Python 3.11 이전 버전 및 전체 버전

Security
- gh-103142: The version of OpenSSL used in our binary builds has been upgraded to 1.1.1u to address several CVEs.
- gh-99889: Fixed a security in flaw in uu.decode() that could allow for directory traversal based on the input if no out_file was specified.
- gh-104049: Do not expose the local on-disk location in directory indexes produced by http.client.SimpleHTTPRequestHandler.
- gh-102153: urllib.parse.urlsplit() now strips leading C0 control and space characters following the specification for URLs defined by WHATWG in response to CVE-2023-24329. Patch by Illia Volochii.
Core and Builtins
- gh-105164: Ensure annotations are set up correctly if the only annotation in a block is within a match block. Patch by Jelle Zijlstra.
- gh-104615: Fix wrong ordering of assignments in code like a, a = x, y. Contributed by Carl Meyer.
- gh-104482: Fix three error handling bugs in ast.c’s validation of pattern matching statements.
- gh-102818: Do not add a frame to the traceback in the sys.setprofile and sys.settrace trampoline functions. This ensures that frames are not duplicated if an exception is raised in the callback function, and ensures that frames are not omitted if a C callback is used and that does not add the frame.
- gh-104405: Fix an issue where some bytecode instructions could ignore

PEP 523 when “inlining” calls.
- gh-104018: Disallow the “z” format specifier in %-format of bytes objects.
- gh-103971: Fix an issue where incorrect locations numbers could be assigned to code following case blocks.
- gh-102310: Change the error range for invalid bytes literals.
- gh-103590: Do not wrap a single exception raised from a try-except* construct in an ExceptionGroup.
- gh-101517: Fix bug in line numbers of instructions emitted for except*.
- gh-103242: Migrate set_ecdh_curve() method not to use deprecated OpenSSL APIs. Patch by Dong-hee Na.
- gh-102700: Allow built-in modules to be submodules. This allows submodules to be statically linked into a CPython binary.
- gh-101857: Fix xattr support detection on Linux systems by widening the check to linux, not just glibc. This fixes support for musl.
- gh-99184: Bypass instance attribute access of __name__ in repr of weakref.ref.
- gh-96670: The parser now raises SyntaxError when parsing source code containing null bytes. Backported from aab01e3. Patch by Pablo Galindo
- bpo-31821: Fix pause_reading() to work when called from connection_made() in asyncio.
Library
- gh-105080: Fixed inconsistent signature on derived classes for inspect.signature()
- gh-104874: Document the __name__ and __supertype__ attributes of typing.NewType. Patch by Jelle Zijlstra.
- gh-104340: When an asyncio pipe protocol loses its connection due to an error, and the caller doesn’t await wait_closed() on the corresponding StreamWriter, don’t log a warning about an exception that was never retrieved. After all, according to the StreamWriter.close() docs, the wait_closed() call is optional (“not mandatory”).
- gh-104372: Refactored the _posixsubprocess internals to avoid Python C API usage between fork and exec when marking pass_fds= file descriptors inheritable.
- gh-75367: Fix data descriptor detection in inspect.getattr_static().
- gh-104536: Fix a race condition in the internal multiprocessing.process cleanup logic that could manifest as an unintended AttributeError when calling process.close().
- gh-104399: Prepare the _tkinter module for building with Tcl 9.0 and future libtommath by replacing usage of deprecated functions mp_to_unsigned_bin_n() and mp_unsigned_bin_size() when necessary.
- gh-104307: socket.getnameinfo() now releases the GIL while contacting the DNS server
- gh-87695: Fix issue where pathlib.Path.glob() raised OSError when it encountered a symlink to an overly long path.
- gh-104265: Prevent possible crash by disallowing instantiation of the _csv.Reader and _csv.Writer types. The regression was introduced in 3.10.0a4 with PR 23224 (bpo-14935). Patch by Radislav Chugunov.
- gh-104035: 

Security
- gh-101727: Updated the OpenSSL version used in Windows and macOS binary release builds to 1.1.1t to address CVE-2023-0286, CVE-2022-4303, and CVE-2022-4303 per the OpenSSL 2023-02-07 security advisory.
- gh-101283: subprocess.Popen now uses a safer approach to find cmd.exe when launching with shell=True. Patch by Eryk Sun, based on a patch by Oleg Iarygin.
Core and Builtins
- gh-101975: Fixed stacktop value on tracing entries to avoid corruption on garbage collection.
- gh-102701: Fix overflow when creating very large dict.
- gh-102416: Do not memoize incorrectly automatically generated loop rules in the parser. Patch by Pablo Galindo.
- gh-102356: Fix a bug that caused a crash when deallocating deeply nested filter objects. Patch by Marta Gómez Macías.
- gh-102397: Fix segfault from race condition in signal handling during garbage collection. Patch by Kumar Aditya.
- gh-102281: Fix potential nullptr dereference and use of uninitialized memory in fileutils. Patch by Max Bachmann.
- gh-102126: Fix deadlock at shutdown when clearing thread states if any finalizer tries to acquire the runtime head lock. Patch by Kumar Aditya.
- gh-102027: Fix SSE2 and SSE3 detection in _blake2 internal module. Patch by Max Bachmann.
- gh-101967: Fix possible segfault in positional_only_passed_as_keyword function, when new list created.
- gh-101765: Fix SystemError / segmentation fault in iter __reduce__ when internal access of builtins.__dict__ keys mutates the iter object.
- gh-101696: Invalidate type version tag in _PyStaticType_Dealloc for static types, avoiding bug where a false cache hit could crash the interpreter. Patch by Kumar Aditya.
Library
- gh-102549: Don’t ignore exceptions in member type creation.
- gh-102947: Improve traceback when dataclasses.fields() is called on a non-dataclass. Patch by Alex Waygood
- gh-102780: The asyncio.Timeout context manager now works reliably even when performing cleanup due to task cancellation. Previously it could raise a CancelledError instead of an TimeoutError in such cases.
- gh-88965: typing: Fix a bug relating to substitution in custom classes generic over a ParamSpec. Previously, if the ParamSpec was substituted with a parameters list that itself contained a TypeVar, the TypeVar in the parameters list could not be subsequently substituted. This is now fixed.
Patch by Nikita Sobolev.
- gh-101979: Fix a bug where parentheses in the metavar argument to argparse.ArgumentParser.add_argument() were dropped. Patch by Yeojin Kim.
- gh-102179: Fix os.dup2() error message for negative fds.
- gh-101961: For the binary mode, fileinput.hookcompressed() doesn’t set the encoding value even if the value is None. Patch by Gihwan Kim.
- gh-101936: The default value of fp becomes io.BytesIO if HTTPError is initialized without a designated fp parameter. Patch by Long Vo.
- gh-102069: Fix __weakref__ descriptor generation for custom dataclasses.
- gh-101566: In zipfile, apply fix for extractall on the underlying zipfile after being wrapped in Path.
- gh-101892: Callable iterators no longer raise SystemError when the callable object exhausts the iterator but forgets to either return a sentinel value or raise StopIteration.
- gh-97786: Fix potential undefined behaviour in corner cases of floating-point-to-time conversions.
- gh-101517: Fixed bug where bdb looks up the source line with linecache with a lineno=None, which causes it to fail with an unhandled exception.
- gh-101673: Fix a pdb bug where ll clears the changes to local variables.
- gh-96931: Fix incorrect results from ssl.SSLSocket.shared_ciphers()
- gh-88233: Correctly preserve “extra” fields in zipfile regardless of their ordering relative to a zip64 “extra.”
- gh-96127: inspect.signature was raising TypeError on call with mock objects. Now it correctly returns (*args, **kwargs) as infered signature.
- gh-95495: When built against OpenSSL 3.0, the ssl module had a bug where it reported unauthenticated EOFs (i.e. without close_notify) as a clean

Core and Builtins
- gh-92173: Fix the defs and kwdefs arguments to PyEval_EvalCodeEx() and a reference leak in that function.
- gh-101400: Fix wrong lineno in exception message on continue or break which are not in a loop. Patch by Dong-hee Na.
- gh-101372: Fix is_normalized() to properly handle the UCD 3.2.0 cases. Patch by Dong-hee Na.
- gh-101046: Fix a possible memory leak in the parser when raising MemoryError. Patch by Pablo Galindo
- gh-101037: Fix potential memory underallocation issue for instances of int subclasses with value zero.
- gh-100942: Fixed segfault in property.getter/setter/deleter that occurred when a property subclass overrode the __new__ method to return a non-property instance.
- gh-100892: Fix race while iterating over thread states in clearing threading.local. Patch by Kumar Aditya.
- gh-100776: Fix misleading default value in input()’s __text_signature__.
- gh-100637: Fix int.__sizeof__() calculation to include the 1 element ob_digit array for 0 and False.
- gh-100649: Update the native_thread_id field of PyThreadState after fork.
- gh-100374: Fix incorrect result and delay in socket.getfqdn(). Patch by Dominic Socular.
- gh-99110: Initialize frame->previous in frameobject.c to fix a segmentation fault when accessing frames created by PyFrame_New().
- gh-100050: Honor existing errors obtained when searching for mismatching parentheses in the tokenizer. Patch by Pablo Galindo
- bpo-32782: ctypes arrays of length 0 now report a correct itemsize when a memoryview is constructed from them, rather than always giving a value of 0.
Library
- gh-101541: [Enum] - fix psuedo-flag creation
- gh-101326: Fix regression when passing None as second or third argument to FutureIter.throw.
- gh-100795: Avoid potential unexpected freeaddrinfo call (double free) in socket when when a libc getaddrinfo() implementation leaves garbage in an output pointer when returning an error. Original patch by Sergey G. Brester.
- gh-101143: Remove unused references to TimerHandle in asyncio.base_events.BaseEventLoop._add_callback.
- gh-101144: Make zipfile.Path.open() and zipfile.Path.read_text() also accept encoding as a positional argument. This was the behavior in Python 3.9 and earlier. 3.10 introduced a regression where supplying it as a positional argument would lead to a TypeError.
- gh-101015: Fix typing.get_type_hints() on '*tuple[...]' and *tuple[...]. It must not drop the Unpack part.
- gh-100573: Fix a Windows asyncio bug with named pipes where a client doing os.stat() on the pipe would cause an error in the server that disabled serving future requests.
- gh-100805: Modify random.choice() implementation to once again work with NumPy arrays.
- gh-90104: Avoid RecursionError on repr if a dataclass field definition has a cyclic reference.
- gh-100750: pass encoding kwarg to subprocess in platform
- gh-100689: Fix crash in pyexpat by statically allocating PyExpat_CAPI capsule.
- gh-100740: Fix unittest.mock.Mock not respecting the spec for attribute names prefixed with assert.
- gh-86508: Fix asyncio.open_connection() to skip binding to local addresses of different family. Patch by Kumar Aditya.
- gh-100287: Fix the interaction of unittest.mock.seal() with unittest.mock.AsyncMock.
- gh-100474: http.server now checks that an index page is actually a regular file before trying to serve it. This avoids issues with directories named index.html.
- gh-100160: Remove any deprecation warnings in asyncio.get_event_loop(). They are deferred to Python 3.12.
- gh-96290: Fix handling of partial and invalid UNC drives in ntpath.splitdrive(), and in ntpath.normpath() on non-Windows systems. Paths such as ‘\server’ and ‘\’ are now considered by splitdrive() to contain only a drive, and consequently are not modified by normpath() on non-Windows systems. The behaviour of normpath() on Windows systems is unaffected, as native OS APIs are used. Patch by Eryk Sun, with contributions by Barney Gale.
- gh-78878: Fix crash when creating an instance