From b12c1e0abf3bdee467b278edca57fd1ed0c60308 Mon Sep 17 00:00:00 2001 From: Marcus Hoffmann Date: Thu, 12 Feb 2026 10:24:56 +0100 Subject: [PATCH] package/python3: security bump to 3.13.12 This release fixes the following security related issues: * gh-144125: BytesGenerator will now refuse to serialize (write) headers that are unsafely folded or delimited; see verify_generated_headers. * gh-143935: Fixed a bug in the folding of comments when flattening an email message using a modern email policy. Comments consisting of a very long sequence of non-foldable characters could trigger a forced line wrap that omitted the required leading space on the continuation line, causing the remainder of the comment to be interpreted as a new header field. This enabled header injection with carefully crafted inputs. * gh-143925: Reject control characters in data: URL media types. * gh-143919: Reject control characters in http.cookies.Morsel fields and values. * gh-143916: Reject C0 control characters within wsgiref.headers.Headers fields, values, and parameters. Full release notes: https://docs.python.org/release/3.13.12/whatsnew/changelog.html Signed-off-by: Marcus Hoffmann Signed-off-by: Thomas Perale --- package/python3/python3.hash | 5 ++--- package/python3/python3.mk | 2 +- 2 files changed, 3 insertions(+), 4 deletions(-) diff --git a/package/python3/python3.hash b/package/python3/python3.hash index fddfcc1a4d..89282fb41b 100644 --- a/package/python3/python3.hash +++ b/package/python3/python3.hash @@ -1,5 +1,4 @@ -# From https://www.python.org/downloads/release/python-31311/ -md5 4c3517dd8b1fd76377dcb3e5e8f71ad6 Python-3.13.11.tar.xz +# From https://www.python.org/downloads/release/python-31312/ +sha256 2a84cd31dd8d8ea8aaff75de66fc1b4b0127dd5799aa50a64ae9a313885b4593 Python-3.13.12.tar.xz # Locally computed -sha256 16ede7bb7cdbfa895d11b0642fa0e523f291e6487194d53cf6d3b338c3a17ea2 Python-3.13.11.tar.xz sha256 78b12c3a81360b357002334f0e70ea0e92eebf7a9b358805c03c48484945f3bb LICENSE diff --git a/package/python3/python3.mk b/package/python3/python3.mk index d8ee11e8a8..8f7574347b 100644 --- a/package/python3/python3.mk +++ b/package/python3/python3.mk @@ -5,7 +5,7 @@ ################################################################################ PYTHON3_VERSION_MAJOR = 3.13 -PYTHON3_VERSION = $(PYTHON3_VERSION_MAJOR).11 +PYTHON3_VERSION = $(PYTHON3_VERSION_MAJOR).12 PYTHON3_SOURCE = Python-$(PYTHON3_VERSION).tar.xz PYTHON3_SITE = https://python.org/ftp/python/$(PYTHON3_VERSION) PYTHON3_LICENSE = Python-2.0, others