Python: Security Backports and Faster AST Parsing
A broad wave of stability backports for Expat, tarfile and tempfile landed across supported releases, while on main, AST nodes moved to a managed dictionary for major speed and memory gains.
Duration: PT2M26S
Episode overview
This episode is a short developer briefing from Python.
It explains recent repository work in plain language.
- Show: Python
- Published: 2026-10-26T13:09:13Z
- Audio duration: PT2M26S
Transcript excerpt
This excerpt keeps the crawler page concise. Listen to the episode or use the RSS feed for the full update.
Hello, it's Monday, October 26th, 2026, and this is your Python developer briefing.
The big picture is stability at scale: a coordinated set of security and cleanup backports across older branches, paired with a major performance win for parsing on main.
First, the backport wave. Bundled Expat was updated to version 2.9.0 across three stable branches, seen in PRs 160257, 160258 and 160261. In parallel, the tar file filter was tightened to reject links that replace the destination, backported in PRs 160341 through 160343, and a race condition in temporary directory…
Second, faster internals. Commit aa0e410, from PR 160616, switches AST nodes to a managed dictionary instead of allocating a separate dictionary per node. Parsing is about 15.8 percent faster, tree walking about 15.9 percent faster, and tree memory drops by about 51.6 percent. Related correctness work in PR 152632…
Third, crash and hang hardening. PR 160514 fixes start TLS in asyncio, where a lost handshake never called connection lost on the app protocol, leaving stream close waits stuck forever. PR 153606 makes malformed translation files raise an operating system error instead of a raw struct error. Still open are a…
What…
Nearby episodes from Python
- Core Speedups and Boundary Hardening
- Asyncio Hardening and OSError Safety Fix
- Import Lock and Socket Leak Fixes
- ZoneInfo Security Fix and Thread-Safety Hardening
- Weekly Recap - Certificate Distrust and Concurrency Hardening
- Threading Reliability and Security Hardening
- TLS Trust Removal and Parser Fixes
- Crash Hardening and Data Safety Fixes