rpms/python3.14
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Update to Python 3.14.4

Browse source
This commit is contained in:
Karolina Surma 2026-04-08 13:03:09 +02:00
commit e9c5c0c3c4
6 changed files with 23 additions and 140 deletions
Download patch file Download diff file Expand all files Collapse all files

8
00251-change-user-install-location.patch
View file

@ -51,7 +51,7 @@ index aeb7c6cfc7..86f9ae9e76 100644
if os.path.isdir(sitedir):
addsitedir(sitedir, known_paths)
diff --git a/Lib/sysconfig/__init__.py b/Lib/sysconfig/__init__.py
index 2ecbff222f..7211773bad 100644
index faf8273bd0..d7667bbc77 100644
--- a/Lib/sysconfig/__init__.py
+++ b/Lib/sysconfig/__init__.py
@@ -106,6 +106,12 @@
@ -130,7 +130,7 @@ index 2ecbff222f..7211773bad 100644
# On Windows we want to substitute 'lib' for schemes rather
# than the native value (without modifying vars, in case it
diff --git a/Lib/test/test_sysconfig.py b/Lib/test/test_sysconfig.py
index 09eff11179..c227815ebd 100644
index 1fe4b6849f..e0cb3ec23a 100644
--- a/Lib/test/test_sysconfig.py
+++ b/Lib/test/test_sysconfig.py
@@ -132,8 +132,19 @@ def test_get_path(self):
@ -154,7 +154,7 @@ index 09eff11179..c227815ebd 100644
os.path.normpath(expected),
)
@@ -395,7 +406,7 @@ def test_get_config_h_filename(self):
@@ -397,7 +408,7 @@ def test_get_config_h_filename(self):
self.assertTrue(os.path.isfile(config_h), config_h)
def test_get_scheme_names(self):
@ -163,7 +163,7 @@ index 09eff11179..c227815ebd 100644
if HAS_USER_BASE:
wanted.extend(['nt_user', 'osx_framework_user', 'posix_user'])
self.assertEqual(get_scheme_names(), tuple(sorted(wanted)))
@@ -407,6 +418,8 @@ def test_symlink(self): # Issue 7880
@@ -409,6 +420,8 @@ def test_symlink(self): # Issue 7880
cmd = "-c", "import sysconfig; print(sysconfig.get_platform())"
self.assertEqual(py.call_real(*cmd), py.call_link(*cmd))

4
00466-downstream-only-skip-tests-not-working-with-older-expat-version.patch
View file

@ -15,10 +15,10 @@ which is tested as working.
3 files changed, 10 insertions(+)
diff --git a/Lib/test/test_pyexpat.py b/Lib/test/test_pyexpat.py
index daeaa38a3c..b243f1da14 100644
index 465f65a03b..3379ab8aa9 100644
--- a/Lib/test/test_pyexpat.py
+++ b/Lib/test/test_pyexpat.py
@@ -847,6 +847,8 @@ def start_element(name, _):
@@ -905,6 +905,8 @@ def start_element(name, _):
self.assertEqual(started, ['doc'])

2
00477-raise-an-error-when-importing-stdlib-modules-compiled-for-a-different-python-version.patch
View file

@ -81,7 +81,7 @@ index 2a17c891dd..64017c666c 100644
}
#endif
diff --git a/Makefile.pre.in b/Makefile.pre.in
index 38a355a23f..67c19c329e 100644
index 80a1b590c2..f28f562930 100644
--- a/Makefile.pre.in
+++ b/Makefile.pre.in
@@ -3415,3 +3415,6 @@ MODULE__MULTIBYTECODEC_DEPS=$(srcdir)/Modules/cjkcodecs/multibytecodec.h

114
00478-cve-2026-4519.patch
View file

@ -1,114 +0,0 @@
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: "Miss Islington (bot)"
<31488909+miss-islington@users.noreply.github.com>
Date: Tue, 24 Mar 2026 00:16:27 +0100
Subject: 00478: CVE-2026-4519
Reject leading dashes in webbrowser URLs (GH-146214)
(cherry picked from commit 82a24a4442312bdcfc4c799885e8b3e00990f02b)
Co-authored-by: Seth Michael Larson <seth@python.org>
---
Lib/test/test_webbrowser.py | 5 +++++
Lib/webbrowser.py | 13 +++++++++++++
.../2026-01-16-12-04-49.gh-issue-143930.zYC5x3.rst | 1 +
3 files changed, 19 insertions(+)
create mode 100644 Misc/NEWS.d/next/Security/2026-01-16-12-04-49.gh-issue-143930.zYC5x3.rst
diff --git a/Lib/test/test_webbrowser.py b/Lib/test/test_webbrowser.py
index 4c3ea1cd8d..22e9d7493a 100644
--- a/Lib/test/test_webbrowser.py
+++ b/Lib/test/test_webbrowser.py
@@ -67,6 +67,11 @@ def test_open(self):
options=[],
arguments=[URL])
+ def test_reject_dash_prefixes(self):
+ browser = self.browser_class(name=CMD_NAME)
+ with self.assertRaises(ValueError):
+ browser.open(f"--key=val {URL}")
+
class BackgroundBrowserCommandTest(CommandTestMixin, unittest.TestCase):
diff --git a/Lib/webbrowser.py b/Lib/webbrowser.py
index f2e2394089..9ead2990e8 100644
--- a/Lib/webbrowser.py
+++ b/Lib/webbrowser.py
@@ -163,6 +163,12 @@ def open_new(self, url):
def open_new_tab(self, url):
return self.open(url, 2)
+ @staticmethod
+ def _check_url(url):
+ """Ensures that the URL is safe to pass to subprocesses as a parameter"""
+ if url and url.lstrip().startswith("-"):
+ raise ValueError(f"Invalid URL: {url}")
+
class GenericBrowser(BaseBrowser):
"""Class for all browsers started with a command
@@ -180,6 +186,7 @@ def __init__(self, name):
def open(self, url, new=0, autoraise=True):
sys.audit("webbrowser.open", url)
+ self._check_url(url)
cmdline = [self.name] + [arg.replace("%s", url)
for arg in self.args]
try:
@@ -200,6 +207,7 @@ def open(self, url, new=0, autoraise=True):
cmdline = [self.name] + [arg.replace("%s", url)
for arg in self.args]
sys.audit("webbrowser.open", url)
+ self._check_url(url)
try:
if sys.platform[:3] == 'win':
p = subprocess.Popen(cmdline)
@@ -266,6 +274,7 @@ def _invoke(self, args, remote, autoraise, url=None):
def open(self, url, new=0, autoraise=True):
sys.audit("webbrowser.open", url)
+ self._check_url(url)
if new == 0:
action = self.remote_action
elif new == 1:
@@ -357,6 +366,7 @@ class Konqueror(BaseBrowser):
def open(self, url, new=0, autoraise=True):
sys.audit("webbrowser.open", url)
+ self._check_url(url)
# XXX Currently I know no way to prevent KFM from opening a new win.
if new == 2:
action = "newTab"
@@ -588,6 +598,7 @@ def register_standard_browsers():
class WindowsDefault(BaseBrowser):
def open(self, url, new=0, autoraise=True):
sys.audit("webbrowser.open", url)
+ self._check_url(url)
try:
os.startfile(url)
except OSError:
@@ -608,6 +619,7 @@ def __init__(self, name='default'):
def open(self, url, new=0, autoraise=True):
sys.audit("webbrowser.open", url)
+ self._check_url(url)
url = url.replace('"', '%22')
if self.name == 'default':
proto, _sep, _rest = url.partition(":")
@@ -664,6 +676,7 @@ def open(self, url, new=0, autoraise=True):
class IOSBrowser(BaseBrowser):
def open(self, url, new=0, autoraise=True):
sys.audit("webbrowser.open", url)
+ self._check_url(url)
# If ctypes isn't available, we can't open a browser
if objc is None:
return False
diff --git a/Misc/NEWS.d/next/Security/2026-01-16-12-04-49.gh-issue-143930.zYC5x3.rst b/Misc/NEWS.d/next/Security/2026-01-16-12-04-49.gh-issue-143930.zYC5x3.rst
new file mode 100644
index 0000000000..0f27eae99a
--- /dev/null
+++ b/Misc/NEWS.d/next/Security/2026-01-16-12-04-49.gh-issue-143930.zYC5x3.rst
@@ -0,0 +1 @@
+Reject leading dashes in URLs passed to :func:`webbrowser.open`

25
python3.14.spec
View file

@ -45,11 +45,11 @@ URL: https://www.python.org/
# WARNING When rebasing to a new Python version,
# remember to update the python3-docs package as well
%global general_version %{pybasever}.3
%global general_version %{pybasever}.4
#global prerel ...
%global upstream_version %{general_version}%{?prerel}
Version: %{general_version}%{?prerel:~%{prerel}}
Release: 2%{?dist}
Release: 1%{?dist}
License: Python-2.0.1
@ -112,21 +112,21 @@ License: Python-2.0.1
# This needs to be manually updated when we update Python.
# Explore the sources tarball (you need the version before %%prep is executed):
# $ tar -tf Python-%%{upstream_version}.tar.xz | grep whl
%global pip_version 25.3
%global pip_version 26.0.1
%global setuptools_version 79.0.1
# All of those also include a list of indirect bundled libs:
# pip
# $ %%{_rpmconfigdir}/pythonbundles.py <(unzip -p Lib/ensurepip/_bundled/pip-*.whl pip/_vendor/vendor.txt)
%global pip_bundled_provides %{expand:
Provides: bundled(python3dist(cachecontrol)) = 0.14.3
Provides: bundled(python3dist(certifi)) = 2025.10.5
Provides: bundled(python3dist(cachecontrol)) = 0.14.4
Provides: bundled(python3dist(certifi)) = 2026.1.4
Provides: bundled(python3dist(dependency-groups)) = 1.3.1
Provides: bundled(python3dist(distlib)) = 0.4
Provides: bundled(python3dist(distro)) = 1.9
Provides: bundled(python3dist(idna)) = 3.10
Provides: bundled(python3dist(idna)) = 3.11
Provides: bundled(python3dist(msgpack)) = 1.1.2
Provides: bundled(python3dist(packaging)) = 25
Provides: bundled(python3dist(platformdirs)) = 4.5
Provides: bundled(python3dist(packaging)) = 26
Provides: bundled(python3dist(platformdirs)) = 4.5.1
Provides: bundled(python3dist(pygments)) = 2.19.2
Provides: bundled(python3dist(pyproject-hooks)) = 1.2
Provides: bundled(python3dist(requests)) = 2.32.5
@ -444,12 +444,6 @@ Patch475: 00475-cve-2025-15367.patch
# direct call to the check function.
Patch477: 00477-raise-an-error-when-importing-stdlib-modules-compiled-for-a-different-python-version.patch
# 00478 # d9d794656850591a4e6aeddcf853505aeea08028
# CVE-2026-4519
#
# Reject leading dashes in webbrowser URLs (GH-146214)
Patch478: 00478-cve-2026-4519.patch
# (New patches go here ^^^)
#
# When adding new patches to "python" and "python3" in Fedora, EL, etc.,
@ -2003,6 +1997,9 @@ CheckPython freethreading
# ======================================================
%changelog
* Wed Apr 08 2026 Karolina Surma <ksurma@redhat.com> - 3.14.4-1
- Update to Python 3.14.4
* Thu Mar 26 2026 Lumír Balhar <lbalhar@redhat.com> - 3.14.3-2
- Security fix for CVE-2026-4519 (rhbz#2449730)

10
sources
View file

@ -1,5 +1,5 @@
SHA512 (Python-3.14.3.tar.xz) = 9fd875f7a1d96d64e7150913ef38b72b0aeecfcbc24ba46967e57b6495146b0cba6b940c273561fc4d656b6d0ce2e23ffb7bd32bcd0b61fd59a6d90585998c07
SHA512 (Python-3.14.3-aarch64-debug-jit_stencils.h) = 31cd37ee2c788e63867deb3cc40d34be3100a191dbc42a41c30b1de5e23c5dff2aa27e6927baaf2d0a220f32079c5c650b10f72d79939975845c3977508fd4b1
SHA512 (Python-3.14.3-aarch64-optimized-jit_stencils.h) = 504af12fda768c819954367ccb3cdd5af45a473bd311d1b884ef54263248c036cd6722dada013bc060231274c9bfaa20c65958cf4f546e363fe0a8b9ec0e4a93
SHA512 (Python-3.14.3-x86_64-debug-jit_stencils.h) = 0a4a5ba7a48177c0ee66f9eb5215b0287a28d7b0c1943d6a2590921f5e12507eea041f43985c4321d6bf9a2573f70d94c15ef5fee0df2227af1fd45f09409552
SHA512 (Python-3.14.3-x86_64-optimized-jit_stencils.h) = f9e126f66a8c7650ea26c92e4190dee613c5b899dd231ee8d43173e040f29a217d0298675f7ec75df37da340b39af9fc21a7e1711722876ad5830e52b517baea
SHA512 (Python-3.14.4.tar.xz) = 89a7f8b8a31f48d150badb4751df137d47d9014c9c422649a1a55aef5618aa7f0259dd18c151e6804fa8312c6a21544332a9f630ee81150dc00505637e62bb8c
SHA512 (Python-3.14.4-aarch64-debug-jit_stencils.h) = a3dd821a955043a45b03fa03db2492eea9333bf618df17154fe8c6626c5021d992b5bcd3143791526fdbc5ae16381de5a3966477669fa560278527279ba8687e
SHA512 (Python-3.14.4-aarch64-optimized-jit_stencils.h) = ee0d225a555fe340395ebf63e3816fae90be87e9eed12310b130d19149182aafb17d38c3853ada20480b18b1854666523b99de0ab4df196bcef18cde92817a05
SHA512 (Python-3.14.4-x86_64-debug-jit_stencils.h) = 1e1770b1053e5c1504c3cfc246e970123f05366ff460383a902857f10afdc010d0bccaa1b5d48547c50840c3939ee2e4a6d153a67278a7bd4d5bfe5d16d947b5
SHA512 (Python-3.14.4-x86_64-optimized-jit_stencils.h) = 6f41b130d47b6489db909bcd922a26f92ad62153bffcbf169c6137362877797c1efe8eca6811628429b599db962e14933fdbb24c4faa25b57e0d873d9124c7fb