Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package python313 for openSUSE:Factory checked in at 2026-07-22 19:01:05 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/python313 (Old) and /work/SRC/openSUSE:Factory/.python313.new.24530 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "python313" Wed Jul 22 19:01:05 2026 rev:43 rq:1366438 version:3.13.14 Changes: -------- --- /work/SRC/openSUSE:Factory/python313/python313.changes 2026-06-19 17:22:10.395719459 +0200 +++ /work/SRC/openSUSE:Factory/.python313.new.24530/python313.changes 2026-07-22 19:01:14.229095898 +0200 @@ -1,0 +2,348 @@ +Fri Jul 17 10:06:01 UTC 2026 - Matej Cepl <[email protected]> + +- CVE-2026-11940: fix the symlink escape via tarfile + hardlink-extraction fallback (bsc#1268977) + CVE-2026-11940-tarfile-escape.patch + +------------------------------------------------------------------- +Thu Jul 2 23:25:00 CEST 2026 - Matej Cepl <[email protected]> + +- CVE-2025-15367: reject control characters in POP3 commands + (bsc#1257041) + CVE-2025-15366-pop3-ctrl-chars.patch + +------------------------------------------------------------------- +Thu Jul 2 23:22:09 CEST 2026 - Matej Cepl <[email protected]> + +- CVE-2025-15366: reject control characters in IMAP commands + (bsc#1257044, gh#python/cpython!143922) + CVE-2025-15366-imap-ctrl-chars.patch + +------------------------------------------------------------------- +Wed Jun 17 13:00:34 UTC 2026 - Matej Cepl <[email protected]> + +- Update to 3.13.14: + - Security + - gh-151159: Bumps the OpenSSL version to 3.0.21 on Android. + - gh-150599: Fix a possible stack buffer overflow in bz2 when + a bz2.BZ2Decompressor is reused after a decompression + error. The decompressor now becomes unusable after libbz2 + reports an error. + - gh-149835: shutil.move() now resolves symlinks via + os.path.realpath() when checking whether the destination is + inside the source directory, preventing a symlink-based + bypass of that guard. + - gh-149698: Update bundled libexpat to version 2.8.1 for the + fix for CVE 2026-45186. + - gh-87451: The ftplib module’s undocumented ftpcp function + no longer trusts the IPv4 address value returned from the + source server in response to the PASV command by default, + completing the fix for CVE-2021-4189. As with ftplib.FTP, + the former behavior can be re-enabled by setting the + trust_server_pasv_ipv4_address attribute on the source + ftplib.FTP instance to True. Thanks to Qi Deng at Aurascape + AI for the report (bsc#1265268, CVE-2026-8328) + - gh-149486: tarfile.data_filter() now validates link targets + using the same normalised value that is written to disk, + strips trailing separators from the member name when + resolving a symlink’s directory, and rejects link members + that would replace the destination directory itself. This + closes several path-traversal bypasses of the data + extraction filter. + - gh-149079: Fix a potential denial of service in + unicodedata.normalize(). The canonical ordering step of + Unicode normalization used a quadratic-time insertion sort + for reordering combining characters, which could be + exploited with crafted input containing many combining + characters in non-canonical order. Replaced with + a linear-time counting sort for long runs. + - gh-149018: Improved protection against XML hash-flooding + attacks in xml.parsers.expat and xml.etree.ElementTree when + Python is compiled with libExpat 2.8.0 or later + (CVE-2026-7210, bsc#1264962). + - gh-149017: Update bundled libexpat to version 2.8.0. + - gh-90309: Base64-encode values when embedding cookies to + JavaScript using the http.cookies.BaseCookie.js_output() + method to avoid injection and escaping. (bsc#1262654, + CVE-2026-6019) + - gh-148808: Added buffer boundary check when using nbytes + parameter with + asyncio.AbstractEventLoop.sock_recvfrom_into(). Only + relevant for Windows and the asyncio.ProactorEventLoop. + - gh-148395: Fix a dangling input pointer in + lzma.LZMADecompressor, bz2.BZ2Decompressor, and internal + zlib._ZlibDecompressor when memory allocation fails with + MemoryError, which could let a subsequent decompress() call + read or write through a stale pointer to the + already-released caller buffer. (bsc#1262098, + CVE-2026-6100, seems like it has been incompletely applied + gh#python/cpython#151605) + - gh-148169: A bypass in webbrowser allowed URLs prefixed + with %action to pass the dash-prefix safety check + (bsc#1262098, CVE-2026-6100). + - gh-146581: Fix vulnerability in shutil.unpack_archive() for + ZIP files on Windows which allowed to write files outside + of the destination tree if the patch in the archive + contains a Windows drive prefix. Now such invalid paths + will be skipped. Files containing “..” in the name (like + “foo..bar”) are no longer skipped. + - gh-146333: Fix quadratic backtracking in + configparser.RawConfigParser option parsing regexes (OPTCRE + and OPTCRE_NV). A crafted configuration line with many + whitespace characters could cause excessive CPU usage. + - gh-146211: Reject CR/LF characters in tunnel request + headers for the HTTPConnection.set_tunnel() method. + (bsc#1261969, CVE-2026-1502) + - Core and Builtins + - gh-151112: Fix a crash in the compiler that could occur + when running out of memory. + - gh-151126: Fix a crash, when there’s no memory left on + a device, which happened in: + - code compilation - _winapi.CreateProcess() + - Now these places raise proper MemoryError errors. + - gh-150633: Fix the frozen importer accepting module names + with embedded null bytes, which caused it to bypass the + sys.modules cache and create duplicate module objects. + - gh-149156: Fix an intermittent crash after os.fork() when + perf trampoline profiling is enabled and the child returns + through trampoline frames inherited from the parent + process. + - gh-149449: Fix a use-after-free crash when the unicodedata + module was removed from sys.modules and garbage-collected + between calls that decode \N{...} escapes or use the + namereplace codec error handler. + - gh-148450: Fix abc.register() so it invalidates type + version tags for registered classes. + - gh-150207: Fix a crash when a memory allocation fails + during tokenizer initialization. A proper MemoryError is + now raised instead. + - gh-150107: asyncio: sendfile() and sock_sendfile() event + loop methods now call file.seek(offset) if file has + a seek() method, even if offset is 0 (default value). + - gh-150146: Fix a crash on a complex type variable + substitution. + - from typing import TypeVar; + memoryview[TypeVar("")][*typing.Mapping[..., ...]] used to + fail due to missing NULL check on _unpack_args C function + call. + - gh-149590: Fix crash when faulthandler is imported more + than once. + - gh-149738: sqlite3: Disallow removing row_factory and + text_factory attributes of a connection to prevent a crash + on a query. + - gh-139808: Add branch protections for AArch64 (BTI/PAC) in + assembly code used by -X perf_jit (Linux perf profiler + integration). + - gh-148820: Fix a race in _PyRawMutex on the free-threaded + build where a Py_PARK_INTR return from _PySemaphore_Wait + could let the waiter destroy its semaphore before the + unlocking thread’s _PySemaphore_Wakeup completed, causing + a fatal ReleaseSemaphore error. + - gh-148653: Forbid marshalling recursive code objects which + cannot be correctly unmarshalled. + - gh-148390: Fix an undefined behavior in memoryview when + using the native boolean format (?) in cast(). Previously, + on some common platforms, calling + memoryview(b).cast("?").tolist() incorrectly returned + [False] instead of [True] for any even byte b. Patch by + Bénédikt Tran. + - gh-148418: Fix a possible reference leak in a corrupted + TYPE_CODE marshal stream. + - gh-148222: Fix vectorcall support in types.GenericAlias + when the underlying type does not support the vectorcall + protocol. Fix possible leaks in types.GenericAlias and + types.UnionType in case of memory error. + - gh-145376: Fix reference leaks in various unusual error + scenarios. + - C API + - gh-150907: Fix dynamic_annotations.h header file when built + with C++ and Valgrind: add extern "C++" scope for the C++ + template. Patch by Victor Stinner. + - Build + - gh-149351: Avoid possible broken macOS framework install + names when DESTDIR is specified during builds. + - gh-146475: Block Apple Clang from being used to build the + JIT as it ships without required LLVM tools. + - gh-148535: No longer use the gcc -fprofile-update=atomic + flag on i686. The flag has been added to fix a random GCC + internal error on PGO build (gh-145801) caused by + corruption of profile data (.gcda files). The problem is + that it makes the PGO build way slower (up to 47x slower) + on i686. Since the GCC internal error was not seen on i686 + so far, don’t use -fprofile-update=atomic on i686 anymore. + Patch by Victor Stinner. + - Library + - gh-150913: Fix sqlite3.Blob slice assignment to raise + TypeError and IndexError for type and size mismatches + respectively, even when the target slice is empty. + - gh-143008: Fix race conditions when re-initializing + a io.TextIOWrapper object. + - gh-150685: Update bundled pip to 26.1.2 + - gh-150406: Fix a possible crash occurring during socket + module initialization when the system is out of memory on + platforms without a reentrant gethostbyname. + - gh-150372: readline: Fix a potential crash during tab + completion caused by an out-of-memory error during module + initialization. + - gh-150175: Fix race condition in + unittest.mock.ThreadingMock where concurrent calls could + lose increments to call_count and other attributes due to + a missing lock in _increment_mock_call. + - gh-84353: Preserve non-UTF-8 encoded filenames when + appending to a zipfile.ZipFile. Previously, non-ASCII names + stored in a legacy encoding (without the UTF-8 flag bit + set) could be corrupted when the central directory was + rewritten: they were decoded as cp437 and then re-stored as + UTF-8. + - gh-149995: Update various docstrings in typing. + - gh-88726: The email package now uses standard MIME charset + names “gb2312” and “big5” instead of non-standard names + “eucgb2312_cn” and “big5_tw”. + - gh-149571: Fix the C implementation of + xml.etree.ElementTree.Element.itertext(): it no longer + emits text for comments and processing instructions. + - gh-149921: Fix reference leaks in error paths of the + _interpchannels and _interpqueues extension modules. + - gh-149801: Add IANA registered names and aliases with + leading zeros before number (like IBM00858, CP00858, + IBM01140, CP01140) for corresponding codecs. + - gh-149701: Fix bad return code from Lib/venv/bin/activate + if hashing is disabled + - gh-112821: In the REPL, autocompletion might run arbitrary + code in the getter of a descriptor. If that getter raised + an exception, autocompletion would fail to present any + options for the entire object. Autocompletion now works as + expected for these objects. + - gh-149388: Make asyncio.windows_utils.PipeHandle closing + idempotent. + - gh-149489: Fix ElementTree serialization to HTML. The + content of elements “xmp”, “iframe”, “noembed”, “noframes”, + and “plaintext” is no longer escaped. The “plaintext” + element no longer have the closing tag. + - gh-149377: Update bundled pip to 26.1.1 + - gh-149231: In tomllib, the number of parts in TOML keys is + now limited. + - gh-149117: Fix runpy.run_module() and runpy.run_path() to + set the name attribute on the ImportError they raise. + - gh-149148: ensurepip: Upgrade bundled pip to 26.1. This + version fixes the CVE 2026-3219 vulnerability. Patch by + Victor Stinner. + - gh-148093: Fix an out-of-bounds read of one byte in + binascii.a2b_uu(). Raise binascii.Error, instead of reading + past the buffer end. + - gh-148914: Fix memoization of in-band PickleBuffer in the + Python implementation of pickle. Previously, identical + PickleBuffers did not preserve identity, and empty writable + PickleBuffer memoized an empty bytearray object in place of + b'', so the following references to b'' were unpickled as + an empty bytearray object. + - gh-138907: Support RFC 9309 in urllib.robotparser. + - gh-148954: Fix XML injection vulnerability in + xmlrpc.client.dumps() where the methodname was not being + escaped before interpolation into the XML body. + - gh-148801: xml.etree.ElementTree: Fix a crash in + Element.__deepcopy__ on deeply nested trees. + - gh-148735: xml.etree.ElementTree: Fix a use-after-free in + Element.findtext when the element tree is mutated + concurrently during the search. + - gh-146553: Fix infinite loop in typing.get_type_hints() + when __wrapped__ forms a cycle. Patch by Shamil Abdulaev. + - gh-148508: An intermittent timing error when running SSL + tests on iOS has been resolved. + - gh-148518: If an email containing an address header that + ended in an open double quote was parsed with + a non-compat32 policy, accessing the username attribute of + the mailbox accessed through that header object would + result in an IndexError. It now correctly returns an empty + string as the result. + - gh-148370: configparser: prevent quadratic behavior when + a ParsingError is raised after a parser fails to parse + multiple lines. Patch by Bénédikt Tran. + - gh-148254: Use singular “sec” instead of “secs” in timeit + verbose output for consistency with other time units. + - gh-148192: email.generator.Generator._make_boundary could + fail to detect a duplicate boundary string if linesep was + not n. It now correctly detects boundary strings when + linesep is rn as well. + - gh-146313: Fix a deadlock in multiprocessing’s resource + tracker where the parent process could hang indefinitely in + os.waitpid() during interpreter shutdown if a child created + via os.fork() still held the resource tracker’s pipe open. + - gh-145831: Fix email.quoprimime.decode() leaving a stray \r + when eol='\r\n' by stripping the full eol string instead of + one character. + - gh-145105: Fix crash in csv reader when iterating with + a re-entrant iterator that calls next() on the same reader + from within __next__. + - gh-130750: Restore quoting of choices in argparse error + messages for improved clarity and consistency with + documentation. + - gh-105936: Attempting to mutate non-field attributes of + dataclasses with both frozen and slots being True now + raises FrozenInstanceError instead of TypeError. Their + non-dataclass subclasses can now freely mutate non-field + attributes, and the original non-slotted class can be + garbage collected. The fix also handles the case of an + empty __class__ cell on a function found within the class + (gh-148947). + - gh-142516: ssl: fix reference leaks in ssl.SSLContext + objects. Patch by Bénédikt Tran. + - gh-142831: Fix a crash in the json module where + a use-after-free could occur if the object being encoded is + modified during serialization. + - gh-140287: The asyncio REPL now handles exceptions when + executing PYTHONSTARTUP scripts. Patch by Bartosz Sławecki. + - gh-90949: Add + SetBillionLaughsAttackProtectionActivationThreshold() and + SetBillionLaughsAttackProtectionMaximumAmplification() to ++++ 51 more lines (skipped) ++++ between /work/SRC/openSUSE:Factory/python313/python313.changes ++++ and /work/SRC/openSUSE:Factory/.python313.new.24530/python313.changes Old: ---- CVE-2026-1502-reject-CRLF-HTTP-tunnel.patch CVE-2026-4786-webbrowser-open-action.patch CVE-2026-6019-Morsel-js_output.patch CVE-2026-6100-use-after-free-decompression.patch Python-3.13.13.tar.xz Python-3.13.13.tar.xz.sigstore New: ---- CVE-2025-15366-imap-ctrl-chars.patch CVE-2025-15366-pop3-ctrl-chars.patch CVE-2026-11940-tarfile-escape.patch Python-3.13.14.tar.xz Python-3.13.14.tar.xz.sigstore ----------(Old B)---------- Old:- Remove upstreamed patches: - CVE-2026-1502-reject-CRLF-HTTP-tunnel.patch - CVE-2026-4786-webbrowser-open-action.patch Old: - CVE-2026-1502-reject-CRLF-HTTP-tunnel.patch - CVE-2026-4786-webbrowser-open-action.patch - CVE-2026-6019-Morsel-js_output.patch Old: - CVE-2026-4786-webbrowser-open-action.patch - CVE-2026-6019-Morsel-js_output.patch - CVE-2026-6100-use-after-free-decompression.patch Old: - CVE-2026-6019-Morsel-js_output.patch - CVE-2026-6100-use-after-free-decompression.patch ----------(Old E)---------- ----------(New B)---------- New: (bsc#1257044, gh#python/cpython!143922) CVE-2025-15366-imap-ctrl-chars.patch New: (bsc#1257041) CVE-2025-15366-pop3-ctrl-chars.patch New: hardlink-extraction fallback (bsc#1268977) CVE-2026-11940-tarfile-escape.patch ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ python313.spec ++++++ --- /var/tmp/diff_new_pack.MNBVyi/_old 2026-07-22 19:01:15.545140904 +0200 +++ /var/tmp/diff_new_pack.MNBVyi/_new 2026-07-22 19:01:15.545140904 +0200 @@ -167,7 +167,7 @@ # _md5.cpython-38m-x86_64-linux-gnu.so %define dynlib() %{sitedir}/lib-dynload/%{1}.cpython-%{abi_tag}-%{archname}-%{_os}%{?_gnu}%{?armsuffix}.so Name: %{python_pkg_name}%{psuffix} -Version: 3.13.13 +Version: 3.13.14 %define tarversion %{version} %define tarname Python-%{tarversion} Release: 0 @@ -236,21 +236,18 @@ # PATCH-FIX-UPSTREAM pass-test_write_read_limited_history.patch bsc#[0-9]+ [email protected] # Fix readline history truncation when length is reduced Patch48: pass-test_write_read_limited_history.patch -# PATCH-FIX-UPSTREAM CVE-2026-6100-use-after-free-decompression.patch bsc#1262098 [email protected] -# NULL dangling pointer to avoid use-after-free error -Patch49: CVE-2026-6100-use-after-free-decompression.patch -# PATCH-FIX-UPSTREAM CVE-2026-4786-webbrowser-open-action.patch bsc#1262319 [email protected] -# Fix webbrowser %action substitution bypass of dash-prefix check -Patch50: CVE-2026-4786-webbrowser-open-action.patch -# PATCH-FIX-UPSTREAM CVE-2026-1502-reject-CRLF-HTTP-tunnel.patch bsc#1261969 [email protected] -# Reject CR/LF in HTTP tunnel request headers -Patch51: CVE-2026-1502-reject-CRLF-HTTP-tunnel.patch -# PATCH-FIX-UPSTREAM CVE-2026-6019-Morsel-js_output.patch bsc#1262654 [email protected] -# Base64-encode cookie values embedded in JS -Patch52: CVE-2026-6019-Morsel-js_output.patch # PATCH-FIX-OPENSUSE test_UDPLITE_support.patch gh#python/cpython#149078 [email protected] # improve testing of the presence of IPPROTO_UDPLITE support Patch53: test_UDPLITE_support.patch +# PATCH-FIX-UPSTREAM CVE-2025-15366-imap-ctrl-chars.patch bsc#1257044 [email protected] +# Reject control characters in wsgiref.headers.Headers +Patch54: CVE-2025-15366-imap-ctrl-chars.patch +# PATCH-FIX-UPSTREAM CVE-2025-15366-pop3-ctrl-chars.patch bsc#1257041 [email protected] +# Reject control characters in POP3 commands +Patch55: CVE-2025-15366-pop3-ctrl-chars.patch +# PATCH-FIX-UPSTREAM CVE-2026-11940-tarfile-escape.patch bsc#1268977 [email protected] +# Fix symlink escape via tarfile hardlink-extraction fallback +Patch56: CVE-2026-11940-tarfile-escape.patch #### END OF PATCHES BuildRequires: autoconf-archive BuildRequires: automake ++++++ CVE-2025-15366-imap-ctrl-chars.patch ++++++ >From 7485ee5e2cf81d3e5ad0d9c3be73cecd2ab4eec7 Mon Sep 17 00:00:00 2001 From: Seth Michael Larson <[email protected]> Date: Fri, 16 Jan 2026 10:54:09 -0600 Subject: [PATCH 1/2] Add 'test.support' fixture for C0 control characters --- Lib/imaplib.py | 4 +++- Lib/test/test_imaplib.py | 6 ++++++ Misc/NEWS.d/next/Security/2026-01-16-11-41-06.gh-issue-143921.AeCOor.rst | 1 + 3 files changed, 10 insertions(+), 1 deletion(-) Index: Python-3.13.14/Lib/imaplib.py =================================================================== --- Python-3.13.14.orig/Lib/imaplib.py 2026-07-02 23:48:31.095827517 +0200 +++ Python-3.13.14/Lib/imaplib.py 2026-07-02 23:48:47.033673195 +0200 @@ -132,7 +132,7 @@ # We compile these in _mode_xxx. _Literal = br'.*{(?P<size>\d+)}$' _Untagged_status = br'\* (?P<data>\d+) (?P<type>[A-Z-]+)( (?P<data2>.*))?' - +_control_chars = re.compile(b'[\x00-\x1F\x7F]') class IMAP4: @@ -1000,6 +1000,8 @@ if arg is None: continue if isinstance(arg, str): arg = bytes(arg, self._encoding) + if _control_chars.search(arg): + raise ValueError("Control characters not allowed in commands") data = data + b' ' + arg literal = self.literal Index: Python-3.13.14/Lib/test/test_imaplib.py =================================================================== --- Python-3.13.14.orig/Lib/test/test_imaplib.py 2026-07-02 23:48:32.624887170 +0200 +++ Python-3.13.14/Lib/test/test_imaplib.py 2026-07-03 00:05:01.535007334 +0200 @@ -558,6 +558,12 @@ self.assertEqual(data[0], b'Returned to authenticated state. (Success)') self.assertEqual(client.state, 'AUTH') + def test_control_characters(self): + client, _ = self._setup(SimpleIMAPHandler) + for c0 in support.control_characters_c0(): + with self.assertRaises(ValueError): + client.login(f'user{c0}', 'pass') + class NewIMAPTests(NewIMAPTestsMixin, unittest.TestCase): imap_class = imaplib.IMAP4 Index: Python-3.13.14/Misc/NEWS.d/next/Security/2026-01-16-11-41-06.gh-issue-143921.AeCOor.rst =================================================================== --- /dev/null 1970-01-01 00:00:00.000000000 +0000 +++ Python-3.13.14/Misc/NEWS.d/next/Security/2026-01-16-11-41-06.gh-issue-143921.AeCOor.rst 2026-07-02 23:48:47.034881464 +0200 @@ -0,0 +1 @@ +Reject control characters in IMAP commands. ++++++ CVE-2025-15366-pop3-ctrl-chars.patch ++++++ >From b6f733b285b1c4f27dacb5c2e1f292c914e8b933 Mon Sep 17 00:00:00 2001 From: Seth Michael Larson <[email protected]> Date: Fri, 16 Jan 2026 10:54:09 -0600 Subject: [PATCH 1/2] Add 'test.support' fixture for C0 control characters --- Lib/poplib.py | 2 ++ Lib/test/test_poplib.py | 8 ++++++++ Misc/NEWS.d/next/Security/2026-01-16-11-43-47.gh-issue-143923.DuytMe.rst | 1 + 3 files changed, 11 insertions(+) Index: Python-3.13.14/Lib/poplib.py =================================================================== --- Python-3.13.14.orig/Lib/poplib.py 2026-07-04 11:00:17.557334328 +0200 +++ Python-3.13.14/Lib/poplib.py 2026-07-04 11:00:26.988664709 +0200 @@ -122,6 +122,8 @@ def _putcmd(self, line): if self._debugging: print('*cmd*', repr(line)) line = bytes(line, self.encoding) + if re.search(b'[\x00-\x1F\x7F]', line): + raise ValueError('Control characters not allowed in commands') self._putline(line) Index: Python-3.13.14/Lib/test/test_poplib.py =================================================================== --- Python-3.13.14.orig/Lib/test/test_poplib.py 2026-07-04 11:00:19.736602403 +0200 +++ Python-3.13.14/Lib/test/test_poplib.py 2026-07-04 11:02:51.276051492 +0200 @@ -17,6 +17,7 @@ from test.support import threading_helper from test.support import asynchat from test.support import asyncore +from test.support import control_characters_c0 from test.support.testcase import ExtraAssertions @@ -396,6 +397,13 @@ self.assertIsNone(self.client.sock) self.assertIsNone(self.client.file) + def test_control_characters(self): + for c0 in control_characters_c0(): + with self.assertRaises(ValueError): + self.client.user(f'user{c0}') + with self.assertRaises(ValueError): + self.client.pass_(f'{c0}pass') + @requires_ssl def test_stls_capa(self): capa = self.client.capa() Index: Python-3.13.14/Misc/NEWS.d/next/Security/2026-01-16-11-43-47.gh-issue-143923.DuytMe.rst =================================================================== --- /dev/null 1970-01-01 00:00:00.000000000 +0000 +++ Python-3.13.14/Misc/NEWS.d/next/Security/2026-01-16-11-43-47.gh-issue-143923.DuytMe.rst 2026-07-04 11:00:26.989135797 +0200 @@ -0,0 +1 @@ +Reject control characters in POP3 commands. ++++++ CVE-2026-11940-tarfile-escape.patch ++++++ >From 41426f20172933a24c6b6d01f1b36e40e3913107 Mon Sep 17 00:00:00 2001 From: Stan Ulbrych <[email protected]> Date: Tue, 23 Jun 2026 14:31:38 +0100 Subject: [PATCH] gh-151558: Fix symlink escape via `tarfile` hardlink-extraction fallback (GH-151559) (cherry picked from commit 27dd970bf6b17ebca7c8ed486a40ab043ed7af8f) Co-authored-by: Stan Ulbrych <[email protected]> --- Lib/tarfile.py | 3 + Lib/test/test_tarfile.py | 24 ++++++++++ Misc/NEWS.d/next/Security/2026-06-10-13-08-19.gh-issue-151558.mL74i2.rst | 3 + 3 files changed, 30 insertions(+) create mode 100644 Misc/NEWS.d/next/Security/2026-06-10-13-08-19.gh-issue-151558.mL74i2.rst Index: Python-3.13.14/Lib/tarfile.py =================================================================== --- Python-3.13.14.orig/Lib/tarfile.py 2026-07-02 12:04:38.836547696 +0200 +++ Python-3.13.14/Lib/tarfile.py 2026-07-02 12:04:44.200884006 +0200 @@ -2718,6 +2718,9 @@ "makelink_with_filter: if filter_function is not None, " + "extraction_root must also not be None") try: + filter_function( + unfiltered.replace(name=tarinfo.name, deep=False), + extraction_root) filtered = filter_function(unfiltered, extraction_root) except _FILTER_ERRORS as cause: raise LinkFallbackError(tarinfo, unfiltered.name) from cause Index: Python-3.13.14/Lib/test/test_tarfile.py =================================================================== --- Python-3.13.14.orig/Lib/test/test_tarfile.py 2026-07-02 12:04:41.154985165 +0200 +++ Python-3.13.14/Lib/test/test_tarfile.py 2026-07-02 12:04:44.201864897 +0200 @@ -4312,6 +4312,30 @@ self.expect_file("c", symlink_to='b') @symlink_test + def test_sneaky_hardlink_fallback_deep(self): + # (CVE-2026-11940) + with ArchiveMaker() as arc: + arc.add("a/b/s", symlink_to=os.path.join("..", "escape")) + arc.add("s", hardlink_to=os.path.join("a", "b", "s")) + + with self.check_context(arc.open(), 'data'): + e = self.expect_exception( + tarfile.LinkFallbackError, + "link 's' would be extracted as a copy of " + + "'a/b/s', which was rejected") + self.assertIsInstance(e.__cause__, + tarfile.LinkOutsideDestinationError) + + for filter in 'tar', 'fully_trusted': + with self.subTest(filter), self.check_context(arc.open(), filter): + if not os_helper.can_symlink(): + self.expect_file("a/") + self.expect_file("a/b/") + else: + self.expect_file("a/b/s", symlink_to=os.path.join('..', 'escape')) + self.expect_file("s", symlink_to=os.path.join('..', 'escape')) + + @symlink_test def test_exfiltration_via_symlink(self): # (CVE-2025-4138) # Test changing symlinks that result in a symlink pointing outside Index: Python-3.13.14/Misc/NEWS.d/next/Security/2026-06-10-13-08-19.gh-issue-151558.mL74i2.rst =================================================================== --- /dev/null 1970-01-01 00:00:00.000000000 +0000 +++ Python-3.13.14/Misc/NEWS.d/next/Security/2026-06-10-13-08-19.gh-issue-151558.mL74i2.rst 2026-07-02 12:04:44.202594053 +0200 @@ -0,0 +1,3 @@ +Fixed an vulnerability in the :mod:`tarfile` ``data`` and ``tar`` extraction +filters where crafted archives could create a symlink pointing outside the +destination directory. This was a bypass of :cve:`2025-4330`. ++++++ Python-3.13.13.tar.xz -> Python-3.13.14.tar.xz ++++++ /work/SRC/openSUSE:Factory/python313/Python-3.13.13.tar.xz /work/SRC/openSUSE:Factory/.python313.new.24530/Python-3.13.14.tar.xz differ: char 26, line 1 ++++++ Python-3.13.13.tar.xz.sigstore -> Python-3.13.14.tar.xz.sigstore ++++++ --- /work/SRC/openSUSE:Factory/python313/Python-3.13.13.tar.xz.sigstore 2026-04-15 16:03:04.067292054 +0200 +++ /work/SRC/openSUSE:Factory/.python313.new.24530/Python-3.13.14.tar.xz.sigstore 2026-07-22 19:01:13.041055270 +0200 @@ -1 +1 @@ -{"mediaType": "application/vnd.dev.sigstore.bundle.v0.3+json", "verificationMaterial": {"certificate": {"rawBytes": "MIICyDCCAk+gAwIBAgIUGhTZElG4g14FGuz+6tP4CD0f480wCgYIKoZIzj0EAwMwNzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRlcm1lZGlhdGUwHhcNMjYwNDA3MTgzODEwWhcNMjYwNDA3MTg0ODEwWjAAMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE/Qc+RtLG7yRaVOAhm1Wm+zXYpH9S/boHjV+yHTfk9C/UqWc4SDI9XJ3zA+CGKoy4XOw4d9u9j/YkjZJNKgfU1qOCAW4wggFqMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAdBgNVHQ4EFgQUNdSpYmLFcoz2dToGqp98EcVE1KYwHwYDVR0jBBgwFoAU39Ppz1YkEZb5qNjpKFWixi4YZD8wHwYDVR0RAQH/BBUwE4ERdGhvbWFzQHB5dGhvbi5vcmcwKQYKKwYBBAGDvzABAQQbaHR0cHM6Ly9hY2NvdW50cy5nb29nbGUuY29tMCsGCisGAQQBg78wAQgEHQwbaHR0cHM6Ly9hY2NvdW50cy5nb29nbGUuY29tMIGJBgorBgEEAdZ5AgQCBHsEeQB3AHUA3T0wasbHETJjGR4cmWc3AqJKXrjePK3/h4pygC8p7o4AAAGdaTzf4gAABAMARjBEAiBvhAoxdh0VK2ZCvGBwxjiXToc13f9+mc9ezYTrsSLoRQIgH9KkUMyL6TLjVzHnpgRyB0ACevhU5hkInN+DNYYIBVUwCgYIKoZIzj0EAwMDZwAwZAIwcllDR1P0VpUsPBs8W3wk6sAnCxYdP23AP/72rErpOtQd8j5gmpSiuRg1 +SrDLo+1AjAZlIoYqEqW8v5dDhH/Z3ZNLyG5lq0th5nu338m0KADcN8YBlURhFX0lQiem8Kkun0="}, "tlogEntries": [{"logIndex": "1247791401", "logId": {"keyId": "wNI9atQGlz+VWfO6LRygH4QUfY/8W4RFwiT5i5WRgB0="}, "kindVersion": {"kind": "hashedrekord", "version": "0.0.1"}, "integratedTime": "1775587090", "inclusionPromise": {"signedEntryTimestamp": "MEUCIQCqavWbun8W6P1n/kFij+NitMv2m/yws9t9pAo1AkkBIgIgFFXufZCRLRGdoJ65fQrjtRBO3YpokREE2CtjPlsWuu0="}, "inclusionProof": {"logIndex": "1125887139", "rootHash": "0rm3uuqoyrYsi+AXbNGa5udAq46B8sgFRTKm/M6WMuw=", "treeSize": "1125887147", "hashes": ["R3OMmIUDtZDiSJm+g0yQ78hUtG47J8i+tbkzqVDMAxQ=", "Q3h1kJ+pgjJfPKLoB+TjxtFZ/8ov1JUyCh2AEn764tw=", "RbNsabll24/HhRa6zejvIRd9jIPagbhQoSmPvhyIYPQ=", "HF2NxpwJQw+AqIufAVE94No7LazP7Q83IXVVAhHkiY4=", "UO11qu4hqF3BqyYqme50iQFdLbchLCMe5iOm4bSxycA=", "O8ieEqc3YlOI5vJWPMtvBg6wA0uXLJmrHoLK+ii7pM8=", "S7wW23Hi2t7r3I+x+4OMUwjHxixQ2xaX7kgK53e6XdM=", "HVg57mecLqZ7Ec7g6NZhVBswvv/1UrmzPrC1Syh1heI=", "RKd9pRFYAbptJPgYSU7hcwgveHw813ekidCp/W8W NdQ=", "daNcvQEzsG0zqEioC6u2KwTJy4oa9qT0adsp7LEOhFw=", "ifjNYQZhuKjhQr9LSmMHyaX9NeFNIdXuPzIVP5/1eA8=", "D7z1tETX/WvHSmZKT4M7w2y8pJ1HI4XtSf6OiM+h6UA=", "2v7+H4Fejl7qkIhG2G79UQH+wJ0QpPreOZwulFGWzLI=", "vXMaHYsu3vXUFKr78h1vCtaZWhgh1OwZh5O05RGwxkw=", "WbswTMpSfvjDqroD6lDGb2VDeljBPlMsAchJ+0L+3U4=", "psQ1PrYXqFtm6T3uF1q91rl1dhNiykO58GpOdq1ZaKI=", "DOCeoSMovIvLExkhIvisow9AuNXgeWs4ECkyR6EcqYU="], "checkpoint": {"envelope": "rekor.sigstore.dev - 1193050959916656506\n1125887147\n0rm3uuqoyrYsi+AXbNGa5udAq46B8sgFRTKm/M6WMuw=\n\n\u2014 rekor.sigstore.dev wNI9ajBEAiAZm2anwROK16iT7hjpwQok7s4uYW2HWTZWI1GbsDZrQgIgJMSOb98BfHfh3lubhDH7phUBLYD+b1lL6wXMih2SCKA=\n"}}, "canonicalizedBody": "eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJraW5kIjoiaGFzaGVkcmVrb3JkIiwic3BlYyI6eyJkYXRhIjp7Imhhc2giOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiIyYWI5MWZmNDAxNzgzY2NjYTY0Zjc1ZDEwYzg4MmU5NTdiZGZkNjBlMmJmNWE3MmY4NDIxNzkzNzI5Yjc4YTcxIn19LCJzaWduYXR1cmUiOnsiY29udGVudCI6Ik1FVUNJUUNPSC9ZVnBmamVrcm5sby9JeFZWamtQWU4wK3h4N3BFVGk2ODJKMlA0My9n SWdOdHZhWGx2UWdheUZpUkxFMk9GZmtZT0c1eDA4dEI1VFR6Z0t6ci9Xd1B3PSIsInB1YmxpY0tleSI6eyJjb250ZW50IjoiTFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVTjVSRU5EUVdzclowRjNTVUpCWjBsVlIyaFVXa1ZzUnpSbk1UUkdSM1Y2S3paMFVEUkRSREJtTkRnd2QwTm5XVWxMYjFwSmVtb3dSVUYzVFhjS1RucEZWazFDVFVkQk1WVkZRMmhOVFdNeWJHNWpNMUoyWTIxVmRWcEhWakpOVWpSM1NFRlpSRlpSVVVSRmVGWjZZVmRrZW1SSE9YbGFVekZ3WW01U2JBcGpiVEZzV2tkc2FHUkhWWGRJYUdOT1RXcFpkMDVFUVROTlZHZDZUMFJGZDFkb1kwNU5hbGwzVGtSQk0wMVVaekJQUkVWM1YycEJRVTFHYTNkRmQxbElDa3R2V2tsNmFqQkRRVkZaU1V0dldrbDZhakJFUVZGalJGRm5RVVV2VVdNclVuUk1SemQ1VW1GV1QwRm9iVEZYYlN0NldGbHdTRGxUTDJKdlNHcFdLM2tLU0ZSbWF6bERMMVZ4VjJNMFUwUkpPVmhLTTNwQkswTkhTMjk1TkZoUGR6UmtPWFU1YWk5WmEycGFTazVMWjJaVk1YRlBRMEZYTkhkblowWnhUVUUwUndwQk1WVmtSSGRGUWk5M1VVVkJkMGxJWjBSQlZFSm5UbFpJVTFWRlJFUkJTMEpuWjNKQ1owVkdRbEZqUkVGNlFXUkNaMDVXU0ZFMFJVWm5VVlZPWkZOd0NsbHRURVpqYjNveVpGUnZSM0Z3T1RoRlkxWkZNVXRaZDBoM1dVUldVakJxUWtKbmQwWnZRVlV6T1ZCd2VqRlphMFZhWWpWeFRtcHdTMFpYYVhocE5Ga0tXa1E0ZDBoM1dVUldVakJTUVZGSUwwSkNWWGRGTkVWU 1pFZG9kbUpYUm5wUlNFSTFaRWRvZG1KcE5YWmpiV04zUzFGWlMwdDNXVUpDUVVkRWRucEJRZ3BCVVZGaVlVaFNNR05JVFRaTWVUbG9XVEpPZG1SWE5UQmplVFZ1WWpJNWJtSkhWWFZaTWpsMFRVTnpSME5wYzBkQlVWRkNaemM0ZDBGUlowVklVWGRpQ21GSVVqQmpTRTAyVEhrNWFGa3lUblprVnpVd1kzazFibUl5T1c1aVIxVjFXVEk1ZEUxSlIwcENaMjl5UW1kRlJVRmtXalZCWjFGRFFraHpSV1ZSUWpNS1FVaFZRVE5VTUhkaGMySklSVlJLYWtkU05HTnRWMk16UVhGS1MxaHlhbVZRU3pNdmFEUndlV2RET0hBM2J6UkJRVUZIWkdGVWVtWTBaMEZCUWtGTlFRcFNha0pGUVdsQ2RtaEJiM2hrYURCV1N6SmFRM1pIUW5kNGFtbFlWRzlqTVRObU9TdHRZemxsZWxsVWNuTlRURzlTVVVsblNEbExhMVZOZVV3MlZFeHFDbFo2U0c1d1oxSjVRakJCUTJWMmFGVTFhR3RKYms0clJFNVpXVWxDVmxWM1EyZFpTVXR2V2tsNmFqQkZRWGROUkZwM1FYZGFRVWwzWTJ4c1JGSXhVREFLVm5CVmMxQkNjemhYTTNkck5uTkJia040V1dSUU1qTkJVQzgzTW5KRmNuQlBkRkZrT0dvMVoyMXdVMmwxVW1jeEsxTnlSRXh2S3pGQmFrRmFiRWx2V1FweFJYRlhPSFkxWkVSb1NDOWFNMXBPVEhsSE5XeHhNSFJvTlc1MU16TTRiVEJMUVVSalRqaFpRbXhWVW1oR1dEQnNVV2xsYlRoTGEzVnVNRDBLTFMwdExTMUZUa1FnUTBWU1ZFbEdTVU5CVkVVdExTMHRMUW89In19fX0="}], "timestampVerificationData": {}}, "messageSignature": {"messa geDigest": {"algorithm": "SHA2_256", "digest": "Krkf9AF4PMymT3XRDIgulXvf1g4r9acvhCF5Nym3inE="}, "signature": "MEUCIQCOH/YVpfjekrnlo/IxVVjkPYN0+xx7pETi682J2P43/gIgNtvaXlvQgayFiRLE2OFfkYOG5x08tB5TTzgKzr/WwPw="}} +{"mediaType": "application/vnd.dev.sigstore.bundle.v0.3+json", "verificationMaterial": {"certificate": {"rawBytes": "MIIDKTCCAq6gAwIBAgIULAhuyOW9GotTtF956yFWVeMi9e0wCgYIKoZIzj0EAwMwNzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRlcm1lZGlhdGUwHhcNMjYwNjEwMTQyODI3WhcNMjYwNjEwMTQzODI3WjAAMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEdYYDPeIvTaNaA504q6KnotW24E+LnSxqZPcpE/YfmwdFx4MU67wyr5JHj+99vRiZRKu7nGGH/L/5Y2QCHXOweaOCAc0wggHJMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAdBgNVHQ4EFgQUtb9Anla5U+yJuuln4ag0E1Hvch4wHwYDVR0jBBgwFoAU39Ppz1YkEZb5qNjpKFWixi4YZD8wHwYDVR0RAQH/BBUwE4ERdGhvbWFzQHB5dGhvbi5vcmcwKQYKKwYBBAGDvzABAQQbaHR0cHM6Ly9hY2NvdW50cy5nb29nbGUuY29tMCsGCisGAQQBg78wAQgEHQwbaHR0cHM6Ly9hY2NvdW50cy5nb29nbGUuY29tMFsGCisGAQQBg78wARgETQxLQ2hVeE1UTXdNREkzTWpZek1UVXpOekkwT0RjNU1EVVNIMmgwZEhCek9pVXlSaVV5Um1GalkyOTFiblJ6TG1kdmIyZHNaUzVqYjIwMIGLBgorBgEEAdZ5AgQCBH0EewB5AHcA3T0wasbHETJjGR4cmWc3AqJKXrjePK3/h4pygC8p7o4AAAGese9CzwAABAMASDBGAiEAs3zEn9PTSTzbsiNMdcHWmnt/Tr7ohDOdN89wXghiplwC IQDKwEFCf+AVlV27FIJyZNxwcVRgoHMzZbbrtpQGeN6oNDAKBggqhkjOPQQDAwNpADBmAjEAxEU8IdjbodolTUvnyOpMSmD5m9r9vzoZvt5fMzhirAZkCkcP4OCvnE/ukJCa6idLAjEA6li+yZaiTaNX0BFBDOLXrvJyPoTnHkyQT9vRpcinxpvrIr6iLkfOAkaha2r4GyDF"}, "tlogEntries": [{"logIndex": "1780117219", "logId": {"keyId": "wNI9atQGlz+VWfO6LRygH4QUfY/8W4RFwiT5i5WRgB0="}, "kindVersion": {"kind": "hashedrekord", "version": "0.0.1"}, "integratedTime": "1781101708", "inclusionPromise": {"signedEntryTimestamp": "MEUCIFS+B+yf9aPd9Y4IygE8cH4o62r7ReqavjRkEf1fgl1LAiEA/CnXwPLUQPCuPlzM0FF7ZTulVNsK4BGrMQ5n4ee/OG8="}, "inclusionProof": {"logIndex": "1658212957", "rootHash": "sHzzFJN2XdaFugNII2SBFTwVL3gvpg/65Kkvy7XjVYg=", "treeSize": "1658212960", "hashes": ["fjIrcah9UCqvI/G3W/gXPbinx4y1XhfdJc2pBrp56Jk=", "8magWOn3O80eK3S9O3iABLjM2e7zcUYfYYILm0CsuEQ=", "FxZ3/KmO9r7RionmLoWqWTG9XHLypgnUMe/8G02U9lg=", "yg472o3t6Dgh2OPS58tqIU3T25ysLLoP/mTqE1OOMMg=", "AxE/Wo8YToTK9SmFomPMJyNXKaOUE2O9lckgoXcg6vA=", "oI154gwGbnn3ycvQKnadlb+taKCtItyR60doRasTk9Y=", "tOVkANwP imLhfqQTm4pls4RGQEUFpz2eAQ3OdicZz8Q=", "b433dsxcmrTWUBI2JbGCjLyy7Pr0IBBMn19dgt3Io4M=", "wOKx0z9QYCh6V91tGPBC6wLftogdim0At1wEeYZQHbo=", "lopYNMPEeyiDfEtpMLlLnbKMdVRShbMH7EYpd/6Z2zQ=", "GKETua1skk2MkOa2eEP3m0xGCLMYojSBY14Q+YigFHA=", "GQOQCyMMlUdewn4btkfMBkpDJPWuNcETDxHWpbp+iKw=", "phbrqVrscGmqV5frx3cP3FZg0R9d16flgXnmF8YlBJs=", "JeFJuYar3D4uBzvMd7x3qts+CGhYQOGMaAiiYVFCxto=", "mDCdA8t/LGc+hqiV0SOyqPXlOYPyWpasRaDDvCC8JAE=", "daxmZaajRpZV+JxHiOYZhJBiSKN5ucqjh2WnGbHhirw=", "DOCeoSMovIvLExkhIvisow9AuNXgeWs4ECkyR6EcqYU="], "checkpoint": {"envelope": "rekor.sigstore.dev - 1193050959916656506\n1658212960\nsHzzFJN2XdaFugNII2SBFTwVL3gvpg/65Kkvy7XjVYg=\n\n\u2014 rekor.sigstore.dev wNI9ajBEAiAq1Bjp86Om5pWj3l+M1byA+TB4kRDCXH08p+zrADhGngIgPNoGamj5tOIr4mM9r3AcgeIRFLr4uRBUJaZcP+YAacc=\n"}}, "canonicalizedBody": "eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJraW5kIjoiaGFzaGVkcmVrb3JkIiwic3BlYyI6eyJkYXRhIjp7Imhhc2giOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiI2MzllNDMyNDNjNjIwYTMwOGY5NjgyMTNkZjllMDBmMmY4ZjYyMzMyZjdhZGJh YTdhN2VlYjk3ODMwNTdjNjkwIn19LCJzaWduYXR1cmUiOnsiY29udGVudCI6Ik1FUUNJRDMrWDcwUWJ5allDanllWDBkdkQ1czdwc3ZtRm4zN1lwWG4vcjRqZHBUMEFpQmtzU25QM1M0QTB0YmN4NjNTTFpTWVdWME1tUkNOVXI3eE8xMkZxTlJEVmc9PSIsInB1YmxpY0tleSI6eyJjb250ZW50IjoiTFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVUkxWRU5EUVhFMlowRjNTVUpCWjBsVlRFRm9kWGxQVnpsSGIzUlVkRVk1TlRaNVJsZFdaVTFwT1dVd2QwTm5XVWxMYjFwSmVtb3dSVUYzVFhjS1RucEZWazFDVFVkQk1WVkZRMmhOVFdNeWJHNWpNMUoyWTIxVmRWcEhWakpOVWpSM1NFRlpSRlpSVVVSRmVGWjZZVmRrZW1SSE9YbGFVekZ3WW01U2JBcGpiVEZzV2tkc2FHUkhWWGRJYUdOT1RXcFpkMDVxUlhkTlZGRjVUMFJKTTFkb1kwNU5hbGwzVG1wRmQwMVVVWHBQUkVrelYycEJRVTFHYTNkRmQxbElDa3R2V2tsNmFqQkRRVkZaU1V0dldrbDZhakJFUVZGalJGRm5RVVZrV1ZsRVVHVkpkbFJoVG1GQk5UQTBjVFpMYm05MFZ6STBSU3RNYmxONGNWcFFZM0FLUlM5WlptMTNaRVo0TkUxVk5qZDNlWEkxU2tocUt6azVkbEpwV2xKTGRUZHVSMGRJTDB3dk5Wa3lVVU5JV0U5M1pXRlBRMEZqTUhkblowaEtUVUUwUndwQk1WVmtSSGRGUWk5M1VVVkJkMGxJWjBSQlZFSm5UbFpJVTFWRlJFUkJTMEpuWjNKQ1owVkdRbEZqUkVGNlFXUkNaMDVXU0ZFMFJVWm5VVlYwWWpsQkNtNXNZVFZWSzNsS2RYVnNialJoWnpCR k1VaDJZMmcwZDBoM1dVUldVakJxUWtKbmQwWnZRVlV6T1ZCd2VqRlphMFZhWWpWeFRtcHdTMFpYYVhocE5Ga0tXa1E0ZDBoM1dVUldVakJTUVZGSUwwSkNWWGRGTkVWU1pFZG9kbUpYUm5wUlNFSTFaRWRvZG1KcE5YWmpiV04zUzFGWlMwdDNXVUpDUVVkRWRucEJRZ3BCVVZGaVlVaFNNR05JVFRaTWVUbG9XVEpPZG1SWE5UQmplVFZ1WWpJNWJtSkhWWFZaTWpsMFRVTnpSME5wYzBkQlVWRkNaemM0ZDBGUlowVklVWGRpQ21GSVVqQmpTRTAyVEhrNWFGa3lUblprVnpVd1kzazFibUl5T1c1aVIxVjFXVEk1ZEUxR2MwZERhWE5IUVZGUlFtYzNPSGRCVW1kRlZGRjRURkV5YUZZS1pVVXhWVlJZWkU1U1JXdDZWRmR3V21Wck1WVldXSEJQWld0cmQxUXdVbXBPVlRGRlZsWk9TVTF0WjNkYVJXaERaV3M1Y0ZaWWJGTmhWbFkxVlcweFJ3cGhiR3Q1VDFSR2FXSnNTalpVUnpGclpHMUplVnBJVG1GVmVsWnhXV3BKZDAxSlIweENaMjl5UW1kRlJVRmtXalZCWjFGRFFrZ3dSV1YzUWpWQlNHTkJDak5VTUhkaGMySklSVlJLYWtkU05HTnRWMk16UVhGS1MxaHlhbVZRU3pNdmFEUndlV2RET0hBM2J6UkJRVUZIWlhObE9VTjZkMEZCUWtGTlFWTkVRa2NLUVdsRlFYTXpla1Z1T1ZCVVUxUjZZbk5wVGsxa1kwaFhiVzUwTDFSeU4yOW9SRTlrVGpnNWQxaG5hR2x3YkhkRFNWRkVTM2RGUmtObUswRldiRll5TndwR1NVcDVXazU0ZDJOV1VtZHZTRTE2V21KaWNuUndVVWRsVGpadlRrUkJTMEpuWjNGb2EycFBVRkZSUkVGM1RuQkJSRUp0UVdwRlFYaE ZWVGhKWkdwaUNtOWtiMnhVVlhadWVVOXdUVk50UkRWdE9YSTVkbnB2V25aME5XWk5lbWhwY2tGYWEwTnJZMUEwVDBOMmJrVXZkV3RLUTJFMmFXUk1RV3BGUVRac2FTc0tlVnBoYVZSaFRsZ3dRa1pDUkU5TVdISjJTbmxRYjFSdVNHdDVVVlE1ZGxKd1kybHVlSEIyY2tseU5tbE1hMlpQUVd0aGFHRXljalJIZVVSR0NpMHRMUzB0UlU1RUlFTkZVbFJKUmtsRFFWUkZMUzB0TFMwSyJ9fX19"}], "timestampVerificationData": {}}, "messageSignature": {"messageDigest": {"algorithm": "SHA2_256", "digest": "Y55DJDxiCjCPloIT354A8vj2IzL3rbqnp+65eDBXxpA="}, "signature": "MEQCID3+X70QbyjYCjyeX0dvD5s7psvmFn37YpXn/r4jdpT0AiBksSnP3S4A0tbcx63SLZSYWV0MmRCNUr7xO12FqNRDVg=="}} ++++++ _scmsync.obsinfo ++++++ --- /var/tmp/diff_new_pack.MNBVyi/_old 2026-07-22 19:01:15.745147743 +0200 +++ /var/tmp/diff_new_pack.MNBVyi/_new 2026-07-22 19:01:15.753148017 +0200 @@ -1,6 +1,6 @@ -mtime: 1781393469 -commit: eb6e39cdf99d0e2e3905f3ad6c5560ea993140e4e9a52c2ee9e440a54817261c +mtime: 1784282806 +commit: 231e2440e2990865abbe4e28761b76d134fc48b59de16e0a1f93c13ed00e4c59 url: https://src.opensuse.org/python-interpreters/python313 -revision: eb6e39cdf99d0e2e3905f3ad6c5560ea993140e4e9a52c2ee9e440a54817261c +revision: 231e2440e2990865abbe4e28761b76d134fc48b59de16e0a1f93c13ed00e4c59 projectscmsync: https://src.opensuse.org/python-interpreters/_ObsPrj ++++++ build.specials.obscpio ++++++ ++++++ build.specials.obscpio ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/.gitignore new/.gitignore --- old/.gitignore 1970-01-01 01:00:00.000000000 +0100 +++ new/.gitignore 2026-07-17 12:06:46.000000000 +0200 @@ -0,0 +1,6 @@ +.osc +*.obscpio +*.osc +_build.* +.pbuild +python313-*-build/ ++++++ doc-py38-to-py36.patch ++++++ --- /var/tmp/diff_new_pack.MNBVyi/_old 2026-07-22 19:01:15.937154309 +0200 +++ /var/tmp/diff_new_pack.MNBVyi/_new 2026-07-22 19:01:15.937154309 +0200 @@ -27,10 +27,10 @@ Doc/tools/extensions/pydoc_topics.py | 22 +++++----- 18 files changed, 159 insertions(+), 130 deletions(-) -Index: Python-3.13.12/Doc/Makefile +Index: Python-3.13.14/Doc/Makefile =================================================================== ---- Python-3.13.12.orig/Doc/Makefile 2026-02-03 18:53:27.000000000 +0100 -+++ Python-3.13.12/Doc/Makefile 2026-02-06 11:32:43.257524049 +0100 +--- Python-3.13.14.orig/Doc/Makefile 2026-06-10 14:24:04.000000000 +0200 ++++ Python-3.13.14/Doc/Makefile 2026-06-17 15:09:20.086496688 +0200 @@ -14,15 +14,15 @@ SOURCES = DISTVERSION = $(shell $(PYTHON) tools/extensions/patchlevel.py) @@ -51,10 +51,10 @@ $(PAPEROPT_$(PAPER)) \ $(SPHINXOPTS) $(SPHINXERRORHANDLING) \ . build/$(BUILDER) $(SOURCES) -Index: Python-3.13.12/Doc/c-api/arg.rst +Index: Python-3.13.14/Doc/c-api/arg.rst =================================================================== ---- Python-3.13.12.orig/Doc/c-api/arg.rst 2026-02-03 18:53:27.000000000 +0100 -+++ Python-3.13.12/Doc/c-api/arg.rst 2026-02-06 11:32:43.257960130 +0100 +--- Python-3.13.14.orig/Doc/c-api/arg.rst 2026-06-10 14:24:04.000000000 +0200 ++++ Python-3.13.14/Doc/c-api/arg.rst 2026-06-17 15:09:20.086830417 +0200 @@ -334,7 +334,6 @@ should raise an exception and leave the content of *address* unmodified. @@ -63,20 +63,20 @@ If the *converter* returns :c:macro:`!Py_CLEANUP_SUPPORTED`, it may get called a second time if the argument parsing eventually fails, giving the converter a -Index: Python-3.13.12/Doc/c-api/typeobj.rst +Index: Python-3.13.14/Doc/c-api/typeobj.rst =================================================================== ---- Python-3.13.12.orig/Doc/c-api/typeobj.rst 2026-02-03 18:53:27.000000000 +0100 -+++ Python-3.13.12/Doc/c-api/typeobj.rst 2026-02-06 11:32:43.258653093 +0100 +--- Python-3.13.14.orig/Doc/c-api/typeobj.rst 2026-06-10 14:24:04.000000000 +0200 ++++ Python-3.13.14/Doc/c-api/typeobj.rst 2026-06-17 15:10:19.774250769 +0200 @@ -610,7 +610,7 @@ Functions like :c:func:`PyObject_NewVar` will take the value of N as an argument, and store in the instance's :c:member:`~PyVarObject.ob_size` field. Note that the :c:member:`~PyVarObject.ob_size` field may later be used for - other purposes. For example, :py:type:`int` instances use the bits of + other purposes. For example, :py:obj:`int` instances use the bits of - :c:member:`~PyVarObject.ob_size` in an implementation-defined - way; the underlying storage and its size should be accessed using - :c:func:`PyLong_Export`. -@@ -622,9 +622,9 @@ + :c:member:`~PyVarObject.ob_size` in an implementation-defined way. + + .. note:: +@@ -620,9 +620,9 @@ Also, the presence of an :c:member:`~PyVarObject.ob_size` field in the instance layout doesn't mean that the instance structure is variable-length. @@ -88,7 +88,7 @@ Call :c:func:`PyList_Size` instead.) The :c:member:`!tp_basicsize` includes size needed for data of the type's -@@ -637,7 +637,7 @@ +@@ -635,7 +635,7 @@ In other words, :c:member:`!tp_basicsize` must be greater than or equal to the base's :c:member:`!tp_basicsize`. @@ -97,12 +97,12 @@ include :c:type:`PyObject` or :c:type:`PyVarObject` (depending on whether :c:member:`~PyVarObject.ob_size` should be included). These are usually defined by the macro :c:macro:`PyObject_HEAD` or -Index: Python-3.13.12/Doc/conf.py +Index: Python-3.13.14/Doc/conf.py =================================================================== ---- Python-3.13.12.orig/Doc/conf.py 2026-02-06 11:32:20.252483695 +0100 -+++ Python-3.13.12/Doc/conf.py 2026-02-06 11:32:43.259159426 +0100 -@@ -11,6 +11,8 @@ - from importlib import import_module +--- Python-3.13.14.orig/Doc/conf.py 2026-06-17 15:09:02.614245675 +0200 ++++ Python-3.13.14/Doc/conf.py 2026-06-17 15:09:20.087949096 +0200 +@@ -10,6 +10,8 @@ + import sys from importlib.util import find_spec +from sphinx import version_info @@ -110,7 +110,7 @@ # Make our custom extensions available to Sphinx sys.path.append(os.path.abspath('tools/extensions')) sys.path.append(os.path.abspath('includes')) -@@ -57,11 +59,11 @@ +@@ -56,11 +58,11 @@ import _tkinter except ImportError: _tkinter = None @@ -136,7 +136,7 @@ # Create table of contents entries for domain objects (e.g. functions, classes, # attributes, etc.). Default is True. -@@ -246,6 +248,9 @@ +@@ -247,6 +249,9 @@ # Avoid a warning with Sphinx >= 4.0 root_doc = 'contents' @@ -146,7 +146,7 @@ # Allow translation of index directives gettext_additional_targets = [ 'index', -@@ -285,7 +290,7 @@ +@@ -286,7 +291,7 @@ # (See .readthedocs.yml and https://docs.readthedocs.io/en/stable/reference/environment-variables.html) is_deployment_preview = os.getenv("READTHEDOCS_VERSION_TYPE") == "external" repository_url = os.getenv("READTHEDOCS_GIT_CLONE_URL", "") @@ -155,7 +155,7 @@ html_context = { "is_deployment_preview": is_deployment_preview, "repository_url": repository_url or None, -@@ -551,6 +556,16 @@ +@@ -562,6 +567,16 @@ } extlinks_detect_hardcoded_links = True @@ -172,10 +172,10 @@ # Options for c_annotations extension # ----------------------------------- -Index: Python-3.13.12/Doc/library/doctest.rst +Index: Python-3.13.14/Doc/library/doctest.rst =================================================================== ---- Python-3.13.12.orig/Doc/library/doctest.rst 2026-02-03 18:53:27.000000000 +0100 -+++ Python-3.13.12/Doc/library/doctest.rst 2026-02-06 11:32:43.259497242 +0100 +--- Python-3.13.14.orig/Doc/library/doctest.rst 2026-06-10 14:24:04.000000000 +0200 ++++ Python-3.13.14/Doc/library/doctest.rst 2026-06-17 15:09:20.088259281 +0200 @@ -310,7 +310,6 @@ .. currentmodule:: None @@ -184,10 +184,10 @@ .. currentmodule:: doctest -Index: Python-3.13.12/Doc/library/email.compat32-message.rst +Index: Python-3.13.14/Doc/library/email.compat32-message.rst =================================================================== ---- Python-3.13.12.orig/Doc/library/email.compat32-message.rst 2026-02-03 18:53:27.000000000 +0100 -+++ Python-3.13.12/Doc/library/email.compat32-message.rst 2026-02-06 11:32:43.259906983 +0100 +--- Python-3.13.14.orig/Doc/library/email.compat32-message.rst 2026-06-10 14:24:04.000000000 +0200 ++++ Python-3.13.14/Doc/library/email.compat32-message.rst 2026-06-17 15:09:20.088601737 +0200 @@ -7,7 +7,6 @@ :synopsis: The base class representing email messages in a fashion backward compatible with Python 3.2 @@ -196,10 +196,10 @@ The :class:`Message` class is very similar to the -Index: Python-3.13.12/Doc/library/xml.etree.elementtree.rst +Index: Python-3.13.14/Doc/library/xml.etree.elementtree.rst =================================================================== ---- Python-3.13.12.orig/Doc/library/xml.etree.elementtree.rst 2026-02-03 18:53:27.000000000 +0100 -+++ Python-3.13.12/Doc/library/xml.etree.elementtree.rst 2026-02-06 11:32:43.260169777 +0100 +--- Python-3.13.14.orig/Doc/library/xml.etree.elementtree.rst 2026-06-10 14:24:04.000000000 +0200 ++++ Python-3.13.14/Doc/library/xml.etree.elementtree.rst 2026-06-17 15:09:20.088861807 +0200 @@ -873,7 +873,6 @@ .. module:: xml.etree.ElementTree @@ -208,10 +208,10 @@ .. class:: Element(tag, attrib={}, **extra) -Index: Python-3.13.12/Doc/tools/check-warnings.py +Index: Python-3.13.14/Doc/tools/check-warnings.py =================================================================== ---- Python-3.13.12.orig/Doc/tools/check-warnings.py 2026-02-03 18:53:27.000000000 +0100 -+++ Python-3.13.12/Doc/tools/check-warnings.py 2026-02-06 11:32:43.260451727 +0100 +--- Python-3.13.14.orig/Doc/tools/check-warnings.py 2026-06-10 14:24:04.000000000 +0200 ++++ Python-3.13.14/Doc/tools/check-warnings.py 2026-06-17 15:09:20.089140552 +0200 @@ -228,7 +228,8 @@ print(filename) for warning in warnings: @@ -231,10 +231,10 @@ for warning in warnings if "Doc/" in warning } -Index: Python-3.13.12/Doc/tools/extensions/audit_events.py +Index: Python-3.13.14/Doc/tools/extensions/audit_events.py =================================================================== ---- Python-3.13.12.orig/Doc/tools/extensions/audit_events.py 2026-02-03 18:53:27.000000000 +0100 -+++ Python-3.13.12/Doc/tools/extensions/audit_events.py 2026-02-06 11:32:43.260742655 +0100 +--- Python-3.13.14.orig/Doc/tools/extensions/audit_events.py 2026-06-10 14:24:04.000000000 +0200 ++++ Python-3.13.14/Doc/tools/extensions/audit_events.py 2026-06-17 15:09:20.089399701 +0200 @@ -1,9 +1,6 @@ """Support for documenting audit events.""" @@ -370,10 +370,10 @@ ) -> nodes.row: row = nodes.row() name_node = nodes.paragraph("", nodes.Text(name)) -Index: Python-3.13.12/Doc/tools/extensions/availability.py +Index: Python-3.13.14/Doc/tools/extensions/availability.py =================================================================== ---- Python-3.13.12.orig/Doc/tools/extensions/availability.py 2026-02-03 18:53:27.000000000 +0100 -+++ Python-3.13.12/Doc/tools/extensions/availability.py 2026-02-06 11:32:43.260981454 +0100 +--- Python-3.13.14.orig/Doc/tools/extensions/availability.py 2026-06-10 14:24:04.000000000 +0200 ++++ Python-3.13.14/Doc/tools/extensions/availability.py 2026-06-17 15:09:20.089618053 +0200 @@ -1,8 +1,6 @@ """Support for documenting platform availability""" @@ -427,10 +427,10 @@ app.add_directive("availability", Availability) return { -Index: Python-3.13.12/Doc/tools/extensions/c_annotations.py +Index: Python-3.13.14/Doc/tools/extensions/c_annotations.py =================================================================== ---- Python-3.13.12.orig/Doc/tools/extensions/c_annotations.py 2026-02-03 18:53:27.000000000 +0100 -+++ Python-3.13.12/Doc/tools/extensions/c_annotations.py 2026-02-06 11:32:43.261164228 +0100 +--- Python-3.13.14.orig/Doc/tools/extensions/c_annotations.py 2026-06-10 14:24:04.000000000 +0200 ++++ Python-3.13.14/Doc/tools/extensions/c_annotations.py 2026-06-17 15:09:20.089797411 +0200 @@ -9,22 +9,26 @@ * Set ``stable_abi_file`` to the path to stable ABI list. """ @@ -569,10 +569,10 @@ return { "version": "1.0", "parallel_read_safe": True, -Index: Python-3.13.12/Doc/tools/extensions/changes.py +Index: Python-3.13.14/Doc/tools/extensions/changes.py =================================================================== ---- Python-3.13.12.orig/Doc/tools/extensions/changes.py 2026-02-03 18:53:27.000000000 +0100 -+++ Python-3.13.12/Doc/tools/extensions/changes.py 2026-02-06 11:32:43.261401915 +0100 +--- Python-3.13.14.orig/Doc/tools/extensions/changes.py 2026-06-10 14:24:04.000000000 +0200 ++++ Python-3.13.14/Doc/tools/extensions/changes.py 2026-06-17 15:09:20.089988751 +0200 @@ -1,7 +1,5 @@ """Support for documenting version of changes, additions, deprecations.""" @@ -608,10 +608,10 @@ # Override Sphinx's directives with support for 'next' app.add_directive("versionadded", PyVersionChange, override=True) app.add_directive("versionchanged", PyVersionChange, override=True) -Index: Python-3.13.12/Doc/tools/extensions/glossary_search.py +Index: Python-3.13.14/Doc/tools/extensions/glossary_search.py =================================================================== ---- Python-3.13.12.orig/Doc/tools/extensions/glossary_search.py 2026-02-03 18:53:27.000000000 +0100 -+++ Python-3.13.12/Doc/tools/extensions/glossary_search.py 2026-02-06 11:32:43.261561375 +0100 +--- Python-3.13.14.orig/Doc/tools/extensions/glossary_search.py 2026-06-10 14:24:04.000000000 +0200 ++++ Python-3.13.14/Doc/tools/extensions/glossary_search.py 2026-06-17 15:09:20.090137722 +0200 @@ -1,21 +1,27 @@ """Feature search results for glossary items prominently.""" @@ -655,10 +655,10 @@ app.connect('doctree-resolved', process_glossary_nodes) app.connect('build-finished', write_glossary_json) -Index: Python-3.13.12/Doc/tools/extensions/implementation_detail.py +Index: Python-3.13.14/Doc/tools/extensions/implementation_detail.py =================================================================== ---- Python-3.13.12.orig/Doc/tools/extensions/implementation_detail.py 2026-02-03 18:53:27.000000000 +0100 -+++ Python-3.13.12/Doc/tools/extensions/implementation_detail.py 2026-02-06 11:32:43.261759899 +0100 +--- Python-3.13.14.orig/Doc/tools/extensions/implementation_detail.py 2026-06-10 14:24:04.000000000 +0200 ++++ Python-3.13.14/Doc/tools/extensions/implementation_detail.py 2026-06-17 15:09:20.090286132 +0200 @@ -1,17 +1,10 @@ """Support for marking up implementation details.""" @@ -709,10 +709,10 @@ app.add_directive("impl-detail", ImplementationDetail) return { -Index: Python-3.13.12/Doc/tools/extensions/issue_role.py +Index: Python-3.13.14/Doc/tools/extensions/issue_role.py =================================================================== ---- Python-3.13.12.orig/Doc/tools/extensions/issue_role.py 2026-02-03 18:53:27.000000000 +0100 -+++ Python-3.13.12/Doc/tools/extensions/issue_role.py 2026-02-06 11:32:43.261920641 +0100 +--- Python-3.13.14.orig/Doc/tools/extensions/issue_role.py 2026-06-10 14:24:04.000000000 +0200 ++++ Python-3.13.14/Doc/tools/extensions/issue_role.py 2026-06-17 15:09:20.090431937 +0200 @@ -1,22 +1,18 @@ """Support for referencing issues in the tracker.""" @@ -758,10 +758,10 @@ app.add_role("issue", BPOIssue()) app.add_role("gh", GitHubIssue()) -Index: Python-3.13.12/Doc/tools/extensions/misc_news.py +Index: Python-3.13.14/Doc/tools/extensions/misc_news.py =================================================================== ---- Python-3.13.12.orig/Doc/tools/extensions/misc_news.py 2026-02-03 18:53:27.000000000 +0100 -+++ Python-3.13.12/Doc/tools/extensions/misc_news.py 2026-02-06 11:32:43.262085421 +0100 +--- Python-3.13.14.orig/Doc/tools/extensions/misc_news.py 2026-06-10 14:24:04.000000000 +0200 ++++ Python-3.13.14/Doc/tools/extensions/misc_news.py 2026-06-17 15:09:20.090610033 +0200 @@ -1,7 +1,5 @@ """Support for including Misc/NEWS.""" @@ -814,10 +814,10 @@ app.add_directive("miscnews", MiscNews) return { -Index: Python-3.13.12/Doc/tools/extensions/patchlevel.py +Index: Python-3.13.14/Doc/tools/extensions/patchlevel.py =================================================================== ---- Python-3.13.12.orig/Doc/tools/extensions/patchlevel.py 2026-02-03 18:53:27.000000000 +0100 -+++ Python-3.13.12/Doc/tools/extensions/patchlevel.py 2026-02-06 11:32:43.262245612 +0100 +--- Python-3.13.14.orig/Doc/tools/extensions/patchlevel.py 2026-06-10 14:24:04.000000000 +0200 ++++ Python-3.13.14/Doc/tools/extensions/patchlevel.py 2026-06-17 15:09:20.090806974 +0200 @@ -3,7 +3,7 @@ import re import sys @@ -855,10 +855,10 @@ version = f"{info.major}.{info.minor}" release = f"{info.major}.{info.minor}.{info.micro}" if info.releaselevel != "final": -Index: Python-3.13.12/Doc/tools/extensions/pydoc_topics.py +Index: Python-3.13.14/Doc/tools/extensions/pydoc_topics.py =================================================================== ---- Python-3.13.12.orig/Doc/tools/extensions/pydoc_topics.py 2026-02-03 18:53:27.000000000 +0100 -+++ Python-3.13.12/Doc/tools/extensions/pydoc_topics.py 2026-02-06 11:32:43.262420171 +0100 +--- Python-3.13.14.orig/Doc/tools/extensions/pydoc_topics.py 2026-06-10 14:24:04.000000000 +0200 ++++ Python-3.13.14/Doc/tools/extensions/pydoc_topics.py 2026-06-17 15:09:20.090958359 +0200 @@ -1,21 +1,23 @@ """Support for building "topic help" for pydoc.""" ++++++ gh139257-Support-docutils-0.22.patch ++++++ --- /var/tmp/diff_new_pack.MNBVyi/_old 2026-07-22 19:01:15.977155677 +0200 +++ /var/tmp/diff_new_pack.MNBVyi/_new 2026-07-22 19:01:15.981155814 +0200 @@ -4,14 +4,14 @@ Subject: [PATCH 1/2] gh-139257: Support docutils >= 0.22 --- - Doc/tools/extensions/pyspecific.py | 69 +++++++++++++++++++++++++------------ - 1 file changed, 47 insertions(+), 22 deletions(-) + Doc/tools/extensions/pyspecific.py | 57 +++++++++++++++++++++++++------------ + 1 file changed, 40 insertions(+), 17 deletions(-) -Index: Python-3.13.11/Doc/tools/extensions/pyspecific.py +Index: Python-3.13.14/Doc/tools/extensions/pyspecific.py =================================================================== ---- Python-3.13.11.orig/Doc/tools/extensions/pyspecific.py 2025-12-05 17:06:33.000000000 +0100 -+++ Python-3.13.11/Doc/tools/extensions/pyspecific.py 2025-12-18 23:38:44.804668556 +0100 -@@ -1,12 +1,12 @@ +--- Python-3.13.14.orig/Doc/tools/extensions/pyspecific.py 2026-06-10 14:24:04.000000000 +0200 ++++ Python-3.13.14/Doc/tools/extensions/pyspecific.py 2026-06-17 15:12:29.013047826 +0200 +@@ -1,20 +1,38 @@ # -*- coding: utf-8 -*- """ - pyspecific.py @@ -29,14 +29,12 @@ """ import re -@@ -22,30 +22,50 @@ - from sphinx.util.docutils import SphinxDirective - # Used in conf.py and updated here by python/release-tools/run_release.py --SOURCE_URI = 'https://github.com/python/cpython/tree/3.13/%s' -+SOURCE_URI = "https://github.com/python/cpython/tree/3.13/%s"; -+ -+ ++from docutils.parsers.rst.states import Body + from sphinx import addnodes + from sphinx.domains.python import PyFunction, PyMethod + + +# monkey-patch reST parser to disable alphabetic and roman enumerated lists +def _disable_alphabetic_and_roman(text): + try: @@ -49,43 +47,15 @@ + return None + + -+from docutils.parsers.rst.states import Body -+ +Body.enum.converters["loweralpha"] = Body.enum.converters["upperalpha"] = ( + Body.enum.converters["lowerroman"] +) = Body.enum.converters["upperroman"] = _disable_alphabetic_and_roman + - ++ class PyAwaitableMixin(object): def handle_signature(self, sig, signode): ret = super(PyAwaitableMixin, self).handle_signature(sig, signode) -- signode.insert(0, addnodes.desc_annotation('awaitable ', 'awaitable ')) -+ signode.insert(0, addnodes.desc_annotation("awaitable ", "awaitable ")) - return ret - - - class PyAwaitableFunction(PyAwaitableMixin, PyFunction): - def run(self): -- self.name = 'py:function' -+ self.name = "py:function" - return PyFunction.run(self) - - - class PyAwaitableMethod(PyAwaitableMixin, PyMethod): - def run(self): -- self.name = 'py:method' -+ self.name = "py:method" - return PyMethod.run(self) - - - # Support for documenting Opcodes - --opcode_sig_re = re.compile(r'(\w+(?:\+\d)?)(?:\s*\((.*)\))?') -+opcode_sig_re = re.compile(r"(\w+(?:\+\d)?)(?:\s*\((.*)\))?") - - - def parse_opcode_signature(env, sig, signode): -@@ -64,7 +84,7 @@ +@@ -55,7 +73,7 @@ # Support for documenting pdb commands @@ -94,7 +64,7 @@ # later... # pdbargs_tokens_re = re.compile(r'''[a-zA-Z]+ | # identifiers -@@ -80,16 +100,16 @@ +@@ -71,16 +89,16 @@ if m is None: raise ValueError name, args = m.groups() @@ -114,7 +84,7 @@ signode += addnodes.desc_name(sig, sig) return sig -@@ -102,7 +122,7 @@ +@@ -93,7 +111,7 @@ As such, we link this to ``env-check-consistency``, even though it has nothing to do with the environment consistency check. """ @@ -123,7 +93,7 @@ return # allow translating deprecated index entries -@@ -119,10 +139,15 @@ +@@ -110,10 +128,15 @@ def setup(app): ++++++ pass-test_write_read_limited_history.patch ++++++ --- /var/tmp/diff_new_pack.MNBVyi/_old 2026-07-22 19:01:16.053158277 +0200 +++ /var/tmp/diff_new_pack.MNBVyi/_new 2026-07-22 19:01:16.057158413 +0200 @@ -2,10 +2,10 @@ Modules/readline.c | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) -Index: Python-3.13.13/Modules/readline.c +Index: Python-3.13.14/Modules/readline.c =================================================================== ---- Python-3.13.13.orig/Modules/readline.c 2026-04-07 20:19:01.000000000 +0200 -+++ Python-3.13.13/Modules/readline.c 2026-04-16 20:41:51.671384000 +0200 +--- Python-3.13.14.orig/Modules/readline.c 2026-06-10 14:24:04.000000000 +0200 ++++ Python-3.13.14/Modules/readline.c 2026-06-17 15:12:41.726025811 +0200 @@ -175,6 +175,8 @@ return PyUnicode_DecodeLocale(s, "surrogateescape"); } ++++++ test_UDPLITE_support.patch ++++++ --- /var/tmp/diff_new_pack.MNBVyi/_old 2026-07-22 19:01:16.133161013 +0200 +++ /var/tmp/diff_new_pack.MNBVyi/_new 2026-07-22 19:01:16.137161149 +0200 @@ -1,11 +1,11 @@ --- - Lib/test/test_socket.py | 21 +++++++++++++++++---- - 1 file changed, 17 insertions(+), 4 deletions(-) + Lib/test/test_socket.py | 18 +++++++++++++++++- + 1 file changed, 17 insertions(+), 1 deletion(-) -Index: Python-3.14.4/Lib/test/test_socket.py +Index: Python-3.13.14/Lib/test/test_socket.py =================================================================== ---- Python-3.14.4.orig/Lib/test/test_socket.py 2026-04-27 22:32:58.390808080 +0200 -+++ Python-3.14.4/Lib/test/test_socket.py 2026-04-27 22:51:31.284375485 +0200 +--- Python-3.13.14.orig/Lib/test/test_socket.py 2026-06-17 15:09:05.649370164 +0200 ++++ Python-3.13.14/Lib/test/test_socket.py 2026-06-17 15:26:46.425345602 +0200 @@ -168,6 +168,22 @@ return (cid is not None) @@ -29,14 +29,11 @@ def _have_socket_bluetooth(): """Check whether AF_BLUETOOTH sockets are supported on this host.""" try: -@@ -245,10 +261,7 @@ +@@ -264,7 +280,7 @@ HAVE_SOCKET_VSOCK = _have_socket_vsock() --# Older Android versions block UDPLITE with SELinux. --HAVE_SOCKET_UDPLITE = ( -- hasattr(socket, "IPPROTO_UDPLITE") -- and not (support.is_android and platform.android_ver().api_level < 29)) +-HAVE_SOCKET_UDPLITE = _have_udp_lite() +HAVE_SOCKET_UDPLITE = _have_socket_udplite() HAVE_SOCKET_BLUETOOTH = _have_socket_bluetooth()
