Repository navigation

[3.13] gh-90949: add Expat API to prevent XML deadly allocations (CVE-2025-59375) (GH-139234) - #139367

Merged

picnixz merged 11 commits into

python:3.13from

hartwork:backport-f04bea4-3.13

Nov 2, 2025

Merged

[3.13] gh-90949: add Expat API to prevent XML deadly allocations (CVE-2025-59375) (GH-139234)#139367
picnixz merged 11 commits into
python:3.13from
hartwork:backport-f04bea4-3.13

Commits on Sep 26, 2025
- gh-90949: add Expat API to prevent XML deadly allocations (CVE-2025-59375) (#139234)
  
  picnixz
  authored and
  hartwork
  committed
  5f9e8b8
- pyexpat.c: Drop @permit_long_* to make peace with "make clinic"
  hartwork
  committed
  9357fd0
- Apply "make clinic" with force
  hartwork
  committed
  9dd807e
- gh-90949: amend GH-139234 in prevision of future mitigation API (#139366)
  
  picnixz
  authored and
  hartwork
  committed
  b235056
Commits on Sep 28, 2025
- Workaround use-after-free from *__fail_for_subparser tests for the moment
  hartwork
  committed
  cff9c7c
Commits on Oct 2, 2025
- Add note on the nature of the workaround
  hartwork
  committed
  59a9613
- Add note on the nature of the workaround
  hartwork
  committed
  ba2968b
Commits on Oct 6, 2025
- Merge remote-tracking branch 'upstream/3.13' into backport-f04bea4-3.13
  hartwork
  committed
  2a25a71
- Drop workaround for 139400 as no-longer-needed
  hartwork
  committed
  f6e0edc
Commits on Nov 2, 2025
- Merge remote-tracking branch 'upstream/3.13' into backport-f04bea4-3.13
  hartwork
  committed
  fc50ad5
- Resolve double "textwrap" import to make linter happy
  hartwork
  committed
  12d2b24