python3-3.13.1 (Wait for LFS)

[Douglas R. Reno]

The release notes for this package can be found here: ​https://docs.python.org/release/3.13.1/whatsnew/changelog.html#python-3-13-1

They do include some security fixes:

gh-126623: Upgrade libexpat to 2.6.4

gh-125140: Remove the current directory from sys.path when using PyREPL.

gh-122792: Changed IPv4-mapped ipaddress.IPv6Address to consistently use the mapped IPv4 
address value for deciding properties. Properties which have their behavior fixed are 
is_multicast, is_reserved, is_link_local, is_global, and is_unspecified.

gh-124651: Properly quote template strings in venv activation scripts.

We are using the system version of expat, so the first vulnerability does not affect us.

For gh-125140, see ​https://github.com/python/cpython/issues/125140

For gh-122792, see ​https://github.com/python/cpython/issues/122792

For gh-124651, see ​https://github.com/python/cpython/issues/124651 - this issue is the only one of the three to have a CVE assigned. It is known as CVE-2024-9287 and is rated as Moderate

[Joe Locash]

I'm seeing a build failure with firefox (and thunderbird) with Python-3.13.1:

The details of the failure are as follows:

ValueError: '/usr/lib/python3.13/site-packages' is not in the subpath of '/tmp/build/firefox-128.5.1/mozbuild/srcdirs/firefox-128.5.1-2e771969e4e2/_virtualenvs/build'

  File "/tmp/build/firefox-128.5.1/python/mozbuild/mozbuild/build_commands.py", line 221, in build
    return driver.build(
           ~~~~~~~~~~~~^
        command_context.metrics,
        ^^^^^^^^^^^^^^^^^^^^^^^^
    ...<7 lines>...
        append_env=append_env,
        ^^^^^^^^^^^^^^^^^^^^^^
    )
    ^
  File "/tmp/build/firefox-128.5.1/python/mozbuild/mozbuild/controller/building.py", line 1087, in build
    status = self._build(
        monitor,
    ...<8 lines>...
        append_env,
    )
  File "/tmp/build/firefox-128.5.1/python/mozbuild/mozbuild/controller/building.py", line 1191, in _build
    config_rc = self.configure(
        metrics,
    ...<2 lines>...
        append_env=append_env,
    )
  File "/tmp/build/firefox-128.5.1/python/mozbuild/mozbuild/controller/building.py", line 1610, in configure
    build_site.ensure()
    ~~~~~~~~~~~~~~~~~^^
  File "/tmp/build/firefox-128.5.1/python/mach/mach/site.py", line 563, in ensure
    result = self._up_to_date()
  File "/tmp/build/firefox-128.5.1/python/mach/mach/site.py", line 800, in _up_to_date
    pthfile_lines = self._pthfile_lines()
  File "/tmp/build/firefox-128.5.1/python/mach/mach/site.py", line 790, in _pthfile_lines
    _deprioritize_venv_packages(self._virtualenv, self._populate_virtualenv)
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/tmp/build/firefox-128.5.1/python/mach/mach/site.py", line 1244, in _deprioritize_venv_packages
    for site_packages_dir in virtualenv.site_packages_dirs()
                             ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^
  File "/tmp/build/firefox-128.5.1/python/mach/mach/site.py", line 853, in site_packages_dirs
    platlib = self.resolve_sysconfig_packages_path("platlib")
  File "/tmp/build/firefox-128.5.1/python/mach/mach/site.py", line 843, in resolve_sysconfig_packages_path
    relative_path = path.relative_to(data_path)
  File "/usr/lib/python3.13/pathlib/_local.py", line 385, in relative_to
    raise ValueError(f"{str(self)!r} is not in the subpath of {str(other)!r}")

Reverting back to 3.13.0 solved the build issue.

I also see the same thing when updating to Python-3.12.8 in a BLFS-12.2 VM.

[Joe Locash]

Replying to Joe Locash:

I'm seeing a build failure with firefox (and thunderbird) with Python-3.13.1:

Upstream fix: ​https://hg.mozilla.org/mozilla-central/rev/b0dbc944fb7b

[Bruce Dubbs]

Fixed at commits

9158d3bd82 Update to libcap-2.73.
8dd3b7ce47 Update to python3-3.13.1 (Security update).
77eaf45c91 Update to muparser-2.3.5.

[Douglas R. Reno]

SA-12.2-054 issued