Integrate 2.7.18.14 into 2.7#85

Merged

icanhasmath merged 24 commits into

2.7from

2.7.18.14-part2

Jun 12, 2026

Commits on Jun 10, 2026

Address CVE-2025-8194 (tarfile) and CVE-2026-4786 (webbrowser)

icanhasmath
and
claude
committed
Reject control characters in header/command APIs (injection cluster)

icanhasmath
and
claude
committed
Reject header injection when generating email messages (CVE-2024-6923)

icanhasmath
and
claude
committed
Harden zipfile against overlapping entries and bad ZIP64 locator

icanhasmath
and
claude
committed
Reject misplaced square brackets in parsed URL hosts (CVE-2025-0938)

icanhasmath
and
claude
committed
Fix quadratic complexity in minidom and os.path.expandvars

icanhasmath
and
claude
committed
Fix quadratic complexity in HTMLParser at EOF (CVE-2025-6069)

icanhasmath
and
claude
committed
Add strict validation option to base64.b64decode

icanhasmath
and
claude
committed
Don't normalize AREGTYPE follow-up headers to DIRTYPE (CVE-2025-13462)

icanhasmath
and
claude
committed
2.7.18.14 Release

icanhasmath
and
claude
committed
Fix Windows test-suite hangs on invalid file descriptors

icanhasmath
and
claude
committed
asyncore: recognize WSAECONNRESET/WSAESHUTDOWN as disconnects on Windows

icanhasmath
and
claude
committed
test: gate test_bigrepeat on sys.maxsize, not sys.maxint (win64)

icanhasmath
and
claude
committed
test_socket: restore missing _have_socket_can/_have_socket_alg helpers

icanhasmath
and
claude
committed
ctypes: fix find_msvcrt on VS2015+ builds; skip win64 pointer-truncation test

icanhasmath
and
claude
committed
ssl: accept WSAENOTCONN when probing whether a socket is connected

icanhasmath
and
claude
committed
test_socket: bind 'support' alias (partial 3.x backport)

icanhasmath
and
claude
committed
test_ctypes: don't assert find_library("c") is non-None on UCRT

icanhasmath
and
claude
committed
test_ssl: accept WSAENOTCONN and skip TLS1.3/PHA tests on this build

icanhasmath
and
claude
committed
test.support: add requires_linux_version (used by forward-ported tests)

icanhasmath
and
claude
committed
test_ftplib: add cmd_noop to dummy server; skip flaky source_address on win32

icanhasmath
and
claude
committed
2.7.18.14 Release: document Windows regression remediation

icanhasmath
and
claude
committed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Integrate 2.7.18.14 into 2.7#85

Integrate 2.7.18.14 into 2.7#85
icanhasmath merged 24 commits into
2.7from
2.7.18.14-part2

Commits on Jun 10, 2026

Address CVE-2025-8194 (tarfile) and CVE-2026-4786 (webbrowser)

Reject control characters in header/command APIs (injection cluster)

Reject header injection when generating email messages (CVE-2024-6923)

Harden zipfile against overlapping entries and bad ZIP64 locator

Reject misplaced square brackets in parsed URL hosts (CVE-2025-0938)

Fix quadratic complexity in minidom and os.path.expandvars

Fix quadratic complexity in HTMLParser at EOF (CVE-2025-6069)

Add strict validation option to base64.b64decode

Don't normalize AREGTYPE follow-up headers to DIRTYPE (CVE-2025-13462)

2.7.18.14 Release

Fix Windows test-suite hangs on invalid file descriptors

asyncore: recognize WSAECONNRESET/WSAESHUTDOWN as disconnects on Windows

test: gate test_bigrepeat on sys.maxsize, not sys.maxint (win64)

test_socket: restore missing _have_socket_can/_have_socket_alg helpers

ctypes: fix find_msvcrt on VS2015+ builds; skip win64 pointer-truncation test

ssl: accept WSAENOTCONN when probing whether a socket is connected

test_socket: bind 'support' alias (partial 3.x backport)

test_ctypes: don't assert find_library("c") is non-None on UCRT

test_ssl: accept WSAENOTCONN and skip TLS1.3/PHA tests on this build

test.support: add requires_linux_version (used by forward-ported tests)

test_ftplib: add cmd_noop to dummy server; skip flaky source_address on win32

2.7.18.14 Release: document Windows regression remediation

Commits on Jun 12, 2026

fix(tests): skip-guard expandvars nonascii test; restore _have_socket_can

Address PR #85 review feedback (ucodery)