Skip to content

Commit cccedb8

Browse files
graingertgraingert
authored
Merge branch 'main' into unignore-error-port-unreachable-in-proactor
2 parents 37f3e94 + 036d309 commit cccedb8

1,415 files changed

Lines changed: 23497 additions & 8036 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/ISSUE_TEMPLATE/bug.yml‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,6 @@ body:
3434
label: "CPython versions tested on:"
3535
multiple: true
3636
options:
37-
- "3.10"
3837
- "3.11"
3938
- "3.12"
4039
- "3.13"

‎.github/ISSUE_TEMPLATE/crash.yml‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,6 @@ body:
2828
label: "CPython versions tested on:"
2929
multiple: true
3030
options:
31-
- "3.10"
3231
- "3.11"
3332
- "3.12"
3433
- "3.13"

‎.github/VULNERABILITY_REPORT.yml‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
name: Vulnerability report
2+
description: Privately report a potential security vulnerability in CPython
3+
body:
4+
- type: markdown
5+
attributes:
6+
value: |
7+
**Not all bugs are vulnerabilities.** Before submitting, read the [Python security policy](https://devguide.python.org/security/policy/) to understand which issues are vulnerabilities and what versions of Python accept reports.
8+
9+
Keep the report short and in plain text: no headers, tables, PDFs, binaries, or severity and CVSS information.
10+
11+
Reports that do not contain a potential security vulnerability will be discarded without a reply.
12+
13+
To report vulnerabilities that affect other projects (such as pip or python.org), or if you are not sure where to send your report, email [security@python.org](mailto:security@python.org).
14+
- type: textarea
15+
id: summary
16+
attributes:
17+
label: Summary
18+
description: A few sentences describing the vulnerability.
19+
validations:
20+
required: true
21+
- type: textarea
22+
id: threat_model
23+
attributes:
24+
label: Threat model
25+
description: >
26+
What does the attacker control, and what do they gain? Describe the code, configuration, or deployment that may exist in the real world and is exploitable. Where possible, cite the relevant part of the [security policy](https://devguide.python.org/security/policy/#what-types-of-bugs-are-vulnerabilities).
27+
validations:
28+
required: true
29+
- type: textarea
30+
id: proof_of_concept
31+
attributes:
32+
label: Proof of concept
33+
description: >
34+
A script that reproduces the issue and clearly indicates whether the vulnerability is present, such as exiting with `1` if vulnerable and `0` if not. If it depends on a specially constructed binary file, include a script to construct the file rather than the file itself.
35+
36+
Wrap scripts longer than a few lines in a [collapsed section](https://docs.github.com/en/get-started/writing-on-github/working-with-advanced-formatting/organizing-information-with-collapsed-sections) using `<details> ... </details>`.
37+
validations:
38+
required: true
39+
- type: dropdown
40+
id: versions
41+
attributes:
42+
label: "CPython versions tested on:"
43+
description: >
44+
If any tested version was not vulnerable, say which in the summary. Only [supported versions](https://devguide.python.org/versions/) accept reports.
45+
multiple: true
46+
options:
47+
- "3.11"
48+
- "3.12"
49+
- "3.13"
50+
- "3.14"
51+
- "3.15"
52+
- "3.16"
53+
- "CPython main branch"
54+
validations:
55+
required: true
56+
- type: textarea
57+
id: patch
58+
attributes:
59+
label: Suggested fix
60+
description: Ideally, a minimal patch with the mitigation.
61+
validations:
62+
required: false
63+
- type: checkboxes
64+
id: checklist
65+
attributes:
66+
label: Before submitting
67+
options:
68+
- label: I have read the security policy and evaluated this report against it.
69+
required: true
70+
- label: I have checked that this issue is not already resolved on the `main` branch.
71+
required: true
72+
- label: I have verified the factual validity of everything in this report, including any content produced by an LLM.
73+
required: true

‎.github/dependabot.yml‎

Lines changed: 30 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,17 @@ updates:
2828
cooldown:
2929
default-days: 14
3030

31+
- package-ecosystem: "npm"
32+
directory: "/Platforms/emscripten/browser_test/"
33+
schedule:
34+
interval: "quarterly"
35+
labels: ["OS-emscripten", "skip issue", "skip news"]
36+
groups:
37+
npm:
38+
patterns: ["*"]
39+
cooldown:
40+
default-days: 14
41+
3142
# Release branches: Dependabot only reads this file from the default
3243
# branch, so each branch that should get its own actions bumps needs an
3344
# entry here with `target-branch`. Add one when a new release branch is
@@ -92,18 +103,6 @@ updates:
92103
cooldown:
93104
default-days: 14
94105

95-
- package-ecosystem: "github-actions"
96-
target-branch: "3.10"
97-
directory: "/"
98-
schedule:
99-
interval: "quarterly"
100-
labels: ["skip issue", "skip news"]
101-
groups:
102-
actions:
103-
patterns: ["*"]
104-
cooldown:
105-
default-days: 14
106-
107106
# Only bump bugfix branches for pip. Remove
108107
# the entry when branch goes security-only.
109108
- package-ecosystem: "pip"
@@ -130,14 +129,28 @@ updates:
130129
cooldown:
131130
default-days: 14
132131

133-
- package-ecosystem: "pip"
134-
target-branch: "3.13"
135-
directory: "/Tools/"
132+
# Only bump bugfix branches for npm. Remove
133+
# the entry when branch goes security-only.
134+
- package-ecosystem: "npm"
135+
target-branch: "3.15"
136+
directory: "/Platforms/emscripten/browser_test/"
136137
schedule:
137138
interval: "quarterly"
138-
labels: ["skip issue", "skip news"]
139+
labels: ["OS-emscripten", "skip issue", "skip news"]
139140
groups:
140-
pip:
141+
npm:
142+
patterns: ["*"]
143+
cooldown:
144+
default-days: 14
145+
146+
- package-ecosystem: "npm"
147+
target-branch: "3.14"
148+
directory: "/Platforms/emscripten/browser_test/"
149+
schedule:
150+
interval: "quarterly"
151+
labels: ["OS-emscripten", "skip issue", "skip news"]
152+
groups:
153+
npm:
141154
patterns: ["*"]
142155
cooldown:
143156
default-days: 14

‎.github/workflows/build.yml‎

Lines changed: 15 additions & 51 deletions
Original file line numberDiff line numberDiff line change
@@ -346,18 +346,28 @@ jobs:
346346
run: python3 Platforms/Android ci --fast-ci ${{ matrix.arch }}-linux-android
347347

348348
build-ios:
349-
name: iOS
349+
name: >-
350+
iOS
351+
${{ fromJSON(matrix.free-threading) && '(free-threading)' || '' }}
350352
needs: build-context
351353
if: needs.build-context.outputs.run-ios == 'true'
352354
timeout-minutes: 60
353355
runs-on: macos-26
356+
strategy:
357+
fail-fast: false
358+
matrix:
359+
free-threading:
360+
- false
361+
- true
354362
steps:
355363
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
356364
with:
357365
persist-credentials: false
358366

359367
- name: Build and test
360-
run: python3 Platforms/Apple ci iOS --fast-ci
368+
run: >-
369+
python3 Platforms/Apple ci iOS --fast-ci
370+
${{ fromJSON(matrix.free-threading) && '--abiflags t' || '' }}
361371
362372
build-emscripten:
363373
name: 'Emscripten'
@@ -481,53 +491,6 @@ jobs:
481491
if: fromJSON(needs.build-context.outputs.run-tests)
482492
uses: ./.github/workflows/reusable-test-lazy-imports-all.yml
483493

484-
build-asan:
485-
name: 'Address sanitizer'
486-
runs-on: ${{ matrix.os }}
487-
timeout-minutes: 60
488-
needs: build-context
489-
if: needs.build-context.outputs.run-ubuntu == 'true'
490-
strategy:
491-
fail-fast: false
492-
matrix:
493-
os: [ubuntu-26.04]
494-
env:
495-
OPENSSL_VER: 3.5.9
496-
PYTHONSTRICTEXTENSIONBUILD: 1
497-
ASAN_OPTIONS: detect_leaks=0:allocator_may_return_null=1:handle_segv=0
498-
steps:
499-
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
500-
with:
501-
persist-credentials: false
502-
- name: Runner image version
503-
run: echo "IMAGE_OS_VERSION=${ImageOS}-${ImageVersion}" >> "$GITHUB_ENV"
504-
- name: Register gcc problem matcher
505-
run: echo "::add-matcher::.github/problem-matchers/gcc.json"
506-
- name: Install dependencies
507-
run: sudo ./.github/workflows/posix-deps-apt.sh
508-
- name: Configure OpenSSL env vars
509-
run: |
510-
echo "MULTISSL_DIR=${GITHUB_WORKSPACE}/multissl" >> "$GITHUB_ENV"
511-
echo "OPENSSL_DIR=${GITHUB_WORKSPACE}/multissl/openssl/${OPENSSL_VER}" >> "$GITHUB_ENV"
512-
echo "LD_LIBRARY_PATH=${GITHUB_WORKSPACE}/multissl/openssl/${OPENSSL_VER}/lib" >> "$GITHUB_ENV"
513-
- name: 'Restore OpenSSL build'
514-
id: cache-openssl
515-
uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
516-
with:
517-
path: ./multissl/openssl/${{ env.OPENSSL_VER }}
518-
key: ${{ matrix.os }}-multissl-openssl-${{ env.OPENSSL_VER }}
519-
- name: Install OpenSSL
520-
if: steps.cache-openssl.outputs.cache-hit != 'true'
521-
run: python3 Tools/ssl/multissltests.py --steps=library --base-directory "$MULTISSL_DIR" --openssl "$OPENSSL_VER" --system Linux
522-
- name: Configure CPython
523-
run: ./configure --config-cache --with-address-sanitizer --without-pymalloc --with-openssl="$OPENSSL_DIR"
524-
- name: Build CPython
525-
run: make -j4
526-
- name: Display build info
527-
run: make pythoninfo
528-
- name: Tests
529-
run: xvfb-run make ci
530-
531494
build-san:
532495
# ${{ '' } is a hack to nest jobs under the same sidebar category.
533496
name: Sanitizers${{ '' }} # zizmor: ignore[obfuscation]
@@ -544,6 +507,9 @@ jobs:
544507
sanitizer:
545508
- TSan
546509
include:
510+
- check-name: Address
511+
sanitizer: ASan
512+
free-threading: false
547513
- check-name: Undefined behavior
548514
sanitizer: UBSan
549515
free-threading: false
@@ -657,7 +623,6 @@ jobs:
657623
- build-wasi
658624
- test-hypothesis
659625
- test-lazy-imports-all
660-
- build-asan
661626
- build-san
662627
- cross-build-linux
663628
- cifuzz
@@ -704,7 +669,6 @@ jobs:
704669
build-ubuntu-installed,
705670
build-ubuntu-ssltests,
706671
test-hypothesis,
707-
build-asan,
708672
build-san,
709673
cross-build-linux,
710674
'

‎.github/workflows/mypy.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -69,7 +69,7 @@ jobs:
6969
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
7070
with:
7171
persist-credentials: false
72-
- uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
72+
- uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
7373
with:
7474
python-version: "3.15"
7575
activate-environment: true

‎.github/workflows/reusable-cifuzz.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,7 @@ jobs:
4343
path: ./out/artifacts
4444
- name: Upload SARIF
4545
if: always() && steps.build.outcome == 'success'
46-
uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0
46+
uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
4747
with:
4848
sarif_file: cifuzz-sarif/results.sarif
4949
checkout_path: cifuzz-sarif

‎.github/workflows/reusable-san.yml‎

Lines changed: 26 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,15 @@ jobs:
4343
# please update the versions in `Tools/pixi-packages/variants.yaml` too.
4444
echo "CC=clang" >> "$GITHUB_ENV"
4545
echo "CXX=clang++" >> "$GITHUB_ENV"
46+
- name: ASan option setup
47+
if: inputs.sanitizer == 'ASan'
48+
run: |
49+
echo "MULTISSL_DIR=${GITHUB_WORKSPACE}/multissl" >> "$GITHUB_ENV"
50+
echo "OPENSSL_DIR=${GITHUB_WORKSPACE}/multissl/openssl/${OPENSSL_VER}" >> "$GITHUB_ENV"
51+
echo "ASAN_OPTIONS=${SAN_LOG_OPTION} detect_leaks=0 allocator_may_return_null=1 handle_segv=0" >> "$GITHUB_ENV"
52+
echo "PYTHONSTRICTEXTENSIONBUILD=1" >> "$GITHUB_ENV"
53+
env:
54+
SAN_LOG_OPTION: log_path=${{ github.workspace }}/san_log
4655
- name: TSan option setup
4756
if: inputs.sanitizer == 'TSan'
4857
run: |
@@ -88,24 +97,27 @@ jobs:
8897
- name: Add ccache to PATH
8998
run: |
9099
echo "PATH=/usr/lib/ccache:$PATH" >> "$GITHUB_ENV"
91-
- name: 'Restore OpenSSL build (TSan)'
100+
- name: 'Restore OpenSSL build'
92101
id: cache-openssl
93-
if: inputs.sanitizer == 'TSan'
102+
if: inputs.sanitizer == 'TSan' || inputs.sanitizer == 'ASan'
94103
uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
95104
with:
96105
path: ./multissl/openssl/${{ env.OPENSSL_VER }}
97-
key: ${{ env.IMAGE_OS_VERSION }}-multissl-openssl-tsan-${{ env.OPENSSL_VER }}
98-
- name: Install OpenSSL (TSan)
106+
key: >-
107+
${{ env.IMAGE_OS_VERSION }}-multissl-openssl-${{
108+
inputs.sanitizer == 'TSan' && 'tsan-' || ''
109+
}}${{ env.OPENSSL_VER }}
110+
- name: Install OpenSSL
99111
if: >-
100-
inputs.sanitizer == 'TSan'
112+
(inputs.sanitizer == 'TSan' || inputs.sanitizer == 'ASan')
101113
&& steps.cache-openssl.outputs.cache-hit != 'true'
102114
run: >-
103115
python3 Tools/ssl/multissltests.py
104116
--steps=library
105117
--base-directory="${MULTISSL_DIR}"
106118
--openssl="${OPENSSL_VER}"
107119
--system=Linux
108-
--tsan
120+
${{ inputs.sanitizer == 'TSan' && '--tsan' || '' }}
109121
# gh-157958: -O2 instead of the pydebug default -Og to avoid a clang 21
110122
# compile-time blowup on some interpreter files.
111123
# (https://github.com/llvm/llvm-project/issues/179695)
@@ -117,14 +129,20 @@ jobs:
117129
--config-cache
118130
OPT="-O2 -g"
119131
${{
120-
inputs.sanitizer == 'TSan'
132+
inputs.sanitizer == 'ASan'
133+
&& '--with-address-sanitizer --without-pymalloc'
134+
|| inputs.sanitizer == 'TSan'
121135
&& '--with-thread-sanitizer'
122136
|| inputs.sanitizer == 'MSan'
123137
&& '--with-memory-sanitizer'
124138
|| '--with-undefined-behavior-sanitizer --with-strict-overflow'
125139
}}
126140
${{ inputs.sanitizer == 'MSan' && '--with-assertions' || '--with-pydebug' }}
127-
${{ inputs.sanitizer == 'TSan' && '--with-openssl="$OPENSSL_DIR" --with-openssl-rpath=auto' || '' }}
141+
${{
142+
(inputs.sanitizer == 'TSan' || inputs.sanitizer == 'ASan')
143+
&& '--with-openssl="$OPENSSL_DIR" --with-openssl-rpath=auto'
144+
|| ''
145+
}}
128146
${{ inputs.free-threading && '--disable-gil' || '' }}
129147
- name: Build CPython
130148
run: make -j4

‎.gitignore‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -76,10 +76,10 @@ Lib/test/data/*
7676
Apple/iOS/Frameworks/
7777
Apple/iOS/Resources/Info.plist
7878
Apple/testbed/build
79-
Apple/testbed/Python.xcframework/*/bin
80-
Apple/testbed/Python.xcframework/*/include
81-
Apple/testbed/Python.xcframework/*/lib
82-
Apple/testbed/Python.xcframework/*/Python.framework
79+
Platforms/Apple/testbed/Python*.xcframework/*/bin
80+
Platforms/Apple/testbed/Python*.xcframework/*/include
81+
Platforms/Apple/testbed/Python*.xcframework/*/lib
82+
Platforms/Apple/testbed/Python*.xcframework/*/Python*.framework
8383
Apple/testbed/*Testbed.xcodeproj/project.xcworkspace
8484
Apple/testbed/*Testbed.xcodeproj/xcuserdata
8585
Mac/Makefile

‎Doc/Makefile‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -189,12 +189,13 @@ venv:
189189
.PHONY: lock
190190
lock:
191191
# Dependencies have a 14 day cooldown period to mitigate supply chain attacks,
192-
# except for sphinx_linklint and python-docs-theme, which are maintained by
192+
# except for blurb, python-docs-theme and sphinx_linklint, which are maintained by
193193
# core team members.
194194
$(UV) pip compile requirements.txt \
195195
--upgrade --exclude-newer P14D \
196-
--exclude-newer-package sphinx_linklint=PT0S \
196+
--exclude-newer-package blurb=PT0S \
197197
--exclude-newer-package python-docs-theme=PT0S \
198+
--exclude-newer-package sphinx_linklint=PT0S \
198199
--no-cache --output-file $(REQUIREMENTS) \
199200
--python-version 3.12 --universal \
200201
--custom-compile-command="make lock"

0 commit comments

Comments
 (0)