From 36fa2b08951c45024be07bc3c4b5fd8749ded0b4 Mon Sep 17 00:00:00 2001 From: Karolina Surma Date: Mon, 10 Aug 2026 10:37:20 +0200 Subject: [PATCH] Update to Python 3.14.7 --- ...not-working-with-older-expat-version.patch | 6 +- 00474-cve-2025-15366.patch | 59 ------------------- ...piled-for-a-different-python-version.patch | 8 +-- ...prebuilt-jit-stencils-configure-flag.patch | 8 +-- plan.fmf | 5 +- python3.14.spec | 40 +++++++------ sources | 10 ++-- 7 files changed, 40 insertions(+), 96 deletions(-) delete mode 100644 00474-cve-2025-15366.patch diff --git a/00466-downstream-only-skip-tests-not-working-with-older-expat-version.patch b/00466-downstream-only-skip-tests-not-working-with-older-expat-version.patch index 1ec4926..aded227 100644 --- a/00466-downstream-only-skip-tests-not-working-with-older-expat-version.patch +++ b/00466-downstream-only-skip-tests-not-working-with-older-expat-version.patch @@ -15,10 +15,10 @@ which is tested as working. 3 files changed, 10 insertions(+) diff --git a/Lib/test/test_pyexpat.py b/Lib/test/test_pyexpat.py -index dea472335b..dfe41760af 100644 +index fd3077063b..6e6468cb7d 100644 --- a/Lib/test/test_pyexpat.py +++ b/Lib/test/test_pyexpat.py -@@ -1031,6 +1031,8 @@ def start_element(name, _): +@@ -1037,6 +1037,8 @@ def start_element(name, _): self.assertEqual(started, ['doc']) @@ -41,7 +41,7 @@ index 5c10bcedc6..1fd7a273b5 100644 result = BytesIO() xmlgen = XMLGenerator(result) diff --git a/Lib/test/test_xml_etree.py b/Lib/test/test_xml_etree.py -index 8c693bfbdb..a71f230b77 100644 +index 6da7c34dc4..e9912cb569 100644 --- a/Lib/test/test_xml_etree.py +++ b/Lib/test/test_xml_etree.py @@ -1598,9 +1598,13 @@ def test_simple_xml(self, chunk_size=None, flush=False): diff --git a/00474-cve-2025-15366.patch b/00474-cve-2025-15366.patch deleted file mode 100644 index 6c29cd9..0000000 --- a/00474-cve-2025-15366.patch +++ /dev/null @@ -1,59 +0,0 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 -From: Seth Michael Larson -Date: Tue, 20 Jan 2026 14:45:42 -0600 -Subject: 00474: CVE-2025-15366 - -Downstream only: Reject control characters in IMAP commands ---- - Lib/imaplib.py | 4 +++- - Lib/test/test_imaplib.py | 6 ++++++ - .../Security/2026-01-16-11-41-06.gh-issue-143921.AeCOor.rst | 1 + - 3 files changed, 10 insertions(+), 1 deletion(-) - create mode 100644 Misc/NEWS.d/next/Security/2026-01-16-11-41-06.gh-issue-143921.AeCOor.rst - -diff --git a/Lib/imaplib.py b/Lib/imaplib.py -index e84ffb2eec..3465881270 100644 ---- a/Lib/imaplib.py -+++ b/Lib/imaplib.py -@@ -131,7 +131,7 @@ - # We compile these in _mode_xxx. - _Literal = br'.*{(?P\d+)}$' - _Untagged_status = br'\* (?P\d+) (?P[A-Z-]+)( (?P.*))?' -- -+_control_chars = re.compile(b'[\x00-\x1F\x7F]') - - - class IMAP4: -@@ -1108,6 +1108,8 @@ def _command(self, name, *args): - if arg is None: continue - if isinstance(arg, str): - arg = bytes(arg, self._encoding) -+ if _control_chars.search(arg): -+ raise ValueError("Control characters not allowed in commands") - data = data + b' ' + arg - - literal = self.literal -diff --git a/Lib/test/test_imaplib.py b/Lib/test/test_imaplib.py -index f0b463949c..165390ee66 100644 ---- a/Lib/test/test_imaplib.py -+++ b/Lib/test/test_imaplib.py -@@ -673,6 +673,12 @@ def test_unselect(self): - self.assertEqual(data[0], b'Returned to authenticated state. (Success)') - self.assertEqual(client.state, 'AUTH') - -+ def test_control_characters(self): -+ client, _ = self._setup(SimpleIMAPHandler) -+ for c0 in support.control_characters_c0(): -+ with self.assertRaises(ValueError): -+ client.login(f'user{c0}', 'pass') -+ - # property tests - - def test_file_property_should_not_be_accessed(self): -diff --git a/Misc/NEWS.d/next/Security/2026-01-16-11-41-06.gh-issue-143921.AeCOor.rst b/Misc/NEWS.d/next/Security/2026-01-16-11-41-06.gh-issue-143921.AeCOor.rst -new file mode 100644 -index 0000000000..4e13fe92bc ---- /dev/null -+++ b/Misc/NEWS.d/next/Security/2026-01-16-11-41-06.gh-issue-143921.AeCOor.rst -@@ -0,0 +1 @@ -+Reject control characters in IMAP commands. diff --git a/00477-raise-an-error-when-importing-stdlib-modules-compiled-for-a-different-python-version.patch b/00477-raise-an-error-when-importing-stdlib-modules-compiled-for-a-different-python-version.patch index b344a70..1ba9248 100644 --- a/00477-raise-an-error-when-importing-stdlib-modules-compiled-for-a-different-python-version.patch +++ b/00477-raise-an-error-when-importing-stdlib-modules-compiled-for-a-different-python-version.patch @@ -81,10 +81,10 @@ index 2a17c891dd..64017c666c 100644 } #endif diff --git a/Makefile.pre.in b/Makefile.pre.in -index f86d7363e0..6aa97b0b6f 100644 +index 526d500fe0..506ec30408 100644 --- a/Makefile.pre.in +++ b/Makefile.pre.in -@@ -3420,3 +3420,6 @@ MODULE__MULTIBYTECODEC_DEPS=$(srcdir)/Modules/cjkcodecs/multibytecodec.h +@@ -3426,3 +3426,6 @@ MODULE__MULTIBYTECODEC_DEPS=$(srcdir)/Modules/cjkcodecs/multibytecodec.h # Local Variables: # mode: makefile # End: @@ -92,10 +92,10 @@ index f86d7363e0..6aa97b0b6f 100644 +# Fedora-specific, downstream only +PY_STDMODULE_CFLAGS += -D_PyHack_check_version_on_modinit=1 diff --git a/Modules/_tkinter.c b/Modules/_tkinter.c -index 6c1af66408..2eb3665fa7 100644 +index 22126b67d8..7ef5b5d5cd 100644 --- a/Modules/_tkinter.c +++ b/Modules/_tkinter.c -@@ -3490,6 +3490,12 @@ static struct PyModuleDef _tkintermodule = { +@@ -3611,6 +3611,12 @@ static struct PyModuleDef _tkintermodule = { PyMODINIT_FUNC PyInit__tkinter(void) { diff --git a/00486-gh-148646-add---enable-prebuilt-jit-stencils-configure-flag.patch b/00486-gh-148646-add---enable-prebuilt-jit-stencils-configure-flag.patch index 06201ff..79101b5 100644 --- a/00486-gh-148646-add---enable-prebuilt-jit-stencils-configure-flag.patch +++ b/00486-gh-148646-add---enable-prebuilt-jit-stencils-configure-flag.patch @@ -70,7 +70,7 @@ index a073300592..5580985974 100644 ) jit_stencils_h = args.output_dir / "jit_stencils.h" diff --git a/configure b/configure -index 2088290f0e..fd960d9551 100755 +index 2cb22a7806..1b396c92b2 100755 --- a/configure +++ b/configure @@ -1105,6 +1105,7 @@ with_strict_overflow @@ -91,7 +91,7 @@ index 2088290f0e..fd960d9551 100755 --enable-loadable-sqlite-extensions support loadable extensions in the sqlite3 module, see Doc/library/sqlite3.rst (default is no) -@@ -10986,6 +10990,28 @@ fi +@@ -11045,6 +11049,28 @@ fi { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $tier2_flags $jit_flags" >&5 printf "%s\n" "$tier2_flags $jit_flags" >&6; } @@ -121,10 +121,10 @@ index 2088290f0e..fd960d9551 100755 # GH-133171: This configuration builds the JIT but never actually uses it, # which is surprising (and strictly worse than not building it at all): diff --git a/configure.ac b/configure.ac -index aed1494673..10d78ae942 100644 +index 967d34d47a..51160cafc2 100644 --- a/configure.ac +++ b/configure.ac -@@ -2822,6 +2822,19 @@ AC_SUBST([REGEN_JIT_COMMAND]) +@@ -2873,6 +2873,19 @@ AC_SUBST([REGEN_JIT_COMMAND]) AC_SUBST([JIT_STENCILS_H]) AC_MSG_RESULT([$tier2_flags $jit_flags]) diff --git a/plan.fmf b/plan.fmf index bb45dcc..09bf963 100644 --- a/plan.fmf +++ b/plan.fmf @@ -24,11 +24,12 @@ discover: test: "PYTHON=python${pybasever}d TOX=false VERSION=${pybasever} CYTHON=true ./venv.sh" - name: selftest path: /selftest - test: "VERSION=${pybasever} X='-i test_check_probes' ./parallel.sh" + # test_subparser_inherits_reparse_deferral fails on RHEL 9: https://github.com/python/cpython/issues/155485 + test: "VERSION=${pybasever} X='-i test_check_probes -i test_subparser_inherits_reparse_deferral' ./parallel.sh" - name: debugtest path: /selftest # test_base_interpreter: https://github.com/python/cpython/issues/131372 - test: "VERSION=${pybasever} PYTHON=python${pybasever}d X='-i test_check_probes -i test_base_interpreter' ./parallel.sh" + test: "VERSION=${pybasever} PYTHON=python${pybasever}d X='-i test_check_probes -i test_base_interpreter -i test_subparser_inherits_reparse_deferral' ./parallel.sh" - name: freethreadingtest path: /selftest test: "VERSION=${pybasever}t X='-i test_check_probes -i test_base_interpreter' ./parallel.sh" diff --git a/python3.14.spec b/python3.14.spec index 8060621..ca7a4fe 100644 --- a/python3.14.spec +++ b/python3.14.spec @@ -45,11 +45,11 @@ URL: https://www.python.org/ # WARNING When rebasing to a new Python version, # remember to update the python3-docs package as well -%global general_version %{pybasever}.6 +%global general_version %{pybasever}.7 #global prerel ... %global upstream_version %{general_version}%{?prerel} Version: %{general_version}%{?prerel:~%{prerel}} -Release: 2%{?dist} +Release: 1%{?dist} License: Python-2.0.1 @@ -112,30 +112,30 @@ License: Python-2.0.1 # This needs to be manually updated when we update Python. # Explore the sources tarball (you need the version before %%prep is executed): # $ tar -tf Python-%%{upstream_version}.tar.xz | grep whl -%global pip_version 26.1.2 +%global pip_version 26.2.1 %global setuptools_version 79.0.1 # All of those also include a list of indirect bundled libs: # pip # $ %%{_rpmconfigdir}/pythonbundles.py <(unzip -p Lib/ensurepip/_bundled/pip-*.whl pip/_vendor/vendor.txt) %global pip_bundled_provides %{expand: Provides: bundled(python3dist(cachecontrol)) = 0.14.4 -Provides: bundled(python3dist(certifi)) = 2026.2.25 -Provides: bundled(python3dist(distlib)) = 0.4 +Provides: bundled(python3dist(certifi)) = 2026.6.17 +Provides: bundled(python3dist(distlib)) = 0.4.2 Provides: bundled(python3dist(distro)) = 1.9 -Provides: bundled(python3dist(idna)) = 3.11 +Provides: bundled(python3dist(idna)) = 3.18 Provides: bundled(python3dist(msgpack)) = 1.1.2 Provides: bundled(python3dist(packaging)) = 26.2 -Provides: bundled(python3dist(platformdirs)) = 4.5.1 -Provides: bundled(python3dist(pygments)) = 2.19.2 +Provides: bundled(python3dist(platformdirs)) = 4.10 +Provides: bundled(python3dist(pygments)) = 2.20 Provides: bundled(python3dist(pyproject-hooks)) = 1.2 -Provides: bundled(python3dist(requests)) = 2.33.1 +Provides: bundled(python3dist(requests)) = 2.34.2 Provides: bundled(python3dist(resolvelib)) = 1.2.1 Provides: bundled(python3dist(rich)) = 14.2 Provides: bundled(python3dist(setuptools)) = 70.3 -Provides: bundled(python3dist(tomli)) = 2.3.1 +Provides: bundled(python3dist(tomli)) = 2.4.1 Provides: bundled(python3dist(tomli-w)) = 1.2 Provides: bundled(python3dist(truststore)) = 0.10.4 -Provides: bundled(python3dist(urllib3)) = 2.6.3 +Provides: bundled(python3dist(urllib3)) = 2.7 } # setuptools # vendor.txt not in .whl @@ -401,12 +401,6 @@ Patch251: 00251-change-user-install-location.patch # which is tested as working. Patch466: 00466-downstream-only-skip-tests-not-working-with-older-expat-version.patch -# 00474 # 0d9da266d5ecb31d8a417a0a5daa251a2d99389f -# CVE-2025-15366 -# -# Downstream only: Reject control characters in IMAP commands -Patch474: 00474-cve-2025-15366.patch - # 00475 # 91e12ebfb2a88b265f3764a0d852b6fa53b2386a # CVE-2025-15367 # @@ -557,7 +551,7 @@ Summary: Python runtime libraries # Combined manually from https://docs.python.org/3.14/license.html # Hash of Doc/license.rst which is compared in %%prep, generated with: # $ sha256sum Doc/license.rst | cut -f1 -d" " -%global license_file_hash c695d550b135e53e38807e76496d1db17d22c40e461d1f3f354c86188d3305dd +%global license_file_hash cd6f471c0bfdb099efefc25ddff9b3df8bf62e10428987f1f05e6f2f9e35d563 # Licenses of incorporated software: # Mersenne Twister in _random C extension contains code under BSD-3-Clause # socket.getaddrinfo() and socket.getnameinfo() are BSD-3-Clause @@ -581,7 +575,8 @@ Summary: Python runtime libraries # parts of asyncio from uvloop are MIT # Python/qsbr.c is adapted from code under BSD-2-Clause # Zstandard bindings in Modules/_zstd and Lib/compression/zstd are BSD-3-Clause -%global libs_license Python-2.0.1 AND MIT AND BSD-3-Clause AND MIT-CMU AND HPND-SMC AND BSD-2-Clause AND dtoa +# An extract of the `Unicode Character Database` converted to an internal format is Unicode-3.0 +%global libs_license Python-2.0.1 AND MIT AND BSD-3-Clause AND MIT-CMU AND HPND-SMC AND BSD-2-Clause AND dtoa AND Unicode-3.0 %if %{with rpmwheels} Requires: %{python_wheel_pkg_prefix}-pip-wheel >= 23.1.2 License: %{libs_license} @@ -1490,6 +1485,7 @@ CheckPython() { # test_check_probes is failing since it was introduced in 3.12.0rc1, # the test is skipped until it is fixed in upstream. # see: https://github.com/python/cpython/issues/104280#issuecomment-1669249980 + # test_subparser_inherits_reparse_deferral: https://github.com/python/cpython/issues/155485 LD_LIBRARY_PATH=$ConfDir $ConfDir/python -m test.regrtest \ -wW --slowest %{_smp_mflags} \ %ifarch riscv64 @@ -1498,6 +1494,9 @@ CheckPython() { --timeout=2700 \ %endif -i test_check_probes \ + %if 0%{?rhel} == 9 + -i test_subparser_inherits_reparse_deferral \ + %endif echo FINISHED: CHECKING OF PYTHON FOR CONFIGURATION: $ConfName @@ -1987,6 +1986,9 @@ CheckPython freethreading # ====================================================== %changelog +* Mon Aug 10 2026 Karolina Surma - 3.14.7-1 +- Update to Python 3.14.7 + * Thu Jul 16 2026 Fedora Release Engineering - 3.14.6-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild diff --git a/sources b/sources index 9504ccc..48e32a1 100644 --- a/sources +++ b/sources @@ -1,5 +1,5 @@ -SHA512 (Python-3.14.6.tar.xz) = 90a82f46c28f0fca613b67358fdc57c145ab05d20fb56bf3bc0c9e4e54947c7d30fbaa6856c41a41909237a9e601d1a7d19579d4b25c7a784ebcfe9012defc41 -SHA512 (Python-3.14.6-aarch64-debug-jit_stencils.h) = f56cbdadc5448636257aa17998886b83d4e7dbf848827e08cf393fc61d0522e6976f7d2799c35e250013629b85f242e3647114ce8d0281b9ed67b45475c2cab2 -SHA512 (Python-3.14.6-aarch64-optimized-jit_stencils.h) = 6fa83d156d4bc73a49d1c03af88c00624dc6dd36fb7b28bf8642e310560a8c4a9bf7059102f2e9827ec30152efdcff839bc9dcf9a2a83e24c86207286c2dda7b -SHA512 (Python-3.14.6-x86_64-debug-jit_stencils.h) = b1edbd82f6e33f58211e00d862d407f1463d12263aa3386ad7e2f1a9c235226edb6ec11fdff1be8260914859e6089bd4b4a792e5cc5e3d5362cd80b383355b05 -SHA512 (Python-3.14.6-x86_64-optimized-jit_stencils.h) = b28575a1c8a3c5cdd6c7860136501359c5cfea92c645d3970b64c75359976a360e3213a68e6a9d589c9f72609b5152093bf10977d31e38ac9110db91e2054634 +SHA512 (Python-3.14.7.tar.xz) = 3d4e2e2f983b320dec47005c408d7178d3656a6de0c4430ce21514797174b972f461200898b25d3dfac2a455019ef87e45d0fb2bb6ec2ca887124d10037a2a07 +SHA512 (Python-3.14.7-aarch64-debug-jit_stencils.h) = 85bf4cdf5996ede2932aa1b5ffb0c3befe7fb395efdadaeedc05969bbf8f4db1fe825666276239183ec24caa58f2307983876b29efa86ac54bd5802c85ab1d3c +SHA512 (Python-3.14.7-aarch64-optimized-jit_stencils.h) = e7245f166126184655275dd5a90a4251e73ed042fc0d9b46624f55faa698a676a6714f8d2577aecd0a03fb54a6fda3d23b1391a1872b66c130b79b817699ab82 +SHA512 (Python-3.14.7-x86_64-debug-jit_stencils.h) = e34b31bcc3959b3fbd9cac07df69eababfab2ff42101a0dc14af34c67775c73ef48dcac658ac0c1f58c8c2957bd88a553a748f849e566d4cf66c0a5d9722f14d +SHA512 (Python-3.14.7-x86_64-optimized-jit_stencils.h) = d17bf0d61136580dfe589dbcac2d51bbb3fa75f467e008ad2000a7f778427f32aef3f88efb46a1c01c4aa4af8878d51d4f4e0b1d18976906ea332bfe6c11e1fe