From a149847ebe1c78ea36564019a5d6424b7d5c332c Mon Sep 17 00:00:00 2001 From: Josef Schlehofer Date: Sun, 27 Sep 2026 17:59:04 +0200 Subject: [PATCH] python3: update to 3.13.15 Update to the latest 3.13 bugfix release. Bump PYTHON3_PIP_VERSION to 26.2.1 to match the pip wheel bundled in ensurepip, which the host build checks for. This pip also fixes CVE-2026-3219 in the host pip. Drop 100-test_hashlib-better-handle-support-for-SHA3.patch, which is included upstream since 3.13.10 (gh-141907). Refresh the other patches. Only the hunk offsets changed, and the changed patches get the git headers they have in master. The bundled libexpat, which the target build uses, goes from 2.7.3 to 2.8.2. Fixes CVEs: CVE-2025-6075, CVE-2025-8291, CVE-2025-11468, CVE-2025-12084, CVE-2025-13462, CVE-2025-13836, CVE-2025-13837, CVE-2025-15282, CVE-2025-15366, CVE-2026-0672, CVE-2026-0864, CVE-2026-0865, CVE-2026-1299, CVE-2026-1502, CVE-2026-2297, CVE-2026-3276, CVE-2026-3446, CVE-2026-3644, CVE-2026-4224, CVE-2026-4360, CVE-2026-4519, CVE-2026-4786, CVE-2026-6019, CVE-2026-6100, CVE-2026-6879, CVE-2026-7210, CVE-2026-7774, CVE-2026-8328, CVE-2026-9669, CVE-2026-11940, CVE-2026-11972, CVE-2026-12003, CVE-2026-15308, CVE-2026-18503, CVE-2026-45186 Release notes: https://docs.python.org/release/3.13.15/whatsnew/changelog.html Signed-off-by: Josef Schlehofer --- lang/python/python3-version.mk | 4 +- lang/python/python3/Makefile | 4 +- .../patches/003-do-not-run-compileall.patch | 9 ++- ...-run-profile-task-during-cross-build.patch | 9 ++- .../025-choose-python-config-version.patch | 7 +- .../patches/027-fix-host-build-libressl.patch | 9 ++- ...shlib-better-handle-support-for-SHA3.patch | 67 ------------------- 7 files changed, 31 insertions(+), 78 deletions(-) delete mode 100644 lang/python/python3/patches/100-test_hashlib-better-handle-support-for-SHA3.patch diff --git a/lang/python/python3-version.mk b/lang/python/python3-version.mk index a6aff75256..a141fb1f23 100644 --- a/lang/python/python3-version.mk +++ b/lang/python/python3-version.mk @@ -8,9 +8,9 @@ # Note: keep in sync with pip PYTHON3_VERSION_MAJOR:=3 PYTHON3_VERSION_MINOR:=13 -PYTHON3_VERSION_MICRO:=9 +PYTHON3_VERSION_MICRO:=15 PYTHON3_VERSION:=$(PYTHON3_VERSION_MAJOR).$(PYTHON3_VERSION_MINOR) PYTHON3_PIP_PKG_RELEASE:=1 -PYTHON3_PIP_VERSION:=25.2 +PYTHON3_PIP_VERSION:=26.2.1 diff --git a/lang/python/python3/Makefile b/lang/python/python3/Makefile index e3ac21625e..0413c241e8 100644 --- a/lang/python/python3/Makefile +++ b/lang/python/python3/Makefile @@ -11,12 +11,12 @@ include $(TOPDIR)/rules.mk include ../python3-version.mk PKG_NAME:=python3 -PKG_RELEASE:=3 +PKG_RELEASE:=1 PKG_VERSION:=$(PYTHON3_VERSION).$(PYTHON3_VERSION_MICRO) PKG_SOURCE:=Python-$(PKG_VERSION).tar.xz PKG_SOURCE_URL:=https://www.python.org/ftp/python/$(PKG_VERSION) -PKG_HASH:=ed5ef34cda36cfa2f3a340f07cac7e7814f91c7f3c411f6d3562323a866c5c66 +PKG_HASH:=1e66a7945a48390ee4c2a4268a0e4185884059a13c4aab6d148aa208deea4a76 PKG_MAINTAINER:=Jeffery To , Alexandru Ardelean PKG_LICENSE:=Python-2.0.1 0BSD diff --git a/lang/python/python3/patches/003-do-not-run-compileall.patch b/lang/python/python3/patches/003-do-not-run-compileall.patch index b80ccac421..57cf4b87c3 100644 --- a/lang/python/python3/patches/003-do-not-run-compileall.patch +++ b/lang/python/python3/patches/003-do-not-run-compileall.patch @@ -1,6 +1,11 @@ +From 8a4da017902d21ac6cada21a3bb23caa5b39af0b Mon Sep 17 00:00:00 2001 +From: Jeffery To +Date: Fri, 12 May 2023 19:40:11 +0800 +Subject: [PATCH] Do not run compileall + --- a/Makefile.pre.in +++ b/Makefile.pre.in -@@ -2569,6 +2569,7 @@ libinstall: all $(srcdir)/Modules/xxmodu +@@ -2575,6 +2575,7 @@ libinstall: all $(srcdir)/Modules/xxmodu echo "Applying app store compliance patch"; \ patch --force --reject-file "$(abs_builddir)/app-store-compliance.rej" --strip 2 --directory "$(DESTDIR)$(LIBDEST)" --input "$(abs_srcdir)/$(APP_STORE_COMPLIANCE_PATCH)" || true ; \ fi @@ -8,7 +13,7 @@ @ # Build PYC files for the 3 optimization levels (0, 1, 2) -PYTHONPATH=$(DESTDIR)$(LIBDEST) $(RUNSHARED) \ $(PYTHON_FOR_BUILD) -Wi $(DESTDIR)$(LIBDEST)/compileall.py \ -@@ -2579,6 +2580,7 @@ libinstall: all $(srcdir)/Modules/xxmodu +@@ -2585,6 +2586,7 @@ libinstall: all $(srcdir)/Modules/xxmodu $(PYTHON_FOR_BUILD) -Wi $(DESTDIR)$(LIBDEST)/compileall.py \ -o 0 -o 1 -o 2 $(COMPILEALL_OPTS) -d $(LIBDEST)/site-packages -f \ -x badsyntax $(DESTDIR)$(LIBDEST)/site-packages diff --git a/lang/python/python3/patches/009-don-t-run-profile-task-during-cross-build.patch b/lang/python/python3/patches/009-don-t-run-profile-task-during-cross-build.patch index 907839bf9a..e819d80134 100644 --- a/lang/python/python3/patches/009-don-t-run-profile-task-during-cross-build.patch +++ b/lang/python/python3/patches/009-don-t-run-profile-task-during-cross-build.patch @@ -1,6 +1,11 @@ +From 97a92f2e7a77c39d087892f5c9a7350c31f3d65b Mon Sep 17 00:00:00 2001 +From: Alexandru Ardelean +Date: Sun, 24 Nov 2024 10:59:27 +0200 +Subject: [PATCH] Do not run profile task during cross build + --- a/Makefile.pre.in +++ b/Makefile.pre.in -@@ -746,6 +746,7 @@ profile-gen-stamp: profile-clean-stamp +@@ -750,6 +750,7 @@ profile-gen-stamp: profile-clean-stamp # Run task with profile generation build to create profile information. profile-run-stamp: @@ -8,7 +13,7 @@ @echo "Running code to generate profile data (this can take a while):" # First, we need to create a clean build with profile generation # enabled. -@@ -759,6 +760,7 @@ profile-run-stamp: +@@ -763,6 +764,7 @@ profile-run-stamp: # This is an expensive target to build and it does not have proper # makefile dependency information. So, we create a "stamp" file # to record its completion and avoid re-running it. diff --git a/lang/python/python3/patches/025-choose-python-config-version.patch b/lang/python/python3/patches/025-choose-python-config-version.patch index 11310cb917..8895b6d77a 100644 --- a/lang/python/python3/patches/025-choose-python-config-version.patch +++ b/lang/python/python3/patches/025-choose-python-config-version.patch @@ -1,6 +1,11 @@ +From 18330902a0ca1b162e1ae938d8024cfb7e7c524d Mon Sep 17 00:00:00 2001 +From: Jeffery To +Date: Tue, 16 Feb 2021 22:23:50 +0800 +Subject: [PATCH] Choose python-config version + --- a/Makefile.pre.in +++ b/Makefile.pre.in -@@ -2595,7 +2595,7 @@ python-config: $(srcdir)/Misc/python-con +@@ -2601,7 +2601,7 @@ python-config: $(srcdir)/Misc/python-con @ # On Darwin, always use the python version of the script, the shell @ # version doesn't use the compiler customizations that are provided @ # in python (_osx_support.py). diff --git a/lang/python/python3/patches/027-fix-host-build-libressl.patch b/lang/python/python3/patches/027-fix-host-build-libressl.patch index 8ae457d71d..1adab3a3df 100644 --- a/lang/python/python3/patches/027-fix-host-build-libressl.patch +++ b/lang/python/python3/patches/027-fix-host-build-libressl.patch @@ -1,6 +1,11 @@ +From 49e3c330d4b5e17a740bc51b7ebbb9a42c67e505 Mon Sep 17 00:00:00 2001 +From: Sean Khan +Date: Thu, 27 Jun 2024 22:06:30 -0400 +Subject: [PATCH] Fix host build with LibreSSL + --- a/Modules/_ssl.c +++ b/Modules/_ssl.c -@@ -4827,7 +4827,11 @@ _ssl__SSLContext_cert_store_stats_impl(P +@@ -4833,7 +4833,11 @@ _ssl__SSLContext_cert_store_stats_impl(P int x509 = 0, crl = 0, ca = 0, i; store = SSL_CTX_get_cert_store(self->ctx); @@ -12,7 +17,7 @@ if (objs == NULL) { PyErr_SetString(PyExc_MemoryError, "failed to query cert store"); return NULL; -@@ -4883,7 +4887,11 @@ _ssl__SSLContext_get_ca_certs_impl(PySSL +@@ -4889,7 +4893,11 @@ _ssl__SSLContext_get_ca_certs_impl(PySSL } store = SSL_CTX_get_cert_store(self->ctx); diff --git a/lang/python/python3/patches/100-test_hashlib-better-handle-support-for-SHA3.patch b/lang/python/python3/patches/100-test_hashlib-better-handle-support-for-SHA3.patch deleted file mode 100644 index b051979327..0000000000 --- a/lang/python/python3/patches/100-test_hashlib-better-handle-support-for-SHA3.patch +++ /dev/null @@ -1,67 +0,0 @@ -From 5ae0915cc9a314f446bf4baa3b3001253d39a158 Mon Sep 17 00:00:00 2001 -From: Christian Marangi -Date: Mon, 24 Nov 2025 15:51:33 +0100 -Subject: [PATCH] test_hashlib: better handle support for SHA3 - -It's possible that the SSL library supports only SHA3 algo and doesn't -have SHAKE one. - -The current test wrongly detect this and set both HASH and HASHXOF to -None expecting to have the extra SHA3 attributes present but this should -only be true for SHAKE algo. - -To better handle this, move the HASH condition to a dedicated try-expect -condition and check if HASHXOF is None in the relevant code effectively -checking if SHA3 is supported by the SSL library but SHAKE algo needs to -use the sha3module one. - -Signed-off-by: Christian Marangi ---- - Lib/test/test_hashlib.py | 20 +++++++++++++++----- - 1 file changed, 15 insertions(+), 5 deletions(-) - ---- a/Lib/test/test_hashlib.py -+++ b/Lib/test/test_hashlib.py -@@ -40,9 +40,13 @@ else: - openssl_hashlib = import_fresh_module('hashlib', fresh=['_hashlib']) - - try: -- from _hashlib import HASH, HASHXOF, openssl_md_meth_names, get_fips_mode -+ from _hashlib import HASH - except ImportError: - HASH = None -+ -+try: -+ from _hashlib import HASHXOF, openssl_md_meth_names, get_fips_mode -+except ImportError: - HASHXOF = None - openssl_md_meth_names = frozenset() - -@@ -558,9 +562,14 @@ class HashLibTestCase(unittest.TestCase) - constructors = self.constructors_to_test[name] - for hash_object_constructor in constructors: - m = hash_object_constructor() -- if HASH is not None and isinstance(m, HASH): -- # _hashopenssl's variant does not have extra SHA3 attributes -- continue -+ if name.startswith('shake_'): -+ if HASHXOF is not None and isinstance(m, HASHXOF): -+ # _hashopenssl's variant does not have extra SHA3 attributes -+ continue -+ else: -+ if HASH is not None and isinstance(m, HASH): -+ # _hashopenssl's variant does not have extra SHA3 attributes -+ continue - self.assertEqual(capacity + rate, 1600) - self.assertEqual(m._capacity_bits, capacity) - self.assertEqual(m._rate_bits, rate) -@@ -1057,7 +1066,8 @@ class HashLibTestCase(unittest.TestCase) - def test_hash_disallow_instantiation(self): - # internal types like _hashlib.HASH are not constructable - support.check_disallow_instantiation(self, HASH) -- support.check_disallow_instantiation(self, HASHXOF) -+ if HASHXOF is not None: -+ support.check_disallow_instantiation(self, HASHXOF) - - def test_readonly_types(self): - for algorithm, constructors in self.constructors_to_test.items():