Message-ID:

"To YOU I'm an atheist; to God, I'm the Loyal Opposition." -- Woody Allen

devel / comp.lang.python.announce / [Python-announce] [RELEASE] Python 3.11.4, 3.10.12, 3.9.17, 3.8.17, 3.7.17, and 3.12.0 beta 2 are now available

[Python-announce] [RELEASE] Python 3.11.4, 3.10.12, 3.9.17, 3.8.17, 3.7.17, and 3.12.0 beta 2 are now available

<F2701C73-767A-4EA6-803A-0BA3781C144A@langa.pl>

copy mid

https://www.rocksolidbbs.com/devel/article-flat.php?id=16922&group=comp.lang.python.announce#16922

copy link Newsgroups: comp.lang.python.announce

Path: i2pn2.org!i2pn.org!news.swapon.de!fu-berlin.de!uni-berlin.de!not-for-mail
From: lukasz@langa.pl (Łukasz Langa)
Newsgroups: comp.lang.python.announce
Subject: [Python-announce] [RELEASE] Python 3.11.4, 3.10.12, 3.9.17, 3.8.17, 3.7.17, and 3.12.0 beta 2 are now available
Date: Wed, 7 Jun 2023 08:58:19 +0200
Lines: 165
Approved: python-announce-list@python.org
Message-ID: <F2701C73-767A-4EA6-803A-0BA3781C144A@langa.pl>
Reply-To: python-list@python.org
Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3731.600.7\))
Content-Type: multipart/signed;
boundary="Apple-Mail=_94B2530A-B517-4255-BC6B-1CE17E2CDB32";
protocol="application/pgp-signature";
micalg=pgp-sha256
X-Trace: news.uni-berlin.de xAvQKqOFWTHcxcfDdWLK4wdmo1TFFBpRZPOd9CdlGBrw==
Authentication-Results: mail.python.org; dkim=pass
reason="2048-bit key; unprotected key"
header.d=langa.pl header.i=@langa.pl header.b=MdJ+k2WC;
dkim-adsp=pass; dkim-atps=neutral
X-Spam-Status: OK 0.000
X-Spam-Evidence: '*H*': 1.00; '*S*': 0.00; 'looks': 0.02; 'url-
ip:140.82/16': 0.03; '3.7': 0.03; 'python?': 0.03; 'url:psf':
0.04; '3.6': 0.05; '3.8': 0.05; 'content-type:multipart/signed':
0.05; 'thread': 0.05; 'to:name:python-dev': 0.05; 'volunteers':
0.05; 'matching': 0.07; 'serving': 0.07; 'to:name:python-
committers': 0.07; 'url:downloads': 0.07; 'wrong.': 0.07;
'content-type:application/pgp-signature': 0.09; 'fact,': 0.09;
'filename:fname piece:asc': 0.09; 'filename:fname
piece:signature': 0.09; 'filename:fname:signature.asc': 0.09;
'mentor': 0.09; 'ned': 0.09; 'pablo': 0.09; 'scroll': 0.09; 'url-
ip:151.101.0.223/32': 0.09; 'url-ip:151.101.128.223/32': 0.09;
'url-ip:151.101.192.223/32': 0.09; 'url-ip:151.101.64.223/32':
0.09; 'url-ip:184.105/16': 0.09; 'url:azure': 0.09; 'url:discuss':
0.09; 'url:release': 0.09; 'subject:Python': 0.12; 'url:github':
0.14; 'url-ip:140/8': 0.15; '3.10': 0.16; '3.7.': 0.16; '<>:':
0.16; 'beta': 0.16; 'binaries.': 0.16; 'bus': 0.16; 'deily': 0.16;
'directory.': 0.16; 'ensuring': 0.16; 'executed': 0.16; 'expose':
0.16; 'fixes': 0.16; 'galindo': 0.16; 'launching': 0.16;
'limiting': 0.16; 'lock.': 0.16; 'mean,': 0.16; 'possible!': 0.16;
'python!': 0.16; 'received:10.202': 0.16; 'received:10.202.2':
0.16; 'received:64.147': 0.16; 'received:64.147.123': 0.16;
'received:internal': 0.16; 'received:messagingengine.com': 0.16;
'releases': 0.16; 'runtime': 0.16; 'salgado': 0.16; 'skip:h 40':
0.16; 'sole': 0.16; 'surprising': 0.16; 'tries': 0.16;
'url:cpython': 0.16; 'url:pep-0537': 0.16; 'url:peps': 0.16;
'urls': 0.16; 'wouters': 0.16; '\xc5\x81ukasz': 0.16; 'python':
0.16; 'instead': 0.17; 'uses': 0.19; 'to:addr:python-list': 0.20;
'subject:] ': 0.21; 'input': 0.21; 'downloading': 0.22; 'mac':
0.22; 'to:no real name:2**1': 0.22; 'version': 0.23; 'anything':
0.25; 'space': 0.26; 'manager,': 0.26; 'pattern': 0.26;
'creating': 0.27; 'local': 0.27; 'old': 0.27; 'foundation.': 0.28;
'wrong': 0.28; 'approach': 0.31; '233': 0.32; 'guess': 0.32;
'raw': 0.32; 'unless': 0.32; 'but': 0.32; 'windows': 0.34;
'release': 0.34; 'same': 0.34; 'trying': 0.35; 'officially': 0.35;
'team.': 0.35; 'following': 0.35; 'six': 0.65; 'well': 0.65;
'years': 0.65; 'let': 0.66; 'skip:t 20': 0.66; 'outside': 0.67;
'time,': 0.67; 'away': 0.67; 'received:64': 0.67; 'manager': 0.68;
'azure': 0.69; 'blue': 0.69; 'factor': 0.69; 'safer': 0.69;
'manual': 0.70; 'them,': 0.70; 'reaching': 0.71; 'url:t': 0.73;
'head': 0.73; 'provider': 0.75; 'read,': 0.75; 'yourself': 0.75;
'features': 0.75; 'details.': 0.76; 'club': 0.76; 'states': 0.80;
'acquire': 0.84; 'happens': 0.84; 'publish': 0.84; 'characters':
0.84; 'greetings!': 0.84; 'indexes': 0.84; 'pipeline': 0.84;
'prestigious': 0.84; 'sign,': 0.84; 'subject: \n ': 0.84; 'tar':
0.84; 'upgraded': 0.84; 'haven\xe2\x80\x99t': 0.91; 'now!': 0.93;
'pressed': 0.93; 'race': 0.93; 'secret': 0.96; 'to:addr:python-
announce': 0.97
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=langa.pl; h=cc
:content-type:content-type:date:date:from:from:in-reply-to
:message-id:mime-version:reply-to:sender:subject:subject:to:to;
s=fm3; t=1686121117; x=1686207517; bh=jj7VkQnvxH7GKuD5Yhs+VfN0U
v4tH4afuVekldOkxXU=; b=MdJ+k2WChguROIucdybQcXTX708qt/DWQoYGQDdn0
onCFCSQOk50ZSdbZV9R4GmaxxRTgGFpnlh4Wx2az2vbEkSzMCJHb4dNyjDcNqDGX
eoP4Aw9ujbinteYDg6QqLHLg//Q6nRzmZJreH5P8FkP2vfDHo6Z0Qv4F9sA2vNZl
NOavaqzwgGPproStmclT+e8oCkdmEMOuu+ve/fjSXBm38mPk/kpHdkhfB52kb5nd
E/RKU7R/r6LpBB4jlIN63H514iHQBesDRhiKmIJzQLWyaG4GkufkTWxbDm1ibVJX
sdHw4HL2fwE3w+BOOQ2ZcG7nFKDbCYMZ+qPdJ0C+7FdjA==
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=
messagingengine.com; h=cc:content-type:content-type:date:date
:feedback-id:feedback-id:from:from:in-reply-to:message-id
:mime-version:reply-to:sender:subject:subject:to:to:x-me-proxy
:x-me-proxy:x-me-sender:x-me-sender:x-sasl-enc; s=fm1; t=
1686121117; x=1686207517; bh=jj7VkQnvxH7GKuD5Yhs+VfN0Uv4tH4afuVe
kldOkxXU=; b=zb4Kt4IEYSjTT/BUw7p80M3FIgbvcRKtUqpPc0JI51VH3eGPs8B
3XNSiWY25r/z/LMTRz0ICuvpi6kNdyB6YUJn8KTv0OdUf731dquK21L8z2h3MLMk
TAgoP0lg7rnVk3UIsXrjyQraEqArk1RPiLy5OQ4bWRvT64ME/rrZAEytdMLPRoI9
orVMl5ARk9dNdNHWeFg9H+7J+DkO0jrwZb4k4Gt+2ZEEMs8oeJZ6QUfnburBT6Ig
jM0RPMVZnVBUBySTm4PvYE24UwY4tA4VcF9K/MH6Lm6N2UMzb4QdtUNzhPzQQxRt
SQovul3EC3d+VzPlf2aW6QgvcrZq1RRvCYQ==
X-ME-Sender: <xms:nCqAZDY95mXBcUtdEWq4GpXitLR7NxQyeaiTS-oAre5r2L7hhzakVQ>
<xme:nCqAZCawxMe-pI95aQVOy99s0iDGHb-MJCUAs2UtBj2AHlP7zkebLnDlWBphVix4A
am9pogKmkwxE0g>
X-ME-Received: <xmr:nCqAZF98aRO-Jw_ff_XIg7glKimBVdyZjbRJitAhraNhwzCg8DyPmnlZBIxlDe-hrP_rt_EQQizeDVkc7LYL>
X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgedvhedrgedtfedgjeeiucetufdoteggodetrfdotf
fvucfrrhhofhhilhgvmecuhfgrshhtofgrihhlpdfqfgfvpdfurfetoffkrfgpnffqhgen
uceurghilhhouhhtmecufedttdenucenucfjughrpefhtggguffkfffvofesghdtmherhh
dtjeenucfhrhhomhepnfhukhgrshiiucfnrghnghgruceolhhukhgrshiisehlrghnghgr
rdhplheqnecuggftrfgrthhtvghrnhephfejfffgheffvedtieejueeiueegfeefvdehve
elhfekvdegveegtefgvdfhudeknecuffhomhgrihhnpehphihthhhonhdrohhrghdprgii
uhhrvgdrtghomhdpghhithhhuhgsrdgtohhmnecuvehluhhsthgvrhfuihiivgeptdenuc
frrghrrghmpehmrghilhhfrhhomheplhhukhgrshiisehlrghnghgrrdhplh
X-ME-Proxy: <xmx:nCqAZJq6HliB8mW958D-xkQylQgIFSmk6EqEZwsxuvtKv3jjhQaRPw>
<xmx:nCqAZOqT9-7AuJgTyT0uk9ciWe3zyu2sypqEunHftahFWZoTgSVomw>
<xmx:nCqAZPTS7PbS9BWvRiXE18yErnmRKLSHGgGKZHa21okGPEGlbIDXog>
<xmx:nSqAZF10ZQYbZ4LpPVC_Nyn6QSmloDGNF6eVr2kHXbYSwz4lAEXyig>
Feedback-ID: i8e7440be:Fastmail
X-Mailer: Apple Mail (2.3731.600.7)
X-MailFrom: lukasz@langa.pl
X-Mailman-Rule-Hits: emergency
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved
Message-ID-Hash: XEQ7I3YDDXJJA3JSARTHFDCBVXD6CPHT
X-Message-ID-Hash: XEQ7I3YDDXJJA3JSARTHFDCBVXD6CPHT
X-Mailman-Approved-At: Wed, 07 Jun 2023 03:26:00 -0400
X-Content-Filtered-By: Mailman/MimeDel 3.3.9b1
X-Mailman-Version: 3.3.9b1
Precedence: list
List-Id: Announcement-only list for the Python programming language <python-announce-list.python.org>
Archived-At: <https://mail.python.org/archives/list/python-announce-list@python.org/message/XEQ7I3YDDXJJA3JSARTHFDCBVXD6CPHT/>
List-Archive: <https://mail.python.org/archives/list/python-announce-list@python.org/>
List-Help: <mailto:python-announce-list-request@python.org?subject=help>
List-Owner: <mailto:python-announce-list-owner@python.org>
List-Post: <mailto:python-announce-list@python.org>
List-Subscribe: <mailto:python-announce-list-join@python.org>
List-Unsubscribe: <mailto:python-announce-list-leave@python.org>

by: Łukasz Langa - Wed, 7 Jun 2023 06:58 UTC

Attachments: signature.asc (application/pgp-signature)

Greetings! Time for another combined release of six separate versions of Python!

<https://discuss.python.org/t/python-3-11-4-3-10-12-3-9-17-3-8-17-3-7-17-and-3-12-0-beta-2-are-now-availble/27477#before-you-scroll-away-to-the-download-links-1>Before you scroll away to the download links

Please test the 3.12 beta! Downloading it and trying it out helps us a lot in ensuring Python 3.12.0 will be as polished as possible.

We welcome 3.10 to the prestigious club of security-only releases. It’s officially an old version of Python now! If you haven’t rewritten all your if:elif:else:s with pattern matching yet, are you even still writing Python?

At the same time, it looks like 3.7 is reaching end-of-life. Unless another security release happens in June, 3.7.17 will be the final release of Python 3.7. I mean, now that I typed it out for all you to read, I’m sure I jinxed it. But in case I didn’t, I would like to thank Ned Deily for serving as the release manager of Python 3.6 and Python 3.7. He was my mentor as Release Manager, and continues serving Python as the provider of Mac installers for new releases. Thank you, Ned!

Speaking of installers, Steve Dower used to be the sole provider of Windows installers for Python releases for years now. His secret was a well-automated Azure pipeline that let him build, sign, and publish releases with minimal manual effort. Now he extended the power to press the blue “Run pipeline” button to more members of the team. Thank you, Steve! This is an important bus factor increment. In fact, the Windows installers for both 3.12.0b2 and 3.11.4 were made by meinitiated by me <https://dev.azure.com/Python/cpython/_build/results?buildId=129764&view=results>. If there’s anything wrong with them, well, I guess that means I pressed the button wrong.

<https://discuss.python.org/t/python-3-11-4-3-10-12-3-9-17-3-8-17-3-7-17-and-3-12-0-beta-2-are-now-availble/27477#security-fixes-in-todays-releases-2>Security fixes in today’s releases

Updating is recommended due to security content:

3.7 - 3.12: gh-103142 <https://github.com/python/cpython/issues/103142>: The version of OpenSSL used in Windows and Mac installers has been upgraded to 1.1.1u to address CVE-2023-2650, CVE-2023-0465, CVE-2023-0466, CVE-2023-0464, as well as CVE-2023-0286, CVE-2022-4303, and CVE-2022-4303 fixed previously in 1.1.1t (gh-101727).
3.7 - 3.11: gh-102153 <https://github.com/python/cpython/issues/102153>: urllib.parse.urlsplit() now strips leading C0 control and space characters following the specification for URLs defined by WHATWG in response to CVE-2023-24329.
3.7 - 3.11: gh-99889 <https://github.com/python/cpython/issues/99889>: Fixed a security in flaw in uu.decode() that could allow for directory traversal based on the input if no out_file was specified.
3.7 - 3.11: gh-104049 <https://github.com/python/cpython/issues/104049>: Do not expose the local on-disk location in directory indexes produced by http.client.SimpleHTTPRequestHandler.
3.7 - 3.11: gh-101283 <https://github.com/python/cpython/issues/101283>: subprocess.Popen now uses a safer approach to find cmd.exe when launching with shell=True.
3.8 - 3.11: gh-103935 <https://github.com/python/cpython/issues/103935>: trace.__main__ now uses io.open_code() for files to be executed instead of raw open().
3.8 - 3.11: gh-102953 <https://github.com/python/cpython/issues/102953>: The extraction methods in tarfile, and shutil.unpack_archive(), have a new filterargument that allows limiting tar features than may be surprising or dangerous, such as creating files outside the destination directory. See Extraction filters <https://docs.python.org/3/library/tarfile.html#extraction-filters> for details.
3.9: gh-102126 <https://github.com/python/cpython/issues/102126>: Fixed a deadlock at shutdown when clearing thread states if any finalizer tries to acquire the runtime head lock.
3.9: gh-100892 <https://github.com/python/cpython/issues/100892>: Fixed a crash due to a race while iterating over thread states in clearing threading.local.
Python 3.12.0 beta 2

Get it here: 3.12.0b2 <https://www.python.org/downloads/release/python-3120b2/>
116 new commits since 3.12.0 beta 1.

Python 3.11.4

Get it here: 3.11.4 <https://www.python.org/downloads/release/python-3114/>
233 new commits.

Python 3.10.12

Get it here: 3.10.12 <https://www.python.org/downloads/release/python-31012/>
Security-only release with no binaries. 20 new commits.

Python 3.9.17

Get it here: 3.9.17 <https://www.python.org/downloads/release/python-3917/>
Security-only release with no binaries. 26 commits.

Python 3.8.17

Get it here: 3.8.17 <https://www.python.org/downloads/release/python-3817/>
Security-only release with no binaries. 24 commits.

Python 3.7.17

Get it here as it might be the last release of 3.7 ever <https://peps.python.org/pep-0537/>:
3.7.17 <https://www.python.org/downloads/release/python-3717/>
Security-only release with no binaries. 21 commits.

We hope you enjoy the new releases!

Thanks to all of the many volunteers who help make Python Development and these releases possible! Please consider supporting our efforts by volunteering yourself or through organization contributions to the Python Software Foundation <https://www.python.org/psf/>.

–
Łukasz Langa @ambv <https://discuss.python.org/u/ambv>
on behalf of your friendly release team,

Ned Deily @nad <https://discuss.python.org/u/nad>
Steve Dower @steve.dower <https://discuss.python.org/u/steve.dower>
Pablo Galindo Salgado @pablogsal <https://discuss.python.org/u/pablogsal>
Łukasz Langa @ambv <https://discuss.python.org/u/ambv>
Thomas Wouters @thomas <https://discuss.python.org/u/thomas>

Attachments: signature.asc (application/pgp-signature)

Subject	Author
[Python-announce] [RELEASE] Python 3.11.4, 3.10.12, 3.9.17, 3.8.17, 3.7.17, and	Łukasz Langa