alt-python311 (3.11.15-6) stable; urgency=medium

  * SECURITY UPDATE: skip tarfile AREGTYPE->DIRTYPE normalization while parsing GNU long name/link continuation headers (parser-differential)
    - debian/patches/CVE-2025-13462.patch: skip tarfile AREGTYPE->DIRTYPE normalization while parsing GNU long name/link continuation headers (parser-differential)
    - CVE-2025-13462

 -- Viktor Borzov <vborzov@cloudlinux.com>  Mon, 27 Jul 2026 12:00:00 +0000

alt-python311 (3.11.15-5) stable; urgency=medium

  * SECURITY UPDATE: configparser key/value injection via CR/CRLF
    - debian/patches/CVE-2026-0864.patch: normalize CR, CRLF and LF line
      endings when writing multi-line values in RawConfigParser so a
      carriage return cannot inject additional keys into the output.
    - CVE-2026-0864
  * SECURITY UPDATE: http.client proxy CONNECT tunnel header injection
    - debian/patches/CVE-2026-1502.patch: reject CR/LF in the proxy tunnel
      host and in set_tunnel() custom headers before writing the CONNECT
      request.
    - CVE-2026-1502
  * SECURITY UPDATE: unicodedata.normalize() quadratic-time DoS
    - debian/patches/CVE-2026-3276.patch: replace the O(n^2) canonical
      ordering insertion sort with a counting sort for long combining
      runs to prevent CPU-exhaustion on crafted input.
    - CVE-2026-3276
  * SECURITY UPDATE: http.cookies js_output() script injection (XSS)
    - debian/patches/CVE-2026-6019.patch: percent-encode the cookie value
      embedded in the inline <script> and decode it with
      decodeURIComponent() so a </script> sequence cannot break out.
    - CVE-2026-6019
  * SECURITY UPDATE: tarfile data filter path traversal
    - debian/patches/CVE-2026-7774.patch: validate the written link target
      against the extraction root in the data/tar filter.
    - CVE-2026-7774
  * SECURITY UPDATE: ftplib.ftpcp() data-connection SSRF
    - debian/patches/CVE-2026-8328.patch: apply the CVE-2021-4189 PASV
      peer-address check to ftpcp() so a malicious source server cannot
      redirect the target's data connection.
    - CVE-2026-8328
  * SECURITY UPDATE: tarfile hardlink-extraction symlink escape
    - debian/patches/CVE-2026-11940.patch: pre-validate the symlink at the
      hardlink's own name in the extraction-filter fallback to prevent a
      path-traversal escape (incomplete fix of CVE-2025-4330).
    - CVE-2026-11940
  * SECURITY UPDATE: tarfile stream-seek infinite-loop DoS
    - debian/patches/CVE-2026-11972.patch: break out of _Stream.seek() on
      EOF so a truncated stream archive cannot cause an unbounded loop.
    - CVE-2026-11972

 -- Vladimir D. Seleznev <vseleznev@cloudlinux.com>  Mon, 27 Jul 2026 00:00:00 +0000

alt-python311 (3.11.15-4) stable; urgency=medium

  * SECURITY UPDATE: CPU denial-of-service in html.parser.HTMLParser
    - debian/patches/CVE-2026-15308.patch: buffer incoming feed() chunks in
      a list and only join and re-scan the unparsed buffer once the pending
      data crosses a doubling threshold (flushing in close()), so repeated
      unterminated markup declarations can no longer force quadratic
      rescanning/concatenation of uncontrolled data (CWE-407/CWE-1333).
    - CVE-2026-15308

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Wed, 22 Jul 2026 08:56:34 +0000

alt-python311 (3.11.15-3) stable; urgency=medium

  * SECURITY UPDATE: webbrowser.open() dash-prefix check bypass via the action token
    - debian/patches/CVE-2026-4786.patch: validate the action-expanded URL
      and reorder the action/URL substitution so a URL containing the action
      token cannot expand into a dash-prefixed browser flag (CVE-2026-4519
      bypass).
    - CVE-2026-4786
  * SECURITY UPDATE: dangling input pointer (UAF) in bz2/lzma decompressors
    - debian/patches/CVE-2026-6100.patch: clear next_in on the MemoryError
      error path in _bz2/_lzma decompress() so a reused decompressor cannot
      read or write through a stale pointer to the released input buffer.
    - CVE-2026-6100
  * SECURITY UPDATE: insufficient Expat hash-flooding entropy
    - debian/patches/CVE-2026-7210.patch: seed Expat with 16 bytes of
      entropy via XML_SetHashSalt16Bytes when libexpat exposes it (weak
      symbol), falling back to the legacy 8-byte salt otherwise.
    - debian/patches/CVE-2026-41080.patch: backport XML_SetHashSalt16Bytes
      into the BUNDLED expat (applied on ubuntu16.04 only; el7 on the RPM
      side) so the 16-byte salt path above is not inert; other platforms
      link system expat.
    - CVE-2026-7210
  * SECURITY UPDATE: bz2.BZ2Decompressor reuse after error (stack overflow)
    - debian/patches/CVE-2026-9669.patch: record the libbz2 error and raise
      ValueError on any subsequent decompress() call instead of re-entering
      libbz2 on an inconsistent stream (CWE-121).
    - CVE-2026-9669

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Mon, 20 Jul 2026 09:39:23 +0000

alt-python311 (3.11.15-2) stable; urgency=medium

  * SECURITY UPDATE: control-character command injection in imaplib
    - debian/patches/CVE-2025-15366.patch: reject control characters in
      IMAP4._command() so user-controlled arguments cannot inject extra
      IMAP commands via newlines (CWE-77).
    - CVE-2025-15366
  * SECURITY UPDATE: control-character command injection in poplib
    - debian/patches/CVE-2025-15367.patch: reject control characters in
      POP3._putcmd() so user-controlled arguments cannot inject extra
      POP3 commands via newlines (CWE-77).
    - CVE-2025-15367
  * SECURITY UPDATE: incomplete control-character rejection in http.cookies
    - debian/patches/CVE-2026-3644.patch: reject control characters in
      Morsel.update(), the |= operator, the unpickling path and
      BaseCookie.js_output(), closing the paths missed by CVE-2026-0672.
    - CVE-2026-3644
  * SECURITY UPDATE: unbounded C recursion in pyexpat
    - debian/patches/CVE-2026-4224.patch: guard conv_content_model() with
      Py_EnterRecursiveCall() so a deeply nested DTD content model with a
      registered ElementDeclHandler cannot cause a C stack overflow (CWE-674).
    - CVE-2026-4224
  * SECURITY UPDATE: argument injection in webbrowser.open()
    - debian/patches/CVE-2026-4519.patch: reject URLs with leading dashes so
      they cannot be smuggled into the spawned browser command line.
    - CVE-2026-4519

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Mon, 20 Jul 2026 09:39:23 +0000

alt-python311 (3.11.15-1) stable; urgency=medium

  * ALTPYTH-591: Update to 3.11.15 version

 -- Razmik Manvelyan <rmanvelyan@cloudlinux.com>  Tue, 07 Apr 2026 00:00:00 +0000

alt-python311 (3.11.14-4) stable; urgency=medium

  * ALTPYTH-596: Ubuntu 26 support: fix tkinter runtime dependencies
  * ALTPYTH-596: Ubuntu 26 support: fix libs runtime dependency on libtirpc-dev,
    replace with libtirpc3t64 (Ubuntu 24+) / libtirpc3 (older)

 -- Nikolai Mardanov <nmardanov@cloudlinux.com>  Mon, 06 Apr 2026 00:00:00 +0000

alt-python311 (3.11.14-3) stable; urgency=medium

  * ALTPYTH-595: Build alt-python packages for Debian 12 and 13 on ARM

 -- Razmik Manvelyan <rmanvelyan@cloudlinux.com>  Fri, 27 Mar 2026 00:00:00 +0000

alt-python311 (3.11.14-2) stable; urgency=medium

  * ALTPYTH-596: Ubuntu 26 support: fix tkinter runtime dependencies

 -- Nikolai Mardanov <nmardanov@cloudlinux.com>  Tue, 01 Apr 2026 00:00:00 +0000

alt-python311 (3.11.14-1) stable; urgency=medium

  * ALTPYTH-583: Update to 3.11.14 version

 -- Huseyn Hajizada <hhajizada@cloudlinux.com>  Wed, 10 Dec 2025 09:47:00 +0000

alt-python311 (3.11.13-1) stable; urgency=medium

  * ALTPYTH-556: Update to 3.11.13 version

 -- CloudLinux Packaging Team <packager@cloudlinux.com>  Wed, 04 Jun 2025 00:23:08 +0000

alt-python311 (3.11.12-1) stable; urgency=medium

  * ALTPYTH-551: Update to 3.11.12 version

 -- CloudLinux Packaging Team <packager@cloudlinux.com>  Wed, 09 Apr 2025 00:23:36 +0000

alt-python311 (3.11.11-1) stable; urgency=medium

  * Update to 3.11.11 version

 -- CloudLinux Packaging Team <packager@cloudlinux.com>  Wed, 04 Dec 2024 00:23:35 +0000

alt-python311 (3.11.10-2) stable; urgency=medium

  * ALTPYTH-530: Ubuntu 24 support

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Mon, 30 Sep 2024 17:00:00 +0100

alt-python311 (3.11.10-1) stable; urgency=medium

  * Update to 3.11.10 version

 -- CloudLinux Packaging Team <packager@cloudlinux.com>  Sat, 07 Sep 2024 06:23:11 +0000

alt-python311 (3.11.9-2) stable; urgency=medium

  * ALTPYTH-518: Resolve conflicts with idle3.appdata.xml with other alt-pythonXX-idle packages

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Thu, 25 Jul 2024 17:03:00 +0200

alt-python311 (3.11.9-1) stable; urgency=medium

  * ALTPYTH-509: Always use alt-sqlite
  * ALTPYTH-513: Update to 3.11.9 version

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Wed, 10 Apr 2024 15:05:00 +0200

alt-python311 (3.11.8-1) stable; urgency=medium

  * ALTPYTH-505: Update to 3.11.8 version.

 -- Eduard Chiganov <echiganov@cloudlinux.com>  Wed, 07 Feb 2024 00:23:08 +0000

alt-python311 (3.11.7-1) stable; urgency=medium

  * Update to 3.11.7 version

 -- CloudLinux Packaging Team <packager@cloudlinux.com>  Tue, 05 Dec 2023 00:23:20 +0000

alt-python311 (3.11.5-1) stable; urgency=medium

  * ALTPYTH-476: Build missing alt-python packages for CL ubuntu.
  * update to 3.11.5

 -- Eduard Chiganov <echiganov@cloudlinux.com>  Mon, 21 Aug 2023 14:20:00 +0200

alt-python311 (3.11.4-1) stable; urgency=medium

  * ALTPYTH-475: relocate tomllib
  * update to 3.11.4

 -- Sergey Fokin <sfokin@cloudlinux.com>  Tue, 18 Jul 2023 16:48:00 +0200

alt-python311 (3.11.3-2) stable; urgency=medium

  * ALTPYTH-471: fixed sqlite dependencies

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Tue, 30 May 2023 19:00:00 +0100

alt-python311 (3.11.3-1) stable; urgency=medium

  * ALTPYTH-468: older OS compatibility
  * Updated to 3.11.3

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Thu, 20 Apr 2023 19:00:00 +0100

alt-python311 (3.11.1-1) stable; urgency=medium

  * ALTPYTH-453: Initial build

 -- Eduard Chiganov <echiganov@cloudlinux.com>  Mon, 19 Dec 2022 13:20:00 +0300
