[icanhasmath]

ActiveState security release 3.9.25.1 of the end-of-life 3.9 line (upstream's last release was 3.9.25 on 2025-10-31).

Brings 3.9 up to date with every upstream security fix released since 3.9.25, including the eMudhra / emSign CA key compromise (python.org advisory).

What's in it

• Every security-relevant commit in upstream 3.10.20, 3.10.21 and 3.10.22 that 3.9.25 lacks (about 60, cherry-picked with -x from the 3.10 branch). Highlights:
  • tarfile filter escapes: tarfile.data_filter doesn't handle symlinks with empty names python/cpython#149486, 151558, 151987, 155999, 157190, 157265
  • Control-character rejection in http.cookies, data: URLs, wsgiref and HTTP tunnel headers
  • http.client / http.server / plistlib memory DoS
  • Quadratic-time fixes in HTMLParser, configparser, csv.Sniffer, unicodedata, minidom and ElementPath
  • SourcelessFileLoader uses io.open_code (CVE-2026-2297)
  • HTTPPasswordMgr scoping (CVE-2026-15806)
  • ssl / bz2 / lzma use-after-free and overflow fixes
  • libexpat 2.7.3 → 2.8.5
• The 3.11.18 set, taken from the 3.10.22.1-security branch (the companion PR):
  • ssl: distrust compromised eMudhra intermediate CA keys python/cpython#160040 ssl distrust of the compromised eMudhra intermediate keys (CVE-2026-115557)
  • tarfile.tar_filter doesn't handle symlinks with empty names python/cpython#160097 (CVE-2026-114583), http.cookiejar skips domain checks for cookies with a negative Version python/cpython#160300, Don't load from mimetypes.knownfiles by default on Windows python/cpython#159428, email: encoded headers lose their quoting when refolded python/cpython#87720
  • libexpat 2.9.0
• ensurepip's pip 23.0.1 → ActiveState pip 26.0.1.post1, the last pip that supports 3.9 (upstream 26.2.2 requires 3.10).
  • Its vendored certifi is 2026.10.19, which fixes GHSA-6q48-6c7w-9gw2 (emSign).
  • It also patches CVE-2026-3219, 6357, 8643 and 13346.
  • The wheel's sha256 6cd40409…226d matches the release notes.
• The last commit sets PY_VERSION to 3.9.25.1 and adds a "Notable changes in 3.9.25.1" section to Doc/whatsnew/3.9.rst.

Hand-ported for 3.9

Each port is explained under "3.9.25.x:" in the body of the commit it affects:

• Use-after-free for server-side SSLContext with sni_callback python/cpython#156293 (SNI callback use-after-free): merged into 3.9's _servername_callback(). Py_NewRef is spelled as Py_INCREF.
• Use-after-free and type confusion in newPySSLSocket() when SSL_new() fails python/cpython#144833: 3.9's _setSSLError takes no socket, so the use-after-free isn't present. The call is only reordered.
• [CVE-2026-7210] Insufficient entropy in pyexpat with protection against hash flooding python/cpython#149018 (16-byte expat hash salt): only the SetHashSalt16Bytes slot is added to the PyExpat_CAPI capsule.
• expat 2.9.0's 64-bit line/column change: applied to 3.9's single-phase set_error(). xcs.c is wired in setup.py / Modules/Setup.
• Out-of-memory when reading a HTTP response with large Content-Length python/cpython#119451 (http.client): 3.9's chunked _safe_read was not exposed, but upstream's version is taken so the tests match.
• [CVE-2026-2297] SourcelessFileLoader does not use io.open_code() python/cpython#145506: the frozen Python/importlib_external.h was regenerated in the same commit.
• Test-support adaptations (3.9 has no test.support.os_helper):
  • can_hardlink() / skip_unless_hardlink() are added to test.support.
  • One tests-only commit maps os_helper.X to support.X and adds the tarfile format class attributes.

Not included

pythongh-90949, the Python API for tuning expat's allocation and billion-laughs limits, is a feature. The protection itself (CVE-2025-59375) is built into libexpat 2.7.2+ and is on by default, and this branch bundles libexpat 2.9.0. 3.9's pyexpat predates module state, so the API wasn't ported. CI-only, release-tooling and MSI-removal commits from 3.10 are also skipped.

Windows build customizations stay as Platform inventory patches and are not part of this branch.

Testing

Linux x86_64 with OpenSSL 3.0.13, out-of-tree build, with zlib, bz2, lzma and ctypes available:

• Full python -m test -j8 -u all,-network,-gui,-cpu,-largefile,-audio,-urlfetch: 396 OK, 0 failed.
• After the version bump and pip swap: test_sys test_platform test_sysconfig test_venv test_ensurepip test_ssl test_pyexpat pass.
• A fresh venv gets pip 26.0.1.post1 with certifi 2026.10.19, and pip download from PyPI works.

Windows was not built.

After merge: tag v3.9.25.1 on the merge commit.

[ezequielp-activestate]

No blockers. Approving.

Coverage. I compared this branch against upstream:

• 3.10.20 → 3.10.22: every non-release commit is either here or already in 3.9.25, except CI, workflow, docs-build and MSI-removal commits.
• 3.11.18: all its security commits are here: pythongh-87720, 159428, 158876 (expat 2.9.0), 160300, 160097 and 160040.
• Security NEWS on 3.12 / 3.13 / 3.14 / main since October 2025: every entry is ported, in 3.9.25 already, or does not apply to 3.9:
  • pythongh-160279 (venv runs pip with the venv on the import path): does not apply. 3.9's venv still runs ensurepip with -I, and ensurepip passes -I on to its pip subprocess.
  • pythongh-160420 (zoneinfo drive letters on Windows): does not apply. 3.9 loads tzdata through importlib.resources.open_binary, whose _normalize_path rejects C:\file before it is joined to a path.
  • pythongh-151544 / CVE-2026-12003 (Setup.local landmark): does not apply. The Windows case is in getpath.py, and 3.9's PC/getpathp.c has no such landmark.
  • pythongh-148808: does not apply; sock_recvfrom_into doesn't exist in 3.9.
  • pythongh-157579 (tempfile cleanup race): that is the separate 3.9.25.2 PR.
• Upstream follow-ups: each ported issue's later commits are present too: the pythongh-143921 narrowing, the pythongh-150751 whitespace follow-up and the re-applied pythongh-119452. The 3.9-only socket.timeout fix in http/server.py is right, since socket.timeout is not TimeoutError before 3.10.

Vendored code and data.

• Modules/expat/ is identical to 3.11.18 except expat_config.h and pyexpatns.h:
  • XML_POOR_ENTROPY is defined in setup.py and the vcxproj files instead, as on 3.10.
  • The two missing XML_SetAllocTracker* renames are harmless: in the built pyexpat.so those symbols are local, and only PyInit_pyexpat is exported.
• Modules/_ssl/distrusted_spki.h and the _ssl.c distrust code are identical to 3.11.18 and to the 3.10.22.1 PR, apart from build plumbing.
• The hand-merged pythongh-156293 SNI fix is equivalent to upstream: the same strong references to the socket's context and callback, with Py_INCREF in place of Py_NewRef.
• The pip wheel is byte-identical to the ActiveState pip 26.0.1.post1 release asset (6cd40409…226d).
• The setuptools wheel's 319 .py files are byte-identical to the ActiveState setuptools v82.0.1.post1 tag, with Requires-Python: >=3.9.

Build and tests. Built base and head out of tree on Debian bookworm (OpenSSL 3.5.7). Head reports 3.9.25.1, expat 2.9.0. Full python -m test -j16 -u all,-network,-gui,-cpu,-largefile,-audio,-urlfetch:

• base: 385 OK, 15 failed
• head: 387 OK, 13 failed

Head's failures are a strict subset of base's. The 13 shared ones (test_import, test_pydoc, test_runpy and so on) come from my read-only source mount. Head additionally passes test_ssl and test_socket, which fail on base.

🟡 Mention the setuptools change in the PR description. The last commit replaces setuptools 79.0.1 with 82.0.1.post1, for CVE-2026-59890. setuptools 82 removed pkg_resources, so every venv that ensurepip seeds on 3.9.25.1 loses it. The commit message and whatsnew say so, but the PR description lists only the pip upgrade, and this is the change most likely to break existing 3.9 users. It may also be worth weighing a patched 79.0.1 for this security-only line. If 82.0.1.post1 stays, the release notes should tell users who need pkg_resources to pip install "setuptools<82".

Not assessed: a Windows build, and the network-dependent tests.

[icanhasmath]

Accepting the standard core setuptools drops pkg_resources.