Python: Security Backports and the Algorithmic Complexity Sweep
A wave of backports hardened CPython against denial-of-service and injection risks across several standard library modules, while a parallel effort cleaned up algorithmic complexity bugs and flaky test infrastructure ahead of the 3.15 cycle.
Duration: PT2M58S
Episode overview
This episode is a short developer briefing from Python.
It explains recent repository work in plain language.
- Show: Python
- Published: 2026-08-04T13:08:02Z
- Audio duration: PT2M58S
Transcript excerpt
This excerpt keeps the crawler page concise. Listen to the episode or use the RSS feed for the full update.
Good morning. It's August 4th, 2026, and today's cpython activity is dominated by security backports and quiet performance fixes.
The biggest pattern: a large batch of security fixes moving down the version branches. PR 146025 rejects control characters in HTTP cookies to close off header injection, CVE-2026-3644. PR 145671 does the same for WSGI status lines. PR 149066 fixes a Windows zip extraction bug that let archives escape their target…
Alongside that, there's a clear thread of algorithmic complexity fixes — the quiet kind of bug that only bites under adversarial input. PR 150843 replaces an O of n squared sort in unicode normalize with a hybrid insertion and counting sort, preventing a denial-of-service via crafted combining characters, and it's…
A third theme is test reliability. Serhiy Storchaka's PR 155120, and its backports, add a decorator to run C-stack-exhausting tests in a thread with a fixed 8 megabyte stack, so results stop depending on system stack limits. Related commits fix flaky allocation-count assumptions in test_class and a subprocess…
Smaller but notable: PR 155085 fixes a real race between thread shutdown and thread handle identity in the threading module,…
Wh…
Nearby episodes from Python
- CSV Sniffer Gets Untangled From Exponential Time
- Weekly Recap - Correctness Fixes and Release Prep
- Decimal, Copy Semantics, and a Logging Race Fix
- Crash Fixes Across Async and Memory Internals
- Curses Cleanup and Correctness Fixes Dominate the Day
- Hardening the Corners Before 3.15
- Thread Safety and the Great Regex Slowdown Cleanup
- Curses Crashes and a Careful Revert