alt-python313 (3.13.15-6) stable; urgency=medium

  * SECURITY UPDATE: urllib.request HTTPPasswordMgr did not scope
    credentials by URL scheme (CWE-523, unprotected transport of
    credentials). reduce_uri() reduces a URI to an (authority, path) pair and
    drops the scheme, so credentials registered for 'https://host/' were also
    returned for 'http://host/'. An attacker able to force an HTTPS to HTTP
    downgrade or redirect therefore received the Basic-auth credentials in
    cleartext.
    - debian/patches/CVE-2026-15806.patch: backport of cpython
      a2773a34183b7d94a243bb98fd658926cc5348ce (gh-155694, GH-155696), which
      adds _reduce_uri_with_scheme() and _is_suburi_with_scheme() and uses
      them in HTTPPasswordMgr.add_password()/find_user_password() and
      HTTPPasswordMgrWithPriorAuth.update_authenticated()/is_authenticated().
      A URI registered without a scheme still matches any scheme, which keeps
      proxy authentication working. Includes upstream's regression tests in
      Lib/test/test_urllib2.py.
    - CVE-2026-15806
  * SECURITY UPDATE: stringprep (and so the 'idna' codec) applied case
    mappings from outside Unicode 3.2.0, which RFC 3454 mandates.
    map_table_b3() falls back to str.lower() for every codepoint not listed in
    b3_exceptions, and str.lower() uses the interpreter's own Unicode 15.1.0
    data, so characters that gained a lowercase mapping after 3.2.0
    (Cherokee, Georgian Mtavruli, Adlam, Cyrillic Palochka and others) were
    case-folded. Different Python versions derived different A-labels for the
    same U-label, breaking domain-name comparison and enabling spoofing.
    - debian/patches/CVE-2026-17084.patch: backport of cpython
      1e54caa096678a38afcabecabb1ff72400dd6bae (gh-155292), which pins every
      such codepoint to itself in b3_exceptions, renames the 3.2.0 database
      alias to unicodedata_320 and asserts the generating unidata_version,
      plus the matching Tools/unicode/mkstringprep.py and
      Lib/test/test_codecs.py changes. The upstream table is specific to its
      Unicode database, so Lib/stringprep.py was regenerated with this
      version's own 3.13.15 interpreter (UCD 15.1.0) rather than copied.
    - CVE-2026-17084

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Thu, 24 Sep 2026 00:00:00 +0000

alt-python313 (3.13.15-5) stable; urgency=medium

  * SECURITY UPDATE: tarfile ignored a None result from the extraction filter
    on the link fallback path
    - debian/patches/CVE-2026-87910.patch: keep the result of the first
      filter_function() call in TarFile.makelink_with_filter() and return
      early when it is None, so a filter that skips a member by returning
      None is honoured when link extraction falls back to copying the target
      under the link's own, shallower name instead of the member being
      extracted anyway (CWE-22).
    - CVE-2026-87910
  * SECURITY UPDATE: tarfile tar/data filters created directories outside the
    destination
    - debian/patches/CVE-2026-19672.patch: collapse ".." components with
      os.path.normpath() in _get_filtered_attrs() before the containment
      check, so a member whose name leaves the destination and comes back,
      such as "../evil/../dest/sub/file", no longer creates the intermediate
      directories outside it. The containment check looked at the resolved
      path, which stayed inside, while the directories were created from the
      name as given (CWE-22). Backport of upstream commit 97688346ada2.
    - Behaviour change: the "tar" and "data" filters now rewrite such names
      with os.path.normpath(), which removes internal ".." components and so
      may change the meaning of a name that traverses symbolic links.
    - CVE-2026-19672

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Tue, 22 Sep 2026 00:00:00 +0000

alt-python313 (3.13.15-4) stable; urgency=medium

  * SECURITY UPDATE: tarfile data/tar filter bypass via a hard link to a symlink
    - debian/patches/CVE-2026-82049.patch: resolve the link source with
      os.path.realpath() before os.link() in TarFile.makelink_with_filter(),
      so a hard link whose target is a symlink no longer duplicates that
      symlink inode one directory shallower, where its relative payload
      re-based outside the destination and the following chmod()/utime()
      hit the outside file (CWE-59).
    - CVE-2026-82049

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Fri, 18 Sep 2026 00:00:00 +0000

alt-python313 (3.13.15-3) stable; urgency=medium

  * SECURITY UPDATE: control-character command injection in poplib
    - debian/patches/00475-CVE-2025-15367-poplib-reject-control-chars.patch:
      reject C0 control characters and DEL in POP3._putcmd() so a CR/LF in a
      user()/pass_() argument cannot inject a second POP3 command (CWE-77/CWE-93).
    - CVE-2025-15367

 -- Tamar Zerekidze <tzerekidze@cloudlinux.com>  Thu, 27 Aug 2026 12:00:00 +0000

alt-python313 (3.13.15-2) stable; urgency=medium

  * ALTPYTH-615: rebuild against renamed alt-openssl11 (deb OpenSSL 1.1.1
    package renamed alt-openssl -> alt-openssl11, install prefix
    /opt/alt/openssl -> /opt/alt/openssl11)

 -- Nikolai Mardanov <nmardanov@cloudlinux.com>  Tue, 18 Aug 2026 11:42:35 +0400

alt-python313 (3.13.15-1) stable; urgency=medium

  * ALTPYTH-613: Update to 3.13.15 version

 -- Levon Matshkalyan <lmatshkalyan@cloudlinux.com>  Wed, 05 Aug 2026 17:43:39 +0200

alt-python313 (3.13.14-1) stable; urgency=medium

  * Update to 3.13.14

 -- CloudLinux Packaging Team <packager@cloudlinux.com>  Wed, 10 Jun 2026 19:49:42 -0400

alt-python313 (3.13.13-1) stable; urgency=medium

  * ALTPYTH-600: Update to 3.13.13 version

 -- Razmik Manvelyan <rmanvelyan@cloudlinux.com>  Tue, 21 Apr 2026 00:00:00 +0000

alt-python313 (3.13.12-3) stable; urgency=medium

  * ALTPYTH-595: Build alt-python packages for Debian 12 and 13 on ARM

 -- Razmik Manvelyan <rmanvelyan@cloudlinux.com>  Fri, 27 Mar 2026 00:00:00 +0000

alt-python313 (3.13.12-2) stable; urgency=medium

  * Fix debian builds across platforms:
    - Use mailcap instead of mime-support on Ubuntu 24+ / Debian 13+
    - Add expat 2.2.1 compat patch for Ubuntu 16 (XML_ERROR_INVALID_ARGUMENT)
    - Fix bootstrap/regen-all inverted condition (Ubuntu 16)
    - Fix __pycache__ fakeroot EISDIR in dh_movefiles (-X__pycache__)
    - Fix bin/__pycache__ rm failure under fakeroot (-rm non-fatal)
    - Exclude __pycache__ from dh_missing --fail-missing

 -- CloudLinux Packaging Team <packager@cloudlinux.com>  Tue, 25 Mar 2026 00:00:00 +0000

alt-python313 (3.13.12-1) stable; urgency=medium

  * ALTPYTH-590: Update to 3.13.12 version

 -- CloudLinux Packaging Team <packager@cloudlinux.com>  Wed, 25 Feb 2026 07:44:26 -0500

alt-python313 (3.13.11-1) stable; urgency=medium

  * ALTPYTH-563: Update to Python 3.13.11 

 -- Huseyn Hajizada <hhajizada@cloudlinux.com>  Sun, 14 Dec 2025 20:36:00 +0000

alt-python313 (3.13.5-1) stable; urgency=medium

  * ALTPYTH-554: Update to 3.13.5 version

 -- CloudLinux Packaging Team <packager@cloudlinux.com>  Thu, 12 Jun 2025 00:22:47 +0000

alt-python313 (3.13.3-1) stable; urgency=medium

  * ALTPYTH-549: Update to 3.13.3 version

 -- CloudLinux Packaging Team <packager@cloudlinux.com>  Wed, 09 Apr 2025 00:23:06 +0000

alt-python313 (3.13.2-1) stable; urgency=medium

  * ALTPYTH-547: update to 3.13.2.

 -- Eduard Chiganov <echiganov@cloudlinux.com>  Fri, 28 Feb 2025 14:20:00 +0200

alt-python313 (3.13.1-1) stable; urgency=medium

  * ALTPYTH-540: update to 3.13.1

 -- Sergey Fokin <sfokin@cloudlinux.com>  Mon, 06 Jan 2025 10:52:00 +0100

alt-python313 (3.13.0-1) stable; urgency=medium

  * ALTPYTH-533: Initial release.

 -- Eduard Chiganov <echiganov@cloudlinux.com>  Thu, 14 Nov 2024 14:20:00 +0200
