alt-python313 (3.13.15-5) stable; urgency=medium

  * SECURITY UPDATE: tarfile ignored a None result from the extraction filter
    on the link fallback path
    - debian/patches/CVE-2026-87910.patch: keep the result of the first
      filter_function() call in TarFile.makelink_with_filter() and return
      early when it is None, so a filter that skips a member by returning
      None is honoured when link extraction falls back to copying the target
      under the link's own, shallower name instead of the member being
      extracted anyway (CWE-22).
    - CVE-2026-87910
  * SECURITY UPDATE: tarfile tar/data filters created directories outside the
    destination
    - debian/patches/CVE-2026-19672.patch: collapse ".." components with
      os.path.normpath() in _get_filtered_attrs() before the containment
      check, so a member whose name leaves the destination and comes back,
      such as "../evil/../dest/sub/file", no longer creates the intermediate
      directories outside it. The containment check looked at the resolved
      path, which stayed inside, while the directories were created from the
      name as given (CWE-22). Backport of upstream commit 97688346ada2.
    - Behaviour change: the "tar" and "data" filters now rewrite such names
      with os.path.normpath(), which removes internal ".." components and so
      may change the meaning of a name that traverses symbolic links.
    - CVE-2026-19672

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Tue, 22 Sep 2026 00:00:00 +0000

alt-python313 (3.13.15-4) stable; urgency=medium

  * SECURITY UPDATE: tarfile data/tar filter bypass via a hard link to a symlink
    - debian/patches/CVE-2026-82049.patch: resolve the link source with
      os.path.realpath() before os.link() in TarFile.makelink_with_filter(),
      so a hard link whose target is a symlink no longer duplicates that
      symlink inode one directory shallower, where its relative payload
      re-based outside the destination and the following chmod()/utime()
      hit the outside file (CWE-59).
    - CVE-2026-82049

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Fri, 18 Sep 2026 00:00:00 +0000

alt-python313 (3.13.15-3) stable; urgency=medium

  * SECURITY UPDATE: control-character command injection in poplib
    - debian/patches/00475-CVE-2025-15367-poplib-reject-control-chars.patch:
      reject C0 control characters and DEL in POP3._putcmd() so a CR/LF in a
      user()/pass_() argument cannot inject a second POP3 command (CWE-77/CWE-93).
    - CVE-2025-15367

 -- Tamar Zerekidze <tzerekidze@cloudlinux.com>  Thu, 27 Aug 2026 12:00:00 +0000

alt-python313 (3.13.15-2) stable; urgency=medium

  * ALTPYTH-615: rebuild against renamed alt-openssl11 (deb OpenSSL 1.1.1
    package renamed alt-openssl -> alt-openssl11, install prefix
    /opt/alt/openssl -> /opt/alt/openssl11)

 -- Nikolai Mardanov <nmardanov@cloudlinux.com>  Tue, 18 Aug 2026 11:42:35 +0400

alt-python313 (3.13.15-1) stable; urgency=medium

  * ALTPYTH-613: Update to 3.13.15 version

 -- Levon Matshkalyan <lmatshkalyan@cloudlinux.com>  Wed, 05 Aug 2026 17:43:39 +0200

alt-python313 (3.13.14-1) stable; urgency=medium

  * Update to 3.13.14

 -- CloudLinux Packaging Team <packager@cloudlinux.com>  Wed, 10 Jun 2026 19:49:42 -0400

alt-python313 (3.13.13-1) stable; urgency=medium

  * ALTPYTH-600: Update to 3.13.13 version

 -- Razmik Manvelyan <rmanvelyan@cloudlinux.com>  Tue, 21 Apr 2026 00:00:00 +0000

alt-python313 (3.13.12-3) stable; urgency=medium

  * ALTPYTH-595: Build alt-python packages for Debian 12 and 13 on ARM

 -- Razmik Manvelyan <rmanvelyan@cloudlinux.com>  Fri, 27 Mar 2026 00:00:00 +0000

alt-python313 (3.13.12-2) stable; urgency=medium

  * Fix debian builds across platforms:
    - Use mailcap instead of mime-support on Ubuntu 24+ / Debian 13+
    - Add expat 2.2.1 compat patch for Ubuntu 16 (XML_ERROR_INVALID_ARGUMENT)
    - Fix bootstrap/regen-all inverted condition (Ubuntu 16)
    - Fix __pycache__ fakeroot EISDIR in dh_movefiles (-X__pycache__)
    - Fix bin/__pycache__ rm failure under fakeroot (-rm non-fatal)
    - Exclude __pycache__ from dh_missing --fail-missing

 -- CloudLinux Packaging Team <packager@cloudlinux.com>  Tue, 25 Mar 2026 00:00:00 +0000

alt-python313 (3.13.12-1) stable; urgency=medium

  * ALTPYTH-590: Update to 3.13.12 version

 -- CloudLinux Packaging Team <packager@cloudlinux.com>  Wed, 25 Feb 2026 07:44:26 -0500

alt-python313 (3.13.11-1) stable; urgency=medium

  * ALTPYTH-563: Update to Python 3.13.11 

 -- Huseyn Hajizada <hhajizada@cloudlinux.com>  Sun, 14 Dec 2025 20:36:00 +0000

alt-python313 (3.13.5-1) stable; urgency=medium

  * ALTPYTH-554: Update to 3.13.5 version

 -- CloudLinux Packaging Team <packager@cloudlinux.com>  Thu, 12 Jun 2025 00:22:47 +0000

alt-python313 (3.13.3-1) stable; urgency=medium

  * ALTPYTH-549: Update to 3.13.3 version

 -- CloudLinux Packaging Team <packager@cloudlinux.com>  Wed, 09 Apr 2025 00:23:06 +0000

alt-python313 (3.13.2-1) stable; urgency=medium

  * ALTPYTH-547: update to 3.13.2.

 -- Eduard Chiganov <echiganov@cloudlinux.com>  Fri, 28 Feb 2025 14:20:00 +0200

alt-python313 (3.13.1-1) stable; urgency=medium

  * ALTPYTH-540: update to 3.13.1

 -- Sergey Fokin <sfokin@cloudlinux.com>  Mon, 06 Jan 2025 10:52:00 +0100

alt-python313 (3.13.0-1) stable; urgency=medium

  * ALTPYTH-533: Initial release.

 -- Eduard Chiganov <echiganov@cloudlinux.com>  Thu, 14 Nov 2024 14:20:00 +0200
