Re: time for a new release
Matti Picus <[email protected]>
| Newsgroups | gmane.comp.python.pypy |
|---|---|
| Message-ID | <[email protected]> |
On 9/9/20 9:55 AM, Michał Górny wrote: > On Tue, 2020-09-08 at 23:15 +0300, Matti Picus wrote: >> I have uploaded rc1 of pypy v7.3.2 to https://buildbot.pypy.org/pypy/ (note the trailing slash) which should be mirrored soon to https://downloads.python.org/pypy/ >> >> The hashes are here https://foss.heptapod.net/pypy/pypy.org/-/blob/branch/default/pages/download_advanced.rst#L465 >> >> The release note is here https://doc.pypy.org/en/latest/release-v7.3.2.html >> >> This release does include a 3.7 alpha. >> >> Please try them out, especially on windows (extra points for non-english interfaces and install paths) and macos (extra points for machines that run without homebrew stuff installed), to make sure you can run your project with them. >> >> Any comments are welcome. >> > What's the vulnerability status of stdlib? > > I've tested pypy2.7 and pypy3.6 so far and neither seems to contain CVE- > 2019-20907 fix (it was never backported to py2.7), the patch from [1] > seems to apply cleanly to both. > > pypy3.6 seems to be missing bpo-39603, and the patch from [2] doesn't > apply cleanly (does pypy3 contain outdated version or modified?). > > CVE-2020-14422 is also unresolved. > > Could you please either update stdlib of pypy3.6 or look through CPython > changes and backport the security fixes? For pypy2.7, please backport > [1] directly since upstream is no longer maintaining that branch. > > [1] https://github.com/python/cpython/commit/47a2955589bdb1a114d271496ff803ad73f954b8 > [2] https://github.com/python/cpython/commit/f02de961b9f19a5db0ead56305fe0057a78787ae > Thanks for looking at this.We ship stdlib 2.7.13, 3.6.9, 3.7.4 with some slight modifications, including backporting some fixes. I fixed CVE-2019-20907 for pypy2.7, pypy3,6, and CVE-2020-14422 for py3.6, 3.7 bpo-39603 is part of 3.6.12, 3.7.9 which were shipped 25 days ago, and that file has changed significantly since the versions we ship. Updating the stdlib is a large undertaking, help welcome for py2.7 and py3.7. I don't think it is worth the effort for py3.6. There are directions in lib-python/stdlib-upgrade.txt. Matti _______________________________________________ pypy-dev mailing list [email protected] https://mail.python.org/mailman/listinfo/pypy-dev