alt-python311 (3.11.15-4) stable; urgency=medium

  * SECURITY UPDATE: CPU denial-of-service in html.parser.HTMLParser
    - debian/patches/CVE-2026-15308.patch: buffer incoming feed() chunks in
      a list and only join and re-scan the unparsed buffer once the pending
      data crosses a doubling threshold (flushing in close()), so repeated
      unterminated markup declarations can no longer force quadratic
      rescanning/concatenation of uncontrolled data (CWE-407/CWE-1333).
    - CVE-2026-15308

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Wed, 22 Jul 2026 08:56:34 +0000

alt-python311 (3.11.15-3) stable; urgency=medium

  * SECURITY UPDATE: webbrowser.open() dash-prefix check bypass via the action token
    - debian/patches/CVE-2026-4786.patch: validate the action-expanded URL
      and reorder the action/URL substitution so a URL containing the action
      token cannot expand into a dash-prefixed browser flag (CVE-2026-4519
      bypass).
    - CVE-2026-4786
  * SECURITY UPDATE: dangling input pointer (UAF) in bz2/lzma decompressors
    - debian/patches/CVE-2026-6100.patch: clear next_in on the MemoryError
      error path in _bz2/_lzma decompress() so a reused decompressor cannot
      read or write through a stale pointer to the released input buffer.
    - CVE-2026-6100
  * SECURITY UPDATE: insufficient Expat hash-flooding entropy
    - debian/patches/CVE-2026-7210.patch: seed Expat with 16 bytes of
      entropy via XML_SetHashSalt16Bytes when libexpat exposes it (weak
      symbol), falling back to the legacy 8-byte salt otherwise.
    - debian/patches/CVE-2026-41080.patch: backport XML_SetHashSalt16Bytes
      into the BUNDLED expat (applied on ubuntu16.04 only; el7 on the RPM
      side) so the 16-byte salt path above is not inert; other platforms
      link system expat.
    - CVE-2026-7210
  * SECURITY UPDATE: bz2.BZ2Decompressor reuse after error (stack overflow)
    - debian/patches/CVE-2026-9669.patch: record the libbz2 error and raise
      ValueError on any subsequent decompress() call instead of re-entering
      libbz2 on an inconsistent stream (CWE-121).
    - CVE-2026-9669

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Mon, 20 Jul 2026 09:39:23 +0000

alt-python311 (3.11.15-2) stable; urgency=medium

  * SECURITY UPDATE: control-character command injection in imaplib
    - debian/patches/CVE-2025-15366.patch: reject control characters in
      IMAP4._command() so user-controlled arguments cannot inject extra
      IMAP commands via newlines (CWE-77).
    - CVE-2025-15366
  * SECURITY UPDATE: control-character command injection in poplib
    - debian/patches/CVE-2025-15367.patch: reject control characters in
      POP3._putcmd() so user-controlled arguments cannot inject extra
      POP3 commands via newlines (CWE-77).
    - CVE-2025-15367
  * SECURITY UPDATE: incomplete control-character rejection in http.cookies
    - debian/patches/CVE-2026-3644.patch: reject control characters in
      Morsel.update(), the |= operator, the unpickling path and
      BaseCookie.js_output(), closing the paths missed by CVE-2026-0672.
    - CVE-2026-3644
  * SECURITY UPDATE: unbounded C recursion in pyexpat
    - debian/patches/CVE-2026-4224.patch: guard conv_content_model() with
      Py_EnterRecursiveCall() so a deeply nested DTD content model with a
      registered ElementDeclHandler cannot cause a C stack overflow (CWE-674).
    - CVE-2026-4224
  * SECURITY UPDATE: argument injection in webbrowser.open()
    - debian/patches/CVE-2026-4519.patch: reject URLs with leading dashes so
      they cannot be smuggled into the spawned browser command line.
    - CVE-2026-4519

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Mon, 20 Jul 2026 09:39:23 +0000

alt-python311 (3.11.15-1) stable; urgency=medium

  * ALTPYTH-591: Update to 3.11.15 version

 -- Razmik Manvelyan <rmanvelyan@cloudlinux.com>  Tue, 07 Apr 2026 00:00:00 +0000

alt-python311 (3.11.14-4) stable; urgency=medium

  * ALTPYTH-596: Ubuntu 26 support: fix tkinter runtime dependencies
  * ALTPYTH-596: Ubuntu 26 support: fix libs runtime dependency on libtirpc-dev,
    replace with libtirpc3t64 (Ubuntu 24+) / libtirpc3 (older)

 -- Nikolai Mardanov <nmardanov@cloudlinux.com>  Mon, 06 Apr 2026 00:00:00 +0000

alt-python311 (3.11.14-3) stable; urgency=medium

  * ALTPYTH-595: Build alt-python packages for Debian 12 and 13 on ARM

 -- Razmik Manvelyan <rmanvelyan@cloudlinux.com>  Fri, 27 Mar 2026 00:00:00 +0000

alt-python311 (3.11.14-2) stable; urgency=medium

  * ALTPYTH-596: Ubuntu 26 support: fix tkinter runtime dependencies

 -- Nikolai Mardanov <nmardanov@cloudlinux.com>  Tue, 01 Apr 2026 00:00:00 +0000

alt-python311 (3.11.14-1) stable; urgency=medium

  * ALTPYTH-583: Update to 3.11.14 version

 -- Huseyn Hajizada <hhajizada@cloudlinux.com>  Wed, 10 Dec 2025 09:47:00 +0000

alt-python311 (3.11.13-1) stable; urgency=medium

  * ALTPYTH-556: Update to 3.11.13 version

 -- CloudLinux Packaging Team <packager@cloudlinux.com>  Wed, 04 Jun 2025 00:23:08 +0000

alt-python311 (3.11.12-1) stable; urgency=medium

  * ALTPYTH-551: Update to 3.11.12 version

 -- CloudLinux Packaging Team <packager@cloudlinux.com>  Wed, 09 Apr 2025 00:23:36 +0000

alt-python311 (3.11.11-1) stable; urgency=medium

  * Update to 3.11.11 version

 -- CloudLinux Packaging Team <packager@cloudlinux.com>  Wed, 04 Dec 2024 00:23:35 +0000

alt-python311 (3.11.10-2) stable; urgency=medium

  * ALTPYTH-530: Ubuntu 24 support

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Mon, 30 Sep 2024 17:00:00 +0100

alt-python311 (3.11.10-1) stable; urgency=medium

  * Update to 3.11.10 version

 -- CloudLinux Packaging Team <packager@cloudlinux.com>  Sat, 07 Sep 2024 06:23:11 +0000

alt-python311 (3.11.9-2) stable; urgency=medium

  * ALTPYTH-518: Resolve conflicts with idle3.appdata.xml with other alt-pythonXX-idle packages

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Thu, 25 Jul 2024 17:03:00 +0200

alt-python311 (3.11.9-1) stable; urgency=medium

  * ALTPYTH-509: Always use alt-sqlite
  * ALTPYTH-513: Update to 3.11.9 version

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Wed, 10 Apr 2024 15:05:00 +0200

alt-python311 (3.11.8-1) stable; urgency=medium

  * ALTPYTH-505: Update to 3.11.8 version.

 -- Eduard Chiganov <echiganov@cloudlinux.com>  Wed, 07 Feb 2024 00:23:08 +0000

alt-python311 (3.11.7-1) stable; urgency=medium

  * Update to 3.11.7 version

 -- CloudLinux Packaging Team <packager@cloudlinux.com>  Tue, 05 Dec 2023 00:23:20 +0000

alt-python311 (3.11.5-1) stable; urgency=medium

  * ALTPYTH-476: Build missing alt-python packages for CL ubuntu.
  * update to 3.11.5

 -- Eduard Chiganov <echiganov@cloudlinux.com>  Mon, 21 Aug 2023 14:20:00 +0200

alt-python311 (3.11.4-1) stable; urgency=medium

  * ALTPYTH-475: relocate tomllib
  * update to 3.11.4

 -- Sergey Fokin <sfokin@cloudlinux.com>  Tue, 18 Jul 2023 16:48:00 +0200

alt-python311 (3.11.3-2) stable; urgency=medium

  * ALTPYTH-471: fixed sqlite dependencies

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Tue, 30 May 2023 19:00:00 +0100

alt-python311 (3.11.3-1) stable; urgency=medium

  * ALTPYTH-468: older OS compatibility
  * Updated to 3.11.3

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Thu, 20 Apr 2023 19:00:00 +0100

alt-python311 (3.11.1-1) stable; urgency=medium

  * ALTPYTH-453: Initial build

 -- Eduard Chiganov <echiganov@cloudlinux.com>  Mon, 19 Dec 2022 13:20:00 +0300
