Skip to content

Commit 703df80

Browse files
naschemenascheme
authored
Merge branch 'main' into gh-158197-split-dict-iteration
2 parents 6418581 + 010bebb commit 703df80

1,464 files changed

Lines changed: 27781 additions & 11677 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/ISSUE_TEMPLATE/bug.yml‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,6 @@ body:
3434
label: "CPython versions tested on:"
3535
multiple: true
3636
options:
37-
- "3.10"
3837
- "3.11"
3938
- "3.12"
4039
- "3.13"

‎.github/ISSUE_TEMPLATE/crash.yml‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,6 @@ body:
2828
label: "CPython versions tested on:"
2929
multiple: true
3030
options:
31-
- "3.10"
3231
- "3.11"
3332
- "3.12"
3433
- "3.13"

‎.github/VULNERABILITY_REPORT.yml‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
name: Vulnerability report
2+
description: Privately report a potential security vulnerability in CPython
3+
body:
4+
- type: markdown
5+
attributes:
6+
value: |
7+
**Not all bugs are vulnerabilities.** Before submitting, read the [Python security policy](https://devguide.python.org/security/policy/) to understand which issues are vulnerabilities and what versions of Python accept reports.
8+
9+
Keep the report short and in plain text: no headers, tables, PDFs, binaries, or severity and CVSS information.
10+
11+
Reports that do not contain a potential security vulnerability will be discarded without a reply.
12+
13+
To report vulnerabilities that affect other projects (such as pip or python.org), or if you are not sure where to send your report, email [security@python.org](mailto:security@python.org).
14+
- type: textarea
15+
id: summary
16+
attributes:
17+
label: Summary
18+
description: A few sentences describing the vulnerability.
19+
validations:
20+
required: true
21+
- type: textarea
22+
id: threat_model
23+
attributes:
24+
label: Threat model
25+
description: >
26+
What does the attacker control, and what do they gain? Describe the code, configuration, or deployment that may exist in the real world and is exploitable. Where possible, cite the relevant part of the [security policy](https://devguide.python.org/security/policy/#what-types-of-bugs-are-vulnerabilities).
27+
validations:
28+
required: true
29+
- type: textarea
30+
id: proof_of_concept
31+
attributes:
32+
label: Proof of concept
33+
description: >
34+
A script that reproduces the issue and clearly indicates whether the vulnerability is present, such as exiting with `1` if vulnerable and `0` if not. If it depends on a specially constructed binary file, include a script to construct the file rather than the file itself.
35+
36+
Wrap scripts longer than a few lines in a [collapsed section](https://docs.github.com/en/get-started/writing-on-github/working-with-advanced-formatting/organizing-information-with-collapsed-sections) using `<details> ... </details>`.
37+
validations:
38+
required: true
39+
- type: dropdown
40+
id: versions
41+
attributes:
42+
label: "CPython versions tested on:"
43+
description: >
44+
If any tested version was not vulnerable, say which in the summary. Only [supported versions](https://devguide.python.org/versions/) accept reports.
45+
multiple: true
46+
options:
47+
- "3.11"
48+
- "3.12"
49+
- "3.13"
50+
- "3.14"
51+
- "3.15"
52+
- "3.16"
53+
- "CPython main branch"
54+
validations:
55+
required: true
56+
- type: textarea
57+
id: patch
58+
attributes:
59+
label: Suggested fix
60+
description: Ideally, a minimal patch with the mitigation.
61+
validations:
62+
required: false
63+
- type: checkboxes
64+
id: checklist
65+
attributes:
66+
label: Before submitting
67+
options:
68+
- label: I have read the security policy and evaluated this report against it.
69+
required: true
70+
- label: I have checked that this issue is not already resolved on the `main` branch.
71+
required: true
72+
- label: I have verified the factual validity of everything in this report, including any content produced by an LLM.
73+
required: true

‎.github/dependabot.yml‎

Lines changed: 30 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,17 @@ updates:
2828
cooldown:
2929
default-days: 14
3030

31+
- package-ecosystem: "npm"
32+
directory: "/Platforms/emscripten/browser_test/"
33+
schedule:
34+
interval: "quarterly"
35+
labels: ["OS-emscripten", "skip issue", "skip news"]
36+
groups:
37+
npm:
38+
patterns: ["*"]
39+
cooldown:
40+
default-days: 14
41+
3142
# Release branches: Dependabot only reads this file from the default
3243
# branch, so each branch that should get its own actions bumps needs an
3344
# entry here with `target-branch`. Add one when a new release branch is
@@ -92,18 +103,6 @@ updates:
92103
cooldown:
93104
default-days: 14
94105

95-
- package-ecosystem: "github-actions"
96-
target-branch: "3.10"
97-
directory: "/"
98-
schedule:
99-
interval: "quarterly"
100-
labels: ["skip issue", "skip news"]
101-
groups:
102-
actions:
103-
patterns: ["*"]
104-
cooldown:
105-
default-days: 14
106-
107106
# Only bump bugfix branches for pip. Remove
108107
# the entry when branch goes security-only.
109108
- package-ecosystem: "pip"
@@ -130,14 +129,28 @@ updates:
130129
cooldown:
131130
default-days: 14
132131

133-
- package-ecosystem: "pip"
134-
target-branch: "3.13"
135-
directory: "/Tools/"
132+
# Only bump bugfix branches for npm. Remove
133+
# the entry when branch goes security-only.
134+
- package-ecosystem: "npm"
135+
target-branch: "3.15"
136+
directory: "/Platforms/emscripten/browser_test/"
136137
schedule:
137138
interval: "quarterly"
138-
labels: ["skip issue", "skip news"]
139+
labels: ["OS-emscripten", "skip issue", "skip news"]
139140
groups:
140-
pip:
141+
npm:
142+
patterns: ["*"]
143+
cooldown:
144+
default-days: 14
145+
146+
- package-ecosystem: "npm"
147+
target-branch: "3.14"
148+
directory: "/Platforms/emscripten/browser_test/"
149+
schedule:
150+
interval: "quarterly"
151+
labels: ["OS-emscripten", "skip issue", "skip news"]
152+
groups:
153+
npm:
141154
patterns: ["*"]
142155
cooldown:
143156
default-days: 14

‎.github/workflows/build.yml‎

Lines changed: 15 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -346,18 +346,28 @@ jobs:
346346
run: python3 Platforms/Android ci --fast-ci ${{ matrix.arch }}-linux-android
347347

348348
build-ios:
349-
name: iOS
349+
name: >-
350+
iOS
351+
${{ fromJSON(matrix.free-threading) && '(free-threading)' || '' }}
350352
needs: build-context
351353
if: needs.build-context.outputs.run-ios == 'true'
352354
timeout-minutes: 60
353355
runs-on: macos-26
356+
strategy:
357+
fail-fast: false
358+
matrix:
359+
free-threading:
360+
- false
361+
- true
354362
steps:
355363
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
356364
with:
357365
persist-credentials: false
358366

359367
- name: Build and test
360-
run: python3 Platforms/Apple ci iOS --fast-ci
368+
run: >-
369+
python3 Platforms/Apple ci iOS --fast-ci
370+
${{ fromJSON(matrix.free-threading) && '--abiflags t' || '' }}
361371
362372
build-emscripten:
363373
name: 'Emscripten'
@@ -547,6 +557,9 @@ jobs:
547557
- check-name: Undefined behavior
548558
sanitizer: UBSan
549559
free-threading: false
560+
- check-name: Memory
561+
sanitizer: MSan
562+
free-threading: false
550563
uses: ./.github/workflows/reusable-san.yml
551564
with:
552565
sanitizer: ${{ matrix.sanitizer }}

‎.github/workflows/mypy.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -69,7 +69,7 @@ jobs:
6969
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
7070
with:
7171
persist-credentials: false
72-
- uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
72+
- uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
7373
with:
7474
python-version: "3.15"
7575
activate-environment: true

‎.github/workflows/reusable-cifuzz.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,7 @@ jobs:
4343
path: ./out/artifacts
4444
- name: Upload SARIF
4545
if: always() && steps.build.outcome == 'success'
46-
uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0
46+
uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
4747
with:
4848
sarif_file: cifuzz-sarif/results.sarif
4949
checkout_path: cifuzz-sarif

‎.github/workflows/reusable-san.yml‎

Lines changed: 22 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -60,7 +60,7 @@ jobs:
6060
|| ''
6161
}}
6262
- name: UBSan option setup
63-
if: inputs.sanitizer != 'TSan'
63+
if: inputs.sanitizer == 'UBSan'
6464
run: >-
6565
echo
6666
"UBSAN_OPTIONS=${SAN_LOG_OPTION}
@@ -69,6 +69,22 @@ jobs:
6969
>> "$GITHUB_ENV"
7070
env:
7171
SAN_LOG_OPTION: log_path=${{ github.workspace }}/san_log
72+
- name: MSan option setup
73+
if: inputs.sanitizer == 'MSan'
74+
run: |
75+
sudo sysctl -w vm.mmap_rnd_bits=28 # Reduce ASLR to avoid MSan re-executing
76+
77+
echo "MSAN_OPTIONS=${SAN_LOG_OPTION} allocator_may_return_null=1 handle_segv=0" >> "$GITHUB_ENV"
78+
# MSan reports false positives for memory initialized by libraries
79+
# that are not built with MSan, so disable modules that use them.
80+
# _remote_debugging links to libzstd directly, but we unpoision the memory.
81+
{
82+
echo '*disabled*'
83+
echo '_bz2 _ctypes _curses _curses_panel _dbm _decimal _gdbm _hashlib'
84+
echo '_lzma _sqlite3 _ssl _tkinter _uuid _zstd readline zlib'
85+
} > Modules/Setup.local
86+
env:
87+
SAN_LOG_OPTION: log_path=${{ github.workspace }}/san_log
7288
- name: Add ccache to PATH
7389
run: |
7490
echo "PATH=/usr/lib/ccache:$PATH" >> "$GITHUB_ENV"
@@ -93,6 +109,8 @@ jobs:
93109
# gh-157958: -O2 instead of the pydebug default -Og to avoid a clang 21
94110
# compile-time blowup on some interpreter files.
95111
# (https://github.com/llvm/llvm-project/issues/179695)
112+
# MSan uses --with-assertions instead of --with-pydebug because its
113+
# hooks on the Python memory allocators hide uninitialized reads.
96114
- name: Configure CPython
97115
run: >-
98116
./configure
@@ -101,9 +119,11 @@ jobs:
101119
${{
102120
inputs.sanitizer == 'TSan'
103121
&& '--with-thread-sanitizer'
122+
|| inputs.sanitizer == 'MSan'
123+
&& '--with-memory-sanitizer'
104124
|| '--with-undefined-behavior-sanitizer --with-strict-overflow'
105125
}}
106-
--with-pydebug
126+
${{ inputs.sanitizer == 'MSan' && '--with-assertions' || '--with-pydebug' }}
107127
${{ inputs.sanitizer == 'TSan' && '--with-openssl="$OPENSSL_DIR" --with-openssl-rpath=auto' || '' }}
108128
${{ inputs.free-threading && '--disable-gil' || '' }}
109129
- name: Build CPython

‎.gitignore‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -76,10 +76,10 @@ Lib/test/data/*
7676
Apple/iOS/Frameworks/
7777
Apple/iOS/Resources/Info.plist
7878
Apple/testbed/build
79-
Apple/testbed/Python.xcframework/*/bin
80-
Apple/testbed/Python.xcframework/*/include
81-
Apple/testbed/Python.xcframework/*/lib
82-
Apple/testbed/Python.xcframework/*/Python.framework
79+
Platforms/Apple/testbed/Python*.xcframework/*/bin
80+
Platforms/Apple/testbed/Python*.xcframework/*/include
81+
Platforms/Apple/testbed/Python*.xcframework/*/lib
82+
Platforms/Apple/testbed/Python*.xcframework/*/Python*.framework
8383
Apple/testbed/*Testbed.xcodeproj/project.xcworkspace
8484
Apple/testbed/*Testbed.xcodeproj/xcuserdata
8585
Mac/Makefile

‎Doc/Makefile‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -189,12 +189,13 @@ venv:
189189
.PHONY: lock
190190
lock:
191191
# Dependencies have a 14 day cooldown period to mitigate supply chain attacks,
192-
# except for sphinx_linklint and python-docs-theme, which are maintained by
192+
# except for blurb, python-docs-theme and sphinx_linklint, which are maintained by
193193
# core team members.
194194
$(UV) pip compile requirements.txt \
195195
--upgrade --exclude-newer P14D \
196-
--exclude-newer-package sphinx_linklint=PT0S \
196+
--exclude-newer-package blurb=PT0S \
197197
--exclude-newer-package python-docs-theme=PT0S \
198+
--exclude-newer-package sphinx_linklint=PT0S \
198199
--no-cache --output-file $(REQUIREMENTS) \
199200
--python-version 3.12 --universal \
200201
--custom-compile-command="make lock"

0 commit comments

Comments
 (0)