Repository navigation
Update python to 3.14.9 and setuptools to 84.2.1 - #982
Merged
Merged
Conversation
python 3.14.9 ships three fixes we carried by hand, so they go: - gh-157265 (tarfile, CVE-2026-87910): drop 0002. - gh-157579 (tempfile, CVE-2026-12345): drop 0004. - gh-159894: ensurepip now bundles pip 26.2.2 (the CVE-2026-111943 certifi fix), so the wheel swap, its Source and `bundled_pip_version` go. gh-143923 (poplib, CVE-2025-15367) is still not in 3.14.x; 0003 stays (applies at fuzz 0). The regression tests stay as guards; the pip test now requires pip >= 26.2.2 instead of exactly 26.2.2. Dropping the pip Source also puts the Python tarball back as the first pinned Source, which the updater rewrites. setuptools 84.2.1: GitHub tag archive, as before (84.0.0's archive matches the old sha256); the staging mirror matches upstream's archive. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Contributor
|
Warning Review limit reached
This review includes 5 billable files and costs up to $1.25.
Reviews can continue after your included limit without a manual trigger. An admin must approve usage-based billing. Or wait 27 minutes for your next included review. View limit details
Comment |
norrietaylor
approved these changes
Oct 22, 2026
Member
There was a problem hiding this comment.
LGTM.
- 0004 (CVE-2026-12345):
58ed0259is an ancestor ofv3.14.9, it's listed in the 3.14.9 NEWS, and the old patch reverse-applies cleanly on every code hunk. Dropping it is correct, and thetempfile_cleanup_race_fixtest stays as a guard. - 0002 (gh-157265): upstream, so dropping it is correct.
- 0003 (poplib, gh-143923): not in 3.14.9; it still applies at fuzz 0 and is correctly kept.
- pip swap: 3.14.9 bundles the same 26.2.2 wheel (
fd7f4dfa…), so removing the swap is correct. - Hashes: the tarball matches staging, and the touched modules are identical to the
v3.14.9tag. setuptools reproduces fromv84.2.1. - setuptools 84.1 brings two GHSA fixes;
archive_utilnow raisesUnsafeMember. cython, ddgr, meson and pyelftools should be unaffected. - The 2h40m
minimal buildmatches the full dependent rebuild.
Small correction to the body: gh-159428 is Windows-only and gh-157953 (bundled expat) doesn't apply under --with-system-expat. So "no fix we lacked" holds, but for those reasons.
Generated by Claude Code
github-merge-queue
Bot
removed this pull request from the merge queue due to no response for status checks
Oct 23, 2026
This was referenced Oct 26, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
python 3.14.8 → 3.14.9 and setuptools 84.0.0 → 84.2.1.
The bot's bundle (#979, c-ares only, separate) dropped both. The updater refused python because #950 put the pip wheel Source ahead of the Python tarball, and the updater only rewrites the first pinned Source. setuptools was dropped with it because it depends on python. That updater gap is being fixed in pkgmgr-rs. This PR also removes the pip Source, so the tarball is first again.
python 3.14.9
Tarball sha256
e02d9ac2…1e53:cosign verify-blob, identityhugo@python.org, issuerhttps://github.com/login/oauth);gs://minimal-staging-archives/Python-3.14.9.tar.xz(new object, created no-clobber; the GCS md5 matches).Security content. 3.14.9's Misc/NEWS Security section names one CVE, CVE-2026-12345, and lists the fixes we were already carrying. So this bump adds no fix we lacked; it replaces our hand-carried copies with upstream's.
0002gh-157265 tarfile link fallback (CVE-2026-87910)0004gh-157579 tempfile cleanup race (CVE-2026-12345)_bundled/holdspip-26.2.2-py3-none-any.whland_PIP_VERSION = "26.2.2"bundled_pip_versionremoved0003gh-143923 poplib CR/LF (CVE-2025-15367)All the regression tests stay as guards. The pip/certifi test now requires pip
>= 26.2.2rather than exactly 26.2.2, so a later 3.14.x that bundles a newer pip still passes. build.sh's post-install check that the installed pip's certifi doesn't contain emSign ECC Root CA - G3 also stays.setuptools 84.2.1
The recipe uses GitHub's tag archive, not the PyPI sdist: 84.0.0's
v84.0.0archive hashes to the old sha256 exactly. The 84.2.1 staging object, which the bot mirrored at 16:36Z, is byte-identical to upstream'sv84.2.1archive (99f6fbe4…bb0), so it's reused.Rebuild scope
MINIMAL_SCIENCE_MODE=1 mip dump --packages --arch amd64gives 561 of 624 spec hashes changed. python is in the toolchain closure, so every python bump has this shape.Remote session (
pkgbuildloadout, fresh activate; the snapshot showed 3.14.9 and only0003):min package build --rebuild --verbose python: a real compile, 485 gcc invocations on thePython-3.14.9tree.0003applied cleanly, and ensurepip installedpip-26.2.2from 3.14.9's own bundle.min package build --rebuild setuptools:Successfully installed setuptools-84.2.1.min check --packages python setuptools: every check Pass for both, standalone tests included (Pass, not Skip). That covers the tarfile, poplib, pip/certifi (>= 26.2.2) and tempfile regression guards.nickel format --checkandbash -nare clean.🤖 Generated with Claude Code