Python for Mac

Security

• Fix http.cookiejar.DefaultCookiePolicy accepting and returning cookies with a negative Version attribute without checking their domain against the request host. Such cookies are now ignored.
• tarfile.tar_filter() now rejects link members whose path resolves to the destination directory itself, as tarfile.data_filter() already did.
• ssl now rejects TLS certificate chains that contain any of a set of compromised eMudhra intermediate CA keys. This is an extraordinary measure and a last line of defense: removing trust is primarily the job of the platform root store, and the built-in denylist only blocks connections while that update has not yet reached the OS, a container image, or a bundled trust store in various Python packages. Entries are added to the denylist only under a very high threshold. The denylist matches on the public key (the SHA-256 digest of the RFC 5280 SubjectPublicKeyInfo), so it also covers the cross-signed certificates that reuse one of the distrusted keys.

Core and Builtins

• Fix the location reported for invalid escape sequences in f-strings and t-strings. The SyntaxError now points at the literal part that contains the escape, instead of at the closing quote.
• Fix a crash in tokenize when a mismatched closing bracket follows the opening brace of an f-string or t-string replacement field, as in f'{]a'. It now raises the same "unmatched" error as the parser.
• Fix venv path discovery when the base executable resolves to a location outside the installation pointed to by the home key in pyvenv.cfg. The standard library is now found from home, and extension modules from the resolved executable's installation, instead of falling back to the compiled-in prefix.
• Fix a crash on 32-bit platforms when left shifting an int by a count close to sys.maxsize * sys.int_info.bits_per_digit. OverflowError is now raised, as for other too large counts.
• Fix bytearray.__init__() leaving uninitialized memory in the object when it fails on a list or tuple containing an integer not in range(256). The object is now empty after the failed call.
• Fix a possible crash when assigning metadata to classmethod or staticmethod objects.
• Fix a race in list.__sizeof__() when a list is concurrently resized on a free-threaded build.

Full list of changes available here