- Update to 3.12.4:
  - Security
    - gh-118486: os.mkdir() on Windows now accepts mode of 0o700
      to restrict the new directory to the current user. This
      fixes CVE-2024-4030 affecting tempfile.mkdtemp() in
      scenarios where the base temporary directory is more
      permissive than the default.
    - gh-116741: Update bundled libexpat to 2.6.2
    - gh-117233: Detect BLAKE2, SHA3, Shake, & truncated SHA512
      support in the OpenSSL-ish libcrypto library at build
      time. This allows hashlib to be used with libraries that do
      not to support every algorithm that upstream OpenSSL does.
  - Core and Builtins
    - gh-119821: Fix execution of annotation scopes within
      classes when globals is set to a non-dict. Patch by Jelle
      Zijlstra.
    - gh-118263: Speed up os.path.normpath() with a direct C
      call.
    - gh-119311: Fix bug where names are unexpectedly mangled in
      the bases of generic classes.
    - gh-119395: Fix bug where names appearing after a generic
      class are mangled as if they are in the generic class.
    - gh-118507: Fix os.path.isfile() on Windows for pipes.
    - gh-119213: Non-builtin modules built with argument clinic
      were crashing if used in a subinterpreter before the main
      interpreter. The objects that were causing the problem by
      leaking between interpreters carelessly have been fixed.
    - gh-119011: Fixes type.__type_params__ to return an empty
      tuple instead of a descriptor.
    - gh-118997: Fix _Py_ClearImmortal() assertion: use

• Files Changed
• Browse Source