Download Python 3.10 versi lama dan semua versi

Security
- gh-101727: Updated the OpenSSL version used in Windows and macOS binary release builds to 1.1.1t to address CVE-2023-0286, CVE-2022-4303, and CVE-2022-4303 per the OpenSSL 2023-02-07 security advisory.
- gh-101283: subprocess.Popen now uses a safer approach to find cmd.exe when launching with shell=True. Patch by Eryk Sun, based on a patch by Oleg Iarygin.
Core and Builtins
- gh-102416: Do not memoize incorrectly automatically generated loop rules in the parser. Patch by Pablo Galindo.
- gh-102356: Fix a bug that caused a crash when deallocating deeply nested filter objects. Patch by Marta Gómez Macías.
- gh-102397: Fix segfault from race condition in signal handling during garbage collection. Patch by Kumar Aditya.
- gh-102126: Fix deadlock at shutdown when clearing thread states if any finalizer tries to acquire the runtime head lock. Patch by Kumar Aditya.
- gh-102027: Fix SSE2 and SSE3 detection in _blake2 internal module. Patch by Max Bachmann.
- gh-101967: Fix possible segfault in positional_only_passed_as_keyword function, when new list created.
- gh-101765: Fix SystemError / segmentation fault in iter __reduce__ when internal access of builtins.__dict__ keys mutates the iter object.
Library
- gh-102947: Improve traceback when dataclasses.fields() is called on a non-dataclass. Patch by Alex Waygood
- gh-101979: Fix a bug where parentheses in the metavar argument to argparse.ArgumentParser.add_argument() were dropped. Patch by Yeojin Kim.
- gh-102179: Fix os.dup2() error message for negative fds.
- gh-101961: For the binary mode, fileinput.hookcompressed() doesn’t set the encoding value even if the value is None. Patch by Gihwan Kim.
- gh-101936: The default value of fp becomes io.BytesIO if HTTPError is initialized without a designated fp parameter. Patch by Long Vo.
- gh-101566: In zipfile, apply fix for extractall on the underlying zipfile after being wrapped in Path.
- gh-101997: Upgrade pip wheel bundled with ensurepip (pip 23.0.1)
- gh-101892: Callable iterators no longer raise SystemError when the callable object exhausts the iterator but forgets to either return a sentinel value or raise StopIteration.
- gh-97786: Fix potential undefined behaviour in corner cases of floating-point-to-time conversions.
- gh-101517: Fixed bug where bdb looks up the source line with linecache with a lineno=None, which causes it to fail with an unhandled exception.
- gh-101673: Fix a pdb bug where ll clears the changes to local variables.
- gh-96931: Fix incorrect results from ssl.SSLSocket.shared_ciphers()
- gh-88233: Correctly preserve “extra” fields in zipfile regardless of their ordering relative to a zip64 “extra.”
- gh-95495: When built against OpenSSL 3.0, the ssl module had a bug where it reported unauthenticated EOFs (i.e. without close_notify) as a clean TLS-level EOF. It now raises SSLEOFError, matching the behavior in previous versions of OpenSSL. The options attribute on SSLContext also no longer includes OP_IGNORE_UNEXPECTED_EOF by default. This option may be set to specify the previous OpenSSL 3.0 behavior.
- gh-94440: Fix a concurrent.futures.process bug where ProcessPoolExecutor shutdown could hang after a future has been quickly submitted and canceled.
Documentation
- gh-103112: Add docstring to http.client.HTTPResponse.read() to fix pydoc output.
- gh-85417: Update cmath documentation to clarify behaviour on branch cuts.
- gh-97725: Fix asyncio.Task.print_stack() description for file=None. Patch by Oleg Iarygin.
Tests
- gh-102980: Improve test coverage on pdb.
- gh-102537: Adjust the error handling strategy in test_zoneinfo.TzPathTest.python_tzpath_context. Patch by Paul Ganssle.
- gh-101377: Improved test_locale_calendar_formatweekday of calendar.
Build
- gh-102711: Fix -Wstrict-prototypes compiler warnings.
Windows
- gh-101759: Update Windows installer to SQLite 3.40.1.
- gh-101614: Correctly handle extensions built against debug binaries that reference python3_d.dll.
macOS
- gh-103207: Add instruction

Security
- gh-97616: Fix multiplying a list by an integer (list *= int): detect the integer overflow when the new allocated length is close to the maximum size. Issue reported by Jordan Limor. Patch by Victor Stinner.
- gh-97612: Fix a shell code injection vulnerability in the get-remote-certificate.py example script. The script no longer uses a shell to run openssl commands. Issue reported and initial fix by Caleb Shortt. Patch by Victor Stinner.
- gh-68966: The deprecated mailcap module now refuses to inject unsafe text (filenames, MIME types, parameters) into shell commands. Instead of using such text, it will warn and act as if a match was not found (or for test commands, as if the test failed).
Core and Builtins
- gh-96078: os.sched_yield() now release the GIL while calling sched_yield(2). Patch by Dong-hee Na.
- gh-97943: Bugfix: PyFunction_GetAnnotations() should return a borrowed reference. It was returning a new reference.
- gh-97591: Fixed a missing incref/decref pair in Exception.__setstate__(). Patch by Ofey Chan.
- gh-96848: Fix command line parsing: reject -X int_max_str_digits option with no value (invalid) when the

PYTHONINTMAXSTRDIGITS environment variable is set to a valid limit. Patch by Victor Stinner.
- gh-95921: Fix overly-broad source position information for chained comparisons used as branching conditions.
- gh-96821: Fix undefined behaviour in _testcapimodule.c.
- gh-95778: When ValueError is raised if an integer is larger than the limit, mention the sys.set_int_max_str_digits() function in the error message. Patch by Victor Stinner.
- gh-96387: At Python exit, sometimes a thread holding the GIL can wait forever for a thread (usually a daemon thread) which requested to drop the GIL, whereas the thread already exited. To fix the race condition, the thread which requested the GIL drop now resets its request before exiting. Issue discovered and analyzed by Mingliang ZHAO. Patch by Victor Stinner.
- gh-96864: Fix a possible assertion failure, fatal error, or SystemError if a line tracing event raises an exception while opcode tracing is enabled.
- gh-96678: Fix undefined behaviour in C code of null pointer arithmetic.
- gh-96641: Do not expose KeyWrapper in _functools.
- gh-96611: When loading a file with invalid UTF-8 inside a multi-line string, a correct SyntaxError is emitted.
- gh-95196: Disable incorrect pickling of the C implemented classmethod descriptors.
- gh-96352: Fix AttributeError missing name and obj attributes in object.__getattribute__(). Patch by Philip Georgi.
- bpo-42316: Document some places where an assignment expression needs parentheses.
Library
- gh-87730: Wrap network errors consistently in urllib FTP support, so the test suite doesn’t fail when a network is available but the public internet is not reachable.
- gh-97825: Fixes AttributeError when subprocess.check_output() is used with argument input=None and either of the arguments encoding or errors are used.
- gh-96827: Avoid spurious tracebacks from asyncio when default executor cleanup is delayed until after the event loop is closed (e.g. as the result of a keyboard interrupt).
- gh-97592: Avoid a crash in the C version of asyncio.Future.remove_done_callback() when an evil argument is passed.
- gh-97639: Remove tokenize.NL check from tabnanny.
- gh-97545: Make Semaphore run faster.
- gh-73588: Fix generation of the default name of tkinter.Checkbutton. Previously, checkbuttons in different parent widgets could have the same short name and share the same state if arguments “name” and “variable” are not specified. Now they are globally unique.
- gh-97005: Update bundled libexpat to 2.4.9
- gh-85760: Fix race condition in asyncio where process_exited() called before the pipe_data_received() leading to inconsistent output. Patch by Kumar Aditya.
- gh-96819: Fixed check in multiprocessing.resource_tracker that guarantees that the length of a write to a pipe is not greater than PIPE_BUF.
- gh-96741: Corrected type annotation for dat

Security
- gh-95778: Converting between int and str in bases other than 2 (binary), 4, 8 (octal), 16 (hexadecimal), or 32 such as base 10 (decimal) now raises a ValueError if the number of digits in string form is above a limit to avoid potential denial of service attacks due to the algorithmic complexity. This is a mitigation for CVE-2020-10735.
This new limit can be configured or disabled by environment variable, command line flag, or sys APIs. See the integer string conversion length limitation documentation. The default limit is 4300 digits in string form.
Patch by Gregory P. Smith [Google] and Christian Heimes [Red Hat] with feedback from Victor Stinner, Thomas Wouters, Steve Dower, Ned Deily, and Mark Dickinson.
Core and Builtins
- gh-96187: Fixed a bug that caused _PyCode_GetExtra to return garbage for negative indexes. Patch by Pablo Galindo
- gh-95876: Fix format string in _PyPegen_raise_error_known_location that can lead to memory corruption on some 64bit systems. The function was building a tuple with i (int) instead of n (Py_ssize_t) for Py_ssize_t arguments.
- gh-95605: Fix misleading contents of error message when converting an all-whitespace string to float.
- gh-93592: coroutine.throw() now properly initializes the frame.f_back when resuming a stack of coroutines. This allows e.g. traceback.print_stack() to work correctly when an exception (such as CancelledError) is thrown into a coroutine.
- gh-94996: ast.parse() will no longer parse function definitions with positional-only params when passed feature_version less than (3, 8). Patch by Shantanu Jain.
Library
- gh-68163: Correct conversion of numbers.Rational’s to float.
- gh-96159: Fix a performance regression in logging TimedRotatingFileHandler. Only check for special files when the rollover time has passed.
- gh-96175: Fix unused localName parameter in the Attr class in xml.dom.minidom.
- gh-95609: Update bundled pip to 22.2.2.
- gh-95231: Fail gracefully if EPERM or ENOSYS is raised when loading crypt methods. This may happen when trying to load MD5 on a Linux kernel with FIPS enabled.
Documentation
- gh-96098: Improve discoverability of the higher level concurrent.futures module by providing clearer links from the lower level threading and multiprocessing modules.
- gh-95789: Update the default RFC base URL from deprecated tools.ietf.org to datatracker.ietf.org
- gh-91207: Fix stylesheet not working in Windows CHM htmlhelp docs. Contributed by C.A.M. Gerlach.
- bpo-47115: The documentation now lists which members of C structs are part of the Limited API/Stable ABI.
Tests
- gh-95243: Mitigate the inherent race condition from using find_unused_port() in testSockName() by trying to find an unused port a few times before failing. Patch by Ross Burton.
Build
- gh-94682: Build and test with OpenSSL 1.1.1q
IDLE
- gh-65802: Document handling of extensions in Save As dialogs.
- gh-95191: Include prompts when saving Shell (interactive input and output).

Core and Builtins
- bpo-46968: Check for the existence of the “sys/auxv.h” header in faulthandler to avoid compilation problems in systems where this header doesn’t exist. Patch by Pablo Galindo
Library
- bpo-23691: Protect the re.finditer() iterator from re-entering.
- bpo-42369: Fix thread safety of zipfile._SharedFile.tell() to avoid a “zipfile.BadZipFile: Bad CRC-32 for file” exception when reading a ZipFile from multiple threads.
- bpo-38256: Fix binascii.crc32() when it is compiled to use zlib’c crc32 to work properly on inputs 4+GiB in length instead of returning the wrong result. The workaround prior to this was to always feed the function data in increments smaller than 4GiB or to just call the zlib module function.
- bpo-39394: A warning about inline flags not at the start of the regular expression now contains the position of the flag.
- bpo-47061: Deprecate the various modules listed by

PEP 594:
aifc, asynchat, asyncore, audioop, cgi, cgitb, chunk, crypt, imghdr, msilib, nntplib, nis, ossaudiodev, pipes, smtpd, sndhdr, spwd, sunau, telnetlib, uu, xdrlib
- bpo-2604: Fix bug where doctests using globals would fail when run multiple times.
- bpo-45997: Fix asyncio.Semaphore re-aquiring FIFO order.
- bpo-47022: The asynchat, asyncore and smtpd modules have been deprecated since at least Python 3.6. Their documentation and deprecation warnings and have now been updated to note they will removed in Python 3.12 (

PEP 594).
- bpo-46421: Fix a unittest issue where if the command was invoked as python -m unittest and the filename(s) began with a dot (.), a ValueError is returned.
- bpo-40296: Fix supporting generic aliases in pydoc.

Core and Builtins
- bpo-46347: Fix memory leak in PyEval_EvalCodeEx.
- bpo-46289: ASDL declaration of FormattedValue has changed to reflect conversion field is not optional.
- bpo-46237: Fix the line number of tokenizer errors inside f-strings. Patch by Pablo Galindo.
- bpo-46006: Fix a regression when a type method like __init__() is modified in a subinterpreter. Fix a regression in _PyUnicode_EqualToASCIIId() and type update_slot(). Revert the change which made the Unicode dictionary of interned strings compatible with subinterpreters: the internal interned dictionary is shared again by all interpreters. Patch by Victor Stinner.
- bpo-46085: Fix iterator cache mechanism of OrderedDict.
- bpo-46110: Add a maximum recursion check to the PEG parser to avoid stack overflow. Patch by Pablo Galindo
- bpo-46054: Fix parser error when parsing non-utf8 characters in source files. Patch by Pablo Galindo.
- bpo-46042: Improve the location of the caret in SyntaxError exceptions emitted by the symbol table. Patch by Pablo Galindo.
- bpo-46025: Fix a crash in the atexit module involving functions that unregister themselves before raising exceptions. Patch by Pablo Galindo.
- bpo-46009: Restore behavior from 3.9 and earlier when sending non-None to newly started generator. In 3.9 this did not affect the state of the generator. In 3.10.0 and 3.10.1 gen_func().send(0) is equivalent to gen_func().throw(TypeError(...) which exhausts the generator. In 3.10.2 onward, the behavior has been reverted to that of 3.9.
- bpo-46000: Improve compatibility of the curses module with NetBSD curses.
- bpo-46004: Fix the SyntaxError location for errors involving for loops with invalid targets. Patch by Pablo Galindo
- bpo-42918: Fix bug where the built-in compile() function did not always raise a SyntaxError when passed multiple statements in ‘single’ mode. Patch by Weipeng Hong.
Library
- bpo-40479: Fix hashlib usedforsecurity option to work correctly with OpenSSL 3.0.0 in FIPS mode.
- bpo-46070: Fix possible segfault when importing the asyncio module from different sub-interpreters in parallel. Patch by Erlend E. Aasland.
- bpo-46278: Reflect context argument in AbstractEventLoop.call_*() methods. Loop implementations already support it.
- bpo-46239: Improve error message when importing asyncio.windows_events on non-Windows.
- bpo-20369: concurrent.futures.wait() no longer blocks forever when given duplicate Futures. Patch by Kumar Aditya.
- bpo-46105: Honor spec when generating requirement specs with urls and extras (importlib_metadata 4.8.3).
- bpo-26952: argparse raises ValueError with clear message when trying to render usage for an empty mutually-exclusive group. Previously it raised a cryptic IndexError.
- bpo-27718: Fix help for the signal module. Some functions (e.g. signal() and getsignal()) were omitted.
- bpo-46032: The registry() method of functools.singledispatch() functions checks now the first argument or the first parameter annotation and raises a TypeError if it is not supported. Previously unsupported “types” were ignored (e.g. typing.List[int]) or caused an error at calling time (e.g. list[int]).
- bpo-46018: Ensure that math.expm1() does not raise on underflow.
- bpo-45755: typing generic aliases now reveal the class attributes of the original generic class when passed to dir(). This was the behavior up to Python 3.6, but was changed in 3.7-3.9.
- bpo-13236: unittest.TextTestResult and unittest.TextTestRunner flush now the output stream more often.
- bpo-42378: Fixes the issue with log file being overwritten when logging.FileHandler is used in atexit with filemode set to 'w'. Note this will cause the message in atexit not being logged if the log stream is already closed due to shutdown of logging.
Documentation
- bpo-46120: State that | is preferred for readability over Union in the typing docs.
- bpo-46040: Fix removal Python version for @asyncio.coroutine, the correct value is 3.11.
- bpo-19737: Update the documentation for the global

Core and Builtins
- bpo-45121: Fix issue where Protocol.__init__ raises RecursionError when it’s called directly or via super(). Patch provided by Yurii Karabas.
Library
- bpo-45234: Fixed a regression in copyfile(), copy(), copy2() raising FileNotFoundError when source is a directory, which should raise IsADirectoryError
Documentation
- bpo-45216: Remove extra documentation listing methods in difflib. It was rendering twice in pydoc and was outdated in some places.
- bpo-45024: collections.abc documentation has been expanded to explicitly cover how instance and subclass checks work, with additional doctest examples and an exhaustive list of ABCs which test membership purely by presence of the right special methods. Patch by Raymond Hettinger.
Tests
- bpo-45128: Fix test_multiprocessing_fork failure due to test_logging and sys.modules manipulation.
- bpo-44860: Update test_sysconfig.test_user_similar() for the posix_user scheme: platlib doesn’t use sys.platlibdir. Patch by Victor Stinner.
Build
- bpo-45067: The ncurses function extended_color_content was introduced in 2017
(https://invisible-island.net/ncurses/NEWS.html#index-t20170401). The
ncurses-devel package in CentOS 7 had a older version ncurses resulted in compilation error. For compiling ncurses with extended color support, we verify the version of the ncurses library >= 20170401.
IDLE
- bpo-45193: Make completion boxes appear on Ubuntu again.
C API
- bpo-45307: Restore the private C API function _PyImport_FindExtensionObject(). It will be removed in Python 3.11.