Commits

Commits on Sep 30, 2026

gh-156293: Use-after-free for server-side SSLContext with sni_callback (#158504)

sethmlarson
and
gpshead
authored
34a53dc
gh-156793: Validate SSLContext.wrap_bio() parameters like wrap_socket() (#158503)

authored
1697ea3

Commits on Aug 18, 2026

gh-155292: Don't consider Unicode codepoint attributes outside RFC 3454 (GH-155293)

authored
7e109d0

Commits on Jun 23, 2026

gh-143927: Normalize all line endings (CR, CRLF, and LF) in configparser (GH-143929)
sethmlarson
authored
5858e42

Commits on Jun 2, 2026

Commits on May 14, 2026

gh-149144: Use decodeURIComponent() for UTF-8 support in js_output() (GH-149157)
sethmlarson
authored
461b1d9

Commits on Apr 22, 2026

gh-90309: Base64-encode cookie values embedded in JS
sethmlarson
authored
76b3923

Commits on Apr 21, 2026

gh-148808: Add boundary check to asyncio.AbstractEventLoop.sock_recvf… (#148809)
sethmlarson
authored
1274766

Commits on Apr 10, 2026

gh-146211: Reject CR/LF in HTTP tunnel request headers (#146212)

sethmlarson
and
illia-v
authored
05ed7ce

Commits on Mar 20, 2026

gh-143930: Reject leading dashes in webbrowser URLs
sethmlarson
authored
82a24a4

Commits on Mar 11, 2026

Add GitHub team for maintaining fuzzers

sethmlarson
and
StanFromIreland
authored
805ca4f
gh-141707: Skip TarInfo DIRTYPE normalization during GNU long name handling

sethmlarson
and
e-nomem
authored
42d754e

Commits on Feb 12, 2026

gh-143916: Allow HTAB in wsgiref header values

sethmlarson
and
vstinner
authored
66da7bf

Commits on Feb 5, 2026

gh-74453: Deprecate os.path.commonprefix (#144436)

authored
957f9fe
gh-144484: Warn users not to use wsgiref in production
sethmlarson
authored
7e777c5

Commits on Feb 3, 2026

gh-74453: Add stronger security warning to os.path.commonprefix (GH-144401)
sethmlarson
authored
4e15b8d

Commits on Feb 2, 2026

gh-144376: Only run 'address' fuzzer for python3-libraries (#144398)
sethmlarson
authored
5f91577

Commits on Jan 23, 2026

gh-144125: email: verify headers are sound in BytesGenerator

authored
052e55e

Commits on Jan 20, 2026

Commits on Jan 19, 2026

gh-143935: Email preserve parens when folding comments (#143936)

sethmlarson
and
beledouxdenis
authored
17d1490

Commits on Jan 17, 2026

gh-143916: Reject control characters in wsgiref.headers.Headers (GH-143917)
sethmlarson
authored
f7fceed

Commits on Jan 16, 2026

gh-143572: Run 'python3-libraries' fuzzer in CI using CIFuzz (#143749)

authored
edeebe2

Commits on Dec 3, 2025

gh-142145: Remove quadratic behavior in node ID cache clearing (GH-142146)

sethmlarson
and
jacobtylerwalls
authored
08d8e18

Commits on Sep 25, 2025

gh-139330: Check expat version/checksum in SBOM with refresh.sh
sethmlarson
authored
89b5571

Commits on May 24, 2025

gh-128840: Limit the number of parts in IPv6 address parsing (GH-128841)

authored
47f1161

Commits on Jan 31, 2025

gh-105704: Disallow square brackets (`[` and `]`) in domain names for parsed URLs (#129418)

sethmlarson
and
ZeroIntensity
authored
d89a5f6

Commits on Nov 15, 2024

Add PEP 761 to What's New (#126550)

sethmlarson
and
hugovk
authored
a2c180f

Commits on Nov 13, 2024

gh-126623: Update libexpat to 2.6.4, make future updates easier (GH-126792)
sethmlarson
authored
3c99969

Commits on Sep 7, 2024

gh-122792: Make IPv4-mapped IPv6 address properties consistent with IPv4 (GH-122793)
sethmlarson
authored
76a1c5d

Commits on Sep 4, 2024

gh-123678: Upgrade libexpat 2.6.3 (#123689)
sethmlarson
authored
40bdb0d

Commits on Sep 2, 2024

gh-123458: Skip SBOM generation if no git repository is detected (#123507)
sethmlarson
authored
db42934