https://github.com/python/cpython/commit/41388c9cb160d0886d5ca00d2e6c8782608a4549
commit: 41388c9cb160d0886d5ca00d2e6c8782608a4549
branch: 3.11
author: Pablo Galindo Salgado <[email protected]>
committer: pablogsal <[email protected]>
date: 2026-08-13T00:03:19+01:00
summary:
Python 3.11.16
files:
A Misc/NEWS.d/3.11.16.rst
D Misc/NEWS.d/next/Build/2026-07-09-22-45-00.gh-issue-153438.Qr7N2p.rst
D Misc/NEWS.d/next/Library/2022-12-20-10-55-14.gh-issue-100372.utfP65.rst
D Misc/NEWS.d/next/Library/2025-09-26-18-04-28.gh-issue-90949.YHjSzX.rst
D Misc/NEWS.d/next/Library/2025-11-18-06-35-53.gh-issue-141707.DBmQIy.rst
D Misc/NEWS.d/next/Library/2026-03-17-20-52-24.gh-issue-146083.NxZa_c.rst
D Misc/NEWS.d/next/Library/2026-05-01-16-45-31.gh-issue-149231.x2nBEE.rst
D Misc/NEWS.d/next/Library/2026-07-29-11-20-00.gh-issue-98820.Qm7Hs4.rst
D Misc/NEWS.d/next/Library/2026-07-29-11-25-00.gh-issue-109638.Vt2Rn9.rst
D Misc/NEWS.d/next/Security/2026-01-16-11-58-19.gh-issue-143927.aviFeG.rst
D Misc/NEWS.d/next/Security/2026-01-16-12-04-49.gh-issue-143930.zYC5x3.rst
D Misc/NEWS.d/next/Security/2026-01-31-21-56-54.gh-issue-144370.fp9m8t.rst
D Misc/NEWS.d/next/Security/2026-03-04-18-59-17.gh-issue-145506.6hwvEh.rst
D Misc/NEWS.d/next/Security/2026-03-06-17-03-38.gh-issue-145599.kchwZV.rst
D Misc/NEWS.d/next/Security/2026-03-14-17-31-39.gh-issue-145986.ifSSr8.rst
D Misc/NEWS.d/next/Security/2026-03-20-09-29-42.gh-issue-146211.PQVbs7.rst
D Misc/NEWS.d/next/Security/2026-03-25-00-51-03.gh-issue-146333.LqdL__bn.rst
D Misc/NEWS.d/next/Security/2026-03-29-12-51-33.gh-issue-146581.4vZfB0.rst
D Misc/NEWS.d/next/Security/2026-03-31-09-15-51.gh-issue-148169.EZJzz2.rst
D Misc/NEWS.d/next/Security/2026-04-10-16-28-21.gh-issue-148395.kfzm0G.rst
D Misc/NEWS.d/next/Security/2026-04-20-15-31-37.gh-issue-148808._Z8JL0.rst
D Misc/NEWS.d/next/Security/2026-04-26-17-49-58.gh-issue-149017.EiVFPo.rst
D Misc/NEWS.d/next/Security/2026-04-26-19-30-45.gh-issue-149018.a9SqWb.rst
D Misc/NEWS.d/next/Security/2026-04-27-16-36-11.gh-issue-149079.vKl-LM.rst
D Misc/NEWS.d/next/Security/2026-05-03-21-00-00.gh-issue-149486.tarflt.rst
D Misc/NEWS.d/next/Security/2026-05-10-18-05-32.gh-issue-87451.XkKB6M.rst
D Misc/NEWS.d/next/Security/2026-05-11-21-15-07.gh-issue-149698.OudOcW.rst
D Misc/NEWS.d/next/Security/2026-05-30-00-00-00.gh-issue-150743.httpdos.rst
D Misc/NEWS.d/next/Security/2026-05-30-09-36-20.gh-issue-150599.nlHqU-.rst
D Misc/NEWS.d/next/Security/2026-06-10-13-08-19.gh-issue-151558.mL74i2.rst
D Misc/NEWS.d/next/Security/2026-06-16-14-58-02.gh-issue-151544._bexVy.rst
D Misc/NEWS.d/next/Security/2026-06-23-13-28-16.gh-issue-151981.xBHEcU.rst
D Misc/NEWS.d/next/Security/2026-06-23-14-19-30.gh-issue-151987.8mNIMf.rst
D Misc/NEWS.d/next/Security/2026-06-25-20-44-20.gh-issue-152216.VxiK5y.rst
D Misc/NEWS.d/next/Security/2026-06-30-13-24-13.gh-issue-152674.-2QVoL.rst
D Misc/NEWS.d/next/Security/2026-07-04-17-00-00.gh-issue-153030.RovkP6.rst
D Misc/NEWS.d/next/Security/2026-08-11-15-24-21.gh-issue-155558.yDsXZC.rst
D Misc/NEWS.d/next/Tests/2026-05-13-14-53-23.gh-issue-149776.orqgsn.rst
D Misc/NEWS.d/next/macOS/2025-10-17-01-07-03.gh-issue-137586.kVzxvp.rst
M Doc/library/pyexpat.rst
M Include/patchlevel.h
M Lib/pydoc_data/topics.py
M README.rst
diff --git a/Doc/library/pyexpat.rst b/Doc/library/pyexpat.rst
index 6a94ee2c046f7b4..5f6bb9d24c4380c 100644
--- a/Doc/library/pyexpat.rst
+++ b/Doc/library/pyexpat.rst
@@ -263,7 +263,7 @@ against some common XML vulnerabilities.
Activation thresholds below 4 MiB are known to break support for DITA 1.3
payload and are hence not recommended.
- .. versionadded:: next
+ .. versionadded:: 3.11.16
.. method::
xmlparser.SetBillionLaughsAttackProtectionMaximumAmplification(max_factor, /)
@@ -295,7 +295,7 @@ against some common XML vulnerabilities.
that can be adjusted by
:meth:`.SetBillionLaughsAttackProtectionActivationThreshold`
is exceeded.
- .. versionadded:: next
+ .. versionadded:: 3.11.16
.. method:: xmlparser.SetAllocTrackerActivationThreshold(threshold, /)
diff --git a/Include/patchlevel.h b/Include/patchlevel.h
index fb28a09324deca8..f6264585e99347b 100644
--- a/Include/patchlevel.h
+++ b/Include/patchlevel.h
@@ -18,12 +18,12 @@
/*--start constants--*/
#define PY_MAJOR_VERSION 3
#define PY_MINOR_VERSION 11
-#define PY_MICRO_VERSION 15
+#define PY_MICRO_VERSION 16
#define PY_RELEASE_LEVEL PY_RELEASE_LEVEL_FINAL
#define PY_RELEASE_SERIAL 0
/* Version as a string */
-#define PY_VERSION "3.11.15+"
+#define PY_VERSION "3.11.16"
/*--end constants--*/
/* Version as a single 4-byte hex number, e.g. 0x010502B2 == 1.5.2b2.
diff --git a/Lib/pydoc_data/topics.py b/Lib/pydoc_data/topics.py
index 25b40327ef99a40..e379e3512cb8b35 100644
--- a/Lib/pydoc_data/topics.py
+++ b/Lib/pydoc_data/topics.py
@@ -1,5 +1,5 @@
# -*- coding: utf-8 -*-
-# Autogenerated by Sphinx on Tue Mar 3 00:52:44 2026
+# Autogenerated by Sphinx on Thu Aug 13 00:02:25 2026
# as part of the release process.
topics = {'assert': 'The "assert" statement\n'
'**********************\n'
diff --git a/Misc/NEWS.d/3.11.16.rst b/Misc/NEWS.d/3.11.16.rst
new file mode 100644
index 000000000000000..915dab3c11acf82
--- /dev/null
+++ b/Misc/NEWS.d/3.11.16.rst
@@ -0,0 +1,415 @@
+.. date: 2025-10-17-01-07-03
+.. gh-issue: 137586
+.. nonce: kVzxvp
+.. release date: 2026-08-13
+.. section: macOS
+
+Invoke :program:`osascript` with absolute path in :mod:`webbrowser` and
+:mod:`!turtledemo`.
+
+..
+
+.. date: 2026-05-13-14-53-23
+.. gh-issue: 149776
+.. nonce: orqgsn
+.. section: Tests
+
+Fix test_socket on Linux kernel 7.1 and newer: skip UDP Lite tests if it's
+not supported. Patch by Victor Stinner.
+
+..
+
+.. date: 2026-08-11-15-24-21
+.. gh-issue: 155558
+.. nonce: yDsXZC
+.. section: Security
+
+Update bundled `libexpat <https://libexpat.github.io/>`_ to version 2.8.3
+for the fix to `CVE-2026-72522
+<https://www.cve.org/CVERecord?id=CVE-2026-72522>`_.
+
+..
+
+.. date: 2026-07-04-17-00-00
+.. gh-issue: 153030
+.. nonce: RovkP6
+.. section: Security
+
+Fixed quadratic complexity in incremental parsing of long unterminated
+constructs (such as tags or comments) in :class:`html.parser.HTMLParser`,
+which could be exploited for a denial of service.
+
+..
+
+.. date: 2026-06-30-13-24-13
+.. gh-issue: 152674
+.. nonce: -2QVoL
+.. section: Security
+
+The :class:`xml.etree.ElementTree.Element` methods
+:meth:`~xml.etree.ElementTree.Element.findall`,
+:meth:`~xml.etree.ElementTree.Element.iterfind` and
+:meth:`~xml.etree.ElementTree.Element.find` avoid quadratic behavior when
+using XPath index predicates (``[1]``, ``[last()]``, ``[last()-N]``) on XML
+documents with many same-tag siblings.
+
+..
+
+.. date: 2026-06-25-20-44-20
+.. gh-issue: 152216
+.. nonce: VxiK5y
+.. section: Security
+
+Update bundled `libexpat <https://libexpat.github.io/>`_ to version 2.8.2.
+
+..
+
+.. date: 2026-06-23-14-19-30
+.. gh-issue: 151987
+.. nonce: 8mNIMf
+.. section: Security
+
+The :meth:`tarfile.TarFile.extract` method now applies the given filter when
+it extracts a link target from the archive as a fallback.
+
+..
+
+.. date: 2026-06-23-13-28-16
+.. gh-issue: 151981
+.. nonce: xBHEcU
+.. section: Security
+
+In :mod:`tarfile`, seeking a stream now stops when end of the stream is
+reached.
+
+..
+
+.. date: 2026-06-16-14-58-02
+.. gh-issue: 151544
+.. nonce: _bexVy
+.. section: Security
+
+:file:`Modules/Setup.local` is no longer used as a landmark to discover
+whether Python is running in a source tree, as it could potentially affect
+actual installs. The :file:`pybuilddir.txt` file is now the sole indicator
+of running in a source tree.
+
+..
+
+.. date: 2026-06-10-13-08-19
+.. gh-issue: 151558
+.. nonce: mL74i2
+.. section: Security
+
+Fixed an vulnerability in the :mod:`tarfile` ``data`` and ``tar`` extraction
+filters where crafted archives could create a symlink pointing outside the
+destination directory. This was a bypass of CVE-2025-4330.
+
+..
+
+.. date: 2026-05-30-09-36-20
+.. gh-issue: 150599
+.. nonce: nlHqU-
+.. section: Security
+
+Fix a possible stack buffer overflow in :mod:`bz2` when a
+:class:`bz2.BZ2Decompressor` is reused after a decompression error. The
+decompressor now becomes unusable after libbz2 reports an error.
+
+..
+
+.. date: 2026-05-30-00-00-00
+.. gh-issue: 150743
+.. nonce: httpdos
+.. section: Security
+
+:mod:`http.client` now limits the number of chunked-response trailer lines
+it will read to 100, and the number of interim (1xx) responses it will skip
+to 100. A malicious or broken server could previously stream trailer lines
+or ``100 Continue`` responses forever, hanging the client even when a socket
+timeout was in use. Reported by ``@YLChen-007`` via GHSA-w4q2-g22w-6fr4.
+
+..
+
+.. date: 2026-05-11-21-15-07
+.. gh-issue: 149698
+.. nonce: OudOcW
+.. section: Security
+
+Update bundled `libexpat <https://libexpat.github.io/>`_ to version 2.8.1
+for the fix for CVE-2026-45186.
+
+..
+
+.. date: 2026-05-10-18-05-32
+.. gh-issue: 87451
+.. nonce: XkKB6M
+.. section: Security
+
+The :mod:`ftplib` module's undocumented ``ftpcp`` function no longer trusts
+the IPv4 address value returned from the source server in response to the
+``PASV`` command by default, completing the fix for CVE-2021-4189. As with
+:class:`ftplib.FTP`, the former behavior can be re-enabled by setting the
+``trust_server_pasv_ipv4_address`` attribute on the source
+:class:`ftplib.FTP` instance to ``True``. Thanks to Qi Deng at Aurascape AI
+for the report.
+
+..
+
+.. date: 2026-05-03-21-00-00
+.. gh-issue: 149486
+.. nonce: tarflt
+.. section: Security
+
+:func:`tarfile.data_filter` now validates link targets using the same
+normalised value that is written to disk, strips trailing separators from
+the member name when resolving a symlink's directory, and rejects link
+members that would replace the destination directory itself. This closes
+several path-traversal bypasses of the ``data`` extraction filter.
+
+..
+
+.. date: 2026-04-27-16-36-11
+.. gh-issue: 149079
+.. nonce: vKl-LM
+.. section: Security
+
+Fix a potential denial of service in :func:`unicodedata.normalize`. The
+canonical ordering step of Unicode normalization used a quadratic-time
+insertion sort for reordering combining characters, which could be exploited
+with crafted input containing many combining characters in non-canonical
+order. Replaced with a linear-time counting sort for long runs.
+
+..
+
+.. date: 2026-04-26-19-30-45
+.. gh-issue: 149018
+.. nonce: a9SqWb
+.. section: Security
+
+Improved protection against XML hash-flooding attacks in
+:mod:`xml.parsers.expat` and :mod:`xml.etree.ElementTree` when Python is
+compiled with libExpat 2.8.0 or later.
+
+..
+
+.. date: 2026-04-26-17-49-58
+.. gh-issue: 149017
+.. nonce: EiVFPo
+.. section: Security
+
+Update bundled `libexpat <https://libexpat.github.io/>`_ to version 2.8.0.
+
+..
+
+.. date: 2026-04-20-15-31-37
+.. gh-issue: 148808
+.. nonce: _Z8JL0
+.. section: Security
+
+Added buffer boundary check when using ``nbytes`` parameter with
+:meth:`!asyncio.AbstractEventLoop.sock_recvfrom_into`. Only relevant for
+Windows and the :class:`asyncio.ProactorEventLoop`.
+
+..
+
+.. date: 2026-04-10-16-28-21
+.. gh-issue: 148395
+.. nonce: kfzm0G
+.. section: Security
+
+Fix a dangling input pointer in :class:`lzma.LZMADecompressor`, and
+:class:`bz2.BZ2Decompressor` when memory allocation fails with
+:exc:`MemoryError`, which could let a subsequent :meth:`!decompress` call
+read or write through a stale pointer to the already-released caller buffer.
+
+..
+
+.. date: 2026-03-31-09-15-51
+.. gh-issue: 148169
+.. nonce: EZJzz2
+.. section: Security
+
+A bypass in :mod:`webbrowser` allowed URLs prefixed with ``%action`` to pass
+the dash-prefix safety check.
+
+..
+
+.. date: 2026-03-29-12-51-33
+.. gh-issue: 146581
+.. nonce: 4vZfB0
+.. section: Security
+
+Fix vulnerability in :func:`shutil.unpack_archive` for ZIP files on Windows
+which allowed to write files outside of the destination tree if the patch in
+the archive contains a Windows drive prefix. Now such invalid paths will be
+skipped. Files containing ".." in the name (like "foo..bar") are no longer
+skipped.
+
+..
+
+.. date: 2026-03-25-00-51-03
+.. gh-issue: 146333
+.. nonce: LqdL__bn
+.. section: Security
+
+Fix quadratic backtracking in :class:`configparser.RawConfigParser` option
+parsing regexes (``OPTCRE`` and ``OPTCRE_NV``). A crafted configuration line
+with many whitespace characters could cause excessive CPU usage.
+
+..
+
+.. date: 2026-03-20-09-29-42
+.. gh-issue: 146211
+.. nonce: PQVbs7
+.. section: Security
+
+Reject CR/LF characters in tunnel request headers for the
+HTTPConnection.set_tunnel() method.
+
+..
+
+.. date: 2026-03-14-17-31-39
+.. gh-issue: 145986
+.. nonce: ifSSr8
+.. section: Security
+
+:mod:`xml.parsers.expat`: Fixed a crash caused by unbounded C recursion when
+converting deeply nested XML content models with
+:meth:`~xml.parsers.expat.xmlparser.ElementDeclHandler`. This addresses
+`CVE-2026-4224 <https://www.cve.org/CVERecord?id=CVE-2026-4224>`_.
+
+..
+
+.. date: 2026-03-06-17-03-38
+.. gh-issue: 145599
+.. nonce: kchwZV
+.. section: Security
+
+Reject control characters in :class:`http.cookies.Morsel`
+:meth:`~http.cookies.Morsel.update` and
+:meth:`~http.cookies.BaseCookie.js_output`. This addresses `CVE-2026-3644
+<https://www.cve.org/CVERecord?id=CVE-2026-3644>`_.
+
+..
+
+.. date: 2026-03-04-18-59-17
+.. gh-issue: 145506
+.. nonce: 6hwvEh
+.. section: Security
+
+Fixes CVE-2026-2297 by ensuring that ``SourcelessFileLoader`` uses
+:func:`io.open_code` when opening ``.pyc`` files.
+
+..
+
+.. date: 2026-01-31-21-56-54
+.. gh-issue: 144370
+.. nonce: fp9m8t
+.. section: Security
+
+Disallow usage of control characters in status in :mod:`wsgiref.handlers` to
+prevent HTTP header injections. Patch by Benedikt Johannes.
+
+..
+
+.. date: 2026-01-16-12-04-49
+.. gh-issue: 143930
+.. nonce: zYC5x3
+.. section: Security
+
+Reject leading dashes in URLs passed to :func:`webbrowser.open`.
+
+..
+
+.. date: 2026-01-16-11-58-19
+.. gh-issue: 143927
+.. nonce: aviFeG
+.. section: Security
+
+Normalize all line endings (CR, CRLF, and LF) to LF+TAB when writing
+multi-line configparser values.
+
+..
+
+.. date: 2026-07-29-11-25-00
+.. gh-issue: 109638
+.. nonce: Vt2Rn9
+.. section: Library
+
+Fix exponential time in :meth:`csv.Sniffer.sniff` for a sample which
+contains many quote characters. A doubled quote character is now also
+detected in a field which contains the delimiter or a line break.
+
+..
+
+.. date: 2026-07-29-11-20-00
+.. gh-issue: 98820
+.. nonce: Qm7Hs4
+.. section: Library
+
+Fix quadratic time in :meth:`csv.Sniffer.sniff` for a sample which contains
+quoted fields, in particular for a single column of quoted fields.
+
+..
+
+.. date: 2026-05-01-16-45-31
+.. gh-issue: 149231
+.. nonce: x2nBEE
+.. section: Library
+
+In :mod:`tomllib`, the number of parts in TOML keys is now limited.
+
+..
+
+.. date: 2026-03-17-20-52-24
+.. gh-issue: 146083
+.. nonce: NxZa_c
+.. section: Library
+
+Update bundled `libexpat <https://libexpat.github.io/>`_ to version 2.7.5.
+
+..
+
+.. date: 2025-11-18-06-35-53
+.. gh-issue: 141707
+.. nonce: DBmQIy
+.. section: Library
+
+Don't change :class:`tarfile.TarInfo` type from ``AREGTYPE`` to ``DIRTYPE``
+when parsing GNU long name or link headers.
+
+..
+
+.. date: 2025-09-26-18-04-28
+.. gh-issue: 90949
+.. nonce: YHjSzX
+.. section: Library
+
+Add
+:meth:`~xml.parsers.expat.xmlparser.SetBillionLaughsAttackProtectionActivationThreshold`
+and
+:meth:`~xml.parsers.expat.xmlparser.SetBillionLaughsAttackProtectionMaximumAmplification`
+to :ref:`xmlparser <xmlparser-objects>` objects to tune protections against
+`billion laughs <https://en.wikipedia.org/wiki/Billion_laughs_attack>`_
+attacks. Patch by Bénédikt Tran.
+
+..
+
+.. date: 2022-12-20-10-55-14
+.. gh-issue: 100372
+.. nonce: utfP65
+.. section: Library
+
+:meth:`ssl.SSLContext.load_verify_locations` no longer incorrectly accepts
+some cases of trailing data when parsing DER.
+
+..
+
+.. date: 2026-07-09-22-45-00
+.. gh-issue: 153438
+.. nonce: Qr7N2p
+.. section: Build
+
+Update Windows build and installer tooling and documentation to use the
+current download URL for ``nuget.exe``.
diff --git
a/Misc/NEWS.d/next/Build/2026-07-09-22-45-00.gh-issue-153438.Qr7N2p.rst
b/Misc/NEWS.d/next/Build/2026-07-09-22-45-00.gh-issue-153438.Qr7N2p.rst
deleted file mode 100644
index edab8e6ba7b2595..000000000000000
--- a/Misc/NEWS.d/next/Build/2026-07-09-22-45-00.gh-issue-153438.Qr7N2p.rst
+++ /dev/null
@@ -1,2 +0,0 @@
-Update Windows build and installer tooling and documentation to use the
-current download URL for ``nuget.exe``.
diff --git
a/Misc/NEWS.d/next/Library/2022-12-20-10-55-14.gh-issue-100372.utfP65.rst
b/Misc/NEWS.d/next/Library/2022-12-20-10-55-14.gh-issue-100372.utfP65.rst
deleted file mode 100644
index ec37aff5092c3af..000000000000000
--- a/Misc/NEWS.d/next/Library/2022-12-20-10-55-14.gh-issue-100372.utfP65.rst
+++ /dev/null
@@ -1,2 +0,0 @@
-:meth:`ssl.SSLContext.load_verify_locations` no longer incorrectly accepts
-some cases of trailing data when parsing DER.
diff --git
a/Misc/NEWS.d/next/Library/2025-09-26-18-04-28.gh-issue-90949.YHjSzX.rst
b/Misc/NEWS.d/next/Library/2025-09-26-18-04-28.gh-issue-90949.YHjSzX.rst
deleted file mode 100644
index dae1b618ca0d76a..000000000000000
--- a/Misc/NEWS.d/next/Library/2025-09-26-18-04-28.gh-issue-90949.YHjSzX.rst
+++ /dev/null
@@ -1,7 +0,0 @@
-Add
-:meth:`~xml.parsers.expat.xmlparser.SetBillionLaughsAttackProtectionActivationThreshold`
-and
-:meth:`~xml.parsers.expat.xmlparser.SetBillionLaughsAttackProtectionMaximumAmplification`
-to :ref:`xmlparser <xmlparser-objects>` objects to tune protections against
-`billion laughs <https://en.wikipedia.org/wiki/Billion_laughs_attack>`_
attacks.
-Patch by Bénédikt Tran.
diff --git
a/Misc/NEWS.d/next/Library/2025-11-18-06-35-53.gh-issue-141707.DBmQIy.rst
b/Misc/NEWS.d/next/Library/2025-11-18-06-35-53.gh-issue-141707.DBmQIy.rst
deleted file mode 100644
index 1f5b8ed90b8a904..000000000000000
--- a/Misc/NEWS.d/next/Library/2025-11-18-06-35-53.gh-issue-141707.DBmQIy.rst
+++ /dev/null
@@ -1,2 +0,0 @@
-Don't change :class:`tarfile.TarInfo` type from ``AREGTYPE`` to ``DIRTYPE``
when parsing
-GNU long name or link headers.
diff --git
a/Misc/NEWS.d/next/Library/2026-03-17-20-52-24.gh-issue-146083.NxZa_c.rst
b/Misc/NEWS.d/next/Library/2026-03-17-20-52-24.gh-issue-146083.NxZa_c.rst
deleted file mode 100644
index 6805a40a03e7346..000000000000000
--- a/Misc/NEWS.d/next/Library/2026-03-17-20-52-24.gh-issue-146083.NxZa_c.rst
+++ /dev/null
@@ -1 +0,0 @@
-Update bundled `libexpat <https://libexpat.github.io/>`_ to version 2.7.5.
diff --git
a/Misc/NEWS.d/next/Library/2026-05-01-16-45-31.gh-issue-149231.x2nBEE.rst
b/Misc/NEWS.d/next/Library/2026-05-01-16-45-31.gh-issue-149231.x2nBEE.rst
deleted file mode 100644
index c265b54db8bed47..000000000000000
--- a/Misc/NEWS.d/next/Library/2026-05-01-16-45-31.gh-issue-149231.x2nBEE.rst
+++ /dev/null
@@ -1 +0,0 @@
-In :mod:`tomllib`, the number of parts in TOML keys is now limited.
diff --git
a/Misc/NEWS.d/next/Library/2026-07-29-11-20-00.gh-issue-98820.Qm7Hs4.rst
b/Misc/NEWS.d/next/Library/2026-07-29-11-20-00.gh-issue-98820.Qm7Hs4.rst
deleted file mode 100644
index aa9ae8d937004fe..000000000000000
--- a/Misc/NEWS.d/next/Library/2026-07-29-11-20-00.gh-issue-98820.Qm7Hs4.rst
+++ /dev/null
@@ -1,2 +0,0 @@
-Fix quadratic time in :meth:`csv.Sniffer.sniff` for a sample which contains
-quoted fields, in particular for a single column of quoted fields.
diff --git
a/Misc/NEWS.d/next/Library/2026-07-29-11-25-00.gh-issue-109638.Vt2Rn9.rst
b/Misc/NEWS.d/next/Library/2026-07-29-11-25-00.gh-issue-109638.Vt2Rn9.rst
deleted file mode 100644
index f44163a20c8278e..000000000000000
--- a/Misc/NEWS.d/next/Library/2026-07-29-11-25-00.gh-issue-109638.Vt2Rn9.rst
+++ /dev/null
@@ -1,3 +0,0 @@
-Fix exponential time in :meth:`csv.Sniffer.sniff` for a sample which contains
-many quote characters. A doubled quote character is now also detected in
-a field which contains the delimiter or a line break.
diff --git
a/Misc/NEWS.d/next/Security/2026-01-16-11-58-19.gh-issue-143927.aviFeG.rst
b/Misc/NEWS.d/next/Security/2026-01-16-11-58-19.gh-issue-143927.aviFeG.rst
deleted file mode 100644
index ca554997e5c3963..000000000000000
--- a/Misc/NEWS.d/next/Security/2026-01-16-11-58-19.gh-issue-143927.aviFeG.rst
+++ /dev/null
@@ -1,2 +0,0 @@
-Normalize all line endings (CR, CRLF, and LF) to LF+TAB when writing
-multi-line configparser values.
diff --git
a/Misc/NEWS.d/next/Security/2026-01-16-12-04-49.gh-issue-143930.zYC5x3.rst
b/Misc/NEWS.d/next/Security/2026-01-16-12-04-49.gh-issue-143930.zYC5x3.rst
deleted file mode 100644
index c561023c3c2d7a7..000000000000000
--- a/Misc/NEWS.d/next/Security/2026-01-16-12-04-49.gh-issue-143930.zYC5x3.rst
+++ /dev/null
@@ -1 +0,0 @@
-Reject leading dashes in URLs passed to :func:`webbrowser.open`.
diff --git
a/Misc/NEWS.d/next/Security/2026-01-31-21-56-54.gh-issue-144370.fp9m8t.rst
b/Misc/NEWS.d/next/Security/2026-01-31-21-56-54.gh-issue-144370.fp9m8t.rst
deleted file mode 100644
index 2d13a0611322c52..000000000000000
--- a/Misc/NEWS.d/next/Security/2026-01-31-21-56-54.gh-issue-144370.fp9m8t.rst
+++ /dev/null
@@ -1,2 +0,0 @@
-Disallow usage of control characters in status in :mod:`wsgiref.handlers` to
prevent HTTP header injections.
-Patch by Benedikt Johannes.
diff --git
a/Misc/NEWS.d/next/Security/2026-03-04-18-59-17.gh-issue-145506.6hwvEh.rst
b/Misc/NEWS.d/next/Security/2026-03-04-18-59-17.gh-issue-145506.6hwvEh.rst
deleted file mode 100644
index edeb9e640c2732d..000000000000000
--- a/Misc/NEWS.d/next/Security/2026-03-04-18-59-17.gh-issue-145506.6hwvEh.rst
+++ /dev/null
@@ -1,2 +0,0 @@
-Fixes CVE-2026-2297 by ensuring that ``SourcelessFileLoader`` uses
-:func:`io.open_code` when opening ``.pyc`` files.
diff --git
a/Misc/NEWS.d/next/Security/2026-03-06-17-03-38.gh-issue-145599.kchwZV.rst
b/Misc/NEWS.d/next/Security/2026-03-06-17-03-38.gh-issue-145599.kchwZV.rst
deleted file mode 100644
index fc2e503779a2546..000000000000000
--- a/Misc/NEWS.d/next/Security/2026-03-06-17-03-38.gh-issue-145599.kchwZV.rst
+++ /dev/null
@@ -1,4 +0,0 @@
-Reject control characters in :class:`http.cookies.Morsel`
-:meth:`~http.cookies.Morsel.update` and
-:meth:`~http.cookies.BaseCookie.js_output`.
-This addresses `CVE-2026-3644
<https://www.cve.org/CVERecord?id=CVE-2026-3644>`_.
diff --git
a/Misc/NEWS.d/next/Security/2026-03-14-17-31-39.gh-issue-145986.ifSSr8.rst
b/Misc/NEWS.d/next/Security/2026-03-14-17-31-39.gh-issue-145986.ifSSr8.rst
deleted file mode 100644
index cb9dbadb72d976d..000000000000000
--- a/Misc/NEWS.d/next/Security/2026-03-14-17-31-39.gh-issue-145986.ifSSr8.rst
+++ /dev/null
@@ -1,4 +0,0 @@
-:mod:`xml.parsers.expat`: Fixed a crash caused by unbounded C recursion when
-converting deeply nested XML content models with
-:meth:`~xml.parsers.expat.xmlparser.ElementDeclHandler`.
-This addresses `CVE-2026-4224
<https://www.cve.org/CVERecord?id=CVE-2026-4224>`_.
diff --git
a/Misc/NEWS.d/next/Security/2026-03-20-09-29-42.gh-issue-146211.PQVbs7.rst
b/Misc/NEWS.d/next/Security/2026-03-20-09-29-42.gh-issue-146211.PQVbs7.rst
deleted file mode 100644
index 4993633b8ebebb2..000000000000000
--- a/Misc/NEWS.d/next/Security/2026-03-20-09-29-42.gh-issue-146211.PQVbs7.rst
+++ /dev/null
@@ -1,2 +0,0 @@
-Reject CR/LF characters in tunnel request headers for the
-HTTPConnection.set_tunnel() method.
diff --git
a/Misc/NEWS.d/next/Security/2026-03-25-00-51-03.gh-issue-146333.LqdL__bn.rst
b/Misc/NEWS.d/next/Security/2026-03-25-00-51-03.gh-issue-146333.LqdL__bn.rst
deleted file mode 100644
index 96d86ecc0a0fb3e..000000000000000
--- a/Misc/NEWS.d/next/Security/2026-03-25-00-51-03.gh-issue-146333.LqdL__bn.rst
+++ /dev/null
@@ -1,3 +0,0 @@
-Fix quadratic backtracking in :class:`configparser.RawConfigParser` option
-parsing regexes (``OPTCRE`` and ``OPTCRE_NV``). A crafted configuration line
-with many whitespace characters could cause excessive CPU usage.
diff --git
a/Misc/NEWS.d/next/Security/2026-03-29-12-51-33.gh-issue-146581.4vZfB0.rst
b/Misc/NEWS.d/next/Security/2026-03-29-12-51-33.gh-issue-146581.4vZfB0.rst
deleted file mode 100644
index 98e65549d79016f..000000000000000
--- a/Misc/NEWS.d/next/Security/2026-03-29-12-51-33.gh-issue-146581.4vZfB0.rst
+++ /dev/null
@@ -1,5 +0,0 @@
-Fix vulnerability in :func:`shutil.unpack_archive` for ZIP files on Windows
-which allowed to write files outside of the destination tree if the patch in
-the archive contains a Windows drive prefix. Now such invalid paths will be
-skipped. Files containing ".." in the name (like "foo..bar") are no longer
-skipped.
diff --git
a/Misc/NEWS.d/next/Security/2026-03-31-09-15-51.gh-issue-148169.EZJzz2.rst
b/Misc/NEWS.d/next/Security/2026-03-31-09-15-51.gh-issue-148169.EZJzz2.rst
deleted file mode 100644
index 45cdeebe1b6d64a..000000000000000
--- a/Misc/NEWS.d/next/Security/2026-03-31-09-15-51.gh-issue-148169.EZJzz2.rst
+++ /dev/null
@@ -1,2 +0,0 @@
-A bypass in :mod:`webbrowser` allowed URLs prefixed with ``%action`` to pass
-the dash-prefix safety check.
diff --git
a/Misc/NEWS.d/next/Security/2026-04-10-16-28-21.gh-issue-148395.kfzm0G.rst
b/Misc/NEWS.d/next/Security/2026-04-10-16-28-21.gh-issue-148395.kfzm0G.rst
deleted file mode 100644
index 349d1cf3cacdf42..000000000000000
--- a/Misc/NEWS.d/next/Security/2026-04-10-16-28-21.gh-issue-148395.kfzm0G.rst
+++ /dev/null
@@ -1,5 +0,0 @@
-Fix a dangling input pointer in :class:`lzma.LZMADecompressor`,
-and :class:`bz2.BZ2Decompressor`
-when memory allocation fails with :exc:`MemoryError`, which could let a
-subsequent :meth:`!decompress` call read or write through a stale pointer to
-the already-released caller buffer.
diff --git
a/Misc/NEWS.d/next/Security/2026-04-20-15-31-37.gh-issue-148808._Z8JL0.rst
b/Misc/NEWS.d/next/Security/2026-04-20-15-31-37.gh-issue-148808._Z8JL0.rst
deleted file mode 100644
index 0b5cf85fedfba10..000000000000000
--- a/Misc/NEWS.d/next/Security/2026-04-20-15-31-37.gh-issue-148808._Z8JL0.rst
+++ /dev/null
@@ -1,3 +0,0 @@
-Added buffer boundary check when using ``nbytes`` parameter with
-:meth:`!asyncio.AbstractEventLoop.sock_recvfrom_into`. Only
-relevant for Windows and the :class:`asyncio.ProactorEventLoop`.
diff --git
a/Misc/NEWS.d/next/Security/2026-04-26-17-49-58.gh-issue-149017.EiVFPo.rst
b/Misc/NEWS.d/next/Security/2026-04-26-17-49-58.gh-issue-149017.EiVFPo.rst
deleted file mode 100644
index 6aa7efb68a1981e..000000000000000
--- a/Misc/NEWS.d/next/Security/2026-04-26-17-49-58.gh-issue-149017.EiVFPo.rst
+++ /dev/null
@@ -1 +0,0 @@
-Update bundled `libexpat <https://libexpat.github.io/>`_ to version 2.8.0.
diff --git
a/Misc/NEWS.d/next/Security/2026-04-26-19-30-45.gh-issue-149018.a9SqWb.rst
b/Misc/NEWS.d/next/Security/2026-04-26-19-30-45.gh-issue-149018.a9SqWb.rst
deleted file mode 100644
index d1b5b368684e6a5..000000000000000
--- a/Misc/NEWS.d/next/Security/2026-04-26-19-30-45.gh-issue-149018.a9SqWb.rst
+++ /dev/null
@@ -1,3 +0,0 @@
-Improved protection against XML hash-flooding attacks in
-:mod:`xml.parsers.expat` and :mod:`xml.etree.ElementTree` when Python is
-compiled with libExpat 2.8.0 or later.
diff --git
a/Misc/NEWS.d/next/Security/2026-04-27-16-36-11.gh-issue-149079.vKl-LM.rst
b/Misc/NEWS.d/next/Security/2026-04-27-16-36-11.gh-issue-149079.vKl-LM.rst
deleted file mode 100644
index 4ed22b58f7405f5..000000000000000
--- a/Misc/NEWS.d/next/Security/2026-04-27-16-36-11.gh-issue-149079.vKl-LM.rst
+++ /dev/null
@@ -1,5 +0,0 @@
-Fix a potential denial of service in :func:`unicodedata.normalize`. The
-canonical ordering step of Unicode normalization used a quadratic-time
insertion
-sort for reordering combining characters, which could be exploited with
-crafted input containing many combining characters in non-canonical order.
-Replaced with a linear-time counting sort for long runs.
diff --git
a/Misc/NEWS.d/next/Security/2026-05-03-21-00-00.gh-issue-149486.tarflt.rst
b/Misc/NEWS.d/next/Security/2026-05-03-21-00-00.gh-issue-149486.tarflt.rst
deleted file mode 100644
index 7c69edb683cf80a..000000000000000
--- a/Misc/NEWS.d/next/Security/2026-05-03-21-00-00.gh-issue-149486.tarflt.rst
+++ /dev/null
@@ -1,5 +0,0 @@
-:func:`tarfile.data_filter` now validates link targets using the same
-normalised value that is written to disk, strips trailing separators from
-the member name when resolving a symlink's directory, and rejects link
-members that would replace the destination directory itself. This closes
-several path-traversal bypasses of the ``data`` extraction filter.
diff --git
a/Misc/NEWS.d/next/Security/2026-05-10-18-05-32.gh-issue-87451.XkKB6M.rst
b/Misc/NEWS.d/next/Security/2026-05-10-18-05-32.gh-issue-87451.XkKB6M.rst
deleted file mode 100644
index 21a79c3e0e7db74..000000000000000
--- a/Misc/NEWS.d/next/Security/2026-05-10-18-05-32.gh-issue-87451.XkKB6M.rst
+++ /dev/null
@@ -1,6 +0,0 @@
-The :mod:`ftplib` module's undocumented ``ftpcp`` function no longer trusts
-the IPv4 address value returned from the source server in response to the
-``PASV`` command by default, completing the fix for CVE-2021-4189. As with
-:class:`ftplib.FTP`, the former behavior can be re-enabled by setting the
-``trust_server_pasv_ipv4_address`` attribute on the source :class:`ftplib.FTP`
-instance to ``True``. Thanks to Qi Deng at Aurascape AI for the report.
diff --git
a/Misc/NEWS.d/next/Security/2026-05-11-21-15-07.gh-issue-149698.OudOcW.rst
b/Misc/NEWS.d/next/Security/2026-05-11-21-15-07.gh-issue-149698.OudOcW.rst
deleted file mode 100644
index 31e106997378092..000000000000000
--- a/Misc/NEWS.d/next/Security/2026-05-11-21-15-07.gh-issue-149698.OudOcW.rst
+++ /dev/null
@@ -1,2 +0,0 @@
-Update bundled `libexpat <https://libexpat.github.io/>`_ to version 2.8.1
-for the fix for CVE-2026-45186.
diff --git
a/Misc/NEWS.d/next/Security/2026-05-30-00-00-00.gh-issue-150743.httpdos.rst
b/Misc/NEWS.d/next/Security/2026-05-30-00-00-00.gh-issue-150743.httpdos.rst
deleted file mode 100644
index 4cc4e4b092da71c..000000000000000
--- a/Misc/NEWS.d/next/Security/2026-05-30-00-00-00.gh-issue-150743.httpdos.rst
+++ /dev/null
@@ -1,6 +0,0 @@
-:mod:`http.client` now limits the number of chunked-response trailer lines
-it will read to 100, and the number of interim (1xx) responses it will
-skip to 100. A malicious or broken server could previously stream trailer
-lines or ``100 Continue`` responses forever, hanging the client even when
-a socket timeout was in use.
-Reported by ``@YLChen-007`` via GHSA-w4q2-g22w-6fr4.
diff --git
a/Misc/NEWS.d/next/Security/2026-05-30-09-36-20.gh-issue-150599.nlHqU-.rst
b/Misc/NEWS.d/next/Security/2026-05-30-09-36-20.gh-issue-150599.nlHqU-.rst
deleted file mode 100644
index a37d86cf423f820..000000000000000
--- a/Misc/NEWS.d/next/Security/2026-05-30-09-36-20.gh-issue-150599.nlHqU-.rst
+++ /dev/null
@@ -1,3 +0,0 @@
-Fix a possible stack buffer overflow in :mod:`bz2` when a
-:class:`bz2.BZ2Decompressor` is reused after a decompression error.
-The decompressor now becomes unusable after libbz2 reports an error.
diff --git
a/Misc/NEWS.d/next/Security/2026-06-10-13-08-19.gh-issue-151558.mL74i2.rst
b/Misc/NEWS.d/next/Security/2026-06-10-13-08-19.gh-issue-151558.mL74i2.rst
deleted file mode 100644
index 575081600f8bdd9..000000000000000
--- a/Misc/NEWS.d/next/Security/2026-06-10-13-08-19.gh-issue-151558.mL74i2.rst
+++ /dev/null
@@ -1,3 +0,0 @@
-Fixed an vulnerability in the :mod:`tarfile` ``data`` and ``tar`` extraction
-filters where crafted archives could create a symlink pointing outside the
-destination directory. This was a bypass of CVE-2025-4330.
diff --git
a/Misc/NEWS.d/next/Security/2026-06-16-14-58-02.gh-issue-151544._bexVy.rst
b/Misc/NEWS.d/next/Security/2026-06-16-14-58-02.gh-issue-151544._bexVy.rst
deleted file mode 100644
index 418e3b4b9677943..000000000000000
--- a/Misc/NEWS.d/next/Security/2026-06-16-14-58-02.gh-issue-151544._bexVy.rst
+++ /dev/null
@@ -1,4 +0,0 @@
-:file:`Modules/Setup.local` is no longer used as a landmark to discover
-whether Python is running in a source tree, as it could potentially affect
-actual installs. The :file:`pybuilddir.txt` file is now the sole indicator
-of running in a source tree.
diff --git
a/Misc/NEWS.d/next/Security/2026-06-23-13-28-16.gh-issue-151981.xBHEcU.rst
b/Misc/NEWS.d/next/Security/2026-06-23-13-28-16.gh-issue-151981.xBHEcU.rst
deleted file mode 100644
index 2123ab8e081b1d9..000000000000000
--- a/Misc/NEWS.d/next/Security/2026-06-23-13-28-16.gh-issue-151981.xBHEcU.rst
+++ /dev/null
@@ -1,2 +0,0 @@
-In :mod:`tarfile`, seeking a stream now stops when end of the stream is
-reached.
diff --git
a/Misc/NEWS.d/next/Security/2026-06-23-14-19-30.gh-issue-151987.8mNIMf.rst
b/Misc/NEWS.d/next/Security/2026-06-23-14-19-30.gh-issue-151987.8mNIMf.rst
deleted file mode 100644
index 9eea7b32c4d2b4f..000000000000000
--- a/Misc/NEWS.d/next/Security/2026-06-23-14-19-30.gh-issue-151987.8mNIMf.rst
+++ /dev/null
@@ -1,2 +0,0 @@
-The :meth:`tarfile.TarFile.extract` method now applies the given filter when
-it extracts a link target from the archive as a fallback.
diff --git
a/Misc/NEWS.d/next/Security/2026-06-25-20-44-20.gh-issue-152216.VxiK5y.rst
b/Misc/NEWS.d/next/Security/2026-06-25-20-44-20.gh-issue-152216.VxiK5y.rst
deleted file mode 100644
index 2769048e001d694..000000000000000
--- a/Misc/NEWS.d/next/Security/2026-06-25-20-44-20.gh-issue-152216.VxiK5y.rst
+++ /dev/null
@@ -1 +0,0 @@
-Update bundled `libexpat <https://libexpat.github.io/>`_ to version 2.8.2.
diff --git
a/Misc/NEWS.d/next/Security/2026-06-30-13-24-13.gh-issue-152674.-2QVoL.rst
b/Misc/NEWS.d/next/Security/2026-06-30-13-24-13.gh-issue-152674.-2QVoL.rst
deleted file mode 100644
index 69e73008af79f14..000000000000000
--- a/Misc/NEWS.d/next/Security/2026-06-30-13-24-13.gh-issue-152674.-2QVoL.rst
+++ /dev/null
@@ -1,6 +0,0 @@
-The :class:`xml.etree.ElementTree.Element` methods
-:meth:`~xml.etree.ElementTree.Element.findall`,
-:meth:`~xml.etree.ElementTree.Element.iterfind` and
-:meth:`~xml.etree.ElementTree.Element.find` avoid quadratic behavior when
-using XPath index predicates (``[1]``, ``[last()]``, ``[last()-N]``) on XML
-documents with many same-tag siblings.
diff --git
a/Misc/NEWS.d/next/Security/2026-07-04-17-00-00.gh-issue-153030.RovkP6.rst
b/Misc/NEWS.d/next/Security/2026-07-04-17-00-00.gh-issue-153030.RovkP6.rst
deleted file mode 100644
index d1d60593f4ba7d2..000000000000000
--- a/Misc/NEWS.d/next/Security/2026-07-04-17-00-00.gh-issue-153030.RovkP6.rst
+++ /dev/null
@@ -1,3 +0,0 @@
-Fixed quadratic complexity in incremental parsing of long unterminated
-constructs (such as tags or comments) in :class:`html.parser.HTMLParser`,
-which could be exploited for a denial of service.
diff --git
a/Misc/NEWS.d/next/Security/2026-08-11-15-24-21.gh-issue-155558.yDsXZC.rst
b/Misc/NEWS.d/next/Security/2026-08-11-15-24-21.gh-issue-155558.yDsXZC.rst
deleted file mode 100644
index 90cc3a765cf554e..000000000000000
--- a/Misc/NEWS.d/next/Security/2026-08-11-15-24-21.gh-issue-155558.yDsXZC.rst
+++ /dev/null
@@ -1,2 +0,0 @@
-Update bundled `libexpat <https://libexpat.github.io/>`_ to version 2.8.3
-for the fix to `CVE-2026-72522
<https://www.cve.org/CVERecord?id=CVE-2026-72522>`_.
diff --git
a/Misc/NEWS.d/next/Tests/2026-05-13-14-53-23.gh-issue-149776.orqgsn.rst
b/Misc/NEWS.d/next/Tests/2026-05-13-14-53-23.gh-issue-149776.orqgsn.rst
deleted file mode 100644
index e86a9130ff9bfb6..000000000000000
--- a/Misc/NEWS.d/next/Tests/2026-05-13-14-53-23.gh-issue-149776.orqgsn.rst
+++ /dev/null
@@ -1,2 +0,0 @@
-Fix test_socket on Linux kernel 7.1 and newer: skip UDP Lite tests if it's
-not supported. Patch by Victor Stinner.
diff --git
a/Misc/NEWS.d/next/macOS/2025-10-17-01-07-03.gh-issue-137586.kVzxvp.rst
b/Misc/NEWS.d/next/macOS/2025-10-17-01-07-03.gh-issue-137586.kVzxvp.rst
deleted file mode 100644
index 8e42065392a2de6..000000000000000
--- a/Misc/NEWS.d/next/macOS/2025-10-17-01-07-03.gh-issue-137586.kVzxvp.rst
+++ /dev/null
@@ -1 +0,0 @@
-Invoke :program:`osascript` with absolute path in :mod:`webbrowser` and
:mod:`!turtledemo`.
diff --git a/README.rst b/README.rst
index cb71ecb4886cbbe..5ac70fa1474e1b0 100644
--- a/README.rst
+++ b/README.rst
@@ -1,4 +1,4 @@
-This is Python version 3.11.15
+This is Python version 3.11.16
==============================
.. image:: https://github.com/python/cpython/workflows/Tests/badge.svg
_______________________________________________
Python-checkins mailing list -- [email protected]
To unsubscribe send an email to [email protected]
https://mail.python.org/mailman3//lists/python-checkins.python.org
Member address: [email protected]
