Commits

Commits on Apr 13, 2026

[3.11] gh-148395: Fix a possible UAF in `{LZMA,BZ2}Decompressor` (GH-148396) (#148504)
StanFromIreland
authored
[3.11] gh-148169: Fix webbrowser `%action` substitution bypass of dash-prefix check (GH-148170) (#148520)
StanFromIreland
authored

Commits on Apr 12, 2026

[3.11] Default GHA permissions to `contents: read` (GH-148346) (#148389)
hugovk
authored

Commits on Apr 8, 2026

[3.11] gh-145986: Avoid unbound C recursion in `conv_content_model` in `pyexpat.c` (CVE 2026-4224) (GH-145987) (#146000)

StanFromIreland
and
picnixz
authored
[3.11] gh-146083: Upgrade bundled Expat to 2.7.5 (GH-146085) (#146607)
StanFromIreland
authored

Commits on Apr 7, 2026

[3.11] gh-137586: Open external osascript program with absolute path (GH-137584) (#148176)

authored

Commits on Apr 5, 2026

Commits on Apr 3, 2026

[3.11] gh-143930: Tweak the exception message and increase test coverage (GH-146476) (GH-148045) (GH-148051) (GH-148052)

miss-islington
and
ambv
authored

Commits on Apr 2, 2026

Commits on Mar 30, 2026

[3.11] gh-145098: Run Apple Silicon macOS CI on macos-26 (Tahoe) (GH-145099) (GH-146412) (GH-146414) (GH-146635) (#146638)

authored

Commits on Mar 24, 2026

[3.11] gh-143930: Reject leading dashes in webbrowser URLs (GH-143931) (GH-146364)

tomcruiseqi
and
sethmlarson
authored

Commits on Mar 5, 2026

Commits on Mar 3, 2026

Commits on Mar 2, 2026

Commits on Feb 26, 2026

[3.11] gh-144833: Fix use-after-free in SSL module when SSL_new() fails (GH-144843) (#144861)

miss-islington
and
raminfp
authored

Commits on Feb 5, 2026

[3.11] gh-144484: Warn users not to use wsgiref in production

miss-islington
and
sethmlarson
authored

Commits on Feb 3, 2026

[3.11] gh-74453: Add stronger security warning to os.path.commonprefix

miss-islington
and
sethmlarson
authored

Commits on Jan 25, 2026

Commits on Jan 20, 2026

[3.11] gh-143916: Reject control characters in wsgiref.headers.Headers

gpshead
and
sethmlarson
authored

Commits on Jan 13, 2026

[3.11] Bump GitHub Actions (GH-143757) (#143802)
hugovk
authored

Commits on Dec 29, 2025

[3.11] gh-139436: Remove ``dist-pdf`` from the docs archives rebuild target (#139437) (#141164)

StanFromIreland
and
AA-Turner
authored