+++++++++++

Python News

+++++++++++

What's New in Python 3.3.6?

===========================

*Release date: 11-Oct-2014*

Core and Builtins

-----------------

- Issue #22518: Fixed integer overflow issues in "backslashreplace",

"xmlcharrefreplace", and "surrogatepass" error handlers.

- Issue #22520: Fix overflow checking when generating the repr of a unicode

object.

- Issue #22519: Fix overflow checking in PyBytes_Repr.

- Issue #22518: Fix integer overflow issues in latin-1 encoding.

Library

-------

- Issue #22517: When a io.BufferedRWPair object is deallocated, clear its

weakrefs.

- Issue #22419: Limit the length of incoming HTTP request in wsgiref server to

65536 bytes and send a 414 error code for higher lengths. Patch contributed

by Devin Cook.

- Lax cookie parsing in http.cookies could be a security issue when combined

with non-standard cookie handling in some Web browsers. Reported by

Sergey Bobrov.

- Issue #21766: Prevent a security hole in CGIHTTPServer by URL unquoting paths

before checking for a CGI script at that path.

- Fix arbitrary memory access in JSONDecoder.raw_decode with a negative second

parameter. Bug reported by Guido Vranken.

- Issue #20633: Replace relative import by absolute import.

- Issue #21082: In os.makedirs, do not set the process-wide umask. Note this

changes behavior of makedirs when exist_ok=True.

- Issue #20875: Prevent possible gzip "'read' is not defined" NameError.

Patch by Claudiu Popa.

- Issue #11599: When an external command (e.g. compiler) fails, distutils now

prints out the whole command line (instead of just the command name) if the

environment variable DISTUTILS_DEBUG is set.

- Issue #4931: distutils should not produce unhelpful "error: None" messages

anymore. distutils.util.grok_environment_error is kept but doc-deprecated.

- Issue #20283: RE pattern methods now accept the string keyword parameters

as documented. The pattern and source keyword parameters are left as

deprecated aliases.

- Issue #21323: Fix http.server to again handle scripts in CGI subdirectories,

broken by the fix for security issue #19435. Patch by Zach Byrne.

Tests

-----

- Issue #17752: Fix distutils tests when run from the installed location.

- Issue #20946: Correct alignment assumptions of some ctypes tests.

- Issue #20939: Fix test_geturl failure in test_urllibnet due to

new redirect of http://www.python.org/ to https://www.python.org.

What's New in Python 3.3.5?

===========================

*Release date: 09-Mar-2014*

No changes from release candidate 2.

What's New in Python 3.3.5 release candidate 2?

===============================================

*Release date: 02-Mar-2014*

Core and Builtins

-----------------

- Issue #20731: Properly position in source code files even if they

are opened in text mode. Patch by Serhiy Storchaka.

- Issue #19619: str.encode, bytes.decode and bytearray.decode now use an

internal API to throw LookupError for known non-text encodings, rather

than attempting the encoding or decoding operation and then throwing a

TypeError for an unexpected output type. (The latter mechanism remains

in place for third party non-text encodings)

Library

-------

- Issue #20778: Fix modulefinder to work with bytecode-only modules.

- Issue #20791: copy.copy() now doesn't make a copy when the input is

a bytes object. Initial patch by Peter Otten.

- Issue #20621: Fixes a zipimport bug introduced in 3.3.4 that could cause

spurious crashes or SystemErrors when importing modules or packages from a

zip file. The change causing the problem was reverted.

- Issue #20404: io.TextIOWrapper (and hence the open() builtin) now uses the

internal codec marking system added for issue #19619 to throw LookupError

for known non-text encodings at stream construction time. The existing

output type checks remain in place to deal with unmarked third party

codecs.

Tests

-----

- Issue #20743: Fix a reference leak in test_tcl.

Tools/Demos

-----------

- Issue #20535: PYTHONWARNING no longer affects the run_tests.py script.

Patch by Arfrever Frehtes Taifersar Arahesis.

What's New in Python 3.3.5 release candidate 1?

===============================================

*Release date: 23-Feb-2014*

Core and Builtins

-----------------

- Issue #20588: Make Python-ast.c C89 compliant.

- Issue #20437: Fixed 21 potential bugs when deleting objects references.

- Issue #20538: UTF-7 incremental decoder produced inconsistant string when

input was truncated in BASE64 section.

Library

-------

- Issue #20635: Fixed grid_columnconfigure() and grid_rowconfigure() methods of

Tkinter widgets to work in wantobjects=True mode.

- Issue #19612: On Windows, subprocess.Popen.communicate() now ignores

OSError(22, 'Invalid argument') when writing input data into stdin, whereas

the process already exited.

- Issue #6815: os.path.expandvars() now supports non-ASCII environment

variables names and values.

- Issue #17671: Fixed a crash when use non-initialized io.BufferedRWPair.

Based on patch by Stephen Tu.

- Issue #8478: Untokenizer.compat processes first token from iterator input.

Patch based on lines from Georg Brandl, Eric Snow, and Gareth Rees.

- Issue #20594: Avoid name clash with the libc function posix_close.

- Issue #19856: shutil.move() failed to move a directory to other directory

on Windows if source name ends with os.altsep.

- Issue #14983: email.generator now always adds a line end after each MIME

boundary marker, instead of doing so only when there is an epilogue. This

fixes an RFC compliance bug and solves an issue with signed MIME parts.

- Issue #20540: Fix a performance regression (vs. Python 3.2) when layering

a multiprocessing Connection over a TCP socket. For small payloads, Nagle's

algorithm would introduce idle delays before the entire transmission of a

message.

- Issue #16983: the new email header parsing code will now decode encoded words

that are (incorrectly) surrounded by quotes, and register a defect.

- Issue #19772: email.generator no longer mutates the message object when

doing a down-transform from 8bit to 7bit CTEs.

- Issue #18805: the netmask/hostmask parsing in ipaddress now more reliably

filters out illegal values and correctly allows any valid prefix length.

- Issue #17369: get_filename was raising an exception if the filename

parameter's RFC2231 encoding was broken in certain ways. This was

a regression relative to python2.

- Issue #20013: Some imap servers disconnect if the current mailbox is

deleted, and imaplib did not handle that case gracefully. Now it

handles the 'bye' correctly.

- Issue #19920: TarFile.list() no longer fails when outputs a listing

containing non-encodable characters. Based on patch by Vajrasky Kok.

- Issue #20515: Fix NULL pointer dereference introduced by issue #20368.

- Issue #19186: Restore namespacing of expat symbols inside the pyexpat module.

- Issue #20426: When passing the re.DEBUG flag, re.compile() displays the

debug output every time it is called, regardless of the compilation cache.

- Issue #20368: The null character now correctly passed from Tcl to Python.

Improved error handling in variables-related commands.

- Issue #20435: Fix _pyio.StringIO.getvalue() to take into account newline

translation settings.

- Issue #20288: fix handling of invalid numeric charrefs in HTMLParser.

- Issue #20424: Python implementation of io.StringIO now supports lone surrogates.

- Issue #19456: ntpath.join() now joins relative paths correctly when a drive

is present.

- Issue #19077: tempfile.TemporaryDirectory cleanup is now most likely

successful when called during nulling out of modules during shutdown.

Misleading exception no longer raised when resource warning is emitted

during shutdown.

- Issue #20367: Fix behavior of concurrent.futures.as_completed() for

duplicate arguments. Patch by Glenn Langford.

- Issue #8260: The read(), readline() and readlines() methods of

codecs.StreamReader returned incomplete data when were called after

readline() or read(size). Based on patch by Amaury Forgeot d'Arc.

IDLE

----

- Issue #20406: Use Python application icons for Idle window title bars.

Patch mostly by Serhiy Storchaka.

- Update the python.gif icon for the Idle classbrowser and pathbowser

from the old green snake to the new new blue and yellow snakes.

- Issue #17721: Remove non-functional configuration dialog help button until we

make it actually gives some help when clicked. Patch by Guilherme Simões.

Tests

-----

- Issue #20510: Rewrote test_exit in test_sys to match existing comments,

use modern unittest features, and use helpers from test.script_helper

instead of using subprocess directly. Patch by Gareth Rees.

- Issue #20532: Tests which use _testcapi are now marked as CPython only.

- Issue #19920: Added tests for TarFile.list(). Based on patch by Vajrasky Kok.

- Issue #19990: Added tests for the imghdr module. Based on patch by

Claudiu Popa.

- Issue #20474: Fix test_socket "unexpected success" failures on OS X 10.7+.

- Issue #20605: Make test_socket getaddrinfo OS X segfault test more robust.

Documentation

-------------

- Issue #20488: Importlib is no longer *an* implementation of import, it's *the*

implementation.

Build

-----

- Issue #20221: Removed conflicting (or circular) hypot definition when

compiled with VS 2010 or above. Initial patch by Tabrez Mohammed.

- Issue #20609: Restored the ability to build 64-bit Windows binaries on

32-bit Windows, which was broken by the change in issue #19788.

What's New in Python 3.3.4?

===========================

*Release date: 09-Feb-2014*

Library

-------

- Issue #20374: Fix build warnings of the readline module with libedit on Mac.

What's New in Python 3.3.4 release candidate 1?

===============================================

*Release date: 26-Jan-2014*

Core and Builtins

-----------------

- Issue #17825: Cursor "^" is correctly positioned for SyntaxError and

IndentationError.

- Issue #2382: SyntaxError cursor "^" is now written at correct position in most

cases when multibyte characters are in line (before "^"). This still not

works correctly with wide East Asian characters.

- Issue #18960: The first line of Python script could be executed twice when

the source encoding was specified on the second line. Now the source encoding

declaration on the second line isn't effective if the first line contains

anything except a comment. 'python -x' works now again with files with the

source encoding declarations, and can be used to make Python batch files

on Windows.

- Issue #17432: Drop UCS2 from names of Unicode functions in python3.def.

- Issue #19969: PyBytes_FromFormatV() now raises an OverflowError if "%c"

argument is not in range [0; 255].

- Issue #14432: Generator now clears the borrowed reference to the thread

state. Fix a crash when a generator is created in a C thread that is

destroyed while the generator is still used. The issue was that a generator

contains a frame, and the frame kept a reference to the Python state of the

destroyed C thread. The crash occurs when a trace function is setup.

- Issue #19932: Fix typo in import.h, missing whitespaces in function prototypes.

- Issue #19729: In str.format(), fix recursive expansion in format spec.

- Issue #19638: Fix possible crash / undefined behaviour from huge (more than 2

billion characters) input strings in _Py_dg_strtod.

Library

-------

- Issue #16042: CVE-2013-1752: smtplib: Limit amount of data read by

limiting the call to readline(). Original patch by Christian Heimes.

- Issue #20317: ExitStack.__exit__ could create a self-referential loop if an

exception raised by a cleanup operation already had its context set

correctly (for example, by the @contextmanager decorator). The infinite

loop this caused is now avoided by checking if the expected context is

already set before trying to fix it.

- Issue #20374: Fix build with GNU readline >= 6.3.

- Issue #20262: Warnings are raised now when duplicate names are added in the

ZIP file or too long ZIP file comment is truncated.

- Issue #18574: Added missing newline in 100-Continue reply from

http.server.BaseHTTPRequestHandler. Patch by Nikolaus Rath.

- Issue #20270: urllib.urlparse now supports empty ports.

- Issue #20243: TarFile no longer raise ReadError when opened in write mode.

- Issue #20238: TarFile opened with external fileobj and "w:gz" mode didn't

write complete output on close.

- Issue #20245: The open functions in the tarfile module now correctly handle

empty mode.

- Issue #20242: Fixed basicConfig() format strings for the alternative

formatting styles. Thanks to kespindler for the bug report and patch.

- Issue #20246: Fix buffer overflow in socket.recvfrom_into.

- Issues #20206 and #5803: Fix edge case in email.quoprimime.encode where it

truncated lines ending in a character needing encoding but no newline by

using a more efficient algorithm that doesn't have the bug.

- Issue #19082: Working xmlrpc.server and xmlrpc.client examples. Both in

modules and in documentation. Initial patch contributed by Vajrasky Kok.

- Issue #20138: The wsgiref.application_uri() and wsgiref.request_uri()

functions now conform to PEP 3333 when handle non-ASCII URLs.

- Issue #19097: Raise the correct Exception when cgi.FieldStorage is given an

invalid fileobj.

- Issue #20217: Fix build in SCHED_SPORADIC is defined.

- Issue #13107: argparse and optparse no longer raises an exception when output

a help on environment with too small COLUMNS. Based on patch by

Elazar Gershuni.

- Issue #20207: Always disable SSLv2 except when PROTOCOL_SSLv2 is explicitly

asked for.

- Issue #18960: The tokenize module now ignore the source encoding declaration

on the second line if the first line contains anything except a comment.

- Issue #20078: Reading malformed zipfiles no longer hangs with 100% CPU

consumption.

- Issue #20113: os.readv() and os.writev() now raise an OSError exception on

error instead of returning -1.

- Issue #20072: Fixed multiple errors in tkinter with wantobjects is False.

- Issue #20108: Avoid parameter name clash in inspect.getcallargs().

- Issue #12692: Backport the fix for ResourceWarning in test_urllib2net. This

also helps in closing the socket when Connection Close header is not sent.

- Issue #19422: Explicitly disallow non-SOCK_STREAM sockets in the ssl

module, rather than silently let them emit clear text data.

- Issue #18116: getpass was always getting an error when testing /dev/tty,

and thus was always falling back to stdin, and would then raise an exception

if stdin could not be used (such as /dev/null). It also leaked an open file.

All of these issues are now fixed.

- Issue #20027: Fixed locale aliases for devanagari locales.

- Issue #20067: Tkinter variables now work when wantobjects is false.

- Issue #19020: Tkinter now uses splitlist() instead of split() in configure

methods.

- Fix TypeError on "setup.py upload --show-response".

- Issue #12226: HTTPS is now used by default when connecting to PyPI.

- Issue #20045: Fix "setup.py register --list-classifiers".

- Issue #18879: When a method is looked up on a temporary file, avoid closing

the file before the method is possibly called.

- Issue #20034: Updated alias mapping to most recent locale.alias file

from X.org distribution using makelocalealias.py.

- Issue #5815: Fixed support for locales with modifiers. Fixed support for

locale encodings with hyphens.

- Issue #20026: Fix the sqlite module to handle correctly invalid isolation

level (wrong type).

- Issue #18829: csv.Dialect() now checks type for delimiter, escapechar and

quotechar fields. Original patch by Vajrasky Kok.

- Issue #19855: uuid.getnode() on Unix now looks on the PATH for the

executables used to find the mac address, with /sbin and /usr/sbin as

fallbacks.

- Issue #20007: HTTPResponse.read(0) no more prematurely closes connection.

Original patch by Simon Sapin.

- Issue #19912: Fixed numerous bugs in ntpath.splitunc().

- Issue #19911: ntpath.splitdrive() now correctly processes the 'İ' character

(U+0130, LATIN CAPITAL LETTER I WITH DOT ABOVE).

- Issue #19532: python -m compileall with no filename/directory arguments now

respects the -f and -q flags instead of ignoring them.

- Issue #19623: Fixed writing to unseekable files in the aifc module.

- Issue #17919: select.poll.register() again works with poll.POLLNVAL on AIX.

Fixed integer overflow in the eventmask parameter.

- Issue #19063: if a Charset's body_encoding was set to None, the email

package would generate a message claiming the Content-Transfer-Encoding

was 7bit, and produce garbage output for the content. This now works.

A couple of other set_payload mishandlings of non-ASCII are also fixed.

- Issue #17200: telnetlib's read_until and expect timeout was broken by the

fix to Issue #14635 in Python 3.3.0 to be interpreted as milliseconds

instead of seconds when the platform supports select.poll (ie: everywhere).

It is now treated as seconds once again.

- Issue #17429: platform.linux_distribution() now decodes files from the UTF-8

encoding with the surrogateescape error handler, instead of decoding from the

locale encoding in strict mode. It fixes the function on Fedora 19 which is

probably the first major distribution release with a non-ASCII name. Patch

written by Toshio Kuratomi.

- Issue #19929: Call os.read with 32768 within subprocess.Popen.communicate

rather than 4096 for efficiency. A microbenchmark shows Linux and OS X

both using ~50% less cpu time this way.

- Issue #19506: Use a memoryview to avoid a data copy when piping data

to stdin within subprocess.Popen.communicate. 5-10% less cpu usage.

- Issue #19839: Fix regression in bz2 module's handling of non-bzip2 data at

EOF, and analogous bug in lzma module.

- Issue #19138: doctest's IGNORE_EXCEPTION_DETAIL now allows a match when

no exception detail exists (no colon following the exception's name, or

a colon does follow but no text follows the colon).

- Issue #19834: Support unpickling of exceptions pickled by Python 2.

- Issue #15798: Fixed subprocess.Popen() to no longer fail if file

descriptor 0, 1 or 2 is closed.

- Issue #19088: Fixed incorrect caching of the copyreg module in

object.__reduce__() and object.__reduce_ex__().

- Fixed _pickle.Unpickler to not fail when loading empty strings as

persistent IDs.

- Issue #11480: Fixed copy.copy to work with classes with custom metaclasses.

Patch by Daniel Urban.

- Issue #6477: Added support for pickling the types of built-in singletons

(i.e., Ellipsis, NotImplemented, None).

- Issue #11508: Fixed uuid.getnode() and uuid.uuid1() on environment with

virtual interface. Original patch by Kent Frazier.

- Issue #11489: JSON decoder now accepts lone surrogates.

- Issue #19545: Avoid chained exceptions while passing stray % to

time.strptime(). Initial patch by Claudiu Popa.

- Issue #19633: Fixed writing not compressed 16- and 32-bit wave files on

big-endian platforms.

- Issue #19449: in csv's writerow, handle non-string keys when generating the

error message that certain keys are not in the 'fieldnames' list.

- Fix test.support.bind_port() to not cause an error when Python was compiled

on a system with SO_REUSEPORT defined in the headers but run on a system

with an OS kernel that does not support that reasonably new socket option.

- Fix compilation error under gcc of the ctypes module bundled libffi for arm.

- Issue #19523: Closed FileHandler leak which occurred when delay was set.

- Issue #13674: Prevented time.strftime from crashing on Windows when given

a year before 1900 and a format of %y.

- Issue #19544 and Issue #6286: Restore use of urllib over http allowing use

of http_proxy for Distutils upload command, a feature accidentally lost

in the rollback of distutils2.

- Issue #19544 and Issue #7457: Restore the read_pkg_file method to

distutils.dist.DistributionMetadata accidentally removed in the undo of

distutils2.

- Issue #1575020: Fixed support of 24-bit wave files on big-endian platforms.

- Issue #19480: HTMLParser now accepts all valid start-tag names as defined

by the HTML5 standard.

- Issue #6157: Fixed tkinter.Text.debug(). Original patch by Guilherme Polo.

- Issue #6160: The bbox() method of tkinter.Spinbox now returns a tuple of

integers instead of a string. Based on patch by Guilherme Polo.

- Issue #10197: Rework subprocess.get[status]output to use subprocess

functionality and thus to work on Windows. Patch by Nick Coghlan.

- Issue #19286: Directories in ``package_data`` are no longer added to

the filelist, preventing failure outlined in the ticket.

IDLE

----

- Issue #17390: Add Python version to Idle editor window title bar.

Original patches by Edmond Burnett and Kent Johnson.

- Issue #18960: IDLE now ignores the source encoding declaration on the second

line if the first line contains anything except a comment.

- Issue #20058: sys.stdin.readline() in IDLE now always returns only one line.

- Issue #19481: print() of string subclass instance in IDLE no longer hangs.

- Issue #18270: Prevent possible IDLE AttributeError on OS X when no initial

shell window is present.

Tests

-----

- Issue #19804: The test_find_mac test in test_uuid is now skipped if the

ifconfig executable is not available.

- Issue #19886: Use better estimated memory requirements for bigmem tests.

- Issue #20055: Fix test_shutil under Windows with symlink privileges held.

Patch by Vajrasky Kok.

- Issue #19938: Re-enabled test_bug_1333982 in test_dis, which had been

disabled since 3.0 due to the changes in listcomp handling.

- Issue #19320: test_tcl no longer fails when wantobjects is false.

- Issue #19683: Removed empty tests from test_minidom. Patch by Ajitesh Gupta.

- Issue #19919: Fix flaky SSL test. connect_ex() sometimes returns

EWOULDBLOCK on Windows or VMs hosted on Windows.

- Issue #19912: Added tests for ntpath.splitunc().

- Issue #19828: Fixed test_site when the whole suite is run with -S.

- Issue #19928: Implemented a test for repr() of cell objects.

- Issue #19535: Fixed test_docxmlrpc when python is run with -OO.

- Issue #19926: Removed unneeded test_main from test_abstract_numbers.

Patch by Vajrasky Kok.

- Issue #19595, #19987: Re-enabled a long-disabled test in test_winsound.

- Issue #19588: Fixed tests in test_random that were silently skipped most

of the time. Patch by Julian Gindi.

- Issue #19596: Set untestable tests in test_importlib to None to avoid

reporting success on empty tests.

- Issue #19440: Clean up test_capi by removing an unnecessary __future__

import, converting from test_main to unittest.main, and running the

_testcapi module tests within a unittest TestCase.

- Issue #18702, 19572: All skipped tests now reported as skipped.

- Issue #19085: Added basic tests for all tkinter widget options.

Documentation

-------------

- Issue #20265: Updated some parts of the Using Windows document.

- Issue #20266: Updated some parts of the Windows FAQ.

- Issue #20255: Updated the about and bugs pages.

- Issue #20253: Fixed a typo in the ipaddress docs that advertised an

illegal attribute name. Found by INADA Naoki.

- Issue #19963: Document that importlib.import_module() no longer requires

importing parent packages separately.

- Issue #18840: Introduce the json module in the tutorial, and de-emphasize

the pickle module.

- Issue #19845: Updated the Compiling Python on Windows section.

- Issue #19795: Improved markup of True/False constants.

- Issue #18326: Clarify that list.sort's arguments are keyword-only. Also,

attempt to reduce confusion in the glossary by not saying there are

different "types" of arguments and parameters.

Build

-----

- Issue #19788: kill_python(_d).exe is now run as a PreBuildEvent on the

pythoncore sub-project. This should prevent build errors due a previous

build's python(_d).exe still running.

- Add workaround for VS 2010 nmake clean issue. VS 2010 doesn't set up PATH

for nmake.exe correctly.

Tools/Demos

-----------

- Issue #19936: Added executable bits or shebang lines to Python scripts which

requires them. Disable executable bits and shebang lines in test and

benchmark files in order to prevent using a random system python, and in

source files of modules which don't provide command line interface. Fixed

shebang line to use python3 executable in the unittestgui script.

- Issue #18960: 2to3 and the findnocoding.py script now ignore the source

encoding declaration on the second line if the first line contains anything

except a comment.

What's New in Python 3.3.3?

===========================

*Release date: 17-Nov-2013*

No changes from release candidate 2.

What's New in Python 3.3.3 release candidate 2?

===============================================

*Release date: 11-Nov-2013*

Library

-------

- Issue #19227: Any re-seeding of the OpenSSL RNG on fork has been removed;

this should be handled by OpenSSL itself or by the application.

- Issue #19435: Fix directory traversal attack on CGIHttpRequestHandler.

Tests

-----

- Issue #18964: Fix test_tcl when run with Tcl/Tk versions < 8.5.

Build

-----

- Issue #15663: Revert OS X installer built-in Tcl/Tk support for 3.3.3.

Some third-party projects, such as Matplotlib and PIL/Pillow,

depended on being able to build with Tcl and Tk frameworks in

/Library/Frameworks.

What's New in Python 3.3.3 release candidate 1?

===============================================

*Release date: 27-Oct-2013*

Core and Builtins

-----------------

- Issue #18603: Ensure that PyOS_mystricmp and PyOS_mystrnicmp are in the

Python executable and not removed by the linker's optimizer.

- Issue #19279: UTF-7 decoder no more produces illegal strings.

- Fix macro expansion of _PyErr_OCCURRED(), and make sure to use it in at

least one place so as to avoid regressions.

- Issue #19014: memoryview.cast() is now allowed on zero-length views.

- Issue #19098: Prevent overflow in the compiler when the recursion limit is set

absurdly high.

- Issue #18942: sys._debugmallocstats() output was damaged on Windows.

- Issue #18667: Add missing "HAVE_FCHOWNAT" symbol to posix._have_functions.

- Issue #18368: PyOS_StdioReadline() no longer leaks memory when realloc()

fails.

- Issue #16741: Fix an error reporting in int().

- Issue #17899: Fix rare file descriptor leak in os.listdir().

- Issue #18552: Check return value of PyArena_AddPyObject() in

obj2ast_object().

- Issue #18560: Fix potential NULL pointer dereference in sum().

- Issue #15905: Fix theoretical buffer overflow in handling of sys.argv[0],

prefix and exec_prefix if the operation system does not obey MAXPATHLEN.

- Issue #18344: Fix potential ref-leaks in _bufferedreader_read_all().

- Issue #17872: Fix a segfault in marshal.load() when input stream returns

more bytes than requested.

- Issue #18426: Fix NULL pointer dereference in C extension import when

PyModule_GetDef() returns an error.

- Issue #18328: Reorder ops in PyThreadState_Delete*() functions. Now the

tstate is first removed from TLS and then deallocated.

- Issue #18184: PyUnicode_FromFormat() and PyUnicode_FromFormatV() now raise

OverflowError when an argument of %c format is out of range.

- Issue #18137: Detect integer overflow on precision in float.__format__()

and complex.__format__().

- Issue #18183: Fix various unicode operations on strings with large unicode

codepoints.

- Issue #18180: Fix ref leak in _PyImport_GetDynLoadWindows().

- Issue #18038: SyntaxError raised during compilation sources with illegal

encoding now always contains an encoding name.

- Issue #17644: Fix a crash in str.format when curly braces are used in square

brackets.

- Issue #17983: Raise a SyntaxError for a ``global __class__`` statement in a

class body.

- Issue #17927: Frame objects kept arguments alive if they had been copied into

a cell, even if the cell was cleared.

Library

-------

- Issue #19395: Raise an exception when attempting to pickle a bz2 or lzma

compressor/decompressor object, rather than creating a pickle that would

cause a segfault when loaded and used.

- Issue #19227: Try to fix deadlocks caused by re-seeding then OpenSSL

pseudo-random number generator on fork().

- Issue #16037: HTTPMessage.readheaders() raises an HTTPException when more than

100 headers are read. Adapted from patch by Jyrki Pulliainen.

- Issue #16040: CVE-2013-1752: nntplib: Limit maximum line lengths to 2048 to

prevent readline() calls from consuming too much memory. Patch by Jyrki

Pulliainen.

- Issue #16041: CVE-2013-1752: poplib: Limit maximum line lengths to 2048 to

prevent readline() calls from consuming too much memory. Patch by Jyrki

Pulliainen.

- Issue #17997: Change behavior of ``ssl.match_hostname()`` to follow RFC 6125,

for security reasons. It now doesn't match multiple wildcards nor wildcards

inside IDN fragments.

- Issue #16039: CVE-2013-1752: Change use of readline in imaplib module to limit

line length. Patch by Emil Lind.

- Issue #19393: Fix symtable.symtable function to not be confused when there are

functions or classes named "top".

- Issue #19339: telnetlib module is now using time.monotonic() when available

to compute timeout.

- Issue #19288: Fixed the "in" operator of dbm.gnu databases for string

argument. Original patch by Arfrever Frehtes Taifersar Arahesis.

- Issue #19287: Fixed the "in" operator of dbm.ndbm databases for string

argument. Original patch by Arfrever Frehtes Taifersar Arahesis.

- Issue #19327: Fixed the working of regular expressions with too big charset.

- Issue #19350: Increasing the test coverage of macurl2path. Patch by Colin

Williams.

- Issue #19352: Fix unittest discovery when a module can be reached

through several paths (e.g. under Debian/Ubuntu with virtualenv).

- Issue #15207: Fix mimetypes to read from correct part of Windows registry

Original patch by Dave Chambers

- Issue #8964: fix platform._sys_version to handle IronPython 2.6+.

Patch by Martin Matusiak.

- Issue #16038: CVE-2013-1752: ftplib: Limit amount of data read by

limiting the call to readline(). Original patch by Michał

Jastrzębski and Giampaolo Rodola.

- Issue #18235: Fix the sysconfig variables LDSHARED and BLDSHARED under AIX.

Patch by David Edelsohn.

- Issue #19276: Fixed the wave module on 64-bit big-endian platforms.

- Issue #18776: atexit callbacks now display their full traceback when they

raise an exception.

- Issue #17827: Add the missing documentation for ``codecs.encode`` and

``codecs.decode``.

- Issue #18458: Prevent crashes with newer versions of libedit. Its readline

emulation has changed from 0-based indexing to 1-based like gnu readline.

Original patch by Ronald Oussoren.

- Issue #18919: If the close() method of a writer in the sunau or wave module

failed, second invocation of close() and destructor no more raise an

exception.

- Issue #19131: The aifc module now correctly reads and writes sampwidth of

compressed streams.

- Issue #19158: a rare race in BoundedSemaphore could allow .release() too

often.

- Issue #18037: 2to3 now escapes '\u' and '\U' in native strings.

- Issue #19137: The pprint module now correctly formats instances of set and

frozenset subclasses.

- Issue #19092: contextlib.ExitStack now correctly reraises exceptions

from the __exit__ callbacks of inner context managers (Patch by Hrvoje

Nikšić)

- Issue #12641: Avoid passing "-mno-cygwin" to the mingw32 compiler, except

when necessary. Patch by Oscar Benjamin.

- Issue #18594: The fast path for collections.Counter() was never taken

due to an over-restrictive type check. And the fallback path did

not implement the same algorithm as the pure python code.

- Properly initialize all fields of a SSL object after allocation.

- Issue #4366: Fix building extensions on all platforms when --enable-shared

is used.

- Issue #18950: Fix miscellaneous bugs in the sunau module.

Au_read.readframes() now updates current file position and reads correct

number of frames from multichannel stream. Au_write.writeframesraw() now

correctly updates current file position. Au_read.getnframes() now returns an

integer (as in Python 2). Au_read and Au_write now correctly works with file

object if start file position is not a zero.

- Issue #19053: ZipExtFile.read1() with non-zero argument no more returns empty

bytes until end of data.

- Issue #19028: Fixed tkinter.Tkapp.merge() for non-string arguments.

- Issue #3015: Fixed tkinter with wantobject=False. Any Tcl command call

returned empty string.

- Issue #18050: Fixed an incompatibility of the re module with Python 3.3.0

binaries.

- Issue #19037: The mailbox module now makes all changes to maildir files

before moving them into place, to avoid race conditions with other programs

that may be accessing the maildir directory.

- Issue #14984: On POSIX systems, when netrc is called without a filename

argument (and therefore is reading the user's $HOME/.netrc file), it now

enforces the same security rules as typical ftp clients: the .netrc file must

be owned by the user that owns the process and must not be readable by any

other user.

- Issue #18873: The tokenize module now detects Python source code encoding

only in comment lines.

- Issue #17324: Fix http.server's request handling case on trailing '/'. Patch

contributed by Vajrasky Kok.

- Issue #19018: The heapq.merge() function no longer suppresses IndexError

in the underlying iterables.

- Issue #18784: The uuid module no more attempts to load libc via ctypes.CDLL,

if all necessary functions are already found in libuuid.

Patch by Evgeny Sologubov.

- Issue #18672: Fixed format specifiers for Py_ssize_t in debugging output in

the _sre module.

- Issue #18830: inspect.getclasstree() no more produces duplicated entries even

when input list contains duplicates.

- Issue #18909: Fix _tkinter.tkapp.interpaddr() on Windows 64-bit, don't cast

64-bit pointer to long (32 bits).

- Issue #18876: The FileIO.mode attribute now better reflects the actual mode

under which the file was opened. Patch by Erik Bray.

- Issue #18418: After fork(), reinit all threads states, not only active ones.

Patch by A. Jesse Jiryu Davis.

- Issue #16611: http.cookie now correctly parses the 'secure' and 'httponly'

cookie flags.

- Issue #11973: Fix a problem in kevent. The flags and fflags fields are now

properly handled as unsigned.

- Issue #17702: On error, os.environb now removes suppress the except context

when raising a new KeyError with the original key.

- Issue #18755: Fixed the loader used in imp to allow get_data() to be called

multiple times.

- Issue #16809: Fixed some tkinter incompabilities with Tcl/Tk 8.6.

- Issue #16809: Tkinter's splitlist() and split() methods now accept Tcl_Obj

argument.

- Issue #18324: set_payload now correctly handles binary input. This also

supersedes the previous fixes for #14360, #1717, and #16564.

- Issue #17119: Fixed integer overflows when processing large strings and tuples

in the tkinter module.

- Issue #18747: Re-seed OpenSSL's pseudo-random number generator after fork.

A pthread_atfork() parent handler is used to seed the PRNG with pid, time

and some stack data.

- Issue #8865: Concurrent invocation of select.poll.poll() now raises a

RuntimeError exception. Patch by Christian Schubert.

- Issue #13461: Fix a crash in the TextIOWrapper.tell method on 64-bit

platforms. Patch by Yogesh Chaudhari.

- Issue #18777: The ssl module now uses the new CRYPTO_THREADID API of

OpenSSL 1.0.0+ instead of the deprecated CRYPTO id callback function.

- Issue #18768: Correct doc string of RAND_edg(). Patch by Vajrasky Kok.

- Issue #18178: Fix ctypes on BSD. dlmalloc.c was compiled twice which broke

malloc weak symbols.

- Issue #18709: Fix CVE-2013-4238. The SSL module now handles NULL bytes

inside subjectAltName correctly. Formerly the module has used OpenSSL's

GENERAL_NAME_print() function to get the string represention of ASN.1

strings for ``rfc822Name`` (email), ``dNSName`` (DNS) and

``uniformResourceIdentifier`` (URI).

- Issue #18756: Improve error reporting in os.urandom() when the failure

is due to something else than /dev/urandom not existing (for example,

exhausting the file descriptor limit).

- Issue #18405: Improve the entropy of crypt.mksalt().

- Issue #19151: Fix docstring and use of _get_supported_file_loaders() to

reflect 2-tuples.

- Issue #18676: Change 'positive' to 'non-negative' in queue.py put and get

docstrings and ValueError messages. Patch by Zhongyue Luo

- Issue #18681: Fix a NameError in imp.reload() (noticed by Weizhao Li).

- Issue #8112: xlmrpc.server's DocXMLRPCServer server no longer raises an error

if methods have annotations; it now correctly displays the annotations.

- Issue #17998: Fix an internal error in regular expression engine.