Python 3.13.0RC2, 3.12.6, 3.11.10, 3.10.15, 3.9.20, and 3.8.20 are now available!

Hi there!
A big joint release today. Mostly security fixes but we also have the final release candidate of 3.13 so let’s start with that!

Python 3.13.0RC2

Final opportunity to test and find any show-stopper bugs before we bless and release 3.13.0 final on October 1st.

Get it here:

Call to action

We strongly encourage maintainers of third-party Python projects to prepare their projects for 3.13 compatibilities during this phase, and where necessary publish Python 3.13 wheels on PyPI to be ready for the final release of 3.13.0. Any binary wheels built against Python 3.13.0rc2 will work with future versions of Python 3.13. As always, report any issues to the Python bug tracker.

Please keep in mind that this is a preview release and while it’s as close to the final release as we can get it, its use is not recommended for production environments.

Core developers: time to work on documentation now

  • Are all your changes properly documented?
  • Are they mentioned in What’s New?
  • Did you notice other changes you know of to have insufficient documentation?

As a reminder, until the final release of 3.13.0, the 3.13 branch is set up so that the Release Manager (@thomas) has to merge the changes. Please add him (@Yhg1s on GitHub) to any changes you think should go into 3.13.0. At this point, unless something critical comes up, it should really be documentation only. Other changes (including tests) will be pushed to 3.13.1.

New features in Python 3.13

Python 3.12.6

This is an expedited release for 3.12 due to security content. The schedule returns back to regular programming in October.

One notable change for macOS users: as mentioned in the previous release of 3.12, this release drops support for macOS versions 10.9 through 10.12. Versions of macOS older than 10.13 haven’t been supported by Apple since 2019, and maintaining support for them has become too difficult. (All versions of Python 3.13 have already dropped support for them.)

Get it here:

92 commits.

Python 3.11.10

Python 3.11 joins the elite club of security-only versions with no binary installers.

Get it here:

28 commits.

Python 3.10.15

Get it here:

24 commits.

Python 3.9.20

Get it here:

22 commits.

Python 3.8.20

Python 3.8 is very close to End of Life (see the Release Schedule). Will this be the last release of 3.8 ever? We’ll see… but now I think I jinxed it.

Get it here:

22 commits.

Security content in today’s releases

  • gh-123678 and gh-116741: Upgrade bundled libexpat to 2.6.3 to fix CVE-2024-28757, CVE-2024-45490, CVE-2024-45491 and CVE-2024-45492.
  • gh-118486: os.mkdir() on Windows now accepts mode of 0o700 to restrict the new directory to the current user. This fixes CVE-2024-4030 affecting tempfile.mkdtemp() in scenarios where the base temporary directory is more permissive than the default.
  • gh-123067: Fix quadratic complexity in parsing "-quoted cookie values with backslashes by http.cookies. Fixes CVE-2024-7592.
  • gh-113171: Fixed various false positives and false negatives in IPv4Address.is_private, IPv4Address.is_global, IPv6Address.is_private, IPv6Address.is_global. Fixes CVE-2024-4032.
  • gh-67693: Fix urllib.parse.urlunparse() and urllib.parse.urlunsplit() for URIs with path starting with multiple slashes and no authority. Fixes CVE-2015-2104.
  • gh-121957: Fixed missing audit events around interactive use of Python, now also properly firing for python -i, as well as for python -m asyncio. The event in question is cpython.run_stdin.
  • gh-122133: Authenticate the socket connection for the socket.socketpair() fallback on platforms where AF_UNIX is not available like Windows.
  • gh-121285: Remove backtracking from tarfile header parsing for hdrcharset, PAX, and GNU sparse headers. That’s CVE-2024-6232.
  • gh-114572: ssl.SSLContext.cert_store_stats() and ssl.SSLContext.get_ca_certs() now correctly lock access to the certificate store, when the ssl.SSLContext is shared across multiple threads.
  • gh-102988: email.utils.getaddresses() and email.utils.parseaddr() now return ('', '') 2-tuples in more situations where invalid email addresses are encountered instead of potentially inaccurate values. Add optional strict parameter to these two functions: use strict=False to get the old behavior, accept malformed inputs. getattr(email.utils, 'supports_strict_parsing', False) can be use to check if the strict paramater is available. This improves the CVE-2023-27043 fix.
  • gh-123270: Sanitize names in zipfile.Path to avoid infinite loops (gh-122905) without breaking contents using legitimate characters. That’s CVE-2024-8088.
  • gh-121650: email headers with embedded newlines are now quoted on output. The generator will now refuse to serialize (write) headers that are unsafely folded or delimited; see verify_generated_headers. That’s CVE-2024-6923.
  • gh-119690: Fixes data type confusion in audit events raised by _winapi.CreateFile and _winapi.CreateNamedPipe.
  • gh-116773: Fix instances of <_overlapped.Overlapped object at 0xXXX> still has pending operation at deallocation, the process may crash.
  • gh-112275: A deadlock involving pystate.c’s HEAD_LOCK in posixmodule.c at fork is now fixed.

Stay safe and upgrade!

Upgrading is highly recommended to all users of affected versions.

Thank you for your support

Thanks to all of the many volunteers who help make Python Development and these releases possible! Please consider supporting our efforts by volunteering yourself or through organization contributions to the Python Software Foundation.


Łukasz Langa @ambv
on behalf of your friendly release team,

Ned Deily @nad
Steve Dower @steve.dower
Pablo Galindo Salgado @pablogsal
Łukasz Langa @ambv
Thomas Wouters @thomas

16 Likes

Is it intentional that 3.9.20 and 3.8.20 don’t include PGP signatures?

1 Like

Good catch. We are indeed dropping GPG signatures for Python 3.14, but me not including them for 3.9.20 and 3.8.20 is an omission. Those old versions aren’t using the GitHub Actions automation as the newer releases, and all artifact signing moved there in March.

I uploaded the GPG signatures for both 3.8.20 and 3.9.20 now. The git tags were properly GPG-signed FWIW.

5 Likes

Some additional CVEs:

That’s CVE-2024-8088

That’s CVE-2024-6923

That’s CVE-2024-6232

4 Likes

Thank you, I updated the list with this information.

1 Like

as a cosmetic remark, the release page of Python-3.11.10 embarks the text for a Python-3.10 release Python Release Python 3.11.10 | Python.org

According to the release calendar specified in PEP 619, Python 3.10 is now in the “security fixes only”

1 Like

Fixed that, too. Thanks!

1 Like

3.10.13 Documentation is still on 3.10.13.

You mean 3.10 documentation? It goes to 3.10.15 for me, maybe just CDN or other caching.

OK, most likely.

I don’t see this, but 3.13.0rc1 Documentation still points at 3.13.0rc1 for me. Also a stale CDN cache?

1 Like

Docs rebuilds are quite slow due to all languages and formats we build. We’ll get all branches up-to-date this week.

3 Likes

In the interim while the full doc builds are completing, you can also find archives of the untranslated (English-only) versions of the documentation as they existed at the time of each release here. Note that these archives do not get updated with post-release changes.

1 Like

Could I possibly just ask about this?

By PEP 602, for a major Python version…

  • During the first twenty four months (2 years) it receives bugfix updates and full releases (sources and installers for Windows and macOS) are made approximately every other month.

According to Status of Python Versions Python 3.11 was released on 2022-10-24 and so I’d expect it to receive a full release and still be in bugfix status for another month yet.

Is that not correct? Or more, clearly not, so why the early change?

Thanks!

Don’t worry, I’ve seen it. Below the 24 months quote there’s an extra note:

Note: 2 years of full support start with Python 3.13. Python versions 3.9 - 3.12 operate on a calendar with 1½ year of full support, followed by 3½ more years of security fixes.

Sorry for the noise.

6 Likes

All the 3.8+ docs and translations have now rebuilt (except fr/3.14 and fr/3.13 which is a known bug).

1 Like

All 24 (6 Python versions × 4 Fedora Linux versions) Fedora updates are now ready and should be available in the updates-testing (or rawhide) repository within 24 hours. Run sudo dnf --enablerepo=updates-testing upgrade python3.{8..13} to get them.

2 Likes

CI testing images have been ready for a while[1].


  1. technically, they update automatically and within a 4 hour window, but I still have to manually update the README ↩︎

1 Like

Was this the last 3.8 release?

I believe it most likely will be, unless a new security issue comes up before the end of October.