https://github.com/python/cpython/commit/2c2462afc5d978d31f3d073001fc202d269917ff
commit: 2c2462afc5d978d31f3d073001fc202d269917ff
branch: 3.12
author: Thomas Wouters <[email protected]>
committer: Yhg1s <[email protected]>
date: 2026-10-25T19:24:37+01:00
summary:
Python 3.12.16
files:
A Misc/NEWS.d/3.12.16.rst
D Misc/NEWS.d/next/Library/2026-10-08-16-18-43.gh-issue-87720.Elqdl9.rst
D Misc/NEWS.d/next/Security/2026-08-14-11-55-00.gh-issue-157579.Kq3Vt2.rst
D Misc/NEWS.d/next/Security/2026-08-31-16-47-33.gh-issue-157953.KxCFSN.rst
D Misc/NEWS.d/next/Security/2026-10-15-03-47-08.gh-issue-159428.XHRKwY.rst
D Misc/NEWS.d/next/Security/2026-10-21-16-55-07.gh-issue-160040.9PjFjC.rst
D Misc/NEWS.d/next/Security/2026-10-21-19-58-53.gh-issue-160097.-opfAL.rst
D Misc/NEWS.d/next/Security/2026-10-22-08-04-33.gh-issue-160300.q7Zk2B.rst
M Include/patchlevel.h
M Lib/pydoc_data/topics.py
M README.rst
diff --git a/Include/patchlevel.h b/Include/patchlevel.h
index 4e1b4cc13d04518..925a7018e0558f7 100644
--- a/Include/patchlevel.h
+++ b/Include/patchlevel.h
@@ -18,12 +18,12 @@
/*--start constants--*/
#define PY_MAJOR_VERSION 3
#define PY_MINOR_VERSION 12
-#define PY_MICRO_VERSION 15
+#define PY_MICRO_VERSION 16
#define PY_RELEASE_LEVEL PY_RELEASE_LEVEL_FINAL
#define PY_RELEASE_SERIAL 0
/* Version as a string */
-#define PY_VERSION "3.12.15+"
+#define PY_VERSION "3.12.16"
/*--end constants--*/
/* Version as a single 4-byte hex number, e.g. 0x010502B2 == 1.5.2b2.
diff --git a/Lib/pydoc_data/topics.py b/Lib/pydoc_data/topics.py
index 099408f7bfd2b6d..aa1aa838f692407 100644
--- a/Lib/pydoc_data/topics.py
+++ b/Lib/pydoc_data/topics.py
@@ -1,4 +1,4 @@
-# Autogenerated by Sphinx on Thu Oct 1 00:04:15 2026
+# Autogenerated by Sphinx on Sun Oct 25 19:24:32 2026
# as part of the release process.
topics = {
diff --git a/Misc/NEWS.d/3.12.16.rst b/Misc/NEWS.d/3.12.16.rst
new file mode 100644
index 000000000000000..ca070075f6e2c0f
--- /dev/null
+++ b/Misc/NEWS.d/3.12.16.rst
@@ -0,0 +1,84 @@
+.. date: 2026-10-22-08-04-33
+.. gh-issue: 160300
+.. nonce: q7Zk2B
+.. release date: 2026-10-25
+.. section: Security
+
+Fix :class:`http.cookiejar.DefaultCookiePolicy` accepting and returning
+cookies with a negative ``Version`` attribute without checking their domain
+against the request host. Such cookies are now ignored.
+
+..
+
+.. cve: CVE-2026-114583
+.. date: 2026-10-21-19-58-53
+.. gh-issue: 160097
+.. nonce: -opfAL
+.. section: Security
+
+:func:`tarfile.tar_filter` now rejects link members whose path resolves to
+the destination directory itself, as :func:`tarfile.data_filter` already
+did.
+
+..
+
+.. cve: CVE-2026-115557
+.. date: 2026-10-21-16-55-07
+.. gh-issue: 160040
+.. nonce: 9PjFjC
+.. section: Security
+
+:mod:`ssl` now rejects TLS certificate chains that contain any of a set of
+compromised eMudhra intermediate CA keys. This is an extraordinary measure
+and a last line of defense: removing trust is primarily the job of the
+platform root store, and the built-in denylist only blocks connections while
+that update has not yet reached the OS, a container image, or a bundled
+trust store in various Python packages. Entries are added to the denylist
+only under a very high threshold. The denylist matches on the public key
+(the SHA-256 digest of the :rfc:`5280` ``SubjectPublicKeyInfo``), so it also
+covers the cross-signed certificates that reuse one of the distrusted keys.
+
+..
+
+.. date: 2026-10-15-03-47-08
+.. gh-issue: 159428
+.. nonce: XHRKwY
+.. section: Security
+
+:mod:`mimetypes` no longer reads the files listed in
+:data:`mimetypes.knownfiles` by default on Windows, and uses only the
+registry.
+
+..
+
+.. date: 2026-08-31-16-47-33
+.. gh-issue: 157953
+.. nonce: KxCFSN
+.. section: Security
+
+Update bundled `libexpat <https://libexpat.github.io/>`_ to version 2.9.0.
+
+..
+
+.. date: 2026-08-14-11-55-00
+.. gh-issue: 157579
+.. nonce: Kq3Vt2
+.. section: Security
+
+Fix a race condition in the cleanup of :class:`tempfile.TemporaryDirectory`.
+When working around file system permission errors, files are now removed
+relative to open directory file descriptors instead of resolving their path
+again, so that replacing a directory of the tree with a symbolic link can no
+longer make the cleanup delete files outside of the temporary directory.
+This addresses :cve:`2026-12345`.
+
+..
+
+.. date: 2026-10-08-16-18-43
+.. gh-issue: 87720
+.. nonce: Elqdl9
+.. section: Library
+
+Fixed error in :mod:`email` new policies where header folding failed to
+detect the need to re-quote text obtained from encoded words in certain
+cases.
diff --git
a/Misc/NEWS.d/next/Library/2026-10-08-16-18-43.gh-issue-87720.Elqdl9.rst
b/Misc/NEWS.d/next/Library/2026-10-08-16-18-43.gh-issue-87720.Elqdl9.rst
deleted file mode 100644
index a2df7654b31444b..000000000000000
--- a/Misc/NEWS.d/next/Library/2026-10-08-16-18-43.gh-issue-87720.Elqdl9.rst
+++ /dev/null
@@ -1,3 +0,0 @@
-Fixed error in :mod:`email` new policies where header folding failed to
-detect the need to re-quote text obtained from encoded words in certain
-cases.
diff --git
a/Misc/NEWS.d/next/Security/2026-08-14-11-55-00.gh-issue-157579.Kq3Vt2.rst
b/Misc/NEWS.d/next/Security/2026-08-14-11-55-00.gh-issue-157579.Kq3Vt2.rst
deleted file mode 100644
index 46e87575dba9839..000000000000000
--- a/Misc/NEWS.d/next/Security/2026-08-14-11-55-00.gh-issue-157579.Kq3Vt2.rst
+++ /dev/null
@@ -1,6 +0,0 @@
-Fix a race condition in the cleanup of :class:`tempfile.TemporaryDirectory`.
-When working around file system permission errors, files are now removed
-relative to open directory file descriptors instead of resolving their path
-again, so that replacing a directory of the tree with a symbolic link can no
-longer make the cleanup delete files outside of the temporary directory.
-This addresses :cve:`2026-12345`.
diff --git
a/Misc/NEWS.d/next/Security/2026-08-31-16-47-33.gh-issue-157953.KxCFSN.rst
b/Misc/NEWS.d/next/Security/2026-08-31-16-47-33.gh-issue-157953.KxCFSN.rst
deleted file mode 100644
index 3220f4613a91af6..000000000000000
--- a/Misc/NEWS.d/next/Security/2026-08-31-16-47-33.gh-issue-157953.KxCFSN.rst
+++ /dev/null
@@ -1 +0,0 @@
-Update bundled `libexpat <https://libexpat.github.io/>`_ to version 2.9.0.
diff --git
a/Misc/NEWS.d/next/Security/2026-10-15-03-47-08.gh-issue-159428.XHRKwY.rst
b/Misc/NEWS.d/next/Security/2026-10-15-03-47-08.gh-issue-159428.XHRKwY.rst
deleted file mode 100644
index d481ed2b74a20ea..000000000000000
--- a/Misc/NEWS.d/next/Security/2026-10-15-03-47-08.gh-issue-159428.XHRKwY.rst
+++ /dev/null
@@ -1,2 +0,0 @@
-:mod:`mimetypes` no longer reads the files listed in
:data:`mimetypes.knownfiles`
-by default on Windows, and uses only the registry.
diff --git
a/Misc/NEWS.d/next/Security/2026-10-21-16-55-07.gh-issue-160040.9PjFjC.rst
b/Misc/NEWS.d/next/Security/2026-10-21-16-55-07.gh-issue-160040.9PjFjC.rst
deleted file mode 100644
index 7bcec7f5808cac6..000000000000000
--- a/Misc/NEWS.d/next/Security/2026-10-21-16-55-07.gh-issue-160040.9PjFjC.rst
+++ /dev/null
@@ -1,12 +0,0 @@
-.. cve: CVE-2026-115557
-
-:mod:`ssl` now rejects TLS certificate chains that contain any of a set of
-compromised eMudhra intermediate CA keys. This is an extraordinary measure and
-a last line of defense: removing trust is primarily the job of the platform
root
-store, and the built-in denylist only blocks connections while that update has
-not yet reached the OS, a container image, or a bundled trust store in various
-Python packages. Entries are added to the denylist only under a very high
-threshold.
-The denylist matches on the public key (the SHA-256 digest of the :rfc:`5280`
-``SubjectPublicKeyInfo``), so it also covers the cross-signed certificates that
-reuse one of the distrusted keys.
diff --git
a/Misc/NEWS.d/next/Security/2026-10-21-19-58-53.gh-issue-160097.-opfAL.rst
b/Misc/NEWS.d/next/Security/2026-10-21-19-58-53.gh-issue-160097.-opfAL.rst
deleted file mode 100644
index b48c8f7213ee826..000000000000000
--- a/Misc/NEWS.d/next/Security/2026-10-21-19-58-53.gh-issue-160097.-opfAL.rst
+++ /dev/null
@@ -1,5 +0,0 @@
-.. cve: CVE-2026-114583
-
-:func:`tarfile.tar_filter` now rejects link members whose path resolves to
-the destination directory itself, as :func:`tarfile.data_filter` already
-did.
diff --git
a/Misc/NEWS.d/next/Security/2026-10-22-08-04-33.gh-issue-160300.q7Zk2B.rst
b/Misc/NEWS.d/next/Security/2026-10-22-08-04-33.gh-issue-160300.q7Zk2B.rst
deleted file mode 100644
index 3cadc6c2c4fd1fb..000000000000000
--- a/Misc/NEWS.d/next/Security/2026-10-22-08-04-33.gh-issue-160300.q7Zk2B.rst
+++ /dev/null
@@ -1,3 +0,0 @@
-Fix :class:`http.cookiejar.DefaultCookiePolicy` accepting and returning
-cookies with a negative ``Version`` attribute without checking their domain
-against the request host. Such cookies are now ignored.
diff --git a/README.rst b/README.rst
index 0232eaf76ec149c..8ac64d179fb5ce3 100644
--- a/README.rst
+++ b/README.rst
@@ -1,5 +1,5 @@
-This is Python version 3.12.15+
-===============================
+This is Python version 3.12.16
+==============================
.. image:: https://github.com/python/cpython/workflows/Tests/badge.svg
:alt: CPython build status on GitHub Actions
_______________________________________________
Python-checkins mailing list -- [email protected]
To unsubscribe send an email to [email protected]
https://mail.python.org/mailman3//lists/python-checkins.python.org
Member address: [email protected]
