From bcf7e97121512ccc1724f6ae8a3bd02f88c65546 Mon Sep 17 00:00:00 2001 From: icanhasmath Date: Fri, 30 Oct 2026 11:15:46 -0500 Subject: [PATCH] 2.7.18.17 Release Bump PY_VERSION to 2.7.18.17 and move the gh-151497 NEWS entry (#125: tarfile no longer pre-allocates a huge buffer for an oversized GNU or pax extended header) into the 2.7.18.17 release notes. Co-Authored-By: Claude Opus 5.5 --- Include/patchlevel.h | 2 +- ...15-32-36.gh-issue-151497.1cfmSV.rst => 2.7.18.17.rst} | 9 +++++++++ 2 files changed, 10 insertions(+), 1 deletion(-) rename Misc/NEWS.d/{next/Library/2026-06-15-15-32-36.gh-issue-151497.1cfmSV.rst => 2.7.18.17.rst} (60%) diff --git a/Include/patchlevel.h b/Include/patchlevel.h index 7d32ce5e2f0144..fde09df0f9a395 100644 --- a/Include/patchlevel.h +++ b/Include/patchlevel.h @@ -27,7 +27,7 @@ #define PY_RELEASE_SERIAL 0 /* Version as a string */ -#define PY_VERSION "2.7.18.16" +#define PY_VERSION "2.7.18.17" /*--end constants--*/ /* Subversion Revision number of this file (not of the repository). Empty diff --git a/Misc/NEWS.d/next/Library/2026-06-15-15-32-36.gh-issue-151497.1cfmSV.rst b/Misc/NEWS.d/2.7.18.17.rst similarity index 60% rename from Misc/NEWS.d/next/Library/2026-06-15-15-32-36.gh-issue-151497.1cfmSV.rst rename to Misc/NEWS.d/2.7.18.17.rst index a4c03c9d71d761..592daba03f9379 100644 --- a/Misc/NEWS.d/next/Library/2026-06-15-15-32-36.gh-issue-151497.1cfmSV.rst +++ b/Misc/NEWS.d/2.7.18.17.rst @@ -1,3 +1,12 @@ +.. bpo: 0 +.. date: 2026-10-30 +.. nonce: as0117 +.. release date: 2026-10-30 +.. original section: Library +.. section: Security + +gh-151497: tarfile no longer pre-allocates oversized extended headers + Opening a :mod:`tarfile` archive no longer attempts to pre-allocate a huge buffer when a crafted or truncated member claims an oversized extended header (a GNU long name/link or a pax header). The extended header is now read in