Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package python313 for openSUSE:Factory checked in at 2026-09-18 22:03:41 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/python313 (Old) and /work/SRC/openSUSE:Factory/.python313.new.383539 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "python313" Fri Sep 18 22:03:41 2026 rev:45 rq:1378363 version:3.13.15 Changes: -------- --- /work/SRC/openSUSE:Factory/python313/python313.changes 2026-08-17 16:55:30.414666548 +0200 +++ /work/SRC/openSUSE:Factory/.python313.new.383539/python313.changes 2026-09-18 22:04:21.795123481 +0200 @@ -1,0 +2,649 @@ +Wed Sep 16 12:10:23 UTC 2026 - Matej Cepl <[email protected]> + +- Restore back macros.python3, we need it. + +------------------------------------------------------------------- +Tue Sep 15 10:29:32 UTC 2026 - Matej Cepl <[email protected]> + +- CVE-2026-19672: in tarfile, handle a member that leaves the + destination and comes back (bsc#1276227, gh#python/cpython#156000) + CVE-2026-19672-tarfile-outside-dirs.patch + +------------------------------------------------------------------- +Fri Sep 11 18:27:42 UTC 2026 - Matej Cepl <[email protected]> + +CVE-2026-17084: Don't consider Unicode codepoint attributes + outside RFC 3454 (bsc#1276226) + CVE-2026-17084-unicode-rfc3454.patch + +------------------------------------------------------------------- +Wed Sep 9 23:02:34 UTC 2026 - Matej Cepl <[email protected]> + +- Add sphinx9-runtime-node.patch fixing documentation build with + Sphinx 9 by importing the extension's Node type at runtime. + +------------------------------------------------------------------- +Wed Sep 9 21:18:36 UTC 2026 - Matej Cepl <[email protected]> + +- Restore the self-contained structure of the python313 package in + openSUSE Factory: + * the package has started to rely on the separate virtual `python3` + package for the generic interpreter entry points and for the + `python3*` Provides (bsc#1258364). That structure is meant for the + SUSE Linux family of distros, it does not belong to Factory + * python313 provides python3, python3-base and the other `python3*` + virtual names again + * python313 owns the python3 and pydoc3 binaries, the python3.1(1) + man page, python3-config, libpython3.so and the unversioned + pkg-config files again + * python313 uses the rpm-build-python generated `python(abi)` Provides + +------------------------------------------------------------------- +Thu Sep 3 21:52:20 UTC 2026 - Matej Cepl <[email protected]> + +- Update to 3.13.15 + - Tools/Demos + - gh-155218: Fix Argument Clinic generating the flags of the + optional groups in different order on 32-bit and 64-bit + platforms. + - gh-155207: Argument Clinic now supports the --dry-run and + --diff options. They list the files which would be changed, + or write a unified diff of the changes to the standard + output, without modifying any file. + - gh-64502: Fix Argument Clinic support of parameters with + a default value used together with optional groups. Such + parameters were always required in the generated parsing + code. + - gh-154580: Fix python-gdb.py raising UnicodeEncodeError + when pretty-printing a non-ASCII str in a locale whose host + charset cannot encode it, such as any non-ASCII string in + the C locale. + - Tests + - gh-76595: Add C API tests for PyCapsule_Import(). + - gh-154167: The test runner (regrtest) now restores the + default SIGINT handler if it was inherited as ignored, so + the test suite no longer hangs when run as a shell + background job. + - gh-154144: Fix building the _testcapi module on NetBSD. + - gh-152548: Add the test.support.isolation.runInSubprocess() + decorator to run a test method or TestCase subclass in + a fresh interpreter subprocess, isolated from the rest of + the test run. + - gh-151626: Fix several tests in test.test_inspect, + test.test_import, test.test_importlib, test.test_py_compile + and test.test_compileall that failed when the test suite + was run with PYTHONPYCACHEPREFIX set. These tests now + neutralize the pycache prefix where they assume the default + __pycache__ bytecode layout. + - gh-151096: Fix test_embed failing when CPython is + configured with a split exec prefix (--exec-prefix + differing from --prefix). + - Security + - gh-153030: Fixed quadratic complexity in incremental + parsing of long unterminated constructs (such as tags or + comments) in html.parser.HTMLParser, which could be + exploited for a denial of service (bsc#1271192, + CVE-2026-15308). + - gh-152674: The xml.etree.ElementTree.Element methods + findall(), iterfind() and find() avoid quadratic behavior + when using XPath index predicates ([1], [last()], + [last()-N]) on XML documents with many same-tag siblings + (bsc#1273148, CVE-2026-6879). + - gh-152216: Update bundled libexpat to version 2.8.2. + - gh-151987: The tarfile.TarFile.extract() method now applies + the given filter when it extracts a link target from the + archive as a fallback (bsc#1269959, CVE-2026-4360). + - gh-151981: In tarfile, seeking a stream now stops when end + of the stream is reached (bsc#1269788, CVE-2026-11972). + - gh-151544: Modules/Setup.local is no longer used as + a landmark to discover whether Python is running in + a source tree, as it could potentially affect actual + installs. The pybuilddir.txt file is now the sole indicator + of running in a source tree. + - gh-151558: Fixed an vulnerability in the tarfile data and + tar extraction filters where crafted archives could create + a symlink pointing outside the destination directory. This + was a bypass of CVE 2025-4330 (bsc#1268977, + CVE-2026-11940). + - gh-150743: http.client now limits the number of + chunked-response trailer lines it will read to 100, and the + number of interim (1xx) responses it will skip to 100. + A malicious or broken server could previously stream + trailer lines or 100 Continue responses forever, hanging + the client even when a socket timeout was in use. Reported + by @YLChen-007 via GHSA-w4q2-g22w-6fr4. + - gh-143927: Normalize all line endings (CR, CRLF, and LF) to + LF+TAB when writing multi-line configparser values + (bsc#1269066, CVE-2026-0864). + - gh-143921: Reject NUL, CR and LF characters in IMAP + commands. Other control characters are allowed and sent + quoted (bsc#1257044, CVE-2025-15366). + - Library + - gh-155063: Bump the version of pip bundled in ensurepip to + version 26.2.1 + - gh-155063: Bump the version of pip bundled in ensurepip to + version 26.2 + - gh-154936: Fix the pure Python json decoder to report the + correct position for invalid literal control characters in + JSON strings. + - gh-154892: Fix a bug in the C accelerator for zoneinfo + where datetime.datetime subclasses returning -1 for hour, + minute, or second could incorrectly raise a SystemError. + - gh-154871: Fixed a crash in asyncio.Task.get_context() when + called on an uninitialized task. + - gh-154848: The pickle C accelerator now enforces frame + boundaries when unpickling, as the pure Python + implementation already did. An argument that straddles + a frame boundary, or a frame that begins before the + previous one has ended, now raises pickle.UnpicklingError + instead of being silently read across the boundary. This + prevents the loaded data from diverging from the + pickletools disassembly of the same pickle. + - gh-109638: Fix exponential time in csv.Sniffer.sniff() for + a sample which contains many quote characters. A doubled + quote character is now also detected in a field which + contains the delimiter or a line break. + - gh-98820: Fix quadratic time in csv.Sniffer.sniff() for + a sample which contains quoted fields, in particular for + a single column of quoted fields (bsc#1274683, + CVE-2026-18503). + - gh-154738: Fix ExternalEntityParserCreate() not propagating + the reparse-deferral setting to the subparser, which left + GetReparseDeferralEnabled() returning an uninitialized + value. Patch by tonghuaroot. + - gh-93251: Fix UnicodeDecodeError in socket functions (such + as getaddrinfo() and gethostbyaddr()) when the localized + error message of the C library is not UTF-8: decode it from + the locale encoding. + - gh-154551: Fix ctypes.util.find_library() returning None in + non-UTF-8 locales. + - gh-79366: Fixed a race condition in logging: if a handler + was removed while a record was being emitted, the following + handlers of the same logger could be skipped. + - gh-73458: Fix logging.config.listen(): it left the caller + waiting for the ready event forever if the server could not + be started, for example if the port was invalid or already + in use. It now also binds to an IPv6 address if the host + has no IPv4 address, for example if localhost is only + aliased to ::1. + - gh-154460: Fix time.strftime() and + datetime.datetime.strftime() returning a wrong ISO 8601 + week number (%V) on OpenBSD. + - gh-154435: Fix os.posix_fadvise() and os.posix_fallocate() + on DragonFly BSD: they raised OSError with a meaningless + error code, because these functions return -1 and set errno + there. + - gh-154399: Fix venv activation in a non-interactive csh: + activate.csh no longer fails when the prompt variable is + not set. + - gh-154389: Fix uuid.uuid1() on OpenBSD: it returned + a version 4 UUID, because uuid_create() generates random + UUIDs on this platform. + - gh-154324: Fix os.sendfile() on illumos: it no longer + reports a successful transfer when the underlying system + call failed without writing any data. + - gh-154307: Fix tempfile.TemporaryDirectory.cleanup() on + DragonFly BSD, where removing a file with the UF_NOUNLINK + flag failed with EISDIR instead of EPERM. + - gh-154291: Fix socket.has_dualstack_ipv6() to return False + on platforms such as DragonFly BSD where setting + IPV6_V6ONLY to 0 silently has no effect. + - gh-154283: On DragonFly BSD, threading.get_native_id() now + returns a value that is unique across processes, matching + the other platforms. + - gh-154258: Fix a crash in mmap.mmap.resize() on NetBSD when + growing a shared anonymous mapping. resize() now raises + ValueError in this case, as it already did on Linux. + - gh-154225: Fix os.openpty() on Solaris and illumos: it no + longer leaves the pseudo-terminal as the controlling + terminal of the calling process. + - gh-154227: Fix os.posix_openpt() on OpenBSD, where it + rejected the O_CLOEXEC flag. + - gh-145030: Fix asyncio write pipe transports for named + FIFOs on macOS and Solaris. Unread data sitting in the FIFO + made the transport misinterpret a poll event as the reader + disconnecting, wrongly closing the transport. + - gh-154001: Fix random.binomialvariate() raising + ZeroDivisionError when random.random() returns zero. + - gh-153896: Deduplicate unhashable args in typing.Literal. + - gh-153864: On a wide curses build, curses.window.insch() + now inserts a non-ASCII byte as the character it encodes in + the window’s encoding, consistently with addch(), instead + of its code point. + - gh-153862: On a wide curses build, curses.window.inch() now + returns the locale-encoded byte of a non-ASCII character, + matching instr(), instead of the low byte of its code + point. + - gh-146011: Fix a heap-use-after-free in the + C implementation of decimal when calling repr() after + deleting the Context. + - gh-153761: Fix cancelling asyncio.loop.sock_accept() + dropping a pending connection. + - gh-153695: Hashing a sqlite3.Row that contains an + unhashable value now raises TypeError instead of + SystemError. Patch by tonghuaroot. + - gh-153658: Fix sqlite3.Connection.iterdump() raising + sqlite3.OperationalError when a table name contains + a single quote. Patch by tonghuaroot. + - gh-85943: Fix struct functions raising BytesWarning under + the -bb command line option when a str format is used after + an equal bytes format (or vice versa). The internal format + cache no longer mixes str and bytes keys. + - gh-153404: urllib.robotparser.RobotFileParser now silently + ignores a Crawl-delay or Request-rate value written with + non-decimal digits (such as U+00B2 SUPERSCRIPT TWO) instead + of raising ValueError and aborting the parse of the whole + robots.txt file. + - gh-153417: Error messages from imaplib.IMAP4.select() and + imaplib.IMAP4.uid() no longer raise BytesWarning under -bb + when the mailbox or command argument is bytes. + - gh-153406: email.utils.parsedate_to_datetime() now raises + ValueError instead of OverflowError when the parsed year or + timezone offset is out of range, matching its documented + behavior. + - gh-153083: Defer GC tracking of an array.array to the end + of its construction. Patch by Donghee Na. + - gh-143990: A tkinter.font.Font created from a named font, + including by copy(), now copies its configured options + rather than the options resolved by Tcl’s font actual, + preserving a size specified in pixels (a negative size). + - gh-153210: Fix crash on array import under a memory + pressure. + - gh-153200: Fix math.isqrt() returning an incorrect result + for arguments not less than 2**64 that are instances of an + int subclass with an overridden comparison operator. + - gh-153068: Fix cProfile.Profile.enable() to no longer + overwrite errors from sys.monitoring. + - gh-153056: Fix string.Template raising a spurious + ValueError when the pattern attribute is a compiled regular + expression object, which the documentation allows. + - gh-135661: Fix html.parser.HTMLParser: an abruptly closed + empty comment (<!--> or <!--->) no longer extends up to + a later --> in the same feed() call. + - gh-54930: Error responses of + http.server.BaseHTTPRequestHandler to malformed request + lines now include a status line and headers instead of + being sent in the bare HTTP/0.9 style. Only a valid + HTTP/0.9 request (a two-word GET request line) now receives + an HTTP/0.9 style response. + - gh-152951: collections.deque prevent rare crash when + calling extend under high memory pressure conditions. + - gh-150880: Normalize non-extended Windows paths before + appending the wildcard used by os.listdir() and + os.scandir(), making paths with trailing spaces behave + consistently with other filesystem APIs. + - gh-152849: Out-of-range float and integer timestamps now + raise OverflowError with the same message. Patch by + tonghuaroot. + - gh-152847: Reject a POSIX TZ transition rule with non-digit + characters in the day-of-year field in the pure-Python + zoneinfo parser. Patch by tonghuaroot. + - gh-108280: Connecting imaplib to a server that does not + send a valid IMAP4 greeting (for example a POP3 server + answering on the IMAP port) now raises an error reporting + the server’s response instead of imaplib.IMAP4.error: None. + - gh-151126: Fix a crash caused by failing to set MemoryError + on allocation failure when passing ctypes.Structure or + ctypes.Union instances by value to ctypes foreign + functions. + - gh-63121: imaplib now refreshes the cached capability list + after a successful login() or authenticate(), using the + CAPABILITY response sent by the server or, if none was + sent, by querying it, so that capabilities that become + available only after authentication (such as ENABLE on + Gmail) are recognized. Capabilities advertised in the + server greeting are now also used, avoiding a redundant + CAPABILITY command. + - gh-88574: imaplib no longer fails when a server sends ++++ 397 more lines (skipped) ++++ between /work/SRC/openSUSE:Factory/python313/python313.changes ++++ and /work/SRC/openSUSE:Factory/.python313.new.383539/python313.changes Old: ---- CVE-2025-15366-imap-ctrl-chars.patch CVE-2026-0864-normalize-LFTAB-configparser.patch CVE-2026-11940-tarfile-escape.patch CVE-2026-11972-tarfile-Stream-seek-EOF.patch CVE-2026-15308-HTMLParser-CPU-exhaust.patch CVE-2026-4360-filter_function-TarFile-extractone.patch Python-3.13.14.tar.xz Python-3.13.14.tar.xz.sigstore reproducible_stencils.patch New: ---- CVE-2026-17084-unicode-rfc3454.patch CVE-2026-19672-tarfile-outside-dirs.patch Python-3.13.15.tar.xz Python-3.13.15.tar.xz.sigstore sphinx9-runtime-node.patch ----------(Old B)---------- Old:- Remove upstreamed patches: - CVE-2025-15366-imap-ctrl-chars.patch - CVE-2026-0864-normalize-LFTAB-configparser.patch Old: - CVE-2025-15366-imap-ctrl-chars.patch - CVE-2026-0864-normalize-LFTAB-configparser.patch - CVE-2026-11940-tarfile-escape.patch Old: - CVE-2026-0864-normalize-LFTAB-configparser.patch - CVE-2026-11940-tarfile-escape.patch - CVE-2026-11972-tarfile-Stream-seek-EOF.patch Old: - CVE-2026-11940-tarfile-escape.patch - CVE-2026-11972-tarfile-Stream-seek-EOF.patch - CVE-2026-15308-HTMLParser-CPU-exhaust.patch Old: - CVE-2026-11972-tarfile-Stream-seek-EOF.patch - CVE-2026-15308-HTMLParser-CPU-exhaust.patch - CVE-2026-4360-filter_function-TarFile-extractone.patch Old: - CVE-2026-15308-HTMLParser-CPU-exhaust.patch - CVE-2026-4360-filter_function-TarFile-extractone.patch - reproducible_stencils.patch Old: - CVE-2026-4360-filter_function-TarFile-extractone.patch - reproducible_stencils.patch ----------(Old E)---------- ----------(New B)---------- New: outside RFC 3454 (bsc#1276226) CVE-2026-17084-unicode-rfc3454.patch New: destination and comes back (bsc#1276227, gh#python/cpython#156000) CVE-2026-19672-tarfile-outside-dirs.patch New: - Add sphinx9-runtime-node.patch fixing documentation build with Sphinx 9 by importing the extension's Node type at runtime. ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ python313.spec ++++++ --- /var/tmp/diff_new_pack.mpD5gc/_old 2026-09-18 22:04:23.883210993 +0200 +++ /var/tmp/diff_new_pack.mpD5gc/_new 2026-09-18 22:04:23.885211077 +0200 @@ -167,7 +167,7 @@ # _md5.cpython-38m-x86_64-linux-gnu.so %define dynlib() %{sitedir}/lib-dynload/%{1}.cpython-%{abi_tag}-%{archname}-%{_os}%{?_gnu}%{?armsuffix}.so Name: %{python_pkg_name}%{psuffix} -Version: 3.13.14 +Version: 3.13.15 %define tarversion %{version} %define tarname Python-%{tarversion} Release: 0 @@ -233,36 +233,24 @@ Patch43: bsc1243155-sphinx-non-determinism.patch # PATCH-FIX-OPENSUSE gh139257-Support-docutils-0.22.patch gh#python/cpython#139257 [email protected] Patch45: gh139257-Support-docutils-0.22.patch +# PATCH-FIX-OPENSUSE sphinx9-runtime-node.patch [email protected] +# Import Node at runtime because Sphinx 9 evaluates extension annotations. +Patch46: sphinx9-runtime-node.patch # PATCH-FIX-UPSTREAM pass-test_write_read_limited_history.patch bsc#[0-9]+ [email protected] # Fix readline history truncation when length is reduced Patch48: pass-test_write_read_limited_history.patch # PATCH-FIX-OPENSUSE test_UDPLITE_support.patch gh#python/cpython#149078 [email protected] # improve testing of the presence of IPPROTO_UDPLITE support Patch53: test_UDPLITE_support.patch -# PATCH-FIX-UPSTREAM CVE-2025-15366-imap-ctrl-chars.patch bsc#1257044 [email protected] -# Reject control characters in wsgiref.headers.Headers -Patch54: CVE-2025-15366-imap-ctrl-chars.patch # PATCH-FIX-UPSTREAM CVE-2025-15366-pop3-ctrl-chars.patch bsc#1257041 [email protected] # Reject control characters in POP3 commands Patch55: CVE-2025-15366-pop3-ctrl-chars.patch -# PATCH-FIX-UPSTREAM CVE-2026-11940-tarfile-escape.patch bsc#1268977 [email protected] -# Fix symlink escape via tarfile hardlink-extraction fallback -Patch56: CVE-2026-11940-tarfile-escape.patch -# PATCH-FIX-UPSTREAM reproducible_stencils.patch gh#python/cpython!154988 [email protected] -# make jit_stencils.h reproducible -Patch57: reproducible_stencils.patch -# PATCH-FIX-UPSTREAM CVE-2026-0864-normalize-LFTAB-configparser.patch bsc#1269066 [email protected] -# Normalize all line endings (CR, CRLF, and LF) in configparser -Patch58: CVE-2026-0864-normalize-LFTAB-configparser.patch -# PATCH-FIX-UPSTREAM CVE-2026-11972-tarfile-Stream-seek-EOF.patch bsc#1269788 [email protected] -# Make tarfile._Stream.seek break at EOF -Patch59: CVE-2026-11972-tarfile-Stream-seek-EOF.patch -# PATCH-FIX-UPSTREAM CVE-2026-4360-filter_function-TarFile-extractone.patch bsc#1269959 [email protected] -# Pass filter_function to TarFile._extract_one() during .extract() -Patch60: CVE-2026-4360-filter_function-TarFile-extractone.patch -# PATCH-FIX-UPSTREAM CVE-2026-15308-HTMLParser-CPU-exhaust.patch bsc#1271192 [email protected] -# Fix quadratic complexity in incremental parsing in HTMLParser -Patch61: CVE-2026-15308-HTMLParser-CPU-exhaust.patch +# PATCH-FIX-UPSTREAM CVE-2026-17084-unicode-rfc3454.patch bsc#1276226 Matej Cepl <[email protected]> +# Don't consider Unicode codepoint attributes outside RFC 3454 +Patch56: CVE-2026-17084-unicode-rfc3454.patch +# PATCH-FIX-UPSTREAM CVE-2026-19672-tarfile-outside-dirs.patch bsc#1276227 [email protected] +# in tarfile, handle a member that leaves the destination and comes back +Patch57: CVE-2026-19672-tarfile-outside-dirs.patch #### END OF PATCHES BuildRequires: autoconf-archive BuildRequires: automake ++++++ CVE-2025-15366-pop3-ctrl-chars.patch ++++++ --- /var/tmp/diff_new_pack.mpD5gc/_old 2026-09-18 22:04:23.947213675 +0200 +++ /var/tmp/diff_new_pack.mpD5gc/_new 2026-09-18 22:04:23.954213969 +0200 @@ -9,10 +9,10 @@ Misc/NEWS.d/next/Security/2026-01-16-11-43-47.gh-issue-143923.DuytMe.rst | 1 + 3 files changed, 11 insertions(+) -Index: Python-3.13.14/Lib/poplib.py +Index: Python-3.13.15/Lib/poplib.py =================================================================== ---- Python-3.13.14.orig/Lib/poplib.py 2026-07-04 11:00:17.557334328 +0200 -+++ Python-3.13.14/Lib/poplib.py 2026-07-04 11:00:26.988664709 +0200 +--- Python-3.13.15.orig/Lib/poplib.py 2026-08-05 14:25:43.000000000 +0200 ++++ Python-3.13.15/Lib/poplib.py 2026-09-09 23:30:12.452525909 +0200 @@ -122,6 +122,8 @@ def _putcmd(self, line): if self._debugging: print('*cmd*', repr(line)) @@ -22,10 +22,10 @@ self._putline(line) -Index: Python-3.13.14/Lib/test/test_poplib.py +Index: Python-3.13.15/Lib/test/test_poplib.py =================================================================== ---- Python-3.13.14.orig/Lib/test/test_poplib.py 2026-07-04 11:00:19.736602403 +0200 -+++ Python-3.13.14/Lib/test/test_poplib.py 2026-07-04 11:02:51.276051492 +0200 +--- Python-3.13.15.orig/Lib/test/test_poplib.py 2026-08-05 14:25:43.000000000 +0200 ++++ Python-3.13.15/Lib/test/test_poplib.py 2026-09-09 23:30:12.452648483 +0200 @@ -17,6 +17,7 @@ from test.support import threading_helper from test.support import asynchat @@ -48,10 +48,10 @@ @requires_ssl def test_stls_capa(self): capa = self.client.capa() -Index: Python-3.13.14/Misc/NEWS.d/next/Security/2026-01-16-11-43-47.gh-issue-143923.DuytMe.rst +Index: Python-3.13.15/Misc/NEWS.d/next/Security/2026-01-16-11-43-47.gh-issue-143923.DuytMe.rst =================================================================== --- /dev/null 1970-01-01 00:00:00.000000000 +0000 -+++ Python-3.13.14/Misc/NEWS.d/next/Security/2026-01-16-11-43-47.gh-issue-143923.DuytMe.rst 2026-07-04 11:00:26.989135797 +0200 ++++ Python-3.13.15/Misc/NEWS.d/next/Security/2026-01-16-11-43-47.gh-issue-143923.DuytMe.rst 2026-09-09 23:30:12.453439932 +0200 @@ -0,0 +1 @@ +Reject control characters in POP3 commands. ++++++ CVE-2026-17084-unicode-rfc3454.patch ++++++ ++++ 920 lines (skipped) ++++++ CVE-2026-19672-tarfile-outside-dirs.patch ++++++ >From 8277dc17745107e800f09df2316b2641645e5238 Mon Sep 17 00:00:00 2001 From: Stan Ulbrych <[email protected]> Date: Wed, 19 Aug 2026 09:52:01 +0100 Subject: [PATCH] gh-155999: `tarfile`: handle a member that leaves the destination but comes back (GH-156000) (cherry picked from commit 97688346ada2df3e5b9c279348862c3d64ab0823) Co-authored-by: Stan Ulbrych <[email protected]> --- Doc/library/tarfile.rst | 8 +++++ Lib/tarfile.py | 7 +++++ Lib/test/test_tarfile.py | 14 ++++++++++ Misc/NEWS.d/next/Security/2026-08-13-13-08-11.gh-issue-155999.Xt4rWq.rst | 5 +++ 4 files changed, 34 insertions(+) create mode 100644 Misc/NEWS.d/next/Security/2026-08-13-13-08-11.gh-issue-155999.Xt4rWq.rst Index: Python-3.13.15/Doc/library/tarfile.rst =================================================================== --- Python-3.13.15.orig/Doc/library/tarfile.rst 2026-08-05 14:25:43.000000000 +0200 +++ Python-3.13.15/Doc/library/tarfile.rst 2026-09-15 15:12:23.235872943 +0200 @@ -1049,6 +1049,10 @@ paths (in case the name is absolute even after stripping slashes, e.g. ``C:/foo`` on Windows). This raises :class:`~tarfile.AbsolutePathError`. + - Normalize filenames (:attr:`TarInfo.name`) that contain ``..`` components + using :func:`os.path.normpath`. + Note that this removes internal ``..`` components, which may change the + meaning of the name if it traverses symbolic links. - :ref:`Refuse <tarfile-extraction-refuse>` to extract files whose absolute path (after following symlinks) would end up outside the destination. This raises :class:`~tarfile.OutsideDestinationError`. @@ -1057,6 +1061,10 @@ Return the modified ``TarInfo`` member. + .. versionchanged:: next + + Filenames containing ``..`` components are now normalized. + .. function:: data_filter(member, path) Implements the ``'data'`` filter. Index: Python-3.13.15/Lib/tarfile.py =================================================================== --- Python-3.13.15.orig/Lib/tarfile.py 2026-09-15 15:12:21.513542391 +0200 +++ Python-3.13.15/Lib/tarfile.py 2026-09-15 15:12:23.236726532 +0200 @@ -808,6 +808,13 @@ # For example, 'C:/foo' on Windows. raise AbsolutePathError(member) # Ensure we stay in the destination + if '..' in name.replace(os.sep, '/').split('/'): + # Directories are created from the name as given, so a name that + # leaves the destination part-way through would create them + # outside it even if the resolved path stays inside. + normalized = os.path.normpath(name) + if normalized != name: + name = new_attrs['name'] = normalized target_path = os.path.realpath(os.path.join(dest_path, name), strict=os.path.ALLOW_MISSING) if os.path.commonpath([target_path, dest_path]) != dest_path: Index: Python-3.13.15/Lib/test/test_tarfile.py =================================================================== --- Python-3.13.15.orig/Lib/test/test_tarfile.py 2026-08-05 14:25:43.000000000 +0200 +++ Python-3.13.15/Lib/test/test_tarfile.py 2026-09-15 15:12:23.237843377 +0200 @@ -3892,6 +3892,20 @@ tarfile.AbsolutePathError, """['"].*escaped.evil['"] has an absolute path""") + def test_parent_dir_out_and_back(self): + # Test a member that leaves the destination and comes back. + # The containment check looks at the resolved path, which stays + # inside, but the intermediate directories are created from the + # name as given, which does not. + with ArchiveMaker() as arc: + arc.add(f'../escaped.evil/../{self.destdir.name}/sub/file', + content='content') + + for filter in 'tar', 'data': + with self.subTest(filter): + with self.check_context(arc.open(), filter): + self.expect_file('sub/file', content='content') + @symlink_test def test_parent_symlink(self): # Test interplaying symlinks Index: Python-3.13.15/Misc/NEWS.d/next/Security/2026-08-13-13-08-11.gh-issue-155999.Xt4rWq.rst =================================================================== --- /dev/null 1970-01-01 00:00:00.000000000 +0000 +++ Python-3.13.15/Misc/NEWS.d/next/Security/2026-08-13-13-08-11.gh-issue-155999.Xt4rWq.rst 2026-09-15 15:12:23.238656429 +0200 @@ -0,0 +1,5 @@ +Fix the :mod:`tarfile` ``tar`` and ``data`` extraction filters creating +directories outside the destination for members whose name leaves the +destination and returns to it, such as ``../evil/../dest/sub/file``. The +containment check used the resolved path, but intermediate directories were +created from the name as given. ++++++ Python-3.13.14.tar.xz -> Python-3.13.15.tar.xz ++++++ /work/SRC/openSUSE:Factory/python313/Python-3.13.14.tar.xz /work/SRC/openSUSE:Factory/.python313.new.383539/Python-3.13.15.tar.xz differ: char 26, line 1 ++++++ Python-3.13.14.tar.xz.sigstore -> Python-3.13.15.tar.xz.sigstore ++++++ --- /work/SRC/openSUSE:Factory/python313/Python-3.13.14.tar.xz.sigstore 2026-07-22 19:01:13.041055270 +0200 +++ /work/SRC/openSUSE:Factory/.python313.new.383539/Python-3.13.15.tar.xz.sigstore 2026-09-18 22:04:18.183972138 +0200 @@ -1 +1 @@ -{"mediaType": "application/vnd.dev.sigstore.bundle.v0.3+json", "verificationMaterial": {"certificate": {"rawBytes": "MIIDKTCCAq6gAwIBAgIULAhuyOW9GotTtF956yFWVeMi9e0wCgYIKoZIzj0EAwMwNzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRlcm1lZGlhdGUwHhcNMjYwNjEwMTQyODI3WhcNMjYwNjEwMTQzODI3WjAAMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEdYYDPeIvTaNaA504q6KnotW24E+LnSxqZPcpE/YfmwdFx4MU67wyr5JHj+99vRiZRKu7nGGH/L/5Y2QCHXOweaOCAc0wggHJMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAdBgNVHQ4EFgQUtb9Anla5U+yJuuln4ag0E1Hvch4wHwYDVR0jBBgwFoAU39Ppz1YkEZb5qNjpKFWixi4YZD8wHwYDVR0RAQH/BBUwE4ERdGhvbWFzQHB5dGhvbi5vcmcwKQYKKwYBBAGDvzABAQQbaHR0cHM6Ly9hY2NvdW50cy5nb29nbGUuY29tMCsGCisGAQQBg78wAQgEHQwbaHR0cHM6Ly9hY2NvdW50cy5nb29nbGUuY29tMFsGCisGAQQBg78wARgETQxLQ2hVeE1UTXdNREkzTWpZek1UVXpOekkwT0RjNU1EVVNIMmgwZEhCek9pVXlSaVV5Um1GalkyOTFiblJ6TG1kdmIyZHNaUzVqYjIwMIGLBgorBgEEAdZ5AgQCBH0EewB5AHcA3T0wasbHETJjGR4cmWc3AqJKXrjePK3/h4pygC8p7o4AAAGese9CzwAABAMASDBGAiEAs3zEn9PTSTzbsiNMdcHWmnt/Tr7ohDOdN89wXghiplwC IQDKwEFCf+AVlV27FIJyZNxwcVRgoHMzZbbrtpQGeN6oNDAKBggqhkjOPQQDAwNpADBmAjEAxEU8IdjbodolTUvnyOpMSmD5m9r9vzoZvt5fMzhirAZkCkcP4OCvnE/ukJCa6idLAjEA6li+yZaiTaNX0BFBDOLXrvJyPoTnHkyQT9vRpcinxpvrIr6iLkfOAkaha2r4GyDF"}, "tlogEntries": [{"logIndex": "1780117219", "logId": {"keyId": "wNI9atQGlz+VWfO6LRygH4QUfY/8W4RFwiT5i5WRgB0="}, "kindVersion": {"kind": "hashedrekord", "version": "0.0.1"}, "integratedTime": "1781101708", "inclusionPromise": {"signedEntryTimestamp": "MEUCIFS+B+yf9aPd9Y4IygE8cH4o62r7ReqavjRkEf1fgl1LAiEA/CnXwPLUQPCuPlzM0FF7ZTulVNsK4BGrMQ5n4ee/OG8="}, "inclusionProof": {"logIndex": "1658212957", "rootHash": "sHzzFJN2XdaFugNII2SBFTwVL3gvpg/65Kkvy7XjVYg=", "treeSize": "1658212960", "hashes": ["fjIrcah9UCqvI/G3W/gXPbinx4y1XhfdJc2pBrp56Jk=", "8magWOn3O80eK3S9O3iABLjM2e7zcUYfYYILm0CsuEQ=", "FxZ3/KmO9r7RionmLoWqWTG9XHLypgnUMe/8G02U9lg=", "yg472o3t6Dgh2OPS58tqIU3T25ysLLoP/mTqE1OOMMg=", "AxE/Wo8YToTK9SmFomPMJyNXKaOUE2O9lckgoXcg6vA=", "oI154gwGbnn3ycvQKnadlb+taKCtItyR60doRasTk9Y=", "tOVkANwP imLhfqQTm4pls4RGQEUFpz2eAQ3OdicZz8Q=", "b433dsxcmrTWUBI2JbGCjLyy7Pr0IBBMn19dgt3Io4M=", "wOKx0z9QYCh6V91tGPBC6wLftogdim0At1wEeYZQHbo=", "lopYNMPEeyiDfEtpMLlLnbKMdVRShbMH7EYpd/6Z2zQ=", "GKETua1skk2MkOa2eEP3m0xGCLMYojSBY14Q+YigFHA=", "GQOQCyMMlUdewn4btkfMBkpDJPWuNcETDxHWpbp+iKw=", "phbrqVrscGmqV5frx3cP3FZg0R9d16flgXnmF8YlBJs=", "JeFJuYar3D4uBzvMd7x3qts+CGhYQOGMaAiiYVFCxto=", "mDCdA8t/LGc+hqiV0SOyqPXlOYPyWpasRaDDvCC8JAE=", "daxmZaajRpZV+JxHiOYZhJBiSKN5ucqjh2WnGbHhirw=", "DOCeoSMovIvLExkhIvisow9AuNXgeWs4ECkyR6EcqYU="], "checkpoint": {"envelope": "rekor.sigstore.dev - 1193050959916656506\n1658212960\nsHzzFJN2XdaFugNII2SBFTwVL3gvpg/65Kkvy7XjVYg=\n\n\u2014 rekor.sigstore.dev wNI9ajBEAiAq1Bjp86Om5pWj3l+M1byA+TB4kRDCXH08p+zrADhGngIgPNoGamj5tOIr4mM9r3AcgeIRFLr4uRBUJaZcP+YAacc=\n"}}, "canonicalizedBody": "eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJraW5kIjoiaGFzaGVkcmVrb3JkIiwic3BlYyI6eyJkYXRhIjp7Imhhc2giOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiI2MzllNDMyNDNjNjIwYTMwOGY5NjgyMTNkZjllMDBmMmY4ZjYyMzMyZjdhZGJh YTdhN2VlYjk3ODMwNTdjNjkwIn19LCJzaWduYXR1cmUiOnsiY29udGVudCI6Ik1FUUNJRDMrWDcwUWJ5allDanllWDBkdkQ1czdwc3ZtRm4zN1lwWG4vcjRqZHBUMEFpQmtzU25QM1M0QTB0YmN4NjNTTFpTWVdWME1tUkNOVXI3eE8xMkZxTlJEVmc9PSIsInB1YmxpY0tleSI6eyJjb250ZW50IjoiTFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVUkxWRU5EUVhFMlowRjNTVUpCWjBsVlRFRm9kWGxQVnpsSGIzUlVkRVk1TlRaNVJsZFdaVTFwT1dVd2QwTm5XVWxMYjFwSmVtb3dSVUYzVFhjS1RucEZWazFDVFVkQk1WVkZRMmhOVFdNeWJHNWpNMUoyWTIxVmRWcEhWakpOVWpSM1NFRlpSRlpSVVVSRmVGWjZZVmRrZW1SSE9YbGFVekZ3WW01U2JBcGpiVEZzV2tkc2FHUkhWWGRJYUdOT1RXcFpkMDVxUlhkTlZGRjVUMFJKTTFkb1kwNU5hbGwzVG1wRmQwMVVVWHBQUkVrelYycEJRVTFHYTNkRmQxbElDa3R2V2tsNmFqQkRRVkZaU1V0dldrbDZhakJFUVZGalJGRm5RVVZrV1ZsRVVHVkpkbFJoVG1GQk5UQTBjVFpMYm05MFZ6STBSU3RNYmxONGNWcFFZM0FLUlM5WlptMTNaRVo0TkUxVk5qZDNlWEkxU2tocUt6azVkbEpwV2xKTGRUZHVSMGRJTDB3dk5Wa3lVVU5JV0U5M1pXRlBRMEZqTUhkblowaEtUVUUwUndwQk1WVmtSSGRGUWk5M1VVVkJkMGxJWjBSQlZFSm5UbFpJVTFWRlJFUkJTMEpuWjNKQ1owVkdRbEZqUkVGNlFXUkNaMDVXU0ZFMFJVWm5VVlYwWWpsQkNtNXNZVFZWSzNsS2RYVnNialJoWnpCR k1VaDJZMmcwZDBoM1dVUldVakJxUWtKbmQwWnZRVlV6T1ZCd2VqRlphMFZhWWpWeFRtcHdTMFpYYVhocE5Ga0tXa1E0ZDBoM1dVUldVakJTUVZGSUwwSkNWWGRGTkVWU1pFZG9kbUpYUm5wUlNFSTFaRWRvZG1KcE5YWmpiV04zUzFGWlMwdDNXVUpDUVVkRWRucEJRZ3BCVVZGaVlVaFNNR05JVFRaTWVUbG9XVEpPZG1SWE5UQmplVFZ1WWpJNWJtSkhWWFZaTWpsMFRVTnpSME5wYzBkQlVWRkNaemM0ZDBGUlowVklVWGRpQ21GSVVqQmpTRTAyVEhrNWFGa3lUblprVnpVd1kzazFibUl5T1c1aVIxVjFXVEk1ZEUxR2MwZERhWE5IUVZGUlFtYzNPSGRCVW1kRlZGRjRURkV5YUZZS1pVVXhWVlJZWkU1U1JXdDZWRmR3V21Wck1WVldXSEJQWld0cmQxUXdVbXBPVlRGRlZsWk9TVTF0WjNkYVJXaERaV3M1Y0ZaWWJGTmhWbFkxVlcweFJ3cGhiR3Q1VDFSR2FXSnNTalpVUnpGclpHMUplVnBJVG1GVmVsWnhXV3BKZDAxSlIweENaMjl5UW1kRlJVRmtXalZCWjFGRFFrZ3dSV1YzUWpWQlNHTkJDak5VTUhkaGMySklSVlJLYWtkU05HTnRWMk16UVhGS1MxaHlhbVZRU3pNdmFEUndlV2RET0hBM2J6UkJRVUZIWlhObE9VTjZkMEZCUWtGTlFWTkVRa2NLUVdsRlFYTXpla1Z1T1ZCVVUxUjZZbk5wVGsxa1kwaFhiVzUwTDFSeU4yOW9SRTlrVGpnNWQxaG5hR2x3YkhkRFNWRkVTM2RGUmtObUswRldiRll5TndwR1NVcDVXazU0ZDJOV1VtZHZTRTE2V21KaWNuUndVVWRsVGpadlRrUkJTMEpuWjNGb2EycFBVRkZSUkVGM1RuQkJSRUp0UVdwRlFYaE ZWVGhKWkdwaUNtOWtiMnhVVlhadWVVOXdUVk50UkRWdE9YSTVkbnB2V25aME5XWk5lbWhwY2tGYWEwTnJZMUEwVDBOMmJrVXZkV3RLUTJFMmFXUk1RV3BGUVRac2FTc0tlVnBoYVZSaFRsZ3dRa1pDUkU5TVdISjJTbmxRYjFSdVNHdDVVVlE1ZGxKd1kybHVlSEIyY2tseU5tbE1hMlpQUVd0aGFHRXljalJIZVVSR0NpMHRMUzB0UlU1RUlFTkZVbFJKUmtsRFFWUkZMUzB0TFMwSyJ9fX19"}], "timestampVerificationData": {}}, "messageSignature": {"messageDigest": {"algorithm": "SHA2_256", "digest": "Y55DJDxiCjCPloIT354A8vj2IzL3rbqnp+65eDBXxpA="}, "signature": "MEQCID3+X70QbyjYCjyeX0dvD5s7psvmFn37YpXn/r4jdpT0AiBksSnP3S4A0tbcx63SLZSYWV0MmRCNUr7xO12FqNRDVg=="}} +{"mediaType":"application/vnd.dev.sigstore.bundle.v0.3+json","verificationMaterial":{"certificate":{"rawBytes":"MIIDJzCCAq2gAwIBAgIUXWNlTYdMQmOCSpYDVBJ/fVuHup8wCgYIKoZIzj0EAwMwNzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRlcm1lZGlhdGUwHhcNMjYwODA1MTMxNDQ5WhcNMjYwODA1MTMyNDQ5WjAAMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE6etBIDcOeTwyKUVbA36DpX87cjztnCA9hXmDuQT5lS3dPRd2rIw+wfmY0uegNebVX/5FZa9NKWQ/RjWdcPDZSqOCAcwwggHIMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAdBgNVHQ4EFgQUcVRz1rnUXRra3jTPdXefOMlaayEwHwYDVR0jBBgwFoAU39Ppz1YkEZb5qNjpKFWixi4YZD8wHwYDVR0RAQH/BBUwE4ERdGhvbWFzQHB5dGhvbi5vcmcwKQYKKwYBBAGDvzABAQQbaHR0cHM6Ly9hY2NvdW50cy5nb29nbGUuY29tMCsGCisGAQQBg78wAQgEHQwbaHR0cHM6Ly9hY2NvdW50cy5nb29nbGUuY29tMFsGCisGAQQBg78wARgETQxLQ2hVeE1UTXdNREkzTWpZek1UVXpOekkwT0RjNU1EVVNIMmgwZEhCek9pVXlSaVV5Um1GalkyOTFiblJ6TG1kdmIyZHNaUzVqYjIwMIGKBgorBgEEAdZ5AgQCBHwEegB4AHYA3T0wasbHETJjGR4cmWc3AqJKXrjePK3/h4pygC8p7o4AAAGf0g/1ewAABAMARzBFAiBYvfhic5vW1gpr4OQtkpvdRbExDmqjHZlHTqSo6I55ZQIhAM8rV UFstYL8p9tfpVlMwZKlS6Thatp5sUiEbCxKs9CXMAoGCCqGSM49BAMDA2gAMGUCMQClHcHizN7tg6jMZMGHu+hlnEcjywWClT00qIu2JCBdsrQAoAiFbUxNBgBkvUTt6FsCMH9/lx1mrZI4bLRVEUA3TRtwhVgIDOruB4HwSr0YUe6uYb6Z9eHl4dojJTUetvYo/g=="},"tlogEntries":[{"logIndex":"2345087706","logId":{"keyId":"wNI9atQGlz+VWfO6LRygH4QUfY/8W4RFwiT5i5WRgB0="},"kindVersion":{"kind":"hashedrekord","version":"0.0.1"},"integratedTime":"1785935689","inclusionPromise":{"signedEntryTimestamp":"MEUCIQD+QBYbQQO3GddRk0/5ZV+UX4grdcipQP2p3lUBiUhBVgIgSdZLhvYtJnAuxx+vINxxH7jaxOQOMPZ19YtE7cBd438="},"inclusionProof":{"logIndex":"2223183444","rootHash":"Z5WtsbliahcGvHVaRGTyJ0//FmOXi1P6WnuxeU7wlwg=","treeSize":"2223183472","hashes":["oXSgq+0a4CsJIu7P/mtscxKdbd28/yKaMWb5Ltz6jk0=","0ahq9bkl1gZg42j/xbiW/kjLWARql4wS8sOKZ0iJjWw=","iiZ5I+WkYNc7RlX/Y5i6YSXwwpXPHi8Aj56zlnufIec=","xcPnknohcoDLs0ehfFc79RLJfwnivjdpU0H6psw4lW4=","I0beYI/2oyNuZ/Imh3ALjKcVdl7Of33vT7f/1WLZJ1I=","ZJcA5jT8wPGUT1t71wRA8uU9hlOUUmt8vsJRpAf/kxA=","p7xacxkr1Eri9HhfcfUAd22YFMYv9Hc2QSzrI14RcXA= ","1d5VTWYHfneKOL5npfE8I+gMpp8BFfog2aR2c1SWdlI=","rswPuCYwXTk59Z275E+zooCQopZedFulrLHPTHQY6PU=","k3b7jE001SHjaN7+Y5IQb7yS1tfU5c/XvlLpzum9ndo=","Pv4MBi/G9NUhyiLk1mrltT2GpL0W3bUx9EpJULS59wk=","eP9vZN4l1LpRy4jDtU5NyWBNISJEhUysW6rcbcuQnrc=","ScH++eGfXwQDzE/H9Ae7YYnPqN5zAS9Hiq5LGoXV7Hg=","i5Zl8FZrDwxCDv2e2DNO2M8JvpR/c11ElvCZS53/teA=","xH/DCseLHr9eKoYT8qsORZK7zVdEGYWHuVtsVrD95wY="],"checkpoint":{"envelope":"rekor.sigstore.dev - 1193050959916656506\n2223183472\nZ5WtsbliahcGvHVaRGTyJ0//FmOXi1P6WnuxeU7wlwg=\n\n— rekor.sigstore.dev wNI9ajBFAiEAxkRJeAFahmJ0eaVXZn5drnpm0Tjiy1MDCYasds2uplkCICyWVtHDHP2Thw8k3OeEn/QoT7g1lLSbQRpFkIHAm2BU\n"}},"canonicalizedBody":"eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJraW5kIjoiaGFzaGVkcmVrb3JkIiwic3BlYyI6eyJkYXRhIjp7Imhhc2giOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiIxZTY2YTc5NDVhNDgzOTBlZTRjMmE0MjY4YTBlNDE4NTg4NDA1OWExM2M0YWFiNmQxNDhhYTIwOGRlZWE0YTc2In19LCJzaWduYXR1cmUiOnsiY29udGVudCI6Ik1FVUNJUUMydmp5YkoxYjdpeFI1RGdqL1RJUU5OVlRDL0NmaWZzSW1DRFdUU0ZXeWFnSWdHbmNJWFJHdC9IV3Rz Y1hNZzYyUDgvSlZ2UGo4cXJjMUNaSXVicjl4dDlFPSIsInB1YmxpY0tleSI6eyJjb250ZW50IjoiTFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVUktla05EUVhFeVowRjNTVUpCWjBsVldGZE9iRlJaWkUxUmJVOURVM0JaUkZaQ1NpOW1WblZJZFhBNGQwTm5XVWxMYjFwSmVtb3dSVUYzVFhjS1RucEZWazFDVFVkQk1WVkZRMmhOVFdNeWJHNWpNMUoyWTIxVmRWcEhWakpOVWpSM1NFRlpSRlpSVVVSRmVGWjZZVmRrZW1SSE9YbGFVekZ3WW01U2JBcGpiVEZzV2tkc2FHUkhWWGRJYUdOT1RXcFpkMDlFUVRGTlZFMTRUa1JSTlZkb1kwNU5hbGwzVDBSQk1VMVVUWGxPUkZFMVYycEJRVTFHYTNkRmQxbElDa3R2V2tsNmFqQkRRVkZaU1V0dldrbDZhakJFUVZGalJGRm5RVVUyWlhSQ1NVUmpUMlZVZDNsTFZWWmlRVE0yUkhCWU9EZGphbnAwYmtOQk9XaFliVVFLZFZGVU5XeFRNMlJRVW1ReWNrbDNLM2RtYlZrd2RXVm5UbVZpVmxndk5VWmFZVGxPUzFkUkwxSnFWMlJqVUVSYVUzRlBRMEZqZDNkblowaEpUVUUwUndwQk1WVmtSSGRGUWk5M1VVVkJkMGxJWjBSQlZFSm5UbFpJVTFWRlJFUkJTMEpuWjNKQ1owVkdRbEZqUkVGNlFXUkNaMDVXU0ZFMFJVWm5VVlZqVmxKNkNqRnlibFZZVW5KaE0ycFVVR1JZWldaUFRXeGhZWGxGZDBoM1dVUldVakJxUWtKbmQwWnZRVlV6T1ZCd2VqRlphMFZhWWpWeFRtcHdTMFpYYVhocE5Ga0tXa1E0ZDBoM1dVUldVakJTUVZGSUwwSkNWWGRGTkVWU1pFZG9kbUpYUm5wUlNFS TFaRWRvZG1KcE5YWmpiV04zUzFGWlMwdDNXVUpDUVVkRWRucEJRZ3BCVVZGaVlVaFNNR05JVFRaTWVUbG9XVEpPZG1SWE5UQmplVFZ1WWpJNWJtSkhWWFZaTWpsMFRVTnpSME5wYzBkQlVWRkNaemM0ZDBGUlowVklVWGRpQ21GSVVqQmpTRTAyVEhrNWFGa3lUblprVnpVd1kzazFibUl5T1c1aVIxVjFXVEk1ZEUxR2MwZERhWE5IUVZGUlFtYzNPSGRCVW1kRlZGRjRURkV5YUZZS1pVVXhWVlJZWkU1U1JXdDZWRmR3V21Wck1WVldXSEJQWld0cmQxUXdVbXBPVlRGRlZsWk9TVTF0WjNkYVJXaERaV3M1Y0ZaWWJGTmhWbFkxVlcweFJ3cGhiR3Q1VDFSR2FXSnNTalpVUnpGclpHMUplVnBJVG1GVmVsWnhXV3BKZDAxSlIwdENaMjl5UW1kRlJVRmtXalZCWjFGRFFraDNSV1ZuUWpSQlNGbEJDak5VTUhkaGMySklSVlJLYWtkU05HTnRWMk16UVhGS1MxaHlhbVZRU3pNdmFEUndlV2RET0hBM2J6UkJRVUZIWmpCbkx6RmxkMEZCUWtGTlFWSjZRa1lLUVdsQ1dYWm1hR2xqTlhaWE1XZHdjalJQVVhScmNIWmtVbUpGZUVSdGNXcElXbXhJVkhGVGJ6WkpOVFZhVVVsb1FVMDRjbFpWUm5OMFdVdzRjRGwwWmdwd1ZteE5kMXBMYkZNMlZHaGhkSEExYzFWcFJXSkRlRXR6T1VOWVRVRnZSME5EY1VkVFRUUTVRa0ZOUkVFeVowRk5SMVZEVFZGRGJFaGpTR2w2VGpkMENtYzJhazFhVFVkSWRTdG9iRzVGWTJwNWQxZERiRlF3TUhGSmRUSktRMEprYzNKUlFXOUJhVVppVlhoT1FtZENhM1pWVkhRMlJuTkRUVWc1TDJ4NE1XMEtjbHBKTkdKTVVsWkZWVU V6VkZKMGQyaFdaMGxFVDNKMVFqUklkMU55TUZsVlpUWjFXV0kyV2psbFNHdzBaRzlxU2xSVlpYUjJXVzh2WnowOUNpMHRMUzB0UlU1RUlFTkZVbFJKUmtsRFFWUkZMUzB0TFMwSyJ9fX19"}],"timestampVerificationData":{"rfc3161Timestamps":[{"signedTimestamp":"MIIE6TADAgEAMIIE4AYJKoZIhvcNAQcCoIIE0TCCBM0CAQMxDTALBglghkgBZQMEAgEwgcIGCyqGSIb3DQEJEAEEoIGyBIGvMIGsAgEBBgkrBgEEAYO/MAIwMTANBglghkgBZQMEAgEFAAQgedJj741lxqDmKxlWZ+dSfQtyA6ywq2OU0SWR3N8czS0CFDq2Nn0T8VO8fJxsnDCFXnUjnCrOGA8yMDI2MDgwNTEzMTQ0OVowAwIBAQIJANU/4v8rsmiroDKkMDAuMRUwEwYDVQQKEwxzaWdzdG9yZS5kZXYxFTATBgNVBAMTDHNpZ3N0b3JlLXRzYaCCAhQwggIQMIIBlqADAgECAhQ6E1QvDJBh7rzBQy/Lio6LKiOLDDAKBggqhkjOPQQDAzA5MRUwEwYDVQQKEwxzaWdzdG9yZS5kZXYxIDAeBgNVBAMTF3NpZ3N0b3JlLXRzYS1zZWxmc2lnbmVkMB4XDTI1MDQwODA2NTk0M1oXDTM1MDQwNjA2NTk0M1owLjEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MRUwEwYDVQQDEwxzaWdzdG9yZS10c2EwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAATitrZnyEo2KDZP2QWMIBOgYbfSOTL5ZC/cHMv6Yq+HVIo1H9TC7Cx80KDiyvKhgB3wTqKyi9UDczhqg12b1AOLnRnydMTK+qB8M+1MjBci1+Jb8AV/VXu7CRuQCiPTHFyjajBoMA4GA1UdDwEB/wQEAwIHgDAdBgNVHQ4EF gQUif15Q4fP0GVGwwJGxyxzW3206wMwHwYDVR0jBBgwFoAUmOwB73+7Uf/UlR5vioiYUweJzr8wFgYDVR0lAQH/BAwwCgYIKwYBBQUHAwgwCgYIKoZIzj0EAwMDaAAwZQIwO2mxX/opo7SrIX9QyxfZpJRcpAV2gZOm1AZzR+2rVyy6Uc8Ybp2ybIw13ckH4bcRAjEA5qO8FyOkmYpvg2/7ZNqiPxRzn5vqKHoVcIIqtpKq6l7TvOqzAxxclN7VwTG8e++XMYIB2jCCAdYCAQEwUTA5MRUwEwYDVQQKEwxzaWdzdG9yZS5kZXYxIDAeBgNVBAMTF3NpZ3N0b3JlLXRzYS1zZWxmc2lnbmVkAhQ6E1QvDJBh7rzBQy/Lio6LKiOLDDALBglghkgBZQMEAgGggfwwGgYJKoZIhvcNAQkDMQ0GCyqGSIb3DQEJEAEEMBwGCSqGSIb3DQEJBTEPFw0yNjA4MDUxMzE0NDlaMC8GCSqGSIb3DQEJBDEiBCBPBNPsScb99ghCO1ZnnpvKVrtSW36/zT3r28cVkjsRDzCBjgYLKoZIhvcNAQkQAi8xfzB9MHsweQQghfknvAerYsrDtENWwQ78gbLGiD/aernm2HDZ0TrNBbcwVTA9pDswOTEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MSAwHgYDVQQDExdzaWdzdG9yZS10c2Etc2VsZnNpZ25lZAIUOhNULwyQYe68wUMvy4qOiyojiwwwCgYIKoZIzj0EAwIEZjBkAjATvTPnD8YDf3pvoXNClzuPUghLmuWbmz0ZWClv/PaTrwPw16+V8xVm/JBm+e/Dwb0CMBiKtFK3b4l8RIvWPNiqYjbW/YTYc1o8PGHlTHYt4oSqJwtK5bPDN8hZutn6KhU0CQ=="}]}},"messageSignature":{"messageDigest":{"algorithm":"SHA2_256","digest":"HmanlFpIOQ7kwqQmig 5BhYhAWaE8SqttFIqiCN7qSnY="},"signature":"MEUCIQC2vjybJ1b7ixR5Dgj/TIQNNVTC/CfifsImCDWTSFWyagIgGncIXRGt/HWtscXMg62P8/JVvPj8qrc1CZIubr9xt9E="}} ++++++ _scmsync.obsinfo ++++++ --- /var/tmp/diff_new_pack.mpD5gc/_old 2026-09-18 22:04:24.260226793 +0200 +++ /var/tmp/diff_new_pack.mpD5gc/_new 2026-09-18 22:04:24.264226961 +0200 @@ -1,6 +1,6 @@ -mtime: 1786748532 -commit: 0c31b87f057215535b70ee18ac6609824e74d568e05b74cdef7d75f0af347233 +mtime: 1789560642 +commit: 27f9421b997f631c957f3dde9fc1a6d31f042d82aa439d9892675ad26e97400e url: https://src.opensuse.org/python-interpreters/python313 -revision: 0c31b87f057215535b70ee18ac6609824e74d568e05b74cdef7d75f0af347233 +revision: 27f9421b997f631c957f3dde9fc1a6d31f042d82aa439d9892675ad26e97400e projectscmsync: https://src.opensuse.org/python-interpreters/_ObsPrj ++++++ bsc1243155-sphinx-non-determinism.patch ++++++ --- /var/tmp/diff_new_pack.mpD5gc/_old 2026-09-18 22:04:24.348230482 +0200 +++ /var/tmp/diff_new_pack.mpD5gc/_new 2026-09-18 22:04:24.353230691 +0200 @@ -14,10 +14,10 @@ Doc/tools/extensions/audit_events.py | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) -Index: Python-3.13.5/Doc/tools/extensions/audit_events.py +Index: Python-3.13.15/Doc/tools/extensions/audit_events.py =================================================================== ---- Python-3.13.5.orig/Doc/tools/extensions/audit_events.py 2025-07-02 15:51:58.388560540 +0200 -+++ Python-3.13.5/Doc/tools/extensions/audit_events.py 2025-07-02 15:51:58.411254070 +0200 +--- Python-3.13.15.orig/Doc/tools/extensions/audit_events.py 2026-09-09 23:29:16.483311898 +0200 ++++ Python-3.13.15/Doc/tools/extensions/audit_events.py 2026-09-09 23:30:05.528433384 +0200 @@ -72,8 +72,13 @@ logger.warning(msg) return ++++++ build.specials.obscpio ++++++ ++++++ build.specials.obscpio ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/.gitignore new/.gitignore --- old/.gitignore 1970-01-01 01:00:00.000000000 +0100 +++ new/.gitignore 2026-09-16 14:10:42.000000000 +0200 @@ -0,0 +1,6 @@ +.osc +*.obscpio +*.osc +_build.* +.pbuild +python313-*-build/ ++++++ doc-py38-to-py36.patch ++++++ --- /var/tmp/diff_new_pack.mpD5gc/_old 2026-09-18 22:04:24.758247665 +0200 +++ /var/tmp/diff_new_pack.mpD5gc/_new 2026-09-18 22:04:24.770248168 +0200 @@ -27,10 +27,10 @@ Doc/tools/extensions/pydoc_topics.py | 22 +++++----- 18 files changed, 159 insertions(+), 130 deletions(-) -Index: Python-3.13.14/Doc/Makefile +Index: Python-3.13.15/Doc/Makefile =================================================================== ---- Python-3.13.14.orig/Doc/Makefile 2026-06-10 14:24:04.000000000 +0200 -+++ Python-3.13.14/Doc/Makefile 2026-06-17 15:09:20.086496688 +0200 +--- Python-3.13.15.orig/Doc/Makefile 2026-08-05 14:25:43.000000000 +0200 ++++ Python-3.13.15/Doc/Makefile 2026-09-09 23:29:16.479880327 +0200 @@ -14,15 +14,15 @@ SOURCES = DISTVERSION = $(shell $(PYTHON) tools/extensions/patchlevel.py) @@ -51,10 +51,10 @@ $(PAPEROPT_$(PAPER)) \ $(SPHINXOPTS) $(SPHINXERRORHANDLING) \ . build/$(BUILDER) $(SOURCES) -Index: Python-3.13.14/Doc/c-api/arg.rst +Index: Python-3.13.15/Doc/c-api/arg.rst =================================================================== ---- Python-3.13.14.orig/Doc/c-api/arg.rst 2026-06-10 14:24:04.000000000 +0200 -+++ Python-3.13.14/Doc/c-api/arg.rst 2026-06-17 15:09:20.086830417 +0200 +--- Python-3.13.15.orig/Doc/c-api/arg.rst 2026-08-05 14:25:43.000000000 +0200 ++++ Python-3.13.15/Doc/c-api/arg.rst 2026-09-09 23:29:16.480264862 +0200 @@ -334,7 +334,6 @@ should raise an exception and leave the content of *address* unmodified. @@ -63,10 +63,10 @@ If the *converter* returns :c:macro:`!Py_CLEANUP_SUPPORTED`, it may get called a second time if the argument parsing eventually fails, giving the converter a -Index: Python-3.13.14/Doc/c-api/typeobj.rst +Index: Python-3.13.15/Doc/c-api/typeobj.rst =================================================================== ---- Python-3.13.14.orig/Doc/c-api/typeobj.rst 2026-06-10 14:24:04.000000000 +0200 -+++ Python-3.13.14/Doc/c-api/typeobj.rst 2026-06-17 15:10:19.774250769 +0200 +--- Python-3.13.15.orig/Doc/c-api/typeobj.rst 2026-08-05 14:25:43.000000000 +0200 ++++ Python-3.13.15/Doc/c-api/typeobj.rst 2026-09-09 23:29:16.480800075 +0200 @@ -610,7 +610,7 @@ Functions like :c:func:`PyObject_NewVar` will take the value of N as an argument, and store in the instance's :c:member:`~PyVarObject.ob_size` field. @@ -97,10 +97,10 @@ include :c:type:`PyObject` or :c:type:`PyVarObject` (depending on whether :c:member:`~PyVarObject.ob_size` should be included). These are usually defined by the macro :c:macro:`PyObject_HEAD` or -Index: Python-3.13.14/Doc/conf.py +Index: Python-3.13.15/Doc/conf.py =================================================================== ---- Python-3.13.14.orig/Doc/conf.py 2026-06-17 15:09:02.614245675 +0200 -+++ Python-3.13.14/Doc/conf.py 2026-06-17 15:09:20.087949096 +0200 +--- Python-3.13.15.orig/Doc/conf.py 2026-09-09 23:29:03.479603005 +0200 ++++ Python-3.13.15/Doc/conf.py 2026-09-09 23:29:16.481205115 +0200 @@ -10,6 +10,8 @@ import sys from importlib.util import find_spec @@ -172,10 +172,10 @@ # Options for c_annotations extension # ----------------------------------- -Index: Python-3.13.14/Doc/library/doctest.rst +Index: Python-3.13.15/Doc/library/doctest.rst =================================================================== ---- Python-3.13.14.orig/Doc/library/doctest.rst 2026-06-10 14:24:04.000000000 +0200 -+++ Python-3.13.14/Doc/library/doctest.rst 2026-06-17 15:09:20.088259281 +0200 +--- Python-3.13.15.orig/Doc/library/doctest.rst 2026-08-05 14:25:43.000000000 +0200 ++++ Python-3.13.15/Doc/library/doctest.rst 2026-09-09 23:29:16.481515210 +0200 @@ -310,7 +310,6 @@ .. currentmodule:: None @@ -184,10 +184,10 @@ .. currentmodule:: doctest -Index: Python-3.13.14/Doc/library/email.compat32-message.rst +Index: Python-3.13.15/Doc/library/email.compat32-message.rst =================================================================== ---- Python-3.13.14.orig/Doc/library/email.compat32-message.rst 2026-06-10 14:24:04.000000000 +0200 -+++ Python-3.13.14/Doc/library/email.compat32-message.rst 2026-06-17 15:09:20.088601737 +0200 +--- Python-3.13.15.orig/Doc/library/email.compat32-message.rst 2026-08-05 14:25:43.000000000 +0200 ++++ Python-3.13.15/Doc/library/email.compat32-message.rst 2026-09-09 23:29:16.481886109 +0200 @@ -7,7 +7,6 @@ :synopsis: The base class representing email messages in a fashion backward compatible with Python 3.2 @@ -196,10 +196,10 @@ The :class:`Message` class is very similar to the -Index: Python-3.13.14/Doc/library/xml.etree.elementtree.rst +Index: Python-3.13.15/Doc/library/xml.etree.elementtree.rst =================================================================== ---- Python-3.13.14.orig/Doc/library/xml.etree.elementtree.rst 2026-06-10 14:24:04.000000000 +0200 -+++ Python-3.13.14/Doc/library/xml.etree.elementtree.rst 2026-06-17 15:09:20.088861807 +0200 +--- Python-3.13.15.orig/Doc/library/xml.etree.elementtree.rst 2026-08-05 14:25:43.000000000 +0200 ++++ Python-3.13.15/Doc/library/xml.etree.elementtree.rst 2026-09-09 23:29:16.482343402 +0200 @@ -873,7 +873,6 @@ .. module:: xml.etree.ElementTree @@ -208,10 +208,10 @@ .. class:: Element(tag, attrib={}, **extra) -Index: Python-3.13.14/Doc/tools/check-warnings.py +Index: Python-3.13.15/Doc/tools/check-warnings.py =================================================================== ---- Python-3.13.14.orig/Doc/tools/check-warnings.py 2026-06-10 14:24:04.000000000 +0200 -+++ Python-3.13.14/Doc/tools/check-warnings.py 2026-06-17 15:09:20.089140552 +0200 +--- Python-3.13.15.orig/Doc/tools/check-warnings.py 2026-08-05 14:25:43.000000000 +0200 ++++ Python-3.13.15/Doc/tools/check-warnings.py 2026-09-09 23:29:16.482830300 +0200 @@ -228,7 +228,8 @@ print(filename) for warning in warnings: @@ -231,10 +231,10 @@ for warning in warnings if "Doc/" in warning } -Index: Python-3.13.14/Doc/tools/extensions/audit_events.py +Index: Python-3.13.15/Doc/tools/extensions/audit_events.py =================================================================== ---- Python-3.13.14.orig/Doc/tools/extensions/audit_events.py 2026-06-10 14:24:04.000000000 +0200 -+++ Python-3.13.14/Doc/tools/extensions/audit_events.py 2026-06-17 15:09:20.089399701 +0200 +--- Python-3.13.15.orig/Doc/tools/extensions/audit_events.py 2026-08-05 14:25:43.000000000 +0200 ++++ Python-3.13.15/Doc/tools/extensions/audit_events.py 2026-09-09 23:29:16.483311898 +0200 @@ -1,9 +1,6 @@ """Support for documenting audit events.""" @@ -370,10 +370,10 @@ ) -> nodes.row: row = nodes.row() name_node = nodes.paragraph("", nodes.Text(name)) -Index: Python-3.13.14/Doc/tools/extensions/availability.py +Index: Python-3.13.15/Doc/tools/extensions/availability.py =================================================================== ---- Python-3.13.14.orig/Doc/tools/extensions/availability.py 2026-06-10 14:24:04.000000000 +0200 -+++ Python-3.13.14/Doc/tools/extensions/availability.py 2026-06-17 15:09:20.089618053 +0200 +--- Python-3.13.15.orig/Doc/tools/extensions/availability.py 2026-08-05 14:25:43.000000000 +0200 ++++ Python-3.13.15/Doc/tools/extensions/availability.py 2026-09-09 23:29:16.483670163 +0200 @@ -1,8 +1,6 @@ """Support for documenting platform availability""" @@ -427,10 +427,10 @@ app.add_directive("availability", Availability) return { -Index: Python-3.13.14/Doc/tools/extensions/c_annotations.py +Index: Python-3.13.15/Doc/tools/extensions/c_annotations.py =================================================================== ---- Python-3.13.14.orig/Doc/tools/extensions/c_annotations.py 2026-06-10 14:24:04.000000000 +0200 -+++ Python-3.13.14/Doc/tools/extensions/c_annotations.py 2026-06-17 15:09:20.089797411 +0200 +--- Python-3.13.15.orig/Doc/tools/extensions/c_annotations.py 2026-08-05 14:25:43.000000000 +0200 ++++ Python-3.13.15/Doc/tools/extensions/c_annotations.py 2026-09-09 23:29:16.483912099 +0200 @@ -9,22 +9,26 @@ * Set ``stable_abi_file`` to the path to stable ABI list. """ @@ -569,19 +569,19 @@ return { "version": "1.0", "parallel_read_safe": True, -Index: Python-3.13.14/Doc/tools/extensions/changes.py +Index: Python-3.13.15/Doc/tools/extensions/changes.py =================================================================== ---- Python-3.13.14.orig/Doc/tools/extensions/changes.py 2026-06-10 14:24:04.000000000 +0200 -+++ Python-3.13.14/Doc/tools/extensions/changes.py 2026-06-17 15:09:20.089988751 +0200 +--- Python-3.13.15.orig/Doc/tools/extensions/changes.py 2026-08-05 14:25:43.000000000 +0200 ++++ Python-3.13.15/Doc/tools/extensions/changes.py 2026-09-09 23:29:41.298244669 +0200 @@ -1,7 +1,5 @@ """Support for documenting version of changes, additions, deprecations.""" -from __future__ import annotations - - from typing import TYPE_CHECKING + import re - from sphinx.domains.changeset import ( -@@ -25,7 +23,7 @@ + from docutils import nodes +@@ -28,7 +26,7 @@ class PyVersionChange(VersionChange): @@ -590,7 +590,7 @@ # Replace the 'next' special token with the current development version self.arguments[0] = expand_version_arg( self.arguments[0], self.config.release -@@ -43,7 +41,7 @@ +@@ -46,7 +44,7 @@ "Deprecated since version %s, removed in version %s" ) @@ -599,8 +599,8 @@ # Replace the first two arguments (deprecated version and removed version) # with a single tuple of both versions. version_deprecated = expand_version_arg( -@@ -73,7 +71,7 @@ - versionlabel_classes[self.name] = "" +@@ -146,7 +144,7 @@ + break -def setup(app: Sphinx) -> ExtensionMetadata: @@ -608,10 +608,10 @@ # Override Sphinx's directives with support for 'next' app.add_directive("versionadded", PyVersionChange, override=True) app.add_directive("versionchanged", PyVersionChange, override=True) -Index: Python-3.13.14/Doc/tools/extensions/glossary_search.py +Index: Python-3.13.15/Doc/tools/extensions/glossary_search.py =================================================================== ---- Python-3.13.14.orig/Doc/tools/extensions/glossary_search.py 2026-06-10 14:24:04.000000000 +0200 -+++ Python-3.13.14/Doc/tools/extensions/glossary_search.py 2026-06-17 15:09:20.090137722 +0200 +--- Python-3.13.15.orig/Doc/tools/extensions/glossary_search.py 2026-08-05 14:25:43.000000000 +0200 ++++ Python-3.13.15/Doc/tools/extensions/glossary_search.py 2026-09-09 23:29:16.484488436 +0200 @@ -1,21 +1,27 @@ """Feature search results for glossary items prominently.""" @@ -655,10 +655,10 @@ app.connect('doctree-resolved', process_glossary_nodes) app.connect('build-finished', write_glossary_json) -Index: Python-3.13.14/Doc/tools/extensions/implementation_detail.py +Index: Python-3.13.15/Doc/tools/extensions/implementation_detail.py =================================================================== ---- Python-3.13.14.orig/Doc/tools/extensions/implementation_detail.py 2026-06-10 14:24:04.000000000 +0200 -+++ Python-3.13.14/Doc/tools/extensions/implementation_detail.py 2026-06-17 15:09:20.090286132 +0200 +--- Python-3.13.15.orig/Doc/tools/extensions/implementation_detail.py 2026-08-05 14:25:43.000000000 +0200 ++++ Python-3.13.15/Doc/tools/extensions/implementation_detail.py 2026-09-09 23:29:16.484673435 +0200 @@ -1,17 +1,10 @@ """Support for marking up implementation details.""" @@ -709,10 +709,10 @@ app.add_directive("impl-detail", ImplementationDetail) return { -Index: Python-3.13.14/Doc/tools/extensions/issue_role.py +Index: Python-3.13.15/Doc/tools/extensions/issue_role.py =================================================================== ---- Python-3.13.14.orig/Doc/tools/extensions/issue_role.py 2026-06-10 14:24:04.000000000 +0200 -+++ Python-3.13.14/Doc/tools/extensions/issue_role.py 2026-06-17 15:09:20.090431937 +0200 +--- Python-3.13.15.orig/Doc/tools/extensions/issue_role.py 2026-08-05 14:25:43.000000000 +0200 ++++ Python-3.13.15/Doc/tools/extensions/issue_role.py 2026-09-09 23:29:16.484853795 +0200 @@ -1,22 +1,18 @@ """Support for referencing issues in the tracker.""" @@ -758,10 +758,10 @@ app.add_role("issue", BPOIssue()) app.add_role("gh", GitHubIssue()) -Index: Python-3.13.14/Doc/tools/extensions/misc_news.py +Index: Python-3.13.15/Doc/tools/extensions/misc_news.py =================================================================== ---- Python-3.13.14.orig/Doc/tools/extensions/misc_news.py 2026-06-10 14:24:04.000000000 +0200 -+++ Python-3.13.14/Doc/tools/extensions/misc_news.py 2026-06-17 15:09:20.090610033 +0200 +--- Python-3.13.15.orig/Doc/tools/extensions/misc_news.py 2026-08-05 14:25:43.000000000 +0200 ++++ Python-3.13.15/Doc/tools/extensions/misc_news.py 2026-09-09 23:29:16.485049484 +0200 @@ -1,7 +1,5 @@ """Support for including Misc/NEWS.""" @@ -814,10 +814,10 @@ app.add_directive("miscnews", MiscNews) return { -Index: Python-3.13.14/Doc/tools/extensions/patchlevel.py +Index: Python-3.13.15/Doc/tools/extensions/patchlevel.py =================================================================== ---- Python-3.13.14.orig/Doc/tools/extensions/patchlevel.py 2026-06-10 14:24:04.000000000 +0200 -+++ Python-3.13.14/Doc/tools/extensions/patchlevel.py 2026-06-17 15:09:20.090806974 +0200 +--- Python-3.13.15.orig/Doc/tools/extensions/patchlevel.py 2026-08-05 14:25:43.000000000 +0200 ++++ Python-3.13.15/Doc/tools/extensions/patchlevel.py 2026-09-09 23:29:16.485237418 +0200 @@ -3,7 +3,7 @@ import re import sys @@ -855,10 +855,10 @@ version = f"{info.major}.{info.minor}" release = f"{info.major}.{info.minor}.{info.micro}" if info.releaselevel != "final": -Index: Python-3.13.14/Doc/tools/extensions/pydoc_topics.py +Index: Python-3.13.15/Doc/tools/extensions/pydoc_topics.py =================================================================== ---- Python-3.13.14.orig/Doc/tools/extensions/pydoc_topics.py 2026-06-10 14:24:04.000000000 +0200 -+++ Python-3.13.14/Doc/tools/extensions/pydoc_topics.py 2026-06-17 15:09:20.090958359 +0200 +--- Python-3.13.15.orig/Doc/tools/extensions/pydoc_topics.py 2026-08-05 14:25:43.000000000 +0200 ++++ Python-3.13.15/Doc/tools/extensions/pydoc_topics.py 2026-09-09 23:29:16.485427436 +0200 @@ -1,21 +1,23 @@ """Support for building "topic help" for pydoc.""" @@ -890,7 +890,7 @@ logger = logging.getLogger(__name__) -@@ -188,7 +190,7 @@ +@@ -189,7 +191,7 @@ ) @@ -899,7 +899,7 @@ _docname, label_ids = item labels = [name for name, _id in label_ids] if len(labels) > 4: -@@ -196,7 +198,7 @@ +@@ -197,7 +199,7 @@ return ", ".join(labels) @@ -908,7 +908,7 @@ """Return a triple-single-quoted representation of text.""" if "'''" not in text: return f"r'''{text}'''" -@@ -204,7 +206,7 @@ +@@ -205,7 +207,7 @@ return f"'''{text}'''" ++++++ gh126985-mv-pyvenv.cfg2getpath.patch ++++++ --- /var/tmp/diff_new_pack.mpD5gc/_old 2026-09-18 22:04:24.859251899 +0200 +++ /var/tmp/diff_new_pack.mpD5gc/_new 2026-09-18 22:04:24.863252066 +0200 @@ -8,10 +8,10 @@ Lib/test/test_sysconfig.py | 67 --------------------------------------------- 1 file changed, 1 insertion(+), 66 deletions(-) -Index: Python-3.13.9/Lib/test/test_sysconfig.py +Index: Python-3.13.15/Lib/test/test_sysconfig.py =================================================================== ---- Python-3.13.9.orig/Lib/test/test_sysconfig.py 2025-11-04 17:41:28.521386489 +0100 -+++ Python-3.13.9/Lib/test/test_sysconfig.py 2025-11-04 17:42:36.888243505 +0100 +--- Python-3.13.15.orig/Lib/test/test_sysconfig.py 2026-09-09 23:29:12.197696110 +0200 ++++ Python-3.13.15/Lib/test/test_sysconfig.py 2026-09-09 23:29:58.459915555 +0200 @@ -110,6 +110,7 @@ **venv_create_args, ) @@ -20,7 +20,7 @@ def test_get_path_names(self): self.assertEqual(get_path_names(), sysconfig._SCHEME_KEYS) -@@ -611,72 +612,6 @@ +@@ -615,72 +616,6 @@ suffix = sysconfig.get_config_var('EXT_SUFFIX') self.assertTrue(suffix.endswith('-darwin.so'), suffix) ++++++ gh139257-Support-docutils-0.22.patch ++++++ --- /var/tmp/diff_new_pack.mpD5gc/_old 2026-09-18 22:04:24.920254455 +0200 +++ /var/tmp/diff_new_pack.mpD5gc/_new 2026-09-18 22:04:24.944255461 +0200 @@ -7,10 +7,10 @@ Doc/tools/extensions/pyspecific.py | 57 +++++++++++++++++++++++++------------ 1 file changed, 40 insertions(+), 17 deletions(-) -Index: Python-3.13.14/Doc/tools/extensions/pyspecific.py +Index: Python-3.13.15/Doc/tools/extensions/pyspecific.py =================================================================== ---- Python-3.13.14.orig/Doc/tools/extensions/pyspecific.py 2026-06-10 14:24:04.000000000 +0200 -+++ Python-3.13.14/Doc/tools/extensions/pyspecific.py 2026-06-17 15:12:29.013047826 +0200 +--- Python-3.13.15.orig/Doc/tools/extensions/pyspecific.py 2026-08-05 14:25:43.000000000 +0200 ++++ Python-3.13.15/Doc/tools/extensions/pyspecific.py 2026-09-09 23:30:07.835223707 +0200 @@ -1,20 +1,38 @@ # -*- coding: utf-8 -*- """ ++++++ pass-test_write_read_limited_history.patch ++++++ --- /var/tmp/diff_new_pack.mpD5gc/_old 2026-09-18 22:04:25.237267741 +0200 +++ /var/tmp/diff_new_pack.mpD5gc/_new 2026-09-18 22:04:25.248268202 +0200 @@ -2,10 +2,10 @@ Modules/readline.c | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) -Index: Python-3.13.14/Modules/readline.c +Index: Python-3.13.15/Modules/readline.c =================================================================== ---- Python-3.13.14.orig/Modules/readline.c 2026-06-10 14:24:04.000000000 +0200 -+++ Python-3.13.14/Modules/readline.c 2026-06-17 15:12:41.726025811 +0200 +--- Python-3.13.15.orig/Modules/readline.c 2026-08-05 14:25:43.000000000 +0200 ++++ Python-3.13.15/Modules/readline.c 2026-09-09 23:30:09.232790188 +0200 @@ -175,6 +175,8 @@ return PyUnicode_DecodeLocale(s, "surrogateescape"); } ++++++ sphinx9-runtime-node.patch ++++++ >From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Matej Cepl <[email protected]> Date: Thu, 10 Sep 2026 01:00:00 +0000 Subject: [PATCH] docs: import Node at runtime for Sphinx 9 Sphinx 9 evaluates extension annotations while loading them. Import Node at runtime instead of only under TYPE_CHECKING to avoid a NameError. --- Python-3.13.15.orig/Doc/tools/extensions/changes.py +++ Python-3.13.15/Doc/tools/extensions/changes.py @@ -5,6 +5,7 @@ import re from docutils import nodes +from docutils.nodes import Node from sphinx import addnodes from sphinx.domains.changeset import ( VersionChange, @@ -15,7 +16,6 @@ TYPE_CHECKING = False if TYPE_CHECKING: - from docutils.nodes import Node from sphinx.application import Sphinx from sphinx.util.typing import ExtensionMetadata ++++++ test_UDPLITE_support.patch ++++++ --- /var/tmp/diff_new_pack.mpD5gc/_old 2026-09-18 22:04:25.501278806 +0200 +++ /var/tmp/diff_new_pack.mpD5gc/_new 2026-09-18 22:04:25.513279309 +0200 @@ -2,11 +2,11 @@ Lib/test/test_socket.py | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-) -Index: Python-3.13.14/Lib/test/test_socket.py +Index: Python-3.13.15/Lib/test/test_socket.py =================================================================== ---- Python-3.13.14.orig/Lib/test/test_socket.py 2026-06-17 15:09:05.649370164 +0200 -+++ Python-3.13.14/Lib/test/test_socket.py 2026-06-17 15:26:46.425345602 +0200 -@@ -168,6 +168,22 @@ +--- Python-3.13.15.orig/Lib/test/test_socket.py 2026-08-05 14:25:43.000000000 +0200 ++++ Python-3.13.15/Lib/test/test_socket.py 2026-09-09 23:30:10.477769166 +0200 +@@ -175,6 +175,22 @@ return (cid is not None) @@ -29,7 +29,7 @@ def _have_socket_bluetooth(): """Check whether AF_BLUETOOTH sockets are supported on this host.""" try: -@@ -264,7 +280,7 @@ +@@ -271,7 +287,7 @@ HAVE_SOCKET_VSOCK = _have_socket_vsock()
