Python 3.8: download ældre versioner

Security
- bpo-43434: Creating a sqlite3.Connection object now also produces a sqlite3.connect auditing event. Previously this event was only produced by sqlite3.connect() calls. Patch by Erlend E. Aasland.
- bpo-43472: Ensures interpreter-level audit hooks receive the cpython.PyInterpreterState_New event when called through the _xxsubinterpreters module.
- bpo-43075: Fix Regular Expression Denial of Service (ReDoS) vulnerability in urllib.request.AbstractBasicAuthHandler. The ReDoS-vulnerable regex has quadratic worst-case complexity and it allows cause a denial of service when identifying crafted invalid RFCs. This ReDoS issue is on the client side and needs remote attackers to control the HTTP server.
Core and Builtins
- bpo-43105: Importlib now resolves relative paths when creating module spec objects from file locations.
- bpo-42924: Fix bytearray repetition incorrectly copying data from the start of the buffer, even if the data is offset within the buffer (e.g. after reassigning a slice at the start of the bytearray to a shorter byte string).
Library
- bpo-43993: Update bundled pip to 21.1.1.
- bpo-43937: Fixed the turtle module working with non-default root window.
- bpo-43930: Update bundled pip to 21.1 and setuptools to 56.0.0
- bpo-43920: OpenSSL 3.0.0: load_verify_locations() now returns a consistent error message when cadata contains no valid certificate.
- bpo-43607: urllib can now convert Windows paths with \\?\ prefixes into URL paths.
- bpo-43284: platform.win32_ver derives the windows version from sys.getwindowsversion().platform_version which in turn derives the version from kernel32.dll (which can be of a different version than Windows itself). Therefore change the platform.win32_ver to determine the version using the platform module’s _syscmd_ver private function to return an accurate version.
- bpo-42248: [Enum] ensure exceptions raised in _missing__ are released
- bpo-43799: OpenSSL 3.0.0: define OPENSSL_API_COMPAT 1.1.1 to suppress deprecation warnings. Python requires OpenSSL 1.1.1 APIs.
- bpo-43794: Add ssl.OP_IGNORE_UNEXPECTED_EOF constants (OpenSSL 3.0.0)
- bpo-43789: OpenSSL 3.0.0: Don’t call the password callback function a second time when first call has signaled an error condition.
- bpo-43788: The header files for ssl error codes are now OpenSSL version-specific. Exceptions will now show correct reason and library codes. The make_ssl_data.py script has been rewritten to use OpenSSL’s text file with error codes.
- bpo-43655: tkinter dialog windows are now recognized as dialogs by window managers on macOS and X Window.
- bpo-43534: turtle.textinput() and turtle.numinput() create now a transient window working on behalf of the canvas window.
- bpo-43522: Fix problem with hostname_checks_common_name. OpenSSL does not copy hostflags from struct SSL_CTX to struct SSL.
- bpo-42967: Allow bytes separator argument in urllib.parse.parse_qs and urllib.parse.parse_qsl when parsing str query strings. Previously, this raised a TypeError.
- bpo-43176: Fixed processing of a dataclass that inherits from a frozen dataclass with no fields. It is now correctly detected as an error.
- bpo-34463: Fixed discrepancy between traceback and the interpreter in formatting of SyntaxError with lineno not set (traceback was changed to match interpreter).
- bpo-41735: Fix thread locks in zlib module may go wrong in rare case. Patch by Ma Lin.
- bpo-26053: Fixed bug where the pdb interactive run command echoed the args from the shell command line, even if those have been overridden at the pdb prompt.
- bpo-36470: Fix dataclasses with InitVars and replace(). Patch by Claudiu Popa.
- bpo-28577: The hosts method on 32-bit prefix length IPv4Networks and 128-bit prefix IPv6Networks now returns a list containing the single Address instead of an empty list.
- bpo-32745: Fix a regression in the handling of ctypes’ ctypes.c_wchar_p type: embedded null characters would cause a ValueError to be raised. Patch by Zackery Spytz.
Documentation

Security
- bpo-42988: CVE-2021-3426: Remove the getfile feature of the pydoc module which could be abused to read arbitrary files on the disk (directory traversal vulnerability). Moreover, even source code of Python modules can contain sensitive data like passwords. Vulnerability reported by David Schwörer.
- bpo-43285: ftplib no longer trusts the IP address value returned from the server in response to the PASV command by default. This prevents a malicious FTP server from using the response to probe IPv4 address and port combinations on the client network.
Code that requires the former vulnerable behavior may set a trust_server_pasv_ipv4_address attribute on their ftplib.FTP instances to True to re-enable it.
- bpo-43439: Add audit hooks for gc.get_objects(), gc.get_referrers() and gc.get_referents(). Patch by Pablo Galindo.
Core and Builtins
- bpo-43660: Fix crash that happens when replacing sys.stderr with a callable that can remove the object while an exception is being printed. Patch by Pablo Galindo.
- bpo-35883: Python no longer fails at startup with a fatal error if a command line argument contains an invalid Unicode character. The Py_DecodeLocale() function now escapes byte sequences which would be decoded as Unicode characters outside the [U+0000; U+10ffff] range.
- bpo-43406: Fix a possible race condition where PyErr_CheckSignals tries to execute a non-Python signal handler.
Library
- bpo-35930: Raising an exception raised in a “future” instance will create reference cycles.
- bpo-43577: Fix deadlock when using ssl.SSLContext debug callback with ssl.SSLContext.sni_callback().
- bpo-43423: subprocess.communicate() no longer raises an IndexError when there is an empty stdout or stderr IO buffer during a timeout on Windows.
- bpo-27820: Fixed long-standing bug of smtplib.SMTP where doing AUTH LOGIN with initial_response_ok=False will fail.
The cause is that SMTP.auth_login _always_ returns a password if provided with a challenge string, thus non-compliant with the standard for AUTH LOGIN.
Also fixes bug with the test for smtpd.
- bpo-43399: Fix ElementTree.extend not working on iterators when using the Python implementation
- bpo-43316: The python -m gzip command line application now properly fails when detecting an unsupported extension. It exits with a non-zero exit code and prints an error message to stderr.
- bpo-43260: Fix TextIOWrapper can not flush internal buffer forever after very large text is written.
- bpo-42782: Fail fast in shutil.move() to avoid creating destination directories on failure.
- bpo-37193: Fixed memory leak in socketserver.ThreadingMixIn introduced in Python 3.7.
Documentation
- bpo-43199: Answer “Why is there no goto?” in the Design and History FAQ.
- bpo-43407: Clarified that a result from time.monotonic(), time.perf_counter(), time.process_time(), or time.thread_time() can be compared with the result from any following call to the same function - not just the next immediate call.
- bpo-27646: Clarify that ‘yield from <expr>’ works with any iterable, not just iterators.
- bpo-36346: Update some deprecated unicode APIs which are documented as “will be removed in 4.0” to “3.12”. See

PEP 623 for detail.
Tests
- bpo-37945: Fix test_getsetlocale_issue1813() of test_locale: skip the test if setlocale() fails. Patch by Victor Stinner.
- bpo-41561: Add workaround for Ubuntu’s custom OpenSSL security level policy.
Build
- bpo-43631: Update macOS, Windows, and CI to OpenSSL 1.1.1k.
- bpo-43617: Improve configure.ac: Check for presence of autoconf-archive package and remove our copies of M4 macros.
macOS
- bpo-41837: Update macOS installer build to use OpenSSL 1.1.1j.
IDLE
- bpo-42225: Document that IDLE can fail on Unix either from misconfigured IP masquerage rules or failure displaying complex colored (non-ascii) characters.
- bpo-43283: Document why printing to IDLE’s Shell is often slower than printing to a system terminal and that it can be made faster by pre-formatting a single string before p

There were no new changes in version 3.8.8.

Core and Builtins
- bpo-32381: Fix encoding name when running a .pyc file on Windows: PyRun_SimpleFileExFlags() now uses the correct encoding to decode the filename.
- bpo-42536: Several built-in and standard library types now ensure that their internal result tuples are always tracked by the garbage collector:
- collections.OrderedDict.items()
- dict.items()
- enumerate()
- functools.reduce()
- itertools.combinations()
- itertools.combinations_with_replacement()
- itertools.permutations()
- itertools.product()
- itertools.zip_longest()
- zip()
Previously, they could have become untracked by a prior garbage collection. Patch by Brandt Bucher.
Library
- bpo-42630: tkinter functions and constructors which need a default root window raise now RuntimeError with descriptive message instead of obscure AttributeError or NameError if it is not created yet or cannot be created automatically.
- bpo-42644: logging.disable will now validate the types and value of its parameter. It also now accepts strings representing the levels (as does loging.setLevel) instead of only the numerical values.
- bpo-36541: Fixed lib2to3.pgen2 to be able to parse PEP-570 positional only argument syntax.
- bpo-42375: subprocess module update for DragonFlyBSD support.
- bpo-39825: Windows: Change sysconfig.get_config_var('EXT_SUFFIX') to the expected full platform_tag.extension format. Previously it was hard-coded to .pyd, now it is compatible with distutils.sysconfig and will result in something like .cp38-win_amd64.pyd. This brings windows into conformance with the other platforms.
- bpo-39101: Fixed tests using IsolatedAsyncioTestCase from hanging on BaseExceptions.
- bpo-41907: fix format() behavior for IntFlag
- bpo-41889: Enum: fix regression involving inheriting a multiply-inherited enum
- bpo-41891: Ensure asyncio.wait_for waits for task completion
- bpo-40219: Lowered tkinter.ttk.LabeledScale dummy widget to prevent hiding part of the content label.
- bpo-40084: Fix Enum.__dir__: dir(Enum.member) now includes attributes as well as methods.
Documentation
- bpo-17140: Add documentation for the multiprocessing.pool.ThreadPool class.
Build
- bpo-42604: Now all platforms use a value for the “EXT_SUFFIX” build variable derived from SOABI (for instance in freeBSD, “EXT_SUFFIX” is now “.cpython-310d.so” instead of “.so”). Previosuly only Linux, Mac and VxWorks were using a value for “EXT_SUFFIX” that included “SOABI”.
- bpo-42598: Fix implicit function declarations in configure which could have resulted in incorrect configuration checks. Patch contributed by Joshua Root.
Tools/Demos
- bpo-42613: Fix freeze.py tool to use the prope config and library directories. Patch by Victor Stinner.

Core and Builtins
- bpo-41525: The output of python --help contains now only ASCII characters.
Library
- bpo-41817: fix tkinter.EventType Enum so all members are strings, and none are tuples
- bpo-41815: Fix SQLite3 segfault when backing up closed database. Patch contributed by Peter David McCormick.
- bpo-41517: fix bug allowing Enums to be extended via multiple inheritance
- bpo-39587: use the correct mix-in data type when constructing Enums
- bpo-41789: Honor object overrides in Enum class creation (specifically, __str__, __repr__, __format__, and __reduce_ex__).
- bpo-39651: Fix a race condition in the call_soon_threadsafe() method of asyncio.ProactorEventLoop: do nothing if the self-pipe socket has been closed.
- bpo-41720: Fixed turtle.Vec2D.__rmul__() for arguments which are not int or float.
- bpo-39728: fix default _missing_ so a duplicate ValueError is not set as the __context__ of the original ValueError
- bpo-37479: When Enum.__str__ is overridden in a derived class, the override will be used by Enum.__format__ regardless of whether mixin classes are present.
Documentation
- bpo-35293: Fix RemovedInSphinx40Warning when building the documentation. Patch by Dong-hee Na.
- bpo-37149: Change Shipman tkinter doc link from archive.org to TkDocs. (The doc has been removed from the NMT server.) The new link responds much faster and includes a short explanatory note.
Tests
- bpo-41731: Make test_cmd_line_script pass with option ‘-vv’.
Windows
- bpo-41744: Fixes automatic import of props file when using the Nuget package.
IDLE
- bpo-35764: Rewrite the Calltips doc section.
- bpo-40181: In calltips, stop reminding that ‘/’ marks the end of positional-only arguments.

Security
- bpo-41304: Fixes python3x._pth being ignored on Windows, caused by the fix for bpo-29778 (CVE-2020-15801).
- bpo-39603: Prevent http header injection by rejecting control characters in http.client.putrequest(…).
Core and Builtins
- bpo-41295: Resolve a regression in CPython 3.8.4 where defining “__setattr__” in a multi-inheritance setup and calling up the hierarchy chain could fail if builtins/extension types were involved in the base types.
Library
- bpo-41288: Unpickling invalid NEWOBJ_EX opcode with the C implementation raises now UnpicklingError instead of crashing.
- bpo-39017: Avoid infinite loop when reading specially crafted TAR files using the tarfile module (CVE-2019-20907).
Documentation
- bpo-37703: Updated Documentation to comprehensively elaborate on the behaviour of gather.cancel()
Build
- bpo-41302: Enable building Python 3.8 with libmpdec-2.5.0 to ease maintenance for Linux distributions. Patch by Felix Yan.
macOS
- bpo-40741: Update macOS installer to use SQLite 3.32.3.
IDLE
- bpo-41300: Save files with non-ascii chars. Fix regression released in 3.9.0b4 and 3.8.4.

Security
- bpo-41162: Audit hooks are now cleared later during finalization to avoid missing events.
- bpo-29778: Ensure python3.dll is loaded from correct locations when Python is embedded (CVE-2020-15523).
Core and Builtins
- bpo-41247: Always cache the running loop holder when running asyncio.set_running_loop.
- bpo-41252: Fix incorrect refcounting in _ssl.c’s _servername_callback().
- bpo-41218: Python 3.8.3 had a regression where compiling with ast.PyCF_ALLOW_TOP_LEVEL_AWAIT would aggressively mark list comprehension with CO_COROUTINE. Now only list comprehension making use of async/await will tagged as so.
- bpo-41175: Guard against a NULL pointer dereference within bytearrayobject triggered by the bytearray() + bytearray() operation.
- bpo-39960: The “hackcheck” that prevents sneaking around a type’s __setattr__() by calling the superclass method was rewritten to allow C implemented heap types.
Library
- bpo-41235: Fix the error handling in ssl.SSLContext.load_dh_params().
- bpo-41193: The write_history() atexit function of the readline completer now ignores any OSError to ignore error if the filesystem is read-only, instead of only ignoring FileNotFoundError and PermissionError.
- bpo-41043: Fixed the use of glob() in the stdlib: literal part of the path is now always correctly escaped.
- bpo-39384: Fixed email.contentmanager to allow set_content() to set a null string.
IDLE
- bpo-37765: Add keywords to module name completion list. Rewrite Completions section of IDLE doc.
- bpo-41152: The encoding of stdin, stdout and stderr in IDLE is now always UTF-8.

Core and Builtins
- bpo-40527: Fix command line argument parsing: no longer write errors multiple times into stderr.
- bpo-40417: Fix imp module deprecation warning when PyImport_ReloadModule is called. Patch by Robert Rouhani.
- bpo-39562: The constant values of future flags in the __future__ module are updated in order to prevent collision with compiler flags. Previously PyCF_ALLOW_TOP_LEVEL_AWAIT was clashing with CO_FUTURE_DIVISION.
Library
- bpo-40559: Fix possible memory leak in the C implementation of asyncio.Task.
- bpo-40355: Improve error reporting in ast.literal_eval() in the presence of malformed ast.Dict nodes instead of silently ignoring any non-conforming elements. Patch by Curtis Bucher.
- bpo-40459: platform.win32_ver() now produces correct ptype strings instead of empty strings.
- bpo-40398: typing.get_args() now always returns an empty tuple for special generic aliases.
Documentation
- bpo-40561: Provide docstrings for webbrowser open functions.
- bpo-39435: Fix an incorrect signature for pickle.loads() in the docs
Windows
- bpo-40458: Increase reserved stack space to prevent overflow crash on Windows.
C API
- bpo-40412: Nullify inittab_copy during finalization, preventing future interpreter initializations in an embedded situation from crashing. Patch by Gregory Szorc.

Core and Builtins
- bpo-39382: Fix a use-after-free in the single inheritance path of issubclass(), when the __bases__ of an object has a single reference, and so does its first item. Patch by Yonatan Goldschmidt.
- bpo-39427: Document all possibilities for the -X options in the command line help section. Patch by Pablo Galindo.
Library
- bpo-39649: Remove obsolete check for __args__ in bdb.Bdb.format_stack_entry.
- bpo-39681: Fix a regression where the C pickle module wouldn’t allow unpickling from a file-like object that doesn’t expose a readinto() method.
- bpo-39546: Fix a regression in ArgumentParser where allow_abbrev=False was ignored for long options that used a prefix character other than “-“.
- bpo-39432: Implement PEP-489 algorithm for non-ascii “PyInit_…” symbol names in distutils to make it export the correct init symbol also on Windows.
Documentation
- bpo-17422: The language reference now specifies restrictions on class namespaces. Adapted from a patch by Ethan Furman.
- bpo-39572: Updated documentation of total flag of TypeDict.
- bpo-39654: In pyclbr doc, update ‘class’ to ‘module’ where appropriate and add readmodule comment. Patch by Hakan Çelik.
IDLE
- bpo-39663: Add tests for pyparse find_good_parse_start().

Core and Builtins
- bpo-39080: Fix the value of end_col_offset for Starred Expression AST nodes when they are among the elements in the args attribute of Call AST nodes.
- bpo-39031: When parsing an “elif” node, lineno and col_offset of the node now point to the “elif” keyword and not to its condition, making it consistent with the “if” node. Patch by Lysandros Nikolaou.
- bpo-39008: PySys_Audit() now requires Py_ssize_t to be used for size arguments in the format string, regardless of whethen PY_SSIZE_T_CLEAN was defined at include time.
Library
- bpo-39022: Update importliib.metadata to include improvements from importlib_metadata 1.3 including better serialization of EntryPoints and improved documentation for custom finders.
- bpo-38811: Fix an unhandled exception in pathlib when os.link() is missing. Patch by Toke Høiland-Jørgensen.
- bpo-36406: Handle namespace packages in doctest. Patch by Karthikeyan Singaravelan.
Tests
- bpo-38546: Multiprocessing and concurrent.futures tests now stop the resource tracker process when tests complete.
Windows
- bpo-39007: Add auditing events to functions in winreg.
macOS
- bpo-38295: Prevent failure of test_relative_path in test_py_compile on macOS Catalina.
IDLE
- bpo-38944: Excape key now closes IDLE completion windows. Patch by Johnny Najera.
- bpo-38943: Fix IDLE autocomplete windows not always appearing on some systems. Patch by Johnny Najera.

Core and Builtins
- bpo-38469: Fixed a bug where the scope of named expressions was not being resolved correctly in the presence of the global keyword. Patch by Pablo Galindo.
- bpo-38379: When cyclic garbage collection (gc) runs finalizers that resurrect unreachable objects, the current gc run ends, without collecting any cyclic trash. However, the statistics reported by collect() and get_stats() claimed that all cyclic trash found was collected, and that the resurrected objects were collected. Changed the stats to report that none were collected.
Library
- bpo-38449: Revert GH-15522, which introduces a regression in mimetypes.guess_type() due to improper handling of filenames as urls.
- bpo-38431: Fix __repr__ method for dataclasses.InitVar to support typing objects, patch by Samuel Colvin.
- bpo-38109: Add missing stat.S_IFDOOR, stat.S_IFPORT, stat.S_IFWHT, stat.S_ISDOOR(), stat.S_ISPORT(), and stat.S_ISWHT() values to the Python implementation of stat.
- bpo-38405: Nested subclasses of typing.NamedTuple are now pickleable.
- bpo-38332: Prevent KeyError thrown by _encoded_words.decode() when given an encoded-word with invalid content-type encoding from propagating all the way to email.message.get().
- bpo-38341: Add smtplib.SMTPNotSupportedError to the smtplib exported names.
- bpo-13153: OS native encoding is now used for converting between Python strings and Tcl objects. This allows to display, copy and paste to clipboard emoji and other non-BMP characters. Converting strings from Tcl to Python and back now never fails (except MemoryError).
Documentation
- bpo-38294: Add list of no-longer-escaped chars to re.escape documentation
Tests
- bpo-37531: On timeout, regrtest no longer attempts to call popen.communicate() again: it can hang until all child processes using stdout and stderr pipes completes. Kill the worker process and ignores its output. Change also the faulthandler timeout of the main process from 1 minute to 5 minutes, for Python slowest buildbots.
Windows
- bpo-38344: Fix error message in activate.bat
- bpo-38359: Ensures pyw.exe launcher reads correct registry key.
- bpo-38355: Fixes ntpath.realpath failing on sys.executable.
IDLE
- bpo-36698: IDLE no longer fails when write non-encodable characters to stderr. It now escapes them with a backslash, as the regular Python interpreter. Added the errors field to the standard streams.
Tools/Demos
- bpo-38118: Update Valgrind suppression file to ignore a false alarm in PyUnicode_Decode() when using GCC builtin strcmp().
- bpo-38347: pathfix.py: Assume all files that end on ‘.py’ are Python scripts when working recursively.
C API
- bpo-38395: Fix a crash in weakref.proxy objects due to incorrect lifetime management when calling some associated methods that may delete the last reference to object being referenced by the proxy. Patch by Pablo Galindo.