Python (64-bit)

What's new in this version:

Security:
- os.mkdir() on Windows now accepts mode of 0o700 to restrict the new directory to the current user. This fixes CVE-2024-4030 affecting tempfile.mkdtemp() in scenarios where the base temporary directory is more permissive than the default.
- Update bundled libexpat to 2.6
- Detect BLAKE2, SHA3, Shake, & truncated SHA512 support in the OpenSSL-ish libcrypto library at build time. This allows hashlib to be used with libraries that do not to support every algorithm that upstream OpenSSL does

Core and Builtins:
- Fix execution of annotation scopes within classes when globals is set to a non-dict
- Speed up os.path.normpath() with a direct C call
- Fix bug where names are unexpectedly mangled in the bases of generic classes
- Fix bug where names appearing after a generic class are mangled as if they are in the generic class
- Fix os.path.isfile() on Windows for pipes
- Non-builtin modules built with argument clinic were crashing if used in a subinterpreter before the main interpreter. The objects that were causing the problem by leaking between interpreters carelessly have been fixed
- Fixes type.__type_params__ to return an empty tuple instead of a descriptor
- Fix _Py_ClearImmortal() assertion: use _Py_IsImmortal() to tolerate reference count lower than _Py_IMMORTAL_REFCNT. Fix the assertion for the stable ABI, when a C extension is built with Python 3.11 or lower
- Fix incorrect UnboundLocalError when two comprehensions in the same function both reference the same name, and in one comprehension the name is bound while in the other it’s an implicit global
- Break a loop between the Python implementation of the decimal module and the Python code for integer to string conversion. Also optimize integer to string conversion for values in the range from 9_000 to 135_000 decimal digits
- Fix bug where generator.close does not free the generator frame’s locals
- Fix crash in compiler on ‘async with’ that has many context managers
- Prevent agen.aclose() objects being re-used after .throw()
- prevent concurrent access to an async generator via athrow().throw() or asend().throw(
- Fixed a possible segfault during garbage collection of _asyncio.FutureIter object

Library:
- Fix regression to allow logging configuration with multiprocessing queue types
- Fix issue with shutil.rmtree() where a RecursionError is raised on deep directory trees
- Partially fix issue with shutil.rmtree() where a RecursionError is raised on deep directory trees. A recursion error is no longer raised when rmtree.avoids_symlink_attacks is false
- Fix performance regression in the tokenize module by caching the line token attribute and calculating the column offset more efficiently
- Fix issue with os.fwalk() where a RecursionError was raised on deep directory trees by adjusting the implementation to be iterative instead of recursive
- Now, the method sock_connect of asyncio.ProactorEventLoop raises a ValueError if given socket is not in non-blocking mode, as well as in other loop implementations
- Fix high DPI causes turtledemo(turtle-graphics examples) windows blurr
- Fix an AttributeError in the email module when re-fold a long address list. Also fix more cases of incorrect encoding of the address separator in the address list
- Make pdb return to caller frame correctly when f_trace of the caller frame is not se
- Fixed issue where kwargs were no longer passed to the logging handler QueueHandle
- The Python implementation of the decimal module could appear to hang in relatively small power cases (like 2**117) if context precision was set to a very high value. A different method to check for exactly representable results is used now that doesn’t rely on computing 10**precision (which could be effectively too large to compute)
- Fix inspect.signature() for non-comparable callables
- Fix an edge case in binascii.a2b_base64() strict mode, where excessive padding is not detected when no padding is necessary
- Fix an unraisable exception in telnetlib.Telnet.__del__() when the __init__() method was not called
- Fix a bug where sqlite3.iterdump() could fail if a custom row factory was used
- Fix regression introduced in gh-103193 that meant that calling inspect.getattr_static() on an instance would cause a strong reference to that instance’s class to persist in an internal cache in the inspect module. This caused unexpected memory consumption if the class was dynamically created, the class held strong references to other objects which took up a significant amount of memory, and the cache contained the sole strong reference to the class. The fix for the regression leads to a slowdown in getattr_static(), but the function should still be significantly faster than it was in Python 3.11
- Fixed unittest.mock.create_autospec() to configure parent mock with keyword arguments
- Fix incorrect argument substitution when typing.Unpack is used with the builtin tuple. typing.Unpack now raises TypeError when used with certain invalid types
- Fix dataclasses.dataclass() not creating a __weakref__ slot when subclassing typing.Generic
- Do not try to get the source line for made up file name “sys” in warnings
- Fix erroneous NameError when calling typing.get_type_hints() on a class that made use of PEP 695 type parameters in a module that had from __future__ import annotations at the top of the file
- Don’t raise DeprecationWarning when a sequence of parameters is used to bind indexed, nameless placeholders. See also gh-100668
- Fix TypeError in email.message.Message.get_payload() when the charset is RFC 2231 encoded
- Fix IndexError when parse some emails with invalid Message-ID (including one-off addresses generated by Microsoft Outlook)
- Improve the error messages emitted by tarfile deprecation warnings relating to PEP 706. If a filter argument is not provided to extract() or extractall, the deprecation warning now points to the line in the user’s code where the relevant function was called
- site module now parses .pth file with UTF-8 first, and locale encoding if UnicodeDecodeError happened. It supported only locale encoding before
- Fixes a bug when doctest.DocTestFinder was failing on wrapped builtin_function_or_method
- ipaddress.IPv6Address.is_loopback() will now return True for IPv4-mapped loopback addresses, i.e. addresses in the ::ffff:127.0.0.0/104 address space
- Fix support of non-ASCII user names in bytes paths in os.path.expanduser() on Posix
- Only treat '\n', '\r' and '\r\n' as line separators in re-folding the email messages. Preserve control characters '\v', '\f', '\x1c', '\x1d' and '\x1e' and Unicode line separators '\x85', '\u2028' and '\u2029' as is
-
Fixed various false positives and false negatives i:
- ipaddress.IPv4Address.is_private (see these docs for details)
- ipaddress.IPv4Address.is_global
- ipaddress.IPv6Address.is_private
- ipaddress.IPv6Address.is_global

- Also in the corresponding ipaddress.IPv4Network and ipaddress.IPv6Network attributes.
- Fix lack of newline characters in trace module output when line tracing is enabled but source code line for current frame is not available
- Fix missing spaces in email headers when the spaces are mixed with encoded 8-bit characters
- Prepare Tkinter for C API changes in Tcl 8.7/9.0 to avoid _tkinter.Tcl_Obj being unexpectedly returned instead of bool, str, bytearray, or int
- Fixed handling in inspect.Signature.bind() of keyword arguments having the same name as positional-only arguments when a variadic keyword argument (e.g. **kwargs) is present
- bpo-45767: Fix integer conversion in os.major(), os.minor(), and os.makedev(). Support device numbers larger than 2**63-1. Support non-existent device number (NODEV).
- bpo-40943: Fix several IndexError when parse emails with truncated Message-ID, address, routes, etc, e.g. example@.
- bpo-30988: Fix parsing of emails with invalid address headers having a leading or trailing dot
- Fix urllib.parse.urlunparse() and urllib.parse.urlunsplit() for URIs with path starting with multiple slashes and no authority
- bpo-15010: unittest.TestLoader.discover() now saves the original value of unittest.TestLoader._top_level_dir and restores it at the end of the call.

Documentation:
- The minimum Sphinx version required for the documentation is now 6.2.1
- Changes to documentation files and config outputs to reflect the new location for reporting bugs - i.e. GitHub rather than bugs.python.org

Tests:
- regrtest test runner: Add XML support to the refleak checker (-R option)

Windows:
- Adds Unicode support and fixes audit events for _winapi.CreateNamedPipe
- Fixes py.exe handling of shebangs like /usr/bin/env python3.12, which were previously interpreted as python3.exe instead of python3.12.exe
- Fixes launcher updates not being installed
- Update Windows installer to use SQLite 3.45.3
- Suppress the warning displayed on virtual environment creation when the requested and created paths differ only by a short (8.3 style) name. Warnings will continue to be shown if a junction or symlink in the path caused the venv to be created in a different location than originally requested

macOS:
- Update macOS installer to use SQLite 3.45.3
- Update macOS installer to Tcl/Tk 8.6.14

IDLE:
- bpo-34774: Use user-selected color theme for Help => IDLE Doc.

C API:
- Fix crash when a thread state that was created by PyGILState_Ensure() calls a destructor that during PyThreadState_Clear() that calls back into PyGILState_Ensure() and PyGILState_Release(). This might occur when in the free-threaded build or when using thread-local variables whose destructors call PyGILState_Ensure()
- Improve validation logic in the C implementation of datetime.fromisoformat() to better handle invalid years