+++++++++++ Python News +++++++++++ What's New in Python 3.13.5 final? ================================== *Release date: 2025-06-11* Windows ------- - gh-135151: Avoid distributing modified :file:`pyconfig.h` in the traditional installer. Extension module builds must always specify ``Py_GIL_DISABLED`` when targeting the free-threaded runtime. Tests ----- - gh-135120: Add :func:`!test.support.subTests`. Library ------- - gh-133967: Do not normalize :mod:`locale` name 'C.UTF-8' to 'en_US.UTF-8'. - gh-135326: Restore support of integer-like objects with :meth:`!__index__` in :func:`random.getrandbits`. - gh-135321: Raise a correct exception for values greater than 0x7fffffff for the ``BINSTRING`` opcode in the C implementation of :mod:`pickle`. - gh-135276: Backported bugfixes in zipfile.Path from zipp 3.23. Fixed ``.name``, ``.stem`` and other basename-based properties on Windows when working with a zipfile on disk. - gh-134151: :mod:`email`: Fix :exc:`TypeError` in :func:`email.utils.decode_params` when sorting :rfc:`2231` continuations that contain an unnumbered section. - gh-134152: :mod:`email`: Fix parsing of email message ID with invalid domain. - gh-127081: Fix libc thread safety issues with :mod:`os` by replacing ``getlogin`` with ``getlogin_r`` re-entrant version. - gh-131884: Fix formatting issues in :func:`json.dump` when both *indent* and *skipkeys* are used. Core and Builtins ----------------- - gh-135171: Roll back changes to generator and list comprehensions that went into 3.13.4 to fix GH-127682, but which involved semantic and bytecode changes not appropriate for a bugfix release. C API ----- - gh-134989: Fix ``Py_RETURN_NONE``, ``Py_RETURN_TRUE`` and ``Py_RETURN_FALSE`` macros in the limited C API 3.11 and older: don't treat ``Py_None``, ``Py_True`` and ``Py_False`` as immortal. Patch by Victor Stinner. - gh-134989: Implement :c:func:`PyObject_DelAttr` and :c:func:`PyObject_DelAttrString` as macros in the limited C API 3.12 and older. Patch by Victor Stinner. What's New in Python 3.13.4 final? ================================== *Release date: 2025-06-03* Windows ------- - gh-130727: Fix a race in internal calls into WMI that can result in an "invalid handle" exception under high load. Patch by Chris Eibl. - gh-76023: Make :func:`os.path.realpath` ignore Windows error 1005 when in non-strict mode. - gh-133626: Ensures packages are not accidentally bundled into the traditional installer. - gh-133512: Add warnings to :ref:`launcher` about use of subcommands belonging to the Python install manager. Tests ----- - gh-133744: Fix multiprocessing interrupt test. Add an event to synchronize the parent process with the child process: wait until the child process starts sleeping. Patch by Victor Stinner. - gh-133639: Fix ``TestPyReplAutoindent.test_auto_indent_default()`` doesn't run ``input_code``. - gh-133131: The iOS testbed will now select the most recently released "SE-class" device for testing if a device isn't explicitly specified. - gh-109981: The test helper that counts the list of open file descriptors now uses the optimised ``/dev/fd`` approach on all Apple platforms, not just macOS. This avoids crashes caused by guarded file descriptors. Security -------- - gh-135034: Fixes multiple issues that allowed ``tarfile`` extraction filters (``filter="data"`` and ``filter="tar"``) to be bypassed using crafted symlinks and hard links. Addresses :cve:`2024-12718`, :cve:`2025-4138`, :cve:`2025-4330`, and :cve:`2025-4517`. - gh-133767: Fix use-after-free in the "unicode-escape" decoder with a non-"strict" error handler. - gh-128840: Short-circuit the processing of long IPv6 addresses early in :mod:`ipaddress` to prevent excessive memory consumption and a minor denial-of-service. Library ------- - gh-134718: :func:`ast.dump` now only omits ``None`` and ``[]`` values if they are default values. - gh-128840: Fix parsing long IPv6 addresses with embedded IPv4 address. - gh-134696: Built-in HACL* and OpenSSL implementations of hash function constructors now correctly accept the same *documented* named arguments. For instance, :func:`~hashlib.md5` could be previously invoked as ``md5(data=data)`` or ``md5(string=string)`` depending on the underlying implementation but these calls were not compatible. Patch by Bénédikt Tran. - gh-134210: :func:`curses.window.getch` now correctly handles signals. Patch by Bénédikt Tran. - gh-80334: :func:`multiprocessing.freeze_support` now checks for work on any "spawn" start method platform rather than only on Windows. - gh-114177: Fix :mod:`asyncio` to not close subprocess pipes which would otherwise error out when the event loop is already closed. - gh-134152: Fixed :exc:`UnboundLocalError` that could occur during :mod:`email` header parsing if an expected trailing delimiter is missing in some contexts. - gh-62184: Remove import of C implementation of :class:`io.FileIO` from Python implementation which has its own implementation - gh-133982: Emit :exc:`RuntimeWarning` in the Python implementation of :mod:`io` when the :term:`file-like object ` is not closed explicitly in the presence of multiple I/O layers. - gh-133890: The :mod:`tarfile` module now handles :exc:`UnicodeEncodeError` in the same way as :exc:`OSError` when cannot extract a member. - gh-134097: Fix interaction of the new :term:`REPL` and :option:`-X showrefcount <-X>` command line option. - gh-133889: The generated directory listing page in :class:`http.server.SimpleHTTPRequestHandler` now only shows the decoded path component of the requested URL, and not the query and fragment. - gh-134098: Fix handling paths that end with a percent-encoded slash (``%2f`` or ``%2F``) in :class:`http.server.SimpleHTTPRequestHandler`. - gh-134062: :mod:`ipaddress`: fix collisions in :meth:`~object.__hash__` for :class:`~ipaddress.IPv4Network` and :class:`~ipaddress.IPv6Network` objects. - gh-133745: In 3.13.3 we accidentally changed the signature of the asyncio ``create_task()`` family of methods and how it calls a custom task factory in a backwards incompatible way. Since some 3rd party libraries have already made changes to work around the issue that might break if we simply reverted the changes, we're instead changing things to be backwards compatible with 3.13.2 while still supporting those workarounds for 3.13.3. In particular, the special-casing of ``name`` and ``context`` is back (until 3.14) and consequently eager tasks may still find that their name hasn't been set before they execute their first yielding await. - gh-71253: Raise :exc:`ValueError` in :func:`open` if *opener* returns a negative file-descriptor in the Python implementation of :mod:`io` to match the C implementation. - gh-77057: Fix handling of invalid markup declarations in :class:`html.parser.HTMLParser`. - gh-133489: :func:`random.getrandbits` can now generate more that 2\ :sup:`31` bits. :func:`random.randbytes` can now generate more that 256 MiB. - gh-133290: Fix attribute caching issue when setting :attr:`ctypes._Pointer._type_` in the undocumented and deprecated :func:`!ctypes.SetPointerType` function and the undocumented :meth:`!set_type` method. - gh-132876: ``ldexp()`` on Windows doesn't round subnormal results before Windows 11, but should. Python's :func:`math.ldexp` wrapper now does round them, so results may change slightly, in rare cases of very small results, on Windows versions before 11. - gh-133089: Use original timeout value for :exc:`subprocess.TimeoutExpired` when the func :meth:`subprocess.run` is called with a timeout instead of sometimes a confusing partial remaining time out value used internally on the final ``wait()``. - gh-133009: :mod:`xml.etree.ElementTree`: Fix a crash in :meth:`Element.__deepcopy__ ` when the element is concurrently mutated. Patch by Bénédikt Tran. - gh-132995: Bump the version of pip bundled in ensurepip to version 25.1.1 - gh-132017: Fix error when ``pyrepl`` is suspended, then resumed and terminated. - gh-132673: Fix a crash when using ``_align_ = 0`` and ``_fields_ = []`` in a :class:`ctypes.Structure`. - gh-132527: Include the valid typecode 'w' in the error message when an invalid typecode is passed to :class:`array.array`. - gh-132439: Fix ``PyREPL`` on Windows: characters entered via AltGr are swallowed. Patch by Chris Eibl. - gh-132429: Fix support of Bluetooth sockets on NetBSD and DragonFly BSD. - gh-132106: :meth:`QueueListener.start ` now raises a :exc:`RuntimeError` if the listener is already started. - gh-132417: Fix a ``NULL`` pointer dereference when a C function called using :mod:`ctypes` with ``restype`` :class:`~ctypes.py_object` returns ``NULL``. - gh-132385: Fix instance error suggestions trigger potential exceptions in :meth:`object.__getattr__` in :mod:`traceback`. - gh-132308: A :class:`traceback.TracebackException` now correctly renders the ``__context__`` and ``__cause__`` attributes from :ref:`falsey ` :class:`Exception`, and the ``exceptions`` attribute from falsey :class:`ExceptionGroup`. - gh-132250: Fixed the :exc:`SystemError` in :mod:`cProfile` when locating the actual C function of a method raises an exception. - gh-132063: Prevent exceptions that evaluate as falsey (namely, when their ``__bool__`` method returns ``False`` or their ``__len__`` method returns 0) from being ignored by :class:`concurrent.futures.ProcessPoolExecutor` and :class:`concurrent.futures.ThreadPoolExecutor`. - gh-119605: Respect ``follow_wrapped`` for :meth:`!__init__` and :meth:`!__new__` methods when getting the class signature for a class with :func:`inspect.signature`. Preserve class signature after wrapping with :func:`warnings.deprecated`. Patch by Xuehai Pan. - gh-91555: Ignore log messages generated during handling of log messages, to avoid deadlock or infinite recursion. - gh-131434: Improve error reporting for incorrect format in :func:`time.strptime`. - gh-131127: Systems using LibreSSL now successfully build. - gh-130999: Avoid exiting the new REPL and offer suggestions even if there are non-string candidates when errors occur. - gh-130941: Fix :class:`configparser.ConfigParser` parsing empty interpolation with ``allow_no_value`` set to ``True``. - gh-129098: Fix REPL traceback reporting when using :func:`compile` with an inexisting file. Patch by Bénédikt Tran. - gh-130631: :func:`!http.cookiejar.join_header_words` is now more similar to the original Perl version. It now quotes the same set of characters and always quote values that end with ``"\n"``. - gh-129719: Fix missing :data:`!socket.CAN_RAW_ERR_FILTER` constant in the socket module on Linux systems. It was missing since Python 3.11. - gh-124096: Turn on virtual terminal mode and enable bracketed paste in REPL on Windows console. (If the terminal does not support bracketed paste, enabling it does nothing.) - gh-122559: Remove :meth:`!__reduce__` and :meth:`!__reduce_ex__` methods that always raise :exc:`TypeError` in the C implementation of :class:`io.FileIO`, :class:`io.BufferedReader`, :class:`io.BufferedWriter` and :class:`io.BufferedRandom` and replace them with default :meth:`!__getstate__` methods that raise :exc:`!TypeError`. This restores fine details of behavior of Python 3.11 and older versions. - gh-122179: :func:`hashlib.file_digest` now raises :exc:`BlockingIOError` when no data is available during non-blocking I/O. Before, it added spurious null bytes to the digest. - gh-86155: :meth:`html.parser.HTMLParser.close` no longer loses data when the ``