Python: Threading Reliability and Security Hardening
A cluster of fixes targets crashes and hangs under threads in imports and Zstd compression, alongside backports distrusting compromised certificate keys. The main pattern is reliability under concurrency, with security and performance work alongside.
Duration: PT2M39S
Episode overview
This episode is a short developer briefing from Python.
It explains recent repository work in plain language.
- Show: Python
- Published: 2026-10-25T13:06:06Z
- Audio duration: PT2M39S
Transcript excerpt
This excerpt keeps the crawler page concise. Listen to the episode or use the RSS feed for the full update.
Good morning, it's October 25th, 2026.
Our lead story is concurrency reliability. Two separate fixes address crashes and hangs when Python is heavily threaded.
First, imports. Since a change that shipped in 3.15, the first import of a submodule held its parent package's lock until that submodule finished executing. That blocked threads that only needed the finished parent, and could trigger deadlock errors, false partially-initialized-module errors, or hangs with no actual…
Second, compression. Freeing a busy multi-threaded Zstd compressor that uses a dictionary could crash because the underlying library freed the dictionary before stopping worker threads. PR 160550 works around that by starting a new empty frame to make the library wait for unfinished jobs. A companion fix, PR 160536,…
In security, three backports, PRs 160572, 160570 and 160571, distrust compromised intermediate certificate keys tied to CVE 2026-115557. Separately, PR 160301 rejects cookies with a negative version in the cookie jar, which had previously bypassed domain checks.
Finally, performance and cleanup. An open proposal, PR 160616, would store A S T node attributes with managed dictionaries, reporting about…
Nearby episodes from Python
- Import Lock and Socket Leak Fixes
- ZoneInfo Security Fix and Thread-Safety Hardening
- Security Backports and Faster AST Parsing
- Weekly Recap - Certificate Distrust and Concurrency Hardening
- TLS Trust Removal and Parser Fixes
- Crash Hardening and Data Safety Fixes
- Clinic Conversion for Core Slots and Doc Push
- Free-Threading Race Hardening and Stable Branch Fixes