Re: Status of Python 3.11

Xavier Humbert <[email protected]> writes:
> There are known vulnerabilities in Python 3.11, however I can't see in
> UPDATING an entry for changing the current version.  [...]  What is
> the current recommended version?

The recommended version is still 3.11.  Although upstream has not yet
patched any of the four recent issues, we have backported patches for
two of them (CVE-2025-15366 and CVE-2025-15367) and an upstream patch is
in progress for a third (CVE-2026-1502).  There is no 3.11 patch yet for
the fourth (upstream bug #146333, no CVE assigned).

The oldest version that has patches for all known issues is 3.13.
Unfortunately, changing the default is highly non-trivial as it tends to
break a ton of dependents, but if you build your own packages, you can
try adding this line to make.conf:

    DEFAULT_VERSIONS+=python=3.13 python3=3.13

I do not recommend trying 3.14 or 3.15 at this point, as the risk of
breakage increases the further you move from the recommended default.

The procedure outlined in UPDATING is only necessary for leaf packages,
i.e. if the following command produces any output:

    pkg query -e '%a == 0 || %#r == 0' -g %n 'py311-*'

In which case you should run the following on affected systems before
`pkg upgrade` (assuming you chose 3.13 as your new default):

    for p in $(pkg query -g %n 'py311-*'); do
        pkg set -yn "${p}:py313-${p#py311-}";
    done

Otherwise, package dependencies will take care of everything.

DES
-- 
Dag-Erling Smørgrav - [email protected]