Skip to content

Bump to 4.6.0: CPython 3.12.14 / 3.13.15 / 3.14.7 (python-build 20260902, dart_bridge 1.8.0) #247

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
FeodorFitsner merged 2 commits into from
Sep 2, 2026
Merged

Bump to 4.6.0: CPython 3.12.14 / 3.13.15 / 3.14.7 (python-build 20260902, dart_bridge 1.8.0) #247

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
a02ea3b
Bump to 4.6.0: CPython 3.12.14 / 3.13.15 / 3.14.7
FeodorFitsner Sep 2, 2026
9e7f9a0
Merge main into bump-python-build-20260902; fold 4.5.2 into 4.6.0
FeodorFitsner Sep 2, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 5 additions & 1 deletion src/serious_python/CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,9 @@
## 4.5.2
## 4.6.0

* **The bundled CPython runtimes move to 3.12.14 / 3.13.15 / 3.14.7** (from 3.12.13 / 3.13.14 / 3.14.6) — the first Python version move since 4.3.x; every prior 4.4/4.5 release re-pinned python-build without changing a Python version. All three are security releases: they fix a quadratic-complexity DoS in incremental `html.parser.HTMLParser` parsing ([gh-153030](https://github.com/python/cpython/issues/153030)) and quadratic behaviour in `xml.etree.ElementTree` XPath index predicates ([gh-152674](https://github.com/python/cpython/issues/152674)), among others.
* **3.12 additionally gets the libexpat CVE fix; 3.13 and 3.14 do not yet.** 3.12.14 (released 2026-08-12) bundles **libexpat 2.8.3** for [CVE-2026-72522](https://github.com/python/cpython/issues/155558); 3.13.15 and 3.14.7 (both 2026-08-05) predate it and still bundle **2.8.2** — verified in the runtimes' own `Modules/expat/expat.h`, not inferred from release notes. Relevant only if your app parses untrusted XML through `pyexpat` / `xml.etree` / `xml.sax`; upstream will pick it up in the next 3.13/3.14 micro.
* **Pyodide (web) for 3.14: 314.0.3 → 314.0.6.** 3.13 (**0.29.4**) and 3.12 (**0.27.7**) are unchanged — each is already the newest release on its line.
* Bundled python-build snapshot re-pinned to **20260902** (`dart_bridge` **1.7.1 → 1.8.0**).
* **Packaging:** `pip install` no longer hangs when an index answers `401` — an authenticating mirror or proxy. pip prompted for credentials on a stdin nothing could answer, and wrote the prompt without a newline so callers never displayed it; the install blocked with `Looking in indexes: ...` as its last output, which `flet build` showed as a frozen `Packaging Python app...`. pip now runs with `--no-input` and bounded `--timeout`/`--retries`. See flet-dev/flet#5989, flet-dev/flet#5013 and flet-dev/flet#5507.

## 4.5.1
Expand Down
6 changes: 3 additions & 3 deletions src/serious_python/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,9 +24,9 @@ is specified.

| Short | CPython runtime | Pyodide (web) | Pyodide wheel platform tag |
| ----- | --------------- | ------------- | -------------------------------- |
| 3.12 | 3.12.13 | 0.27.7 | `pyodide-2024.0-wasm32` |
| 3.13 | 3.13.14 | 0.29.4 | `pyemscripten-2025.0-wasm32` |
| 3.14 | 3.14.6 | 314.0.0 | `pyemscripten-2026.0-wasm32` |
| 3.12 | 3.12.14 | 0.27.7 | `pyodide-2024.0-wasm32` |
| 3.13 | 3.13.15 | 0.29.4 | `pyemscripten-2025.0-wasm32` |
| 3.14 | 3.14.7 | 314.0.6 | `pyemscripten-2026.0-wasm32` |

The default is the latest stable row (currently **3.14**) when neither
`--python-version` nor `SERIOUS_PYTHON_VERSION` is set. When running through
Expand Down
20 changes: 10 additions & 10 deletions src/serious_python/lib/src/python_versions.dart
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
// GENERATED by `dart run serious_python:gen_version_tables` from python-build's
// manifest.json (release 20260730). Do not edit by hand — edit python-build's
// manifest.json (release 20260902). Do not edit by hand — edit python-build's
// manifest.json, cut a release, bump `pythonReleaseDate`, and regenerate.

const pythonVersionEnvironmentVariable = "SERIOUS_PYTHON_VERSION";
Expand All @@ -10,8 +10,8 @@ const pyodideVersionEnvironmentVariable = "SERIOUS_PYTHON_PYODIDE_VERSION";
const dartBridgeVersionEnvironmentVariable = "DART_BRIDGE_VERSION";

/// python-build release the bundled runtimes come from (YYYYMMDD).
const pythonReleaseDate = "20260730";
const dartBridgeVersion = "1.7.1";
const pythonReleaseDate = "20260902";
const dartBridgeVersion = "1.8.0";
const defaultPythonVersion = "3.14";

class PythonRelease {
Expand All @@ -38,25 +38,25 @@ class PythonRelease {

const pythonReleases = <String, PythonRelease>{
"3.12": PythonRelease(
standaloneVersion: "3.12.13",
standaloneReleaseDate: "20260623",
standaloneVersion: "3.12.14",
standaloneReleaseDate: "20260901",
pyodideVersion: "0.27.7",
pyodidePlatformTag: "pyodide-2024.0-wasm32",
androidAbis: ["arm64-v8a", "x86_64", "armeabi-v7a"],
prerelease: false,
),
"3.13": PythonRelease(
standaloneVersion: "3.13.14",
standaloneReleaseDate: "20260623",
standaloneVersion: "3.13.15",
standaloneReleaseDate: "20260901",
pyodideVersion: "0.29.4",
pyodidePlatformTag: "pyemscripten-2025.0-wasm32",
androidAbis: ["arm64-v8a", "x86_64", "armeabi-v7a"],
prerelease: false,
),
"3.14": PythonRelease(
standaloneVersion: "3.14.6",
standaloneReleaseDate: "20260623",
pyodideVersion: "314.0.3",
standaloneVersion: "3.14.7",
standaloneReleaseDate: "20260901",
pyodideVersion: "314.0.6",
pyodidePlatformTag: "pyemscripten-2026.0-wasm32",
androidAbis: ["arm64-v8a", "x86_64", "armeabi-v7a"],
prerelease: false,
Expand Down
2 changes: 1 addition & 1 deletion src/serious_python/pubspec.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@ name: serious_python
description: A cross-platform plugin for adding embedded Python runtime to your Flutter apps.
homepage: https://flet.dev
repository: https://github.com/flet-dev/serious-python
version: 4.5.1
version: 4.6.0

platforms:
ios:
Expand Down
5 changes: 5 additions & 0 deletions src/serious_python_android/CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,8 @@
## 4.6.0

* **The bundled Android runtimes move to CPython 3.12.14 / 3.13.15 / 3.14.7** (from 3.12.13 / 3.13.14 / 3.14.6). All three are security releases: they fix a quadratic-complexity DoS in incremental `html.parser.HTMLParser` parsing ([gh-153030](https://github.com/python/cpython/issues/153030)) and quadratic behaviour in `xml.etree.ElementTree` XPath index predicates ([gh-152674](https://github.com/python/cpython/issues/152674)), among others. 3.13.15 and 3.14.7 still bundle libexpat **2.8.2**; only 3.12.14 carries **2.8.3** with the [CVE-2026-72522](https://github.com/python/cpython/issues/155558) fix — see the `serious_python` 4.6.0 notes.
* Re-pins the bundled python-build snapshot to **20260902** and `dart_bridge` to **1.8.0**.

## 4.5.1

* Re-pins the bundled python-build snapshot to **20260730** and `dart_bridge` to **1.7.1**. Both exist to sign the Apple XCFrameworks on both layers (see `serious_python_darwin` 4.5.1); no Python version moved from 20260729 (**3.12.13 / 3.13.14 / 3.14.6**), and nothing about Android changed.
Expand Down
2 changes: 1 addition & 1 deletion src/serious_python_android/android/build.gradle.kts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@ buildscript {
}

group = "com.flet.serious_python_android"
version = "4.5.1"
version = "4.6.0"

rootProject.allprojects {
repositories {
Expand Down
12 changes: 6 additions & 6 deletions src/serious_python_android/android/python_versions.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,11 +1,11 @@
# GENERATED by `dart run serious_python:gen_version_tables` from
# python-build manifest.json (release 20260730). Do not edit by hand.
# python-build manifest.json (release 20260902). Do not edit by hand.
default_python_version=3.14
dart_bridge_version=1.7.1
python_build_release_date=20260730
3.12.full_version=3.12.13
dart_bridge_version=1.8.0
python_build_release_date=20260902
3.12.full_version=3.12.14
3.12.android_abis=arm64-v8a,x86_64,armeabi-v7a
3.13.full_version=3.13.14
3.13.full_version=3.13.15
3.13.android_abis=arm64-v8a,x86_64,armeabi-v7a
3.14.full_version=3.14.6
3.14.full_version=3.14.7
3.14.android_abis=arm64-v8a,x86_64,armeabi-v7a
2 changes: 1 addition & 1 deletion src/serious_python_android/pubspec.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@ name: serious_python_android
description: Android implementation of the serious_python plugin
homepage: https://flet.dev
repository: https://github.com/flet-dev/serious-python
version: 4.5.1
version: 4.6.0

environment:
sdk: ">=3.0.0 <4.0.0"
Expand Down
7 changes: 7 additions & 0 deletions src/serious_python_darwin/CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,10 @@
## 4.6.0

* **iOS/macOS runtimes move to CPython 3.12.14 / 3.13.15 / 3.14.7** (from 3.12.13 / 3.13.14 / 3.14.6). All three are security releases: they fix a quadratic-complexity DoS in incremental `html.parser.HTMLParser` parsing ([gh-153030](https://github.com/python/cpython/issues/153030)) and quadratic behaviour in `xml.etree.ElementTree` XPath index predicates ([gh-152674](https://github.com/python/cpython/issues/152674)), among others. 3.13.15 and 3.14.7 still bundle libexpat **2.8.2**; only 3.12.14 carries **2.8.3** with the [CVE-2026-72522](https://github.com/python/cpython/issues/155558) fix — see the `serious_python` 4.6.0 notes.
* **Both-layer signing survives the runtime bump** — this is a rebuild of every XCFramework, so it was verified rather than assumed. On the published `python-ios-dart-3.14.7`: **56 XCFrameworks and 112 slice frameworks**, all signed and securely timestamped by `Apple Distribution: Appveyor Systems Inc. (GXXRQJK434)`, zero unsigned bundles and zero missing timestamps — the same counts as 3.14.6 in 4.5.1. The `isSecureTimestamp = false` reading discussed in 4.5.1 is unchanged and still believed unreachable by signing.
* **3.13's iOS runtime is built from a refreshed back-port patch.** 3.13.15 back-ported the macOS 27 `dup3`/`pipe2` change from 3.14 ([gh-153711](https://github.com/python/cpython/issues/153711)), which split the `configure` check that python-build's vendored Apple-tooling patch widens; the patch was updated so both halves of the split keep the non-iOS Apple platforms gated off. See [flet-dev/python-build#40](https://github.com/flet-dev/python-build/pull/40).
* Bundled python-build snapshot re-pinned to **20260902** (`dart_bridge` **1.7.1 → 1.8.0**). Pyodide 3.14 **314.0.3 → 314.0.6**.

## 4.5.1

* **iOS/macOS: the bundled XCFrameworks are now signed on both layers — each slice's inner `.framework` as well as the outer `.xcframework`.** 4.5.0 shipped artifacts whose outer bundle was signed but whose inner frameworks were not. An App Store IPA built against it reported `signed = true` — the 4.5.0 fix working — but `isSecureTimestamp = false` for `Python-ios`, `_ssl`, `_hashlib` and `dart_bridge`, in both a development archive and an App Store export. Every slice of an XCFramework Apple's scan demonstrably accepts ([krzyzanowskim/OpenSSL](https://github.com/krzyzanowskim/OpenSSL) 3.6.3000) carries its own Apple Distribution signature with a secure timestamp, with the outer bundle signed last; an unsigned inner framework was the only structural difference left. See flet-dev/python-build#38 and flet-dev/dart-bridge#14.
Expand Down
12 changes: 6 additions & 6 deletions src/serious_python_darwin/darwin/python_versions.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,11 +1,11 @@
# GENERATED by `dart run serious_python:gen_version_tables` from
# python-build manifest.json (release 20260730). Do not edit by hand.
# python-build manifest.json (release 20260902). Do not edit by hand.
default_python_version=3.14
dart_bridge_version=1.7.1
python_build_release_date=20260730
3.12.full_version=3.12.13
dart_bridge_version=1.8.0
python_build_release_date=20260902
3.12.full_version=3.12.14
3.12.android_abis=arm64-v8a,x86_64,armeabi-v7a
3.13.full_version=3.13.14
3.13.full_version=3.13.15
3.13.android_abis=arm64-v8a,x86_64,armeabi-v7a
3.14.full_version=3.14.6
3.14.full_version=3.14.7
3.14.android_abis=arm64-v8a,x86_64,armeabi-v7a
2 changes: 1 addition & 1 deletion src/serious_python_darwin/darwin/serious_python_darwin.podspec
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@
#
Pod::Spec.new do |s|
s.name = 'serious_python_darwin'
s.version = '4.5.1'
s.version = '4.6.0'
s.summary = 'A cross-platform plugin for adding embedded Python runtime to your Flutter apps.'
s.description = <<-DESC
A cross-platform plugin for adding embedded Python runtime to your Flutter apps.
Expand Down
2 changes: 1 addition & 1 deletion src/serious_python_darwin/pubspec.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@ name: serious_python_darwin
description: iOS and macOS implementations of the serious_python plugin
homepage: https://flet.dev
repository: https://github.com/flet-dev/serious-python
version: 4.5.1
version: 4.6.0

environment:
# The Swift Package Manager build path needs Flutter 3.44 / Dart 3.11 (the
Expand Down
5 changes: 5 additions & 0 deletions src/serious_python_linux/CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,8 @@
## 4.6.0

* **The bundled Linux runtimes move to CPython 3.12.14 / 3.13.15 / 3.14.7** (from 3.12.13 / 3.13.14 / 3.14.6). All three are security releases: they fix a quadratic-complexity DoS in incremental `html.parser.HTMLParser` parsing ([gh-153030](https://github.com/python/cpython/issues/153030)) and quadratic behaviour in `xml.etree.ElementTree` XPath index predicates ([gh-152674](https://github.com/python/cpython/issues/152674)), among others. 3.13.15 and 3.14.7 still bundle libexpat **2.8.2**; only 3.12.14 carries **2.8.3** with the [CVE-2026-72522](https://github.com/python/cpython/issues/155558) fix — see the `serious_python` 4.6.0 notes.
* Re-pins the bundled python-build snapshot to **20260902** and `dart_bridge` to **1.8.0**.

## 4.5.1

* Re-pins the bundled python-build snapshot to **20260730** and `dart_bridge` to **1.7.1**. Both exist to sign the Apple XCFrameworks on both layers (see `serious_python_darwin` 4.5.1); no Python version moved from 20260729 (**3.12.13 / 3.13.14 / 3.14.6**), and nothing about Linux changed.
Expand Down
12 changes: 6 additions & 6 deletions src/serious_python_linux/linux/python_versions.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,11 +1,11 @@
# GENERATED by `dart run serious_python:gen_version_tables` from
# python-build manifest.json (release 20260730). Do not edit by hand.
# python-build manifest.json (release 20260902). Do not edit by hand.
default_python_version=3.14
dart_bridge_version=1.7.1
python_build_release_date=20260730
3.12.full_version=3.12.13
dart_bridge_version=1.8.0
python_build_release_date=20260902
3.12.full_version=3.12.14
3.12.android_abis=arm64-v8a,x86_64,armeabi-v7a
3.13.full_version=3.13.14
3.13.full_version=3.13.15
3.13.android_abis=arm64-v8a,x86_64,armeabi-v7a
3.14.full_version=3.14.6
3.14.full_version=3.14.7
3.14.android_abis=arm64-v8a,x86_64,armeabi-v7a
2 changes: 1 addition & 1 deletion src/serious_python_linux/pubspec.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@ name: serious_python_linux
description: Linux implementations of the serious_python plugin
homepage: https://flet.dev
repository: https://github.com/flet-dev/serious-python
version: 4.5.1
version: 4.6.0

environment:
sdk: '>=3.1.3 <4.0.0'
Expand Down
4 changes: 4 additions & 0 deletions src/serious_python_platform_interface/CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,7 @@
## 4.6.0

* Version bump aligning with the `serious_python_*` 4.6.0 release.

## 4.5.1

* Version bump aligning with the `serious_python_*` 4.5.1 release.
Expand Down
2 changes: 1 addition & 1 deletion src/serious_python_platform_interface/pubspec.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@ name: serious_python_platform_interface
description: A common platform interface for the serious_python plugin.
homepage: https://flet.dev
repository: https://github.com/flet-dev/serious-python
version: 4.5.1
version: 4.6.0

environment:
sdk: ">=3.0.0 <4.0.0"
Expand Down
5 changes: 5 additions & 0 deletions src/serious_python_windows/CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,8 @@
## 4.6.0

* **The bundled Windows runtimes move to CPython 3.12.14 / 3.13.15 / 3.14.7** (from 3.12.13 / 3.13.14 / 3.14.6). All three are security releases: they fix a quadratic-complexity DoS in incremental `html.parser.HTMLParser` parsing ([gh-153030](https://github.com/python/cpython/issues/153030)) and quadratic behaviour in `xml.etree.ElementTree` XPath index predicates ([gh-152674](https://github.com/python/cpython/issues/152674)), among others. 3.13.15 and 3.14.7 still bundle libexpat **2.8.2**; only 3.12.14 carries **2.8.3** with the [CVE-2026-72522](https://github.com/python/cpython/issues/155558) fix — see the `serious_python` 4.6.0 notes.
* Re-pins the bundled python-build snapshot to **20260902** and `dart_bridge` to **1.8.0**.

## 4.5.1

* Re-pins the bundled python-build snapshot to **20260730** and `dart_bridge` to **1.7.1**. Both exist to sign the Apple XCFrameworks on both layers (see `serious_python_darwin` 4.5.1); no Python version moved from 20260729 (**3.12.13 / 3.13.14 / 3.14.6**), and nothing about Windows changed.
Expand Down
2 changes: 1 addition & 1 deletion src/serious_python_windows/pubspec.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@ name: serious_python_windows
description: Windows implementations of the serious_python plugin
homepage: https://flet.dev
repository: https://github.com/flet-dev/serious-python
version: 4.5.1
version: 4.6.0

environment:
sdk: '>=3.1.3 <4.0.0'
Expand Down
12 changes: 6 additions & 6 deletions src/serious_python_windows/windows/python_versions.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,11 +1,11 @@
# GENERATED by `dart run serious_python:gen_version_tables` from
# python-build manifest.json (release 20260730). Do not edit by hand.
# python-build manifest.json (release 20260902). Do not edit by hand.
default_python_version=3.14
dart_bridge_version=1.7.1
python_build_release_date=20260730
3.12.full_version=3.12.13
dart_bridge_version=1.8.0
python_build_release_date=20260902
3.12.full_version=3.12.14
3.12.android_abis=arm64-v8a,x86_64,armeabi-v7a
3.13.full_version=3.13.14
3.13.full_version=3.13.15
3.13.android_abis=arm64-v8a,x86_64,armeabi-v7a
3.14.full_version=3.14.6
3.14.full_version=3.14.7
3.14.android_abis=arm64-v8a,x86_64,armeabi-v7a
Loading