alt-python312 (3.12.14-9) stable; urgency=medium

  * SECURITY UPDATE: urllib HTTPPasswordMgr credentials were not scoped by
    URL scheme
    - debian/patches/CVE-2026-15806.patch: add _reduce_uri_with_scheme() and
      _is_suburi_with_scheme() to Lib/urllib/request.py and use them in
      HTTPPasswordMgr and HTTPPasswordMgrWithPriorAuth, so credentials
      registered for an https:// URI are no longer handed out for http://
      (cleartext leak after a downgrade or redirect). A URI registered
      without a scheme still matches any scheme, keeping proxy auth working.
    - CVE-2026-15806
  * SECURITY UPDATE: stringprep applied post-Unicode-3.2.0 case mappings
    - debian/patches/CVE-2026-17084.patch: regenerate Lib/stringprep.py so
      b3_exceptions pins to itself every codepoint that the bundled UCD
      15.0.0 case-folds but Unicode 3.2.0 does not, so the idna codec no
      longer folds them against RFC 3454. The table was regenerated with this
      version's own interpreter; mkstringprep.py and tests updated.
    - CVE-2026-17084

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Thu, 24 Sep 2026 00:00:00 +0000

alt-python312 (3.12.14-8) stable; urgency=medium

  * SECURITY UPDATE: tarfile ignored a None result from the extraction filter
    on the link fallback path
    - debian/patches/CVE-2026-87910.patch: keep the result of the first
      filter_function() call in TarFile.makelink_with_filter() and return
      early when it is None, so a filter that skips a member by returning
      None is honoured when link extraction falls back to copying the target
      under the link's own, shallower name instead of the member being
      extracted anyway (CWE-22).
    - CVE-2026-87910
  * SECURITY UPDATE: tarfile tar/data filters created directories outside the
    destination
    - debian/patches/CVE-2026-19672.patch: collapse ".." components with
      os.path.normpath() in _get_filtered_attrs() before the containment
      check, so a member whose name leaves the destination and comes back,
      such as "../evil/../dest/sub/file", no longer creates the intermediate
      directories outside it. The containment check looked at the resolved
      path, which stayed inside, while the directories were created from the
      name as given (CWE-22). Backport of upstream commit 97688346.
    - Behaviour change: under the "tar" and "data" filters, member names
      containing ".." components are now normalized with os.path.normpath(),
      which removes internal ".." components and so may change the meaning of
      a name that traverses symbolic links.
    - CVE-2026-19672

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Tue, 22 Sep 2026 00:00:00 +0000

alt-python312 (3.12.14-7) stable; urgency=medium

  * SECURITY UPDATE: tarfile data/tar filter bypass via a hard link to a symlink
    - debian/patches/CVE-2026-82049.patch: resolve the link source with
      os.path.realpath() before os.link() in TarFile.makelink_with_filter(),
      so a hard link whose target is a symlink no longer duplicates that
      symlink inode one directory shallower, where its relative payload
      re-based outside the destination and the following chmod()/utime()
      hit the outside file (CWE-59).
    - CVE-2026-82049

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Fri, 18 Sep 2026 00:00:00 +0000

alt-python312 (3.12.14-6) stable; urgency=medium

  * SECURITY UPDATE: template injection in http.cookies.Morsel.js_output()
    - debian/patches/00477-CVE-2026-6019-cookies-js-output-injection.patch:
      percent-encode the cookie value with urllib.parse.quote() and wrap it in
      decodeURIComponent() instead of escaping only the double quote, so a value
      containing </script> cannot break out of the script context (CWE-1336).
    - CVE-2026-6019

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Wed, 02 Sep 2026 00:00:00 +0000

alt-python312 (3.12.14-5) stable; urgency=medium

  * SECURITY UPDATE: control-character command injection in imaplib
    - debian/patches/CVE-2025-15366.patch: reject control characters in
      IMAP4._command() so user-controlled arguments cannot inject extra
      IMAP commands or extra command arguments (CWE-77/CWE-93).
    - CVE-2025-15366

 -- Davit Sargsyan <dsargsyan@cloudlinux.com>  Mon, 31 Aug 2026 14:54:05 +0000

alt-python312 (3.12.14-4) stable; urgency=medium

  * SECURITY UPDATE: control-character command injection in poplib
    - debian/patches/00475-CVE-2025-15367-poplib-reject-control-chars.patch:
      reject C0 control characters and DEL in POP3._putcmd() so a CR/LF in a
      user()/pass_() argument cannot inject a second POP3 command (CWE-77/CWE-93).
    - CVE-2025-15367

 -- Tamar Zerekidze <tzerekidze@cloudlinux.com>  Mon, 31 Aug 2026 12:00:00 +0000

alt-python312 (3.12.14-3) stable; urgency=medium

  * SECURITY UPDATE: base64 decoder silently discarded data after the first
    padded quad
    - debian/patches/00476-CVE-2026-3446-base64-excess-data-after-padding.patch:
      backport of cpython 1f9958f909c1b41a4ffc0b613ef8ec8fa5e7c474 (gh-145264).
      In non-strict (default) mode binascii.a2b_base64() stopped at the first
      padded quad and dropped everything after it instead of ignoring the pad
      character per RFC 4648 section 3.3, so an attacker could append data our
      decoder discards but another implementation retains. Backs
      base64.b64decode(), standard_b64decode() and urlsafe_b64decode().
    - CVE-2026-3446

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Thu, 27 Aug 2026 00:00:00 +0000

alt-python312 (3.12.14-2) stable; urgency=medium

  * ALTPYTH-615: rebuild against renamed alt-openssl11 (deb OpenSSL 1.1.1
    package renamed alt-openssl -> alt-openssl11, install prefix
    /opt/alt/openssl -> /opt/alt/openssl11)

 -- Nikolai Mardanov <nmardanov@cloudlinux.com>  Tue, 18 Aug 2026 11:42:35 +0400

alt-python312 (3.12.14-1) stable; urgency=medium

  * Update to 3.12.14

 -- CloudLinux Packaging Team <packager@cloudlinux.com>  Thu, 13 Aug 2026 15:17:54 +0200

alt-python312 (3.12.13-1) stable; urgency=medium

  * Update to 3.12.13 version

 -- Razmik Manvelyan <rmanvelyan@cloudlinux.com>  Tue, 07 Apr 2026 00:00:00 +0000

alt-python312 (3.12.12-2) stable; urgency=medium

  * ALTPYTH-595: Build alt-python packages for Debian 12 and 13 on ARM

 -- Razmik Manvelyan <rmanvelyan@cloudlinux.com>  Fri, 27 Mar 2026 00:00:00 +0000

alt-python312 (3.12.12-1) stable; urgency=medium

  * ALTPYTH-582: Update to 3.12.12 version

 -- Huseyn Hajizada <hhajizada@cloudlinux.com>  Fri, 12 Dec 2025 17:32:00 +0000

alt-python312 (3.12.11-1) stable; urgency=medium

  * ALTPYTH-555: Update to 3.12.11 version

 -- CloudLinux Packaging Team <packager@cloudlinux.com>  Wed, 04 Jun 2025 00:22:57 +0000

alt-python312 (3.12.10-1) stable; urgency=medium

  * ALTPYTH-550: Update to 3.12.10 version

 -- CloudLinux Packaging Team <packager@cloudlinux.com>  Wed, 09 Apr 2025 00:23:21 +0000

alt-python312 (3.12.9-1) stable; urgency=medium

  * ALTPYTH-545: Update to 3.12.9 version

 -- Eduard Chiganov <echiganov@cloudlinux.com>>  Fri, 29 Feb 2025 14:20:00 +0200


alt-python312 (3.12.8-1) stable; urgency=medium

  * ALTPYTH-532: Update to 3.12.8 version

 -- CloudLinux Packaging Team <packager@cloudlinux.com>  Wed, 04 Dec 2024 00:23:20 +0000

alt-python312 (3.12.6-1) stable; urgency=medium

  * ALTPYTH-526: Update to 3.12.6 version

 -- Eduard Chiganov <echiganov@cloudlinux.com>>  Mon, 16 Sep 2024 14:20:00 +0200

alt-python312 (3.12.5-1) stable; urgency=medium

  * Update to 3.12.5 version

 -- CloudLinux Packaging Team <packager@cloudlinux.com>  Wed, 07 Aug 2024 18:22:51 +0000

alt-python312 (3.12.4-2) stable; urgency=medium

  * ALTPYTH-518: Resolve conflicts with idle3.appdata.xml with other alt-pythonXX-idle packages

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Thu, 25 Jul 2024 17:03:00 +0200    

alt-python312 (3.12.4-1) stable; urgency=medium

  * ALTPYTH-521: Update to 3.12.4 version

 -- CloudLinux Packaging Team <packager@cloudlinux.com>  Fri, 07 Jun 2024 06:22:39 +0000

alt-python312 (3.12.3-1) stable; urgency=medium

  * ALTPYTH-509: Always use alt-sqlite
  * ALTPYTH-514: Update to 3.12.3

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Wed, 10 Apr 2024 15:05:00 +0200

alt-python312 (3.12.2-1) stable; urgency=medium

  * ALTPYTH-503: Update to 3.12.2

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Mon, 4 Mar 2024 19:00:00 +0100


alt-python312 (3.12.0-1) stable; urgency=medium

  * Initial release

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Thu, 14 Dec 2023 19:00:00 +0100
