cython-3.2.6 (Python module)

[Bruce Dubbs]

New point version.

[pierre]

3.2.6 (2026-06-24)

Bugs fixed

• @functools.wraps() was broken in Py3.14+ for Cython compiled functions. (Github issue ​https://github.com/cython/cython/issues/7675)

• A double-free in the t-string code was fixed. (Github issue ​https://github.com/cython/cython/issues/7712)

• The - operator declarations for iterators in libcpp.vector we corrected. Patch by Vadim Markovtsev. (Github issue ​https://github.com/cython/cython/issues/7717)

• The shared utility code module no longer uses a temporary file path that changed the C code on each generation. (Github issue ​https://github.com/cython/cython/issues/7723)

• On 32 bit platforms, cached constants are no longer made immortal during module import. (Github issue ​https://github.com/cython/cython/issues/7744)

Other changes

• Binary wheels are now built with -DNDEBUG to discard runtime assertions from CPython’s inline functions.

[pierre]

Fixed at f014b0cf152

[zeckma]

Fixes a double-free, which is a security vulnerability, potentially leading to memory corruption and ACE. Has no CVE or GHSA from what I can tell.

[pierre]

Replying to zeckma:

Fixes a double-free, which is a security vulnerability, potentially leading to memory corruption and ACE. Has no CVE or GHSA from what I can tell.

I am not sure I agree with the fact it is a security vulnerability. From the PR it is a potential double free and it may occur "if someone else using someone else's tstring backport". That is if someone is using a code that is not in the provided cython package.

I am maybe out of my depth here, so leaving open, but I think we have enough of those security advisories to not add ones that are not deemed such by upstream.

[zeckma]

I was initially debating whether we should flag it or not. I think we'll be safe by not documenting it as a security vulnerability.