alt-python311 (3.11.16-4) stable; urgency=medium

  * SECURITY UPDATE: urllib HTTPPasswordMgr handed out credentials for a
    different URL scheme
    - debian/patches/CVE-2026-15806.patch: add _reduce_uri_with_scheme() and
      _is_suburi_with_scheme() and use them in HTTPPasswordMgr.add_password()
      and find_user_password() and in HTTPPasswordMgrWithPriorAuth's
      update_authenticated() and is_authenticated(). reduce_uri() dropped the
      scheme, so credentials registered for "https://host/" were also
      returned for "http://host/", and an attacker able to force an HTTPS to
      HTTP downgrade or redirect received them in cleartext. A URI
      registered without a scheme still matches any scheme, which keeps
      proxy authentication working. Also carries upstream's two new
      test_urllib2 tests. Upstream commit a2773a34183b
    - CVE-2026-15806
  * SECURITY UPDATE: stringprep applied post-Unicode-3.2.0 case mappings
    - debian/patches/CVE-2026-17084.patch: regenerate Lib/stringprep.py so
      that b3_exceptions pins every codepoint that this interpreter's
      Unicode 14.0.0 case-folds but Unicode 3.2.0 does not to itself (684
      entries). map_table_b3() fell back to str.lower(), which uses the
      bundled UCD, so the idna codec case-folded characters such as Cherokee,
      Cyrillic Palochka and Georgian Mtavruli that RFC 3454 requires to be
      left alone, and different Python versions derived different A-labels
      for the same name. The module now asserts the UCD version it was
      generated for. The table is specific to the bundled UCD, so it was
      regenerated with this version's own interpreter rather than copied
      from upstream; Tools/unicode/mkstringprep.py gains the generation loop
      and upstream's idna regression test is carried in test_codecs.
      Upstream commit 1e54caa09667
    - CVE-2026-17084

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Thu, 24 Sep 2026 12:00:00 +0000

alt-python311 (3.11.16-3) stable; urgency=medium

  * SECURITY UPDATE: tarfile ignored a custom extraction filter that skips a
    member on the hard-link fallback path
    - debian/patches/CVE-2026-87910.patch: keep the result of the first
      filter_function() call in makelink_with_filter() and return when it is
      None. When extracting a hard link falls back to extracting the target
      member under the link's own name, the CVE-2026-11940 guard re-runs the
      filter with that substituted name, but only an exception was acted
      upon. A PEP 706 custom filter signals "skip this member" by returning
      None rather than raising, so such a filter was silently ignored on this
      path and the member was extracted anyway, under the very name the
      filter had just refused. Also carries upstream's
      test_extract_filters_target_none regression test and the matching
      adjustment to test_sneaky_hardlink_fallback. The guard being repaired
      is native to the shipped upstream micro 3.11.16, not a patch of ours
    - CVE-2026-87910
  * SECURITY UPDATE: tarfile tar/data filters created directories outside the
    destination for a member name that leaves it and returns
    - debian/patches/CVE-2026-19672.patch: normalise a member name containing
      a ".." component in _get_filtered_attrs() before the containment check.
      The check looks at the resolved path, which stays inside the
      destination for a name such as "../evil/../dest/sub/file", while the
      intermediate directories are created from the name as given, so "evil"
      was created as a sibling of the destination directory. POSIX only. Also
      carries upstream's test_parent_dir_out_and_back regression test.
      Backported from upstream commit 97688346ada2 (gh-155999). Upstream
      carries this on 3.12 and newer only; the backport pull request for
      3.11 is still open, so this is ahead of upstream
    - Behaviour change: the "tar" and "data" filters now hand back member
      names containing ".." in os.path.normpath() form; as upstream notes,
      removing internal ".." components may change what such a name refers
      to if it traverses a symbolic link
    - CVE-2026-19672

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Tue, 22 Sep 2026 12:00:00 +0000

alt-python311 (3.11.16-2) stable; urgency=medium

  * SECURITY UPDATE: tarfile data/tar extraction filter bypassed by a hard
    link whose target is a symlink
    - debian/patches/CVE-2026-82049.patch: pass os.path.realpath() of the
      hard-link source to os.link() in makelink_with_filter(), so the
      extracted name is a hard link to the file the symlink resolves to
      instead of a second name for the symlink inode itself. link(2) does
      not follow symlinks, so without this a crafted archive could place a
      copy of an already-extracted symlink one directory shallower, where
      its relative payload re-bases outside the destination directory and
      the chmod/utime that follow change the mode and mtime of the outside
      file while exposing its contents inside the extracted tree (CWE-59).
      Also carries upstream's test_sneaky_hardlink_relocation regression
      test. This fix is effective only in combination with CVE-2026-11940,
      which is already part of upstream 3.11.16 and blocks the variant that
      never reaches os.link()
    - CVE-2026-82049

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Fri, 18 Sep 2026 08:40:00 +0000

alt-python311 (3.11.16-1) stable; urgency=medium

  * ALTPYTH-617: Update to 3.11.16 version
  * Drop patches absorbed by upstream 3.11.16: CVE-2025-13462, CVE-2026-0864,
    CVE-2026-1502, CVE-2026-3276, CVE-2026-3644, CVE-2026-4224, CVE-2026-4360,
    CVE-2026-4519, CVE-2026-4786, CVE-2026-6100, CVE-2026-6879, CVE-2026-7774,
    CVE-2026-8328, CVE-2026-9669, CVE-2026-11940, CVE-2026-11972, CVE-2026-15308,
    CVE-2026-41080
  * Keep CVE-2026-7210, reduced to Modules/pyexpat.c: upstream gates the 16-byte
    Expat hash salt on the libexpat HEADER version (XML_COMBINED_VERSION >= 20800),
    but ELS libexpat backports XML_SetHashSalt16Bytes into 2.2.x/2.5.x without
    bumping its version macros, so that gate is false and CPython would silently
    fall back to the 8-byte salt on debian10, ubuntu18.04 and ubuntu20.04. The
    patch restores the weak-symbol check on the function's address. No-op on
    ubuntu16.04 (bundled libexpat, now 2.8.3) and debian13 (system libexpat 2.8.3).
    - debian/patches/CVE-2026-7210.patch

 -- Levon Matshkalyan <lmatshkalyan@cloudlinux.com>  Thu, 20 Aug 2026 09:00:00 +0000

alt-python311 (3.11.15-8) stable; urgency=medium

  * ALTPYTH-615: rebuild against renamed alt-openssl11 (deb OpenSSL 1.1.1
    package renamed alt-openssl -> alt-openssl11, install prefix
    /opt/alt/openssl -> /opt/alt/openssl11)

 -- Nikolai Mardanov <nmardanov@cloudlinux.com>  Tue, 18 Aug 2026 11:42:35 +0400

alt-python311 (3.11.15-7) stable; urgency=medium

  * SECURITY UPDATE: extraction filter bypassed for hardlink targets in tarfile.TarFile.extract()
    - debian/patches/CVE-2026-4360.patch: forward the resolved filter_function
      from extract() to _extract_one(), so that the recursive call which
      materialises a hardlink's target as a fallback is filtered too instead
      of falling back to unfiltered extraction, which let a crafted archive
      write the target with attributes the selected filter would have
      rejected (CWE-281).
    - CVE-2026-4360
  * SECURITY UPDATE: CPU denial-of-service in xml.etree XPath index predicates
    - debian/patches/CVE-2026-6879.patch: memoise the indexed match per
      (parent, tag) pair in the ElementPath index-predicate selector instead
      of calling parent.findall(elem.tag) once per sibling, so patterns such
      as ".//a[1]" or ".//a[last()]" no longer rescan the whole sibling list
      for every sibling and are linear rather than quadratic in the number of
      same-tag siblings (CWE-407/CWE-1333).
    - CVE-2026-6879

 -- Viktor Borzov <vborzov@cloudlinux.com>  Tue, 11 Aug 2026 07:20:00 +0000

alt-python311 (3.11.15-6) stable; urgency=medium

  * SECURITY UPDATE: skip tarfile AREGTYPE->DIRTYPE normalization while parsing GNU long name/link continuation headers (parser-differential)
    - debian/patches/CVE-2025-13462.patch: skip tarfile AREGTYPE->DIRTYPE normalization while parsing GNU long name/link continuation headers (parser-differential)
    - CVE-2025-13462

 -- Viktor Borzov <vborzov@cloudlinux.com>  Mon, 27 Jul 2026 12:00:00 +0000

alt-python311 (3.11.15-5) stable; urgency=medium

  * SECURITY UPDATE: configparser key/value injection via CR/CRLF
    - debian/patches/CVE-2026-0864.patch: normalize CR, CRLF and LF line
      endings when writing multi-line values in RawConfigParser so a
      carriage return cannot inject additional keys into the output.
    - CVE-2026-0864
  * SECURITY UPDATE: http.client proxy CONNECT tunnel header injection
    - debian/patches/CVE-2026-1502.patch: reject CR/LF in the proxy tunnel
      host and in set_tunnel() custom headers before writing the CONNECT
      request.
    - CVE-2026-1502
  * SECURITY UPDATE: unicodedata.normalize() quadratic-time DoS
    - debian/patches/CVE-2026-3276.patch: replace the O(n^2) canonical
      ordering insertion sort with a counting sort for long combining
      runs to prevent CPU-exhaustion on crafted input.
    - CVE-2026-3276
  * SECURITY UPDATE: http.cookies js_output() script injection (XSS)
    - debian/patches/CVE-2026-6019.patch: percent-encode the cookie value
      embedded in the inline <script> and decode it with
      decodeURIComponent() so a </script> sequence cannot break out.
    - CVE-2026-6019
  * SECURITY UPDATE: tarfile data filter path traversal
    - debian/patches/CVE-2026-7774.patch: validate the written link target
      against the extraction root in the data/tar filter.
    - CVE-2026-7774
  * SECURITY UPDATE: ftplib.ftpcp() data-connection SSRF
    - debian/patches/CVE-2026-8328.patch: apply the CVE-2021-4189 PASV
      peer-address check to ftpcp() so a malicious source server cannot
      redirect the target's data connection.
    - CVE-2026-8328
  * SECURITY UPDATE: tarfile hardlink-extraction symlink escape
    - debian/patches/CVE-2026-11940.patch: pre-validate the symlink at the
      hardlink's own name in the extraction-filter fallback to prevent a
      path-traversal escape (incomplete fix of CVE-2025-4330).
    - CVE-2026-11940
  * SECURITY UPDATE: tarfile stream-seek infinite-loop DoS
    - debian/patches/CVE-2026-11972.patch: break out of _Stream.seek() on
      EOF so a truncated stream archive cannot cause an unbounded loop.
    - CVE-2026-11972

 -- Vladimir D. Seleznev <vseleznev@cloudlinux.com>  Mon, 27 Jul 2026 00:00:00 +0000

alt-python311 (3.11.15-4) stable; urgency=medium

  * SECURITY UPDATE: CPU denial-of-service in html.parser.HTMLParser
    - debian/patches/CVE-2026-15308.patch: buffer incoming feed() chunks in
      a list and only join and re-scan the unparsed buffer once the pending
      data crosses a doubling threshold (flushing in close()), so repeated
      unterminated markup declarations can no longer force quadratic
      rescanning/concatenation of uncontrolled data (CWE-407/CWE-1333).
    - CVE-2026-15308

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Wed, 22 Jul 2026 08:56:34 +0000

alt-python311 (3.11.15-3) stable; urgency=medium

  * SECURITY UPDATE: webbrowser.open() dash-prefix check bypass via the action token
    - debian/patches/CVE-2026-4786.patch: validate the action-expanded URL
      and reorder the action/URL substitution so a URL containing the action
      token cannot expand into a dash-prefixed browser flag (CVE-2026-4519
      bypass).
    - CVE-2026-4786
  * SECURITY UPDATE: dangling input pointer (UAF) in bz2/lzma decompressors
    - debian/patches/CVE-2026-6100.patch: clear next_in on the MemoryError
      error path in _bz2/_lzma decompress() so a reused decompressor cannot
      read or write through a stale pointer to the released input buffer.
    - CVE-2026-6100
  * SECURITY UPDATE: insufficient Expat hash-flooding entropy
    - debian/patches/CVE-2026-7210.patch: seed Expat with 16 bytes of
      entropy via XML_SetHashSalt16Bytes when libexpat exposes it (weak
      symbol), falling back to the legacy 8-byte salt otherwise.
    - debian/patches/CVE-2026-41080.patch: backport XML_SetHashSalt16Bytes
      into the BUNDLED expat (applied on ubuntu16.04 only; el7 on the RPM
      side) so the 16-byte salt path above is not inert; other platforms
      link system expat.
    - CVE-2026-7210
  * SECURITY UPDATE: bz2.BZ2Decompressor reuse after error (stack overflow)
    - debian/patches/CVE-2026-9669.patch: record the libbz2 error and raise
      ValueError on any subsequent decompress() call instead of re-entering
      libbz2 on an inconsistent stream (CWE-121).
    - CVE-2026-9669

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Mon, 20 Jul 2026 09:39:23 +0000

alt-python311 (3.11.15-2) stable; urgency=medium

  * SECURITY UPDATE: control-character command injection in imaplib
    - debian/patches/CVE-2025-15366.patch: reject control characters in
      IMAP4._command() so user-controlled arguments cannot inject extra
      IMAP commands via newlines (CWE-77).
    - CVE-2025-15366
  * SECURITY UPDATE: control-character command injection in poplib
    - debian/patches/CVE-2025-15367.patch: reject control characters in
      POP3._putcmd() so user-controlled arguments cannot inject extra
      POP3 commands via newlines (CWE-77).
    - CVE-2025-15367
  * SECURITY UPDATE: incomplete control-character rejection in http.cookies
    - debian/patches/CVE-2026-3644.patch: reject control characters in
      Morsel.update(), the |= operator, the unpickling path and
      BaseCookie.js_output(), closing the paths missed by CVE-2026-0672.
    - CVE-2026-3644
  * SECURITY UPDATE: unbounded C recursion in pyexpat
    - debian/patches/CVE-2026-4224.patch: guard conv_content_model() with
      Py_EnterRecursiveCall() so a deeply nested DTD content model with a
      registered ElementDeclHandler cannot cause a C stack overflow (CWE-674).
    - CVE-2026-4224
  * SECURITY UPDATE: argument injection in webbrowser.open()
    - debian/patches/CVE-2026-4519.patch: reject URLs with leading dashes so
      they cannot be smuggled into the spawned browser command line.
    - CVE-2026-4519

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Mon, 20 Jul 2026 09:39:23 +0000

alt-python311 (3.11.15-1) stable; urgency=medium

  * ALTPYTH-591: Update to 3.11.15 version

 -- Razmik Manvelyan <rmanvelyan@cloudlinux.com>  Tue, 07 Apr 2026 00:00:00 +0000

alt-python311 (3.11.14-4) stable; urgency=medium

  * ALTPYTH-596: Ubuntu 26 support: fix tkinter runtime dependencies
  * ALTPYTH-596: Ubuntu 26 support: fix libs runtime dependency on libtirpc-dev,
    replace with libtirpc3t64 (Ubuntu 24+) / libtirpc3 (older)

 -- Nikolai Mardanov <nmardanov@cloudlinux.com>  Mon, 06 Apr 2026 00:00:00 +0000

alt-python311 (3.11.14-3) stable; urgency=medium

  * ALTPYTH-595: Build alt-python packages for Debian 12 and 13 on ARM

 -- Razmik Manvelyan <rmanvelyan@cloudlinux.com>  Fri, 27 Mar 2026 00:00:00 +0000

alt-python311 (3.11.14-2) stable; urgency=medium

  * ALTPYTH-596: Ubuntu 26 support: fix tkinter runtime dependencies

 -- Nikolai Mardanov <nmardanov@cloudlinux.com>  Tue, 01 Apr 2026 00:00:00 +0000

alt-python311 (3.11.14-1) stable; urgency=medium

  * ALTPYTH-583: Update to 3.11.14 version

 -- Huseyn Hajizada <hhajizada@cloudlinux.com>  Wed, 10 Dec 2025 09:47:00 +0000

alt-python311 (3.11.13-1) stable; urgency=medium

  * ALTPYTH-556: Update to 3.11.13 version

 -- CloudLinux Packaging Team <packager@cloudlinux.com>  Wed, 04 Jun 2025 00:23:08 +0000

alt-python311 (3.11.12-1) stable; urgency=medium

  * ALTPYTH-551: Update to 3.11.12 version

 -- CloudLinux Packaging Team <packager@cloudlinux.com>  Wed, 09 Apr 2025 00:23:36 +0000

alt-python311 (3.11.11-1) stable; urgency=medium

  * Update to 3.11.11 version

 -- CloudLinux Packaging Team <packager@cloudlinux.com>  Wed, 04 Dec 2024 00:23:35 +0000

alt-python311 (3.11.10-2) stable; urgency=medium

  * ALTPYTH-530: Ubuntu 24 support

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Mon, 30 Sep 2024 17:00:00 +0100

alt-python311 (3.11.10-1) stable; urgency=medium

  * Update to 3.11.10 version

 -- CloudLinux Packaging Team <packager@cloudlinux.com>  Sat, 07 Sep 2024 06:23:11 +0000

alt-python311 (3.11.9-2) stable; urgency=medium

  * ALTPYTH-518: Resolve conflicts with idle3.appdata.xml with other alt-pythonXX-idle packages

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Thu, 25 Jul 2024 17:03:00 +0200

alt-python311 (3.11.9-1) stable; urgency=medium

  * ALTPYTH-509: Always use alt-sqlite
  * ALTPYTH-513: Update to 3.11.9 version

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Wed, 10 Apr 2024 15:05:00 +0200

alt-python311 (3.11.8-1) stable; urgency=medium

  * ALTPYTH-505: Update to 3.11.8 version.

 -- Eduard Chiganov <echiganov@cloudlinux.com>  Wed, 07 Feb 2024 00:23:08 +0000

alt-python311 (3.11.7-1) stable; urgency=medium

  * Update to 3.11.7 version

 -- CloudLinux Packaging Team <packager@cloudlinux.com>  Tue, 05 Dec 2023 00:23:20 +0000

alt-python311 (3.11.5-1) stable; urgency=medium

  * ALTPYTH-476: Build missing alt-python packages for CL ubuntu.
  * update to 3.11.5

 -- Eduard Chiganov <echiganov@cloudlinux.com>  Mon, 21 Aug 2023 14:20:00 +0200

alt-python311 (3.11.4-1) stable; urgency=medium

  * ALTPYTH-475: relocate tomllib
  * update to 3.11.4

 -- Sergey Fokin <sfokin@cloudlinux.com>  Tue, 18 Jul 2023 16:48:00 +0200

alt-python311 (3.11.3-2) stable; urgency=medium

  * ALTPYTH-471: fixed sqlite dependencies

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Tue, 30 May 2023 19:00:00 +0100

alt-python311 (3.11.3-1) stable; urgency=medium

  * ALTPYTH-468: older OS compatibility
  * Updated to 3.11.3

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Thu, 20 Apr 2023 19:00:00 +0100

alt-python311 (3.11.1-1) stable; urgency=medium

  * ALTPYTH-453: Initial build

 -- Eduard Chiganov <echiganov@cloudlinux.com>  Mon, 19 Dec 2022 13:20:00 +0300
