOS installer to use SQLite 3.43.1.
gh-71383: Update macOS installer to include an upstream Tcl/Tk fix for the ttk::ThemeChanged error encountered in Tkinter.
gh-92603: Update macOS installer to include a fix accepted by upstream Tcl/Tk for a crash encountered after the first tkinter.Tk() instance is destroyed.
gh-99834: Update macOS installer to Tcl/Tk 8.6.13.

IDLE

bpo-35668: Add docstrings to the IDLE debugger module. Fix two bugs: initialize Idb.botframe (should be in Bdb); in Idb.in_rpc_code, check whether prev_frame is None before trying to use it. Greatly expand test_debugger.

C API

gh-112438: Fix support of format units “es”, “et”, “es#”, and “et#” in nested tuples in PyArg_ParseTuple()-like functions.
gh-109521: PyImport_GetImporter() now sets RuntimeError if it fails to get sys.path_hooks or sys.path_importer_cache or they are not list and dict correspondingly. Previously it could return NULL without setting error in obscure cases, crash or raise SystemError if these attributes have wrong type.
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.7 2023/10/02 19:59:04 adam Exp $
d3 1
a3 1
VERS=		3.11.7
@


1.7
log
@python311 py311-html-docs: updated to 3.11.6

Python 3.11.6 final

Core and Builtins
gh-109351: Fix crash when compiling an invalid AST involving a named (walrus) expression.

gh-109207: Fix a SystemError in __repr__ of symtable entry object.

gh-109179: Fix bug where the C traceback display drops notes from SyntaxError.

gh-88943: Improve syntax error for non-ASCII character that follows a numerical literal. It now points on the invalid non-ASCII character, not on the valid numerical literal.

gh-108959: Fix caret placement for error locations for subscript and binary operations that involve non-semantic parentheses and spaces. Patch by Pablo Galindo

gh-108520: Fix multiprocessing.synchronize.SemLock.__setstate__() to properly initialize multiprocessing.synchronize.SemLock._is_fork_ctx. This fixes a regression when passing a SemLock accross nested processes.

Rename multiprocessing.synchronize.SemLock.is_fork_ctx to multiprocessing.synchronize.SemLock._is_fork_ctx to avoid exposing it as public API.

Library
gh-110036: On Windows, multiprocessing Popen.terminate() now catchs PermissionError and get the process exit code. If the process is still running, raise again the PermissionError. Otherwise, the process terminated as expected: store its exit code. Patch by Victor Stinner.
gh-110038: Fixed an issue that caused KqueueSelector.select() to not return all the ready events in some cases when a file descriptor is registered for both read and write.
gh-109631: re functions such as re.findall(), re.split(), re.search() and re.sub() which perform short repeated matches can now be interrupted by user.
gh-109593: Avoid deadlocking on a reentrant call to the multiprocessing resource tracker. Such a reentrant call, though unlikely, can happen if a GC pass invokes the finalizer for a multiprocessing object such as SemLock.
gh-109613: Fix os.stat() and os.DirEntry.stat(): check for exceptions. Previously, on Python built in debug mode, these functions could trigger a fatal Python error (and abort the process) when a function succeeded with an exception set. Patch by Victor Stinner.
gh-109375: The pdb alias command now prevents registering aliases without arguments.
gh-107219: Fix a race condition in concurrent.futures. When a process in the process pool was terminated abruptly (while the future was running or pending), close the connection write end. If the call queue is blocked on sending bytes to a worker process, closing the connection write end interrupts the send, so the queue can be closed. Patch by Victor Stinner.
gh-50644: Attempts to pickle or create a shallow or deep copy of codecs streams now raise a TypeError. Previously, copying failed with a RecursionError, while pickling produced wrong results that eventually caused unpickling to fail with a RecursionError.
gh-108987: Fix _thread.start_new_thread() race condition. If a thread is created during Python finalization, the newly spawned thread now exits immediately instead of trying to access freed memory and lead to a crash. Patch by Victor Stinner.
gh-108843: Fix an issue in ast.unparse() when unparsing f-strings containing many quote types.
gh-108682: Enum: raise TypeError if super().__new__() is called from a custom __new__.
gh-105829: Fix concurrent.futures.ProcessPoolExecutor deadlock
gh-64662: Fix support for virtual tables in sqlite3.Connection.iterdump(). Patch by Aviv Palivoda.
gh-107913: Fix possible losses of errno and winerror values in OSError exceptions if they were cleared or modified by the cleanup code before creating the exception object.
gh-104372: On Linux where subprocess can use the vfork() syscall for faster spawning, prevent the parent process from blocking other threads by dropping the GIL while it waits for the vfork’ed child process exec() outcome. This prevents spawning a binary from a slow filesystem from blocking the rest of the application.
gh-84867: unittest.TestLoader no longer loads test cases from exact unittest.TestCase and unittest.FunctionTestCase classes.

Documentation
gh-109209: The minimum Sphinx version required for the documentation is now 4.2.
gh-105052: Update timeit doc to specify that time in seconds is just the default.
gh-102823: Document the return type of x // y when x and y have type float.

Tests
gh-110031: Skip test_threading tests using thread+fork if Python is built with Address Sanitizer (ASAN). Patch by Victor Stinner.
gh-110088: Fix test_asyncio timeouts: don’t measure the maximum duration, a test should not measure a CI performance. Only measure the minimum duration when a task has a timeout or delay. Add CLOCK_RES to test_asyncio.utils. Patch by Victor Stinner.
gh-110033: Fix test_interprocess_signal() of test_signal. Make sure that the subprocess.Popen object is deleted before the test raising an exception in a signal handler. Otherwise, Popen.__del__() can get the exception which is logged as Exception ignored in: ... and the test fails. Patch by Victor Stinner.
gh-109594: Fix test_timeout() of test_concurrent_futures.test_wait. Remove the future which may or may not complete depending if it takes longer than the timeout ot not. Keep the second future which does not complete before wait() timeout. Patch by Victor Stinner.
gh-109748: Fix test_zippath_from_non_installed_posix() of test_venv: don’t copy __pycache__/ sub-directories, because they can be modified by other Python tests running in parallel. Patch by Victor Stinner.
gh-103053: Skip test_freeze_simple_script() of test_tools.test_freeze if Python is built with ./configure --enable-optimizations, which means with Profile Guided Optimization (PGO): it just makes the test too slow. The freeze tool is tested by many other CIs with other (faster) compiler flags. Patch by Victor Stinner.
gh-109396: Fix test_socket.test_hmac_sha1() in FIPS mode. Use a longer key: FIPS mode requires at least of at least 112 bits. The previous key was only 32 bits. Patch by Victor Stinner.
gh-104736: Fix test_gdb on Python built with LLVM clang 16 on Linux ppc64le (ex: Fedora 38). Search patterns in gdb “bt” command output to detect when gdb fails to retrieve the traceback. For example, skip a test if Backtrace stopped: frame did not save the PC is found. Patch by Victor Stinner.
gh-109237: Fix test_site.test_underpth_basic() when the working directory contains at least one non-ASCII character: encode the ._pth file to UTF-8 and enable the UTF-8 Mode to use UTF-8 for the child process stdout. Patch by Victor Stinner.
gh-109230: Fix test_pyexpat.test_exception(): it can now be run from a directory different than Python source code directory. Before, the test failed in this case. Skip the test if Modules/pyexpat.c source is not available. Skip also the test on Python implementations other than CPython. Patch by Victor Stinner.
gh-109015: Fix test_asyncio, test_imaplib and test_socket tests on FreeBSD if the TCP blackhole is enabled (sysctl net.inet.tcp.blackhole). Skip the few tests which failed with ETIMEDOUT which such non standard configuration. Currently, the FreeBSD GCP image enables TCP and UDP blackhole (sysctl net.inet.tcp.blackhole=2 and sysctl net.inet.udp.blackhole=1). Patch by Victor Stinner.
gh-91960: Skip test_gdb if gdb is unable to retrieve Python frame objects: if a frame is <optimized out>. When Python is built with “clang -Og”, gdb can fail to retrive the frame parameter of _PyEval_EvalFrameDefault(). In this case, tests like py_bt() are likely to fail. Without getting access to Python frames, python-gdb.py is mostly clueless on retrieving the Python traceback. Moreover, test_gdb is no longer skipped on macOS if Python is built with Clang. Patch by Victor Stinner.
gh-108962: Skip test_tempfile.test_flags() if chflags() fails with “OSError: [Errno 45] Operation not supported” (ex: on FreeBSD 13). Patch by Victor Stinner.
gh-89392: Removed support of test_main() function in tests. They now always use normal unittest test runner.
gh-108851: Fix test_tomllib recursion tests for WASI buildbots: reduce the recursion limit and compute the maximum nested array/dict depending on the current available recursion limit. Patch by Victor Stinner.
gh-108851: Add get_recursion_available() and get_recursion_depth() functions to the test.support module. Patch by Victor Stinner.
gh-108822: regrtest now computes statistics on all tests: successes, failures and skipped. test_netrc, test_pep646_syntax and test_xml_etree now return results in their test_main() function. Patch by Victor Stinner and Alex Waygood.
gh-108388: Convert test_concurrent_futures to a package of 7 sub-tests. Patch by Victor Stinner.
gh-108388: Split test_multiprocessing_fork, test_multiprocessing_forkserver and test_multiprocessing_spawn into test packages. Each package is made of 4 sub-tests: processes, threads, manager and misc. It allows running more tests in parallel and so reduce the total test duration. Patch by Victor Stinner.
gh-101634: When running the Python test suite with -jN option, if a worker stdout cannot be decoded from the locale encoding report a failed testn so the exitcode is non-zero. Patch by Victor Stinner.
gh-100086: The Python test runner (libregrtest) now logs Python build information like “debug” vs “release” build, or LTO and PGO optimizations. Patch by Victor Stinner.
gh-98903: The Python test suite now fails wit exit code 4 if no tests ran. It should help detecting typos in test names and test methods.
gh-95027: On Windows, when the Python test suite is run with the -jN option, the ANSI code page is now used as the encoding for the stdout temporary file, rather than using UTF-8 which can lead to decoding errors. Patch by Victor Stinner.
gh-93353: regrtest now checks if a test leaks temporary files or directories if run with -jN option. Patch by Victor Stinner.

Build
gh-63760: Fix Solaris build: no longer redefine the gethostname() function. Solaris defines the function since 2005. Patch by Victor Stinner, original patch by Jakub Kulík.
gh-108740: Fix a race condition in make regen-all. The deepfreeze.c source and files generated by Argument Clinic are now generated or updated before generating “global objects”. Previously, some identifiers may miss depending on the order in which these files were generated. Patch by Victor Stinner.

Windows
gh-109991: Update Windows build to use OpenSSL 3.0.11.
gh-107565: Update Windows build to use OpenSSL 3.0.10.

macOS
gh-109991: Update macOS installer to use OpenSSL 3.0.11.

Tools/Demos
gh-109991: Update GitHub CI workflows to use OpenSSL 3.0.11 and multissltests to use 1.1.1w, 3.0.11, and 3.1.3.
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.6 2023/08/25 08:28:22 adam Exp $
d3 1
a3 1
VERS=		3.11.6
@


1.6
log
@python311 py311-html-docs: updated to 3.11.5

Python 3.11.5

Security

gh-108310: Fixed an issue where instances of ssl.SSLSocket were vulnerable to a bypass of the TLS handshake and included protections (like certificate verification) and treating sent unencrypted data as if it were post-handshake TLS encrypted data. Security issue reported as CVE-2023-40217 by Aapo Oksman. Patch by Gregory P. Smith.

Core and Builtins

gh-104432: Fix potential unaligned memory access on C APIs involving returned sequences of char * pointers within the grp and socket modules. These were revealed using a -fsaniziter=alignment build on ARM macOS. Patch by Christopher Chavez.
gh-77377: Ensure that multiprocessing synchronization objects created in a fork context are not sent to a different process created in a spawn context. This changes a segfault into an actionable RuntimeError in the parent process.
gh-106092: Fix a segmentation fault caused by a use-after-free bug in frame_dealloc when the trashcan delays the deallocation of a PyFrameObject.
gh-106719: No longer suppress arbitrary errors in the __annotations__ getter and setter in the type and module types.
gh-106723: Propagate frozen_modules to multiprocessing spawned process interpreters.
gh-105979: Fix crash in _imp.get_frozen_object() due to improper exception handling.
gh-105840: Fix possible crashes when specializing function calls with too many __defaults__.
gh-105588: Fix an issue that could result in crashes when compiling malformed ast nodes.
gh-105375: Fix bugs in the builtins module where exceptions could end up being overwritten.
gh-105375: Fix bug in the compiler where an exception could end up being overwritten.
gh-105375: Improve error handling in PyUnicode_BuildEncodingMap() where an exception could end up being overwritten.
gh-105235: Prevent out-of-bounds memory access during mmap.find() calls.
gh-101006: Improve error handling when read marshal data.

Library

gh-105736: Harmonized the pure Python version of OrderedDict with the C version. Now, both versions set up their internal state in __new__. Formerly, the pure Python version did the set up in __init__.
gh-107963: Fix multiprocessing.set_forkserver_preload() to check the given list of modules names. Patch by Dong-hee Na.
gh-106242: Fixes os.path.normpath() to handle embedded null characters without truncating the path.
gh-107845: tarfile.data_filter() now takes the location of symlinks into account when determining their target, so it will no longer reject some valid tarballs with LinkOutsideDestinationError.
gh-107715: Fix doctest.DocTestFinder.find() in presence of class names with special characters. Patch by Gertjan van Zwieten.
gh-100814: Passing a callable object as an option value to a Tkinter image now raises the expected TclError instead of an AttributeError.
gh-106684: Close asyncio.StreamWriter when it is not closed by application leading to memory leaks. Patch by Kumar Aditya.
gh-107077: Seems that in some conditions, OpenSSL will return SSL_ERROR_SYSCALL instead of SSL_ERROR_SSL when a certification verification has failed, but the error parameters will still contain ERR_LIB_SSL and SSL_R_CERTIFICATE_VERIFY_FAILED. We are now detecting this situation and raising the appropiate ssl.SSLCertVerificationError. Patch by Pablo Galindo
gh-107396: tarfiles; Fixed use before assignment of self.exception for gzip decompression
gh-62519: Make gettext.pgettext() search plural definitions when translation is not found.
gh-83006: Document behavior of shutil.disk_usage() for non-mounted filesystems on Unix.
gh-106186: Do not report MultipartInvariantViolationDefect defect when the email.parser.Parser class is used to parse emails with headersonly=True.
gh-106831: Fix potential missing NULL check of d2i_SSL_SESSION result in _ssl.c.
gh-106774: Update the bundled copy of pip to version 23.2.1.
gh-106752: Fixed several bug in zipfile.Path in name/suffix/suffixes/stem operations when no filename is present and the Path is not at the root of the zipfile.
gh-106602: Add __copy__ and __deepcopy__ in enum
gh-106530: Revert a change to colorsys.rgb_to_hls() that caused division by zero for certain almost-white inputs. Patch by Terry Jan Reedy.
gh-106052: re module: fix the matching of possessive quantifiers in the case of a subpattern containing backtracking.
gh-106510: Improve debug output for atomic groups in regular expressions.
gh-105497: Fix flag mask inversion when unnamed flags exist.
gh-90876: Prevent multiprocessing.spawn from failing to import in environments where sys.executable is None. This regressed in 3.11 with the addition of support for path-like objects in multiprocessing.
gh-106350: Detect possible memory allocation failure in the libtommath function mp_init() used by the _tkinter module.
gh-102541: Make pydoc.doc catch bad module ImportError when output stream is not None.
gh-106263: Fix crash when calling repr with a manually constructed SignalDict object. Patch by Charlie Zhao.
gh-105375: Fix a bug in _Unpickler_SetInputStream() where an exception could end up being overwritten in case of failure.
gh-105375: Fix bugs in sys where exceptions could end up being overwritten because of deferred error handling.
gh-105605: Harden pyexpat error handling during module initialisation to prevent exceptions from possibly being overwritten, and objects from being dereferenced twice.
gh-105375: Fix bug in decimal where an exception could end up being overwritten.
gh-105375: Fix bugs in _datetime where exceptions could be overwritten in case of module initialisation failure.
gh-105375: Fix bugs in _ssl initialisation which could lead to leaked references and overwritten exceptions.
gh-105375: Fix a bug in array.array where an exception could end up being overwritten.
gh-105375: Fix bugs in _ctypes where exceptions could end up being overwritten.
gh-105375: Fix a bug in the posix module where an exception could be overwritten.
gh-105375: Fix bugs in _elementtree where exceptions could be overwritten.
gh-105375: Fix bugs in zoneinfo where exceptions could be overwritten.
gh-105375: Fix bugs in pickle where exceptions could be overwritten.
gh-105497: Fix flag inversion when alias/mask members exist.
gh-105375: Fix bugs in pickle where exceptions could be overwritten.
gh-103171: Revert undocumented behaviour change with runtime-checkable protocols decorated with typing.final() in Python 3.11. The behaviour change had meant that objects would not be considered instances of these protocols at runtime unless they had a __final__ attribute. Patch by Alex Waygood.
gh-105375: Fix a bug in sqlite3 where an exception could be overwritten in the collation callback.
gh-105332: Revert pickling method from by-name back to by-value.
gh-104554: Add RTSPS scheme support in urllib.parse
gh-100061: Fix a bug that causes wrong matches for regular expressions with possessive qualifier.
gh-102541: Hide traceback in help() prompt, when import failed.
gh-99203: Restore following CPython <= 3.10.5 behavior of shutil.make_archive(): do not create an empty archive if root_dir is not a directory, and, in that case, raise FileNotFoundError or NotADirectoryError regardless of format choice. Beyond the brought-back behavior, the function may now also raise these exceptions in dry_run mode.
gh-94777: Fix hanging multiprocessing ProcessPoolExecutor when a child process crashes while data is being written in the call queue.
bpo-18319: Ensure gettext(msg) retrieve translations even if a plural form exists. In other words: gettext(msg) == ngettext(msg, '', 1).

Documentation

gh-107008: Document the curses module variables LINES and COLS.
gh-106948: Add a number of standard external names to nitpick_ignore.
gh-54738: Add documentation on how to localize the argparse module.

Tests

gh-105776: Fix test_cppext when the C compiler command -std=c11 option: remove -std= options from the compiler command. Patch by Victor Stinner.
gh-107237: test_logging: Fix test_udp_reconnection() by increasing the timeout from 100 ms to 5 minutes (LONG_TIMEOUT). Patch by Victor Stinner.
gh-101634: When running the Python test suite with -jN option, if a worker stdout cannot be decoded from the locale encoding report a failed testn so the exitcode is non-zero. Patch by Victor Stinner.

Build

gh-107814: When calling find_python.bat with -q it did not properly silence the output of nuget. That is now fixed.

gh-106881: Check for linux/limits.h before including it in Modules/posixmodule.c.

gh-104692: Include commoninstall as a prerequisite for bininstall

This ensures that commoninstall is completed before bininstall is started when parallel builds are used (make -j install), and so the python3 symlink is only installed after all standard library modules are installed.

gh-100340: Allows -Wno-int-conversion for wasm-sdk 17 and onwards, thus enables building WASI builds once against the latest sdk.

Windows

gh-106242: Fixes realpath() to behave consistently when passed a path containing an embedded null character on Windows. In strict mode, it now raises OSError instead of the unexpected ValueError, and in non-strict mode will make the path absolute.
gh-106844: Fix integer overflow in _winapi.LCMapStringEx() which affects ntpath.normcase().
gh-99079: Update Windows build to use OpenSSL 3.0.9
gh-105436: Ensure that an empty environment block is terminated by two null characters, as is required by Windows.

macOS

gh-107565: Update macOS installer to use OpenSSL 3.0.10.
gh-99079: Update macOS installer to use OpenSSL 3.0.9.

Tools/Demos

gh-107565: Update multissltests and GitHub CI workflows to use OpenSSL 1.1.1v, 3.0.10, and 3.1.2.
gh-95065: Argument Clinic now supports overriding automatically generated signature by using directive @@text_signature. See How to override the generated signature.
gh-106970: Fix bugs in the Argument Clinic destination <name> clear command; the destination buffers would never be cleared, and the destination directive parser would simply continue to the fault handler after processing the command. Patch by Erlend E. Aasland.

C API

gh-107916: C API functions PyErr_SetFromErrnoWithFilename(), PyErr_SetExcFromWindowsErrWithFilename() and PyErr_SetFromWindowsErrWithFilename() save now the error code before calling PyUnicode_DecodeFSDefault().
gh-107915: Such C API functions as PyErr_SetString(), PyErr_Format(), PyErr_SetFromErrnoWithFilename() and many others no longer crash or ignore errors if it failed to format the error message or decode the filename. Instead, they keep a corresponding error.
gh-107226: PyModule_AddObjectRef() is now only available in the limited API version 3.10 or later.
gh-105375: Fix a bug in PyErr_WarnExplicit() where an exception could end up being overwritten if the API failed internally.
gh-99612: Fix PyUnicode_DecodeUTF8Stateful() for ASCII-only data: *consumed was not set.
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.5 2023/06/08 10:04:26 adam Exp $
d3 1
a3 1
VERS=		3.11.5
d12 1
a12 1
COMMENT=	HTML Documentation for Python 3.11
@


1.5
log
@py311-html-docs: updated to 3.11.4
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.4 2023/04/06 11:30:37 adam Exp $
d3 1
a3 1
VERS=		3.11.4
@


1.4
log
@python311 py311-html-docs: updated to 3.11.3

Python 3.11.3

Security

gh-101727: Updated the OpenSSL version used in Windows and macOS binary release builds to 1.1.1t to address CVE-2023-0286, CVE-2022-4303, and CVE-2022-4303 per the OpenSSL 2023-02-07 security advisory.
gh-101283: subprocess.Popen now uses a safer approach to find cmd.exe when launching with shell=True. Patch by Eryk Sun, based on a patch by Oleg Iarygin.

Core and Builtins

gh-101975: Fixed stacktop value on tracing entries to avoid corruption on garbage collection.
gh-102701: Fix overflow when creating very large dict.
gh-102416: Do not memoize incorrectly automatically generated loop rules in the parser. Patch by Pablo Galindo.
gh-102356: Fix a bug that caused a crash when deallocating deeply nested filter objects. Patch by Marta Gómez Macías.
gh-102397: Fix segfault from race condition in signal handling during garbage collection. Patch by Kumar Aditya.
gh-102281: Fix potential nullptr dereference and use of uninitialized memory in fileutils. Patch by Max Bachmann.
gh-102126: Fix deadlock at shutdown when clearing thread states if any finalizer tries to acquire the runtime head lock. Patch by Kumar Aditya.
gh-102027: Fix SSE2 and SSE3 detection in _blake2 internal module. Patch by Max Bachmann.
gh-101967: Fix possible segfault in positional_only_passed_as_keyword function, when new list created.
gh-101765: Fix SystemError / segmentation fault in iter __reduce__ when internal access of builtins.__dict__ keys mutates the iter object.
gh-101696: Invalidate type version tag in _PyStaticType_Dealloc for static types, avoiding bug where a false cache hit could crash the interpreter. Patch by Kumar Aditya.

Library

gh-102549: Don’t ignore exceptions in member type creation.

gh-102947: Improve traceback when dataclasses.fields() is called on a non-dataclass. Patch by Alex Waygood

gh-102780: The asyncio.Timeout context manager now works reliably even when performing cleanup due to task cancellation. Previously it could raise a CancelledError instead of an TimeoutError in such cases.

gh-88965: typing: Fix a bug relating to substitution in custom classes generic over a ParamSpec. Previously, if the ParamSpec was substituted with a parameters list that itself contained a TypeVar, the TypeVar in the parameters list could not be subsequently substituted. This is now fixed.

Patch by Nikita Sobolev.

gh-101979: Fix a bug where parentheses in the metavar argument to argparse.ArgumentParser.add_argument() were dropped. Patch by Yeojin Kim.

gh-102179: Fix os.dup2() error message for negative fds.

gh-101961: For the binary mode, fileinput.hookcompressed() doesn’t set the encoding value even if the value is None. Patch by Gihwan Kim.

gh-101936: The default value of fp becomes io.BytesIO if HTTPError is initialized without a designated fp parameter. Patch by Long Vo.

gh-102069: Fix __weakref__ descriptor generation for custom dataclasses.

gh-101566: In zipfile, apply fix for extractall on the underlying zipfile after being wrapped in Path.

gh-101892: Callable iterators no longer raise SystemError when the callable object exhausts the iterator but forgets to either return a sentinel value or raise StopIteration.

gh-97786: Fix potential undefined behaviour in corner cases of floating-point-to-time conversions.

gh-101517: Fixed bug where bdb looks up the source line with linecache with a lineno=None, which causes it to fail with an unhandled exception.

gh-101673: Fix a pdb bug where ll clears the changes to local variables.

gh-96931: Fix incorrect results from ssl.SSLSocket.shared_ciphers()

gh-88233: Correctly preserve “extra” fields in zipfile regardless of their ordering relative to a zip64 “extra.”

gh-96127: inspect.signature was raising TypeError on call with mock objects. Now it correctly returns (*args, **kwargs) as infered signature.

gh-95495: When built against OpenSSL 3.0, the ssl module had a bug where it reported unauthenticated EOFs (i.e. without close_notify) as a clean TLS-level EOF. It now raises SSLEOFError, matching the behavior in previous versions of OpenSSL. The options attribute on SSLContext also no longer includes OP_IGNORE_UNEXPECTED_EOF by default. This option may be set to specify the previous OpenSSL 3.0 behavior.

gh-94440: Fix a concurrent.futures.process bug where ProcessPoolExecutor shutdown could hang after a future has been quickly submitted and canceled.

Documentation

gh-103112: Add docstring to http.client.HTTPResponse.read() to fix pydoc output.
gh-85417: Update cmath documentation to clarify behaviour on branch cuts.
gh-97725: Fix asyncio.Task.print_stack() description for file=None. Patch by Oleg Iarygin.

Tests

gh-102980: Improve test coverage on pdb.
gh-102537: Adjust the error handling strategy in test_zoneinfo.TzPathTest.python_tzpath_context. Patch by Paul Ganssle.
gh-89792: test_tools now copies up to 10x less source data to a temporary directory during the freeze test by ignoring git metadata and other artifacts. It also limits its python build parallelism based on os.cpu_count instead of hard coding it as 8 cores.
gh-101377: Improved test_locale_calendar_formatweekday of calendar.

Build

gh-102711: Fix -Wstrict-prototypes compiler warnings.

Windows

gh-101849: Ensures installer will correctly upgrade existing py.exe launcher installs.
gh-101763: Updates copy of libffi bundled with Windows installs to 3.4.4.
gh-101759: Update Windows installer to SQLite 3.40.1.
gh-101614: Correctly handle extensions built against debug binaries that reference python3_d.dll.

macOS

gh-103207: Add instructions to the macOS installer welcome display on how to workaround the macOS 13 Ventura “The installer encountered an error” failure.
gh-101759: Update macOS installer to SQLite 3.40.1.
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.3 2023/02/09 10:48:15 adam Exp $
d3 1
a3 1
VERS=		3.11.3
@


1.3
log
@python311 py311-html-docs: updated to 3.11.2

Python 3.11.2

Core and Builtins

gh-92173: Fix the defs and kwdefs arguments to PyEval_EvalCodeEx() and a reference leak in that function.
gh-101400: Fix wrong lineno in exception message on continue or break which are not in a loop. Patch by Dong-hee Na.
gh-101372: Fix is_normalized() to properly handle the UCD 3.2.0 cases. Patch by Dong-hee Na.
gh-101046: Fix a possible memory leak in the parser when raising MemoryError. Patch by Pablo Galindo
gh-101037: Fix potential memory underallocation issue for instances of int subclasses with value zero.
gh-100942: Fixed segfault in property.getter/setter/deleter that occurred when a property subclass overrode the __new__ method to return a non-property instance.
gh-100892: Fix race while iterating over thread states in clearing threading.local. Patch by Kumar Aditya.
gh-100776: Fix misleading default value in input()’s __text_signature__.
gh-100637: Fix int.__sizeof__() calculation to include the 1 element ob_digit array for 0 and False.
gh-100649: Update the native_thread_id field of PyThreadState after fork.
gh-100374: Fix incorrect result and delay in socket.getfqdn(). Patch by Dominic Socular.
gh-99110: Initialize frame->previous in frameobject.c to fix a segmentation fault when accessing frames created by PyFrame_New().
gh-100050: Honor existing errors obtained when searching for mismatching parentheses in the tokenizer. Patch by Pablo Galindo
bpo-32782: ctypes arrays of length 0 now report a correct itemsize when a memoryview is constructed from them, rather than always giving a value of 0.

Library

gh-101541: [Enum] - fix psuedo-flag creation
gh-101326: Fix regression when passing None as second or third argument to FutureIter.throw.
gh-100795: Avoid potential unexpected freeaddrinfo call (double free) in socket when when a libc getaddrinfo() implementation leaves garbage in an output pointer when returning an error. Original patch by Sergey G. Brester.
gh-101143: Remove unused references to TimerHandle in asyncio.base_events.BaseEventLoop._add_callback.
gh-101144: Make zipfile.Path.open() and zipfile.Path.read_text() also accept encoding as a positional argument. This was the behavior in Python 3.9 and earlier. 3.10 introduced a regression where supplying it as a positional argument would lead to a TypeError.
gh-101015: Fix typing.get_type_hints() on '*tuple[...]' and *tuple[...]. It must not drop the Unpack part.
gh-100573: Fix a Windows asyncio bug with named pipes where a client doing os.stat() on the pipe would cause an error in the server that disabled serving future requests.
gh-100805: Modify random.choice() implementation to once again work with NumPy arrays.
gh-90104: Avoid RecursionError on repr if a dataclass field definition has a cyclic reference.
gh-100750: pass encoding kwarg to subprocess in platform
gh-100689: Fix crash in pyexpat by statically allocating PyExpat_CAPI capsule.
gh-100740: Fix unittest.mock.Mock not respecting the spec for attribute names prefixed with assert.
gh-86508: Fix asyncio.open_connection() to skip binding to local addresses of different family. Patch by Kumar Aditya.
gh-100287: Fix the interaction of unittest.mock.seal() with unittest.mock.AsyncMock.
gh-100474: http.server now checks that an index page is actually a regular file before trying to serve it. This avoids issues with directories named index.html.
gh-100160: Remove any deprecation warnings in asyncio.get_event_loop(). They are deferred to Python 3.12.
gh-96290: Fix handling of partial and invalid UNC drives in ntpath.splitdrive(), and in ntpath.normpath() on non-Windows systems. Paths such as ‘\server’ and ‘\’ are now considered by splitdrive() to contain only a drive, and consequently are not modified by normpath() on non-Windows systems. The behaviour of normpath() on Windows systems is unaffected, as native OS APIs are used. Patch by Eryk Sun, with contributions by Barney Gale.
gh-78878: Fix crash when creating an instance of _ctypes.CField.
gh-99952: Fix a reference undercounting issue in ctypes.Structure with from_param() results larger than a C pointer.
gh-100133: Fix regression in asyncio where a subprocess would sometimes lose data received from pipe.
gh-100098: Fix tuple subclasses being cast to tuple when used as enum values.
gh-98778: Update HTTPError to be initialized properly, even if the fp is None. Patch by Dong-hee Na.
gh-83035: Fix inspect.getsource() handling of decorator calls with nested parentheses.
gh-99576: Fix .save() method for LWPCookieJar and MozillaCookieJar: saved file was not truncated on repeated save.
gh-99433: Fix doctest failure on types.MethodWrapperType in modules.
gh-99240: Fix double-free bug in Argument Clinic str_converter by extracting memory clean up to a new post_parsing section.
gh-64490: Fix refcount error when arguments are packed to tuple in Argument Clinic.
gh-85267: Several improvements to inspect.signature()’s handling of __text_signature. - Fixes a case where inspect.signature() dropped parameters - Fixes a case where inspect.signature() raised tokenize.TokenError - Allows inspect.signature() to understand defaults involving binary operations of constants - inspect.signature() is documented as only raising TypeError or ValueError, but sometimes raised RuntimeError. These cases now raise ValueError - Removed a dead code path
gh-95882: Fix a 3.11 regression in asynccontextmanager(), which caused it to propagate exceptions with incorrect tracebacks and fix a 3.11 regression in contextmanager(), which caused it to propagate exceptions with incorrect tracebacks for StopIteration.
bpo-44817: Ignore WinError 53 (ERROR_BAD_NETPATH), 65 (ERROR_NETWORK_ACCESS_DENIED) and 161 (ERROR_BAD_PATHNAME) when using ntpath.realpath().
bpo-40447: Accept os.PathLike (such as pathlib.Path) in the stripdir arguments of compileall.compile_file() and compileall.compile_dir().
bpo-36880: Fix a reference counting issue when a ctypes callback with return type py_object returns None, which could cause crashes.

Documentation

gh-100616: Document existing attr parameter to curses.window.vline() function in curses.
gh-100472: Remove claim in documentation that the stripdir, prependdir and limit_sl_dest parameters of compileall.compile_dir() and compileall.compile_file() could be bytes.
gh-99931: Use sphinxext-opengraph to generate OpenGraph metadata.

Tests

gh-101334: test_tarfile has been updated to pass when run as a high UID.
gh-100454: Start running SSL tests with OpenSSL 3.1.0-beta1.
gh-96002: Add functional test for Argument Clinic.

Build

gh-101522: Allow overriding Windows dependencies versions and paths using MSBuild properties.

Windows

gh-101543: Ensure the install path in the registry is only used when the standard library hasn’t been located in any other way.
gh-101467: The py.exe launcher now correctly filters when only a single runtime is installed. It also correctly handles prefix matches on tags so that -3.1 does not match 3.11, but would still match 3.1-32.
gh-101135: Restore ability to launch older 32-bit versions from the py.exe launcher when both 32-bit and 64-bit installs of the same version are available.
gh-82052: Fixed an issue where writing more than 32K of Unicode output to the console screen in one go can result in mojibake.
gh-100320: Ensures the PythonPath registry key from an install is used when launching from a different copy of Python that relies on an existing install to provide a copy of its modules and standard library.
gh-100247: Restores support for the py.exe launcher finding shebang commands in its configuration file using the full command name.
gh-100180: Update Windows installer to OpenSSL 1.1.1s
bpo-43984: winreg.SetValueEx() now leaves the target value untouched in the case of conversion errors. Previously, -1 would be written in case of such errors.

macOS

gh-100180: Update macOS installer to OpenSSL 1.1.1s

Tools/Demos

bpo-45256: Fix a bug that caused an AttributeError to be raised in python-gdb.py when py-locals is used without a frame.
gh-100342: Add missing NULL check for possible allocation failure in *args parsing in Argument Clinic.
gh-64490: Argument Clinic varargs bugfixes
Fix out-of-bounds error in _PyArg_UnpackKeywordsWithVararg().
Fix incorrect check which allowed more than one varargs in clinic.py.
Fix miscalculation of noptargs in generated code.
Do not generate noptargs when there is a vararg argument and no optional argument.

C API

gh-99240: In argument parsing, after deallocating newly allocated memory, reset its pointer to NULL.
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.2 2022/12/07 11:55:37 adam Exp $
d3 1
a3 1
VERS=		3.11.2
@


1.2
log
@python311 py311-html-docs: updated to 3.11.1

Python 3.11.1 final

Security

gh-100001: python -m http.server no longer allows terminal control characters sent within a garbage request to be printed to the stderr server log.

This is done by changing the http.server BaseHTTPRequestHandler .log_message method to replace control characters with a \xHH hex escape before printing.

gh-87604: Avoid publishing list of active per-interpreter audit hooks via the gc module

gh-98433: The IDNA codec decoder used on DNS hostnames by socket or asyncio related name resolution functions no longer involves a quadratic algorithm. This prevents a potential CPU denial of service if an out-of-spec excessive length hostname involving bidirectional characters were decoded. Some protocols such as urllib http 3xx redirects potentially allow for an attacker to supply such a name.

gh-98739: Update bundled libexpat to 2.5.0

gh-97612: Fix a shell code injection vulnerability in the get-remote-certificate.py example script. The script no longer uses a shell to run openssl commands. Issue reported and initial fix by Caleb Shortt. Patch by Victor Stinner.
Core and Builtins
gh-99886: Fix a crash when an object which does not have a dictionary frees its instance values.
gh-99891: Fix a bug in the tokenizer that could cause infinite recursion when showing syntax warnings that happen in the first line of the source. Patch by Pablo Galindo
gh-99729: Fix an issue that could cause frames to be visible to Python code as they are being torn down, possibly leading to memory corruption or hard crashes of the interpreter.
gh-99578: Fix a reference bug in _imp.create_builtin() after the creation of the first sub-interpreter for modules builtins and sys. Patch by Victor Stinner.
gh-99581: Fixed a bug that was causing a buffer overflow if the tokenizer copies a line missing the newline caracter from a file that is as long as the available tokenizer buffer. Patch by Pablo galindo
gh-99553: Fix bug where an ExceptionGroup subclass can wrap a BaseException.
gh-99370: Fix zip path for venv created from a non-installed python on POSIX platforms.
gh-99298: Fix an issue that could potentially cause incorrect error handling for some bytecode instructions.
gh-99205: Fix an issue that prevented PyThreadState and PyInterpreterState memory from being freed properly.
gh-99181: Fix failure in except* with unhashable exceptions.
gh-99204: Fix calculation of sys._base_executable when inside a POSIX virtual environment using copies of the python binary when the base installation does not provide the executable name used by the venv. Calculation will fall back to alternative names (“python<MAJOR>”, “python<MAJOR>.<MINOR>”).
gh-96055: Update faulthandler to emit an error message with the proper unexpected signal number. Patch by Dong-hee Na.
gh-99153: Fix location of SyntaxError for a try block with both except and except*.
gh-99103: Fix the error reporting positions of specialized traceback anchors when the source line contains Unicode characters.
gh-98852: Fix subscription of type aliases containing bare generic types or types like TypeVar: for example tuple[A, T][int] and tuple[TypeVar, T][int], where A is a generic type, and T is a type variable.
gh-98925: Lower the recursion depth for marshal on WASI to support wasmtime 2.0/main.
gh-98783: Fix multiple crashes in debug mode when str subclasses are used instead of str itself.
gh-99257: Fix an issue where member descriptors (such as those for __slots__) could behave incorrectly or crash instead of raising a TypeError when accessed via an instance of an invalid type.
gh-98374: Suppress ImportError for invalid query for help() command. Patch by Dong-hee Na.
gh-98415: Fix detection of MAC addresses for uuid on certain OSs. Patch by Chaim Sanders
gh-92119: Print exception class name instead of its string representation when raising errors from ctypes calls.
gh-96078: os.sched_yield() now release the GIL while calling sched_yield(2). Patch by Dong-hee Na.
gh-93354: Fix an issue that could delay the specialization of PRECALL instructions.
gh-97943: Bugfix: PyFunction_GetAnnotations() should return a borrowed reference. It was returning a new reference.
gh-97779: Ensure that all Python frame objects are backed by “complete” frames.
gh-97591: Fixed a missing incref/decref pair in Exception.__setstate__(). Patch by Ofey Chan.
gh-94526: Fix the Python path configuration used to initialized sys.path at Python startup. Paths are no longer encoded to UTF-8/strict to avoid encoding errors if it contains surrogate characters (bytes paths are decoded with the surrogateescape error handler). Patch by Victor Stinner.
gh-95921: Fix overly-broad source position information for chained comparisons used as branching conditions.
gh-96387: At Python exit, sometimes a thread holding the GIL can wait forever for a thread (usually a daemon thread) which requested to drop the GIL, whereas the thread already exited. To fix the race condition, the thread which requested the GIL drop now resets its request before exiting. Issue discovered and analyzed by Mingliang ZHAO. Patch by Victor Stinner.
gh-96864: Fix a possible assertion failure, fatal error, or SystemError if a line tracing event raises an exception while opcode tracing is enabled.
gh-96678: Fix undefined behaviour in C code of null pointer arithmetic.
gh-96754: Make sure that all frame objects created are created from valid interpreter frames. Prevents the possibility of invalid frames in backtraces and signal handlers.
gh-95196: Disable incorrect pickling of the C implemented classmethod descriptors.
gh-96005: On WASI ENOTCAPABLE is now mapped to PermissionError. The errno modules exposes the new error number. getpath.py now ignores PermissionError when it cannot open landmark files pybuilddir.txt and pyenv.cfg.
gh-93696: Allow pdb to locate source for frozen modules in the standard library.
bpo-31718: Raise ValueError instead of SystemError when methods of uninitialized io.IncrementalNewlineDecoder objects are called. Patch by Oren Milman.
bpo-38031: Fix a possible assertion failure in io.FileIO when the opener returns an invalid file descriptor.
Library
gh-100001: Also escape s in the http.server BaseHTTPRequestHandler.log_message so that it is technically possible to parse the line and reconstruct what the original data was. Without this a xHH is ambiguious as to if it is a hex replacement we put in or the characters r”x” came through in the original request line.

gh-93453: asyncio.get_event_loop() now only emits a deprecation warning when a new event loop was created implicitly. It no longer emits a deprecation warning if the current event loop was set.

gh-51524: Fix bug when calling trace.CoverageResults with valid infile.

gh-99645: Fix a bug in handling class cleanups in unittest.TestCase. Now addClassCleanup() uses separate lists for different TestCase subclasses, and doClassCleanups() only cleans up the particular class.

gh-97001: Release the GIL when calling termios APIs to avoid blocking threads.

gh-99341: Fix ast.increment_lineno() to also cover ast.TypeIgnore when changing line numbers.

gh-99418: Fix bug in urllib.parse.urlparse() that causes URL schemes that begin with a digit, a plus sign, or a minus sign to be parsed incorrectly.

gh-99382: Check the number of arguments in substitution in user generics containing a TypeVarTuple and one or more TypeVar.

gh-99379: Fix substitution of ParamSpec followed by TypeVarTuple in generic aliases.

gh-99344: Fix substitution of TypeVarTuple and ParamSpec together in user generics.

gh-74044: Fixed bug where inspect.signature() reported incorrect arguments for decorated methods.

gh-99275: Fix SystemError in ctypes when exception was not set during __initsubclass__.

gh-99277: Remove older version of _SSLProtocolTransport.get_write_buffer_limits in asyncio.sslproto

gh-99248: fix negative numbers failing in verify()

gh-99155: Fix statistics.NormalDist pickle with 0 and 1 protocols.

gh-93464: enum.auto() is now correctly activated when combined with other assignment values. E.g. ONE = auto(), 'some text' will now evaluate as (1, 'some text').

gh-99134: Update the bundled copy of pip to version 22.3.1.

gh-83004: Clean up refleak on failed module initialisation in _zoneinfo

gh-83004: Clean up refleaks on failed module initialisation in in _pickle

gh-83004: Clean up refleak on failed module initialisation in _io.

gh-98897: Fix memory leak in math.dist() when both points don’t have the same dimension. Patch by Kumar Aditya.

gh-98706: [3.11] Applied changes from importlib_metadata 4.11.4 through 4.13, including compatibility and robustness fixes for Distribution objects without _normalized_name, disallowing invalid inputs to Distribution.from_name, and refined behaviors in PathDistribution._name_from_stem and PathDistribution._normalized_name.

gh-98793: Fix argument typechecks in _overlapped.WSAConnect() and _overlapped.Overlapped.WSASendTo() functions.

gh-98744: Prevent crashing in traceback when retrieving the byte-offset for some source files that contain certain unicode characters.

gh-98740: Fix internal error in the re module which in very rare circumstances prevented compilation of a regular expression containing a conditional expression without the “else” branch.

gh-98703: Fix asyncio.StreamWriter.drain() to call protocol.connection_lost callback only once on Windows.

gh-98624: Add a mutex to unittest.mock.NonCallableMock to protect concurrent access to mock attributes.

gh-89237: Fix hang on Windows in subprocess.wait_closed() in asyncio with ProactorEventLoop. Patch by Kumar Aditya.

gh-98458: Fix infinite loop in unittest when a self-referencing chained exception is raised

gh-97928: tkinter.Text.count() raises now an exception for options starting with “-” instead of silently ignoring them.

gh-97966: On uname_result, restored expectation that _fields and _asdict would include all six properties including processor.

gh-98307: A createSocket() method was added to SysLogHandler.

gh-96035: Fix bug in urllib.parse.urlparse() that causes certain port numbers containing whitespace, underscores, plus and minus signs, or non-ASCII digits to be incorrectly accepted.

gh-98251: Allow venv to pass along PYTHON* variables to ensurepip and pip when they do not impact path resolution

gh-98178: On macOS, fix a crash in syslog.syslog() in multi-threaded applications. On macOS, the libc syslog() function is not thread-safe, so syslog.syslog() no longer releases the GIL to call it. Patch by Victor Stinner.

gh-96151: Allow BUILTINS to be a valid field name for frozen dataclasses.

gh-87730: Wrap network errors consistently in urllib FTP support, so the test suite doesn’t fail when a network is available but the public internet is not reachable.

gh-98086: Make sure patch.dict() can be applied on async functions.

gh-90985: Earlier in 3.11 we deprecated asyncio.Task.cancel("message"). We realized we were too harsh, and have undeprecated it.

gh-97837: Change deprecate warning message in unittest from

It is deprecated to return a value!=None

to

It is deprecated to return a value that is not None from a test case

gh-97825: Fixes AttributeError when subprocess.check_output() is used with argument input=None and either of the arguments encoding or errors are used.

gh-82836: Fix is_private properties in the ipaddress module. Previously non-private networks (0.0.0.0/0) would return True from this method; now they correctly return False.

gh-96827: Avoid spurious tracebacks from asyncio when default executor cleanup is delayed until after the event loop is closed (e.g. as the result of a keyboard interrupt).

gh-97592: Avoid a crash in the C version of asyncio.Future.remove_done_callback() when an evil argument is passed.

gh-97639: Remove tokenize.NL check from tabnanny.

gh-73588: Fix generation of the default name of tkinter.Checkbutton. Previously, checkbuttons in different parent widgets could have the same short name and share the same state if arguments “name” and “variable” are not specified. Now they are globally unique.

gh-97005: Update bundled libexpat to 2.4.9

gh-85760: Fix race condition in asyncio where process_exited() called before the pipe_data_received() leading to inconsistent output. Patch by Kumar Aditya.

gh-96819: Fixed check in multiprocessing.resource_tracker that guarantees that the length of a write to a pipe is not greater than PIPE_BUF.

gh-96741: Corrected type annotation for dataclass attribute pstats.FunctionProfile.ncalls to be str.

gh-95987: Fix repr of Any subclasses.

gh-96388: Work around missing socket functions in socket’s __repr__.

gh-96073: In inspect, fix overeager replacement of “typing.” in formatting annotations.

gh-96192: Fix handling of bytes path-like objects in os.ismount().

gh-96052: Fix handling compiler warnings (SyntaxWarning and DeprecationWarning) in codeop.compile_command() when checking for incomplete input. Previously it emitted warnings and raised a SyntaxError. Now it always returns None for incomplete input without emitting any warnings.

gh-88863: To avoid apparent memory leaks when asyncio.open_connection() raises, break reference cycles generated by local exception and future instances (which has exception instance as its member var). Patch by Dong Uk, Kang.

gh-91212: Fixed flickering of the turtle window when the tracer is turned off. Patch by Shin-myoung-serp.

gh-88050: Fix asyncio subprocess transport to kill process cleanly when process is blocked and avoid RuntimeError when loop is closed. Patch by Kumar Aditya.

gh-93858: Prevent error when activating venv in nested fish instances.

gh-91078: TarFile.next() now returns None when called on an empty tarfile.

bpo-47220: Document the optional callback parameter of WeakMethod. Patch by Géry Ogam.

bpo-46364: Restrict use of sockets instead of pipes for stdin of subprocesses created by asyncio to AIX platform only.

bpo-38523: shutil.copytree() now applies the ignore_dangling_symlinks argument recursively.

bpo-36267: Fix IndexError in argparse.ArgumentParser when a store_true action is given an explicit argument.

Documentation

gh-92892: Document that calling variadic functions with ctypes requires special care on macOS/arm64 (and possibly other platforms).
gh-85525: Remove extra row
gh-95588: Clarified the conflicting advice given in the ast documentation about ast.literal_eval() being “safe” for use on untrusted input while at the same time warning that it can crash the process. The latter statement is true and is deemed unfixable without a large amount of work unsuitable for a bugfix. So we keep the warning and no longer claim that literal_eval is safe.
bpo-41825: Restructured the documentation for the os.wait* family of functions, and improved the docs for os.waitid() with more explanation of the possible argument constants.

Tests

gh-99892: Skip test_normalization() of test_unicodedata if it fails to download NormalizationTest.txt file from pythontest.net. Patch by Victor Stinner.
gh-99934: Correct test_marsh on (32 bit) x86: test_deterministic sets was failing.
gh-99659: Optional big memory tests in test_sqlite3 now catch the correct sqlite.DataError exception type in case of too large strings and/or blobs passed.
gh-98713: Fix a bug in the typing tests where a test relying on CPython-specific implementation details was not decorated with @@cpython_only and was not skipped on other implementations.
gh-87390: Add tests for star-unpacking with PEP 646, and some other miscellaneous PEP 646 tests.
gh-96853: Added explicit coverage of Py_Initialize (and hence Py_InitializeEx) back to the embedding tests (all other embedding tests migrated to Py_InitializeFromConfig in Python 3.11)
bpo-34272: Some C API tests were moved into the new Lib/test/test_capi/ directory.

Build

gh-99086: Fix -Wimplicit-int, -Wstrict-prototypes, and -Wimplicit-function-declaration compiler warnings in configure checks.
gh-99337: Fix a compilation issue with GCC 12 on macOS.
gh-99086: Fix -Wimplicit-int compiler warning in configure check for PTHREAD_SCOPE_SYSTEM.
gh-98872: Fix a possible fd leak in Programs/_freeze_module.c introduced in Python 3.11.
gh-99016: Fix build with PYTHON_FOR_REGEN=python3.8.
gh-97731: Specify the full path to the source location for make docclean (needed for cross-builds).
gh-98707: Don’t use vendored libmpdec headers if --with-system-libmpdec is passed to configure. Don’t use vendored libexpat headers if --with-system-expat is passed to !configure.
gh-96761: Fix the build process of clang compiler for _bootstrap_python if LTO optimization is applied. Patch by Matthias Görgens and Dong-hee Na.
gh-96883: wasm32-emscripten builds for browsers now include concurrent.futures for asyncio and unittest.mock.
gh-84461: wasm32-emscripten platform no longer builds resource module, getresuid(), getresgid(), and their setters. The APIs are stubs and not functional.
gh-94280: Updated pegen regeneration script on Windows to find and use Python 3.9 or higher. Prior to this, pegen regeneration already required 3.9 or higher, but the script may have used lower versions of Python.

Windows

gh-99345: Use faster initialization functions to detect install location for Windows Store package
gh-98629: Fix initialization of sys.version and sys._git on Windows
gh-99442: Fix handling in Python Launcher for Windows when argv[0] does not include a file extension.
gh-98689: Update Windows builds to zlib v1.2.13. v1.2.12 has CVE-2022-37434, but the vulnerable inflateGetHeader API is not used by Python.
gh-98790: Assumes that a missing DLLs directory means that standard extension modules are in the executable’s directory.
gh-98745: Update py.exe launcher to install 3.11 by default and 3.12 on request.
gh-98692: Fix the Python Launcher for Windows ignoring unrecognized shebang lines instead of treating them as local paths
gh-94328: Update Windows installer to use SQLite 3.39.4.
gh-97728: Fix possible crashes caused by the use of uninitialized variables when pass invalid arguments in os.system() on Windows and in Windows-specific modules (like winreg).
gh-96965: Update libffi to 3.4.3
gh-94781: Fix pcbuild.proj to clean previous instances of ouput files in Python\deepfreeze and Python\frozen_modules directories on Windows. Patch by Charlie Zhao.
bpo-40882: Fix a memory leak in multiprocessing.shared_memory.SharedMemory on Windows.

macOS

gh-87235: On macOS python3 /dev/fd/9 9</path/to/script.py failed for any script longer than a couple of bytes.
gh-98940: Fix Mac/Extras.install.py file filter bug.
gh-94328: Update macOS installer to SQLite 3.39.4.

IDLE

gh-97527: Fix a bug in the previous bugfix that caused IDLE to not start when run with 3.10.8, 3.12.0a1, and at least Microsoft Python 3.10.2288.0 installed without the Lib/test package. 3.11.0 was never affected.

Tools/Demos

gh-95853: The wasm_build.py script now pre-builds Emscripten ports, checks for broken EMSDK versions, and warns about pkg-config env vars.
gh-95853: The new tool Tools/wasm/wasm_builder.py automates configure, compile, and test steps for building CPython on WebAssembly platforms.
gh-95731: Fix handling of module docstrings in Tools/i18n/pygettext.py.

C API

gh-98680: PyBUF_* constants were marked as part of Limited API of Python 3.11+. These were available in 3.11.0 with Py_LIMITED_API defined for 3.11, and are necessary to use the buffer API.
gh-98978: Fix use-after-free in Py_SetPythonHome(NULL), Py_SetProgramName(NULL) and _Py_SetProgramFullPath(NULL) function calls. Issue reported by Benedikt Reinartz. Patch by Victor Stinner.
gh-96853: Py_InitializeEx now correctly calls PyConfig_Clear after initializing the interpreter (the omission didn’t cause a memory leak only because none of the dynamically allocated config fields are populated by the wrapper function)
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.1 2022/10/31 09:50:40 adam Exp $
d3 1
a3 1
VERS=		3.11.1
@


1.1
log
@python311 py311-html-docs: added version 3.11.0

Python 3.11 is between 10-60% faster than Python 3.10. On average, we measured a 1.25x speedup on the standard benchmark suite. See Faster CPython for details.

New syntax features:

PEP 654: Exception Groups and except*

New built-in features:

PEP 678: Exceptions can be enriched with notes

New standard library modules:

PEP 680: tomllib — Support for parsing TOML in the Standard Library

Interpreter improvements:

PEP 657: Fine-grained error locations in tracebacks
New -P command line option and PYTHONSAFEPATH environment variable to disable automatically prepending potentially unsafe paths to sys.path

New typing features:

PEP 646: Variadic generics
PEP 655: Marking individual TypedDict items as required or not-required
PEP 673: Self type
PEP 675: Arbitrary literal string type
PEP 681: Data class transforms

Important deprecations, removals and restrictions:

PEP 594: Many legacy standard library modules have been deprecated and will be removed in Python 3.13
PEP 624: Py_UNICODE encoder APIs have been removed
PEP 670: Macros converted to static inline functions
@
text
@d1 1
a1 1
# $NetBSD$
d3 1
a3 1
VERS=		3.11.0
@