Bump to 4.6.0: CPython 3.12.14 / 3.13.15 / 3.14.7 (python-build 20260902, dart_bridge 1.8.0) - #247
Merged
Merged
Conversation
The first Python version move since 4.3.x -- every 4.4/4.5 release re-pinned python-build for Apple signing work without a Python version changing. Re-pins the bundled snapshot to python-build 20260902 (dart_bridge 1.7.1 -> 1.8.0) and regenerates the committed version tables from its manifest.json. All three micros are security releases, sharing a quadratic-complexity DoS fix in incremental html.parser.HTMLParser parsing (gh-153030) and one for xml.etree.ElementTree XPath index predicates (gh-152674). They do not share the libexpat fix. 3.12.14 shipped a week after the other two and bundles libexpat 2.8.3 for CVE-2026-72522; 3.13.15 and 3.14.7 still bundle 2.8.2. Checked in each runtime's own Modules/expat/expat.h rather than taken from the release notes. It only matters for apps parsing untrusted XML, and upstream picks it up in the next 3.13/3.14 micro, but the changelogs say so rather than implying all three are equally current. Pyodide 3.14 moves 314.0.3 -> 314.0.6. 3.13 (0.29.4) and 3.12 (0.27.7) stay put -- each is already newest on its line, so only the 3.14 row moved. Verified on the published 20260902 artifacts rather than assumed: * python-ios-dart-3.14.7 -- PY_VERSION 3.14.7, and 56 XCFrameworks plus 112 slice frameworks all signed and securely timestamped by Apple Distribution: Appveyor Systems Inc. (GXXRQJK434). Zero unsigned bundles, zero missing timestamps -- the same counts 4.5.1 recorded for 3.14.6, so the both-layer signing from 4.5.x survived a full rebuild of every framework. * python-ios-dart-3.13.15 -- PY_VERSION 3.13.15, 168 bundles signed, and HAVE_DUP3/HAVE_PIPE2 correctly undefined in pyconfig.h. That last one is the load-bearing check: 3.13.15 back-ported the macOS 27 dup3/pipe2 change (gh-153711), which split the configure gate that python-build's vendored Apple-tooling patch widens, and the patch had to be refreshed for it (flet-dev/python-build#40). An undefined pair confirms the refreshed gate landed. * The release carries all 30 runtime tarballs -- every platform x every version -- plus manifest.json. README's Python-versions table is updated, including its 3.14 Pyodide cell, which had drifted to 314.0.0 (the generator does not touch README). bridge_example's "Test environment" table still reads CPython 3.14.6: it records the conditions its benchmark numbers were measured under, so it is left alone.
main landed the pip --no-input / bounded-timeout fix (#246) under a new `## 4.5.2` heading in serious_python's changelog, which collided with the `## 4.6.0` heading this branch adds at the same spot. 4.5.2 was never published -- #246 added the heading but left every pubspec, the podspec and build.gradle.kts at 4.5.1 -- so there is no released 4.5.2 for users to have seen. Its bullet moves into 4.6.0 and the heading goes away, rather than shipping an empty version number between 4.5.1 and 4.6.0. The pip bullet goes last in the section, after the runtime bullets it is unrelated to. package_command.dart merged clean and is byte-identical to main.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Re-pins the bundled snapshot to python-build 20260902 and regenerates the committed version tables from its
manifest.json.dart_bridgeThis is the first Python version move since 4.3.x — every 4.4/4.5 release re-pinned python-build for Apple signing work without a Python version changing. Hence 4.6.0 rather than 4.5.2.
Pyodide 3.13 (
0.29.4) and 3.12 (0.27.7) stay put; each is already the newest release on its line, so only the 3.14 row moved.Security content
All three micros are security releases sharing a quadratic-complexity DoS fix in incremental
html.parser.HTMLParserparsing (gh-153030) and one forxml.etree.ElementTreeXPath index predicates (gh-152674).They do not share the libexpat fix. 3.12.14 shipped a week after the other two (2026-08-12 vs 2026-08-05) and bundles libexpat 2.8.3 for CVE-2026-72522; 3.13.15 and 3.14.7 still bundle 2.8.2. Checked in each runtime's own
Modules/expat/expat.hrather than taken from release notes. It only matters for apps parsing untrusted XML throughpyexpat/xml.etree/xml.sax, and upstream picks it up in the next 3.13/3.14 micro — but the changelogs say so rather than implying all three are equally current.Verification
Run against the published 20260902 artifacts, not assumed:
python-ios-dart-3.14.7—PY_VERSION 3.14.7; 56 XCFrameworks + 112 slice frameworks, all signed and securely timestamped byApple Distribution: Appveyor Systems Inc. (GXXRQJK434). Zero unsigned bundles, zero missing timestamps — the same counts 4.5.1 recorded for 3.14.6, so the both-layer signing from 4.5.x survived a full rebuild of every framework.python-ios-dart-3.13.15—PY_VERSION 3.13.15; 168 bundles signed;HAVE_DUP3/HAVE_PIPE2correctly undefined inpyconfig.h. That last one is the load-bearing check: 3.13.15 back-ported the macOS 27dup3/pipe2change (gh-153711), which split theconfiguregate that python-build's vendored Apple-tooling patch widens, and the patch had to be refreshed for it (flet-dev/python-build#40). An undefined pair confirms the refreshed gate landed in the shipped runtime.manifest.json.dart run serious_python:gen_version_tablesagainst the commit is a no-op.dart analyzeclean (the 5invalid_dependencywarnings are the pre-existing monorepopath:deps).Docs
README's Python-versions table is updated, including its 3.14 Pyodide cell, which had drifted to
314.0.0— the generator doesn't touch README, so that cell had been stale across several releases.bridge_example/README.md's "Test environment" table still reads CPython 3.14.6: it records the conditions its benchmark numbers were measured under, so it's deliberately left alone.