python3-3.14.3 (Wait for LFS)

[Bruce Dubbs]

New point version.

[Xi Ruoyao]

The sed should be removed. Note that the upstream change added the inserted line into a different location so it may not seem obvious.

BTW I'd propose we must put a reference to the upstream ticket/change when adding a patch or sed (in the patch file, or XML comment, or the Git commit message). Otherwise it will be so time-wasting to investigate a case like this one.

[Douglas R. Reno]

I 100% agree with you there, not only for time consuming searches like this one, but also so that we know where to look in the event of a security issue that gets caused by the sed/patch/etc.

[Douglas R. Reno]

Security changes for Python-3.14.3:

Security

    gh-144125: BytesGenerator will now refuse to serialize (write) headers that are 
unsafely folded or delimited; see verify_generated_headers. (Contributed by Bas 
Bloemsaat and Petr Viktorin in gh-121650).

    gh-143935: Fixed a bug in the folding of comments when flattening an email message 
using a modern email policy. Comments consisting of a very long sequence of non-foldable 
characters could trigger a forced line wrap that omitted the required leading space on 
the continuation line, causing the remainder of the comment to be interpreted as a new 
header field. This enabled header injection with carefully crafted inputs.

    gh-143925: Reject control characters in data: URL media types.

    gh-143919: Reject control characters in http.cookies.Morsel fields and values.

    gh-143916: Reject C0 control characters within wsgiref.headers.Headers fields, 
values, and parameters.

[Bruce Dubbs]

There are too many changes in this version to post here. See Python-3.14.3/Misc/NEWS in the tarball for the full list.

[Bruce Dubbs]

Fixed at commits

fc6f531da1 Update to Python-3.14.3.
5671b237b7 Update to shadow-4.19.3.