On 19/09/2018 23.12, Ned Deily wrote: > Update: not surprisingly, there have been a number of issues that have popped > up during and since the sprint that we would like to ensure are addressed in > 3.7.1 and 3.6.7. In order to do so, I've been holding off on starting the > releases. I think we are now getting close to having the important ones > resolved so I'm going to plan on cutting off code for 3.7.1rc1 and 3.6.7rc1 > by the end of 2018-09-20 (23:59 AoE). That's roughly 38 hours from now. > > Thanks for all of your help in improving Python for everyone!
Hi Ned, I'm really sorry, but would it be possible to delay the RCs until Sunday or Monday AoE? Some of the XML security fixes, OpenSSL 1.1.1 fixes (TLS 1.3 post-handshake authentication), and SSL module regression haven't landed yet. I'm confident that I can land most to all fixes during the weekend. Related PRs are: * https://github.com/python/cpython/pull/9468 * https://github.com/python/cpython/pull/9460 * https://github.com/python/cpython/pull/9217 * https://github.com/python/cpython/pull/9265 I'm also still collaborating with Sebastian Pipping (libexpat maintainer) on the DoS mitigations (CVE-2013-0340). My initial patch had some flaws. I might be able to get expat release 2.3.0 in time, too. https://github.com/libexpat/libexpat/pull/220 Christian _______________________________________________ Python-Dev mailing list Python-Dev@python.org https://mail.python.org/mailman/listinfo/python-dev Unsubscribe: https://mail.python.org/mailman/options/python-dev/archive%40mail-archive.com
