Commits

History for

Commits on Aug 12, 2026

[3.12] gh-155558: Update bundled Expat to 2.8.3 (GH-155560) (#155615)

miss-islington
and
StanFromIreland
authored
c546712

Commits on Aug 11, 2026

[3.12] gh-152216: Update bundled expat to 2.8.2 (GH-152234) (GH-154747) (#155552)

miss-islington
and
StanFromIreland
authored
01d1f81
[3.12] gh-149018: Use `XML_SetHashSalt16Bytes` in `pyexpat`/`_elementtree` when possible (GH-149023) (#155345)
StanFromIreland
authored
e37df2a

Commits on Aug 4, 2026

[3.12] gh-151544: Fixes CVE-2026-12003 by removing the fallback to %VPATH%/Modules/Setup.local for discovering sources in getpath.py (GH-151545) (#151567)

miss-islington
and
zooba
authored
03ab7b4
[3.12] gh-90949: expose Expat API to tune exponential expansion protections (GH-139368) (#151401)

StanFromIreland
and
picnixz
authored
db195e3
[3.12] gh-150599: Prevent bz2 decompressor reuse after errors (#150600) (#151057)
StanFromIreland
authored
991e6cf
[3.12] gh-149079: Fix O(n^2) canonical ordering in unicodedata.normalize() (GH-149080) (#150843)

authored
d3ab945
[3.12] gh-149698: Update bundled expat to 2.8.1 (GH-149699) (#150020)

miss-islington
and
StanFromIreland
authored
2dd5ce8
[3.12] gh-148808: Add boundary check to asyncio.AbstractEventLoop.sock_recvf… (GH-148809) (#148835)

miss-islington
and
sethmlarson
authored
6c8b85b
[3.12] gh-148395: Fix a possible UAF in `{LZMA,BZ2,_Zlib}Decompressor` (GH-148396) (#148503)

miss-islington
and
StanFromIreland
authored
ea8d735
[3.12] gh-145986: Avoid unbound C recursion in `conv_content_model` in `pyexpat.c` (CVE 2026-4224) (GH-145987) (#145999)

StanFromIreland
and
picnixz
authored
24ce88b

Commits on May 18, 2026

Commits on Feb 23, 2026

Commits on Dec 17, 2025

[3.12] gh-90949: add Expat API to prevent XML deadly allocations (CVE-2025-59375) (GH-139234) (#139527)

hartwork
and
picnixz
authored
0e4cd89

Commits on Oct 7, 2025

Commits on Oct 6, 2025

[3.12] gh-138998: Upgrade vendored expat to 2.7.2 (GH-138999) (#139026)

authored
bfb9e2f

Commits on Apr 7, 2025

Commits on Apr 4, 2025

[3.12] gh-132075: Fix possible use of sockaddr structures with uninitialized members (GH-132076) (GH-132087)

miss-islington
and
serhiy-storchaka
authored
10f73f7

Commits on Apr 2, 2025

[3.12] gh-89039: Call subclass constructors in datetime.*.replace (GH-114780) (GH-131239)

serhiy-storchaka
and
eltoder
authored
6f6b8b4

Commits on Apr 1, 2025

[3.12] gh-111178: Fix getsockaddrarg() undefined behavior (GH-131668) (GH-131977) (#131979)

miss-islington
and
vstinner
authored
afb3f33

Commits on Mar 31, 2025

Commits on Mar 28, 2025

Commits on Mar 23, 2025

[3.12] gh-131418: remove unused legacy typedefs in `{md5,sha1}module.c` (GH-131420) (#131619)

miss-islington
and
picnixz
authored
63a4273

Commits on Mar 18, 2025

Commits on Mar 13, 2025

[3.12] gh-131181: Assert that PyObject_stgdict isn't NULL for PyCData (#131188)
dyupina
authored
ba36389

Commits on Mar 11, 2025

[3.12] gh-131082: Add missing guards for WIN32_LEAN_AND_MEAN (#131044) (#131085)

vstinner
and
maxbachmann
authored
3f226c5

Commits on Mar 5, 2025

[3.12] gh-130824: Add tests for NULL in PyLong_*AndOverflow functions (GH-130828) (GH-130876)

authored
8fe011a

Commits on Mar 3, 2025

[3.12] gh-127667: fix memory leaks in `hashlib` (GH-127668) (#130783)
picnixz
authored
d25da89