Python 3.12.2

What's new in this version:

Security:
- Skip .pth files with names starting with a dot or hidden file attribute

Core and Builtins:
- Changed socket type validation in create_datagram_endpoint() to accept all non-stream sockets. This fixes a regression in compatibility with raw sockets
- Fix a RuntimeWarning emitted when assign an integer-like value that is not an instance of int to an attribute that corresponds to a C struct member of type T_UINT and T_ULONG. Fix a double RuntimeWarning emitted when assign a negative integer value to an attribute that corresponds to a C struct member of type T_UINT
- Fix a regression in the codeop module that was causing it to incorrectly identify incomplete f-strings. Patch by Pablo Galind
- Check for a valid tp_version_tag before performing bytecode specializations that rely on this value being usable
- Fix an error that was causing the parser to try to overwrite existing errors and crashing in the process. Patch by Pablo Galind
- Fix segfault in the compiler on with statement with 19 context managers
- Use per AST-parser state rather than global state to track recursion depth within the AST parser to prevent potential race condition due to simultaneous parsing
- The issue primarily showed up in 3.11 by multithreaded users of ast.parse(). In 3.12 a change to when garbage collection can be triggered prevented the race condition from occurring
- Correctly compute end column offsets for multiline tokens in the tokenize module. Patch by Pablo Galind
- Fix SystemError in the import statement and in __reduce__() methods of builtin types when __builtins__ is not a dict
- Fix UnicodeEncodeError when email.message.get_payload() reads a message with a Unicode surrogate character and the message content is not well-formed for surrogateescape encoding. Patch by Sidney Markowitz

Library:
- Update bundled pip to 24.0
- tarfile no longer ignores errors when trying to extract a directory on top of a file
- Fix support of explicit option value “–” in argparse (e.g. --option=--)
- Fix ctypes structs with array on Windows ARM64 platform by setting MAX_STRUCT_SIZE to 32 in stgdict. Patch by Diego Russ
- Fix a leak of open socket in rare cases when error occurred in ssl.SSLSocket creation
- email.policy.EmailPolicy.fold() now always encodes non-ASCII characters in headers if utf8 is false
- Make the result of termios.tcgetattr() reproducible on Alpine Linux. Previously it could leave a random garbage in some fields
- Revert changes in gh-106584 which made calls of TestResult methods startTest() and stopTest() unbalanced
- Ignore an OSError in asyncio.BaseEventLoop.create_server() when IPv6 is available but the interface cannot actually support it
- Dismiss the FileNotFound error in ctypes.util.find_library() and just return None on Linux
- The tty.setcbreak() and new tty.cfmakecbreak() no longer clears the terminal input ICRLF flag. This fixes a regression introduced in 3.12 that no longer matched how OSes define cbreak mode in their stty(1) manual pages
- Avoid reference cycle in ElementTree.iterparse. The iterator returned by ElementTree.iterparse may hold on to a file descriptor. The reference cycle prevented prompt clean-up of the file descriptor if the returned iterator was not exhausted
- OSError raised when run a subprocess now only has filename attribute set to cwd if the error was caused by a failed attempt to change the current directory
- Enum: correctly handle tuple subclasses in custom __new__
- Fix a reference leak in asyncio.selector_events.BaseSelectorEventLoop when SSL handshakes fail. Patch contributed by Jamie Phan
- Fix possible OverflowError in socket.socket.sendfile() when pass count larger than 2 GiB on 32-bit platform
- Fixed a bug in fractions.Fraction where an invalid string using d in the decimals part creates a different error compared to other invalid letters/characters. Patch by Jeremiah Gabriel Pascual
- Fix the behavior of tag_unbind() methods of tkinter.Text and tkinter.Canvas classes with three arguments. Previously, widget.tag_unbind(tag, sequence, funcid) destroyed the current binding for sequence, leaving sequence unbound, and deleted the funcid command. Now it removes only funcid from the binding for sequence, keeping other commands, and deletes the funcid command. It leaves sequence unbound only if funcid was the last bound command
- Fix tkinter method winfo_pathname() on 64-bit Windows
- unittest runner: Don’t exit 5 if tests were skipped. The intention of exiting 5 was to detect issues where the test suite wasn’t discovered at all. If we skipped tests, it was correctly discovered
- Silence unraisable AttributeError when warnings are emitted during Python finalization
- Restore the ability for zipfile to extractall from zip files with a “/” directory entry in them as is commonly added to zips by some wiki or bug tracker data exporters
- Fix UnicodeEncodeError in email when re-fold lines that contain unknown-8bit encoded part followed by non-unknown-8bit encoded part
- In asyncio.StreamReaderProtocol.connection_made(), there is callback that logs an error if the task wrapping the “connected callback” fails. This callback would itself fail if the task was cancelled. Prevent this by checking whether the task was cancelled first. If so, close the transport but don’t log an error
- Fix resource warnings for unclosed files in pickle and pickletools command line interfaces
- Increase the backlog for multiprocessing.connection.Listener objects created by multiprocessing.manager and multiprocessing.resource_sharer to significantly reduce the risk of getting a connection refused error when creating a multiprocessing.connection.Connection to them
- Make sure that webbrowser.MacOSXOSAScript sends webbrowser.open audit event
- When a second reference to a string appears in the input to pickle, and the Python implementation is in use, we are guaranteed that a single copy gets pickled and a single object is shared when reloaded. Previously, in protocol 0, when a string contained certain characters (e.g. newline) it resulted in duplicate objects
- Fix multiprocessing logger for %(filename)s
- Fix segfaults in the _elementtree module. Fix first segfault during deallocation of _elementtree.XMLParser instances by keeping strong reference to pyexpat module in module state for capsule lifetime. Fix second segfault which happens in the same deallocation process by keeping strong reference to _elementtree module in XMLParser structure for _elementtree module lifetime
- Fix import of unittest.mock when CPython is built without docstrings
- Fix regression in Python 3.12 where Protocol classes that were not marked as runtime-checkable would be unnecessarily introspected, potentially causing exceptions to be raised if the protocol had problematic members. Patch by Alex Waygood
- Fix rendering tracebacks for exceptions with a broken __getattr__
- Fix an AttributeError during asyncio SSL protocol aborts in SSL-over-SSL scenarios
- Update bundled pip to 23.3.2
- Make http.client.HTTPResponse.read1 and http.client.HTTPResponse.readline close IO after reading all data when content length is known. Patch by Illia Volochii
- Fix shutil.copymode() and shutil.copystat() on Windows. Previously they worked differenly if dst is a symbolic link: they modified the permission bits of dst itself rather than the file it points to if follow_symlinks is true or src is not a symbolic link, and did not modify the permission bits if follow_symlinks is false and src is a symbolic link
- Detect line numbers of properties in doctests
- signal.signal() and signal.getsignal() no longer call repr on callable handlers. asyncio.run() and asyncio.Runner.run() no longer call repr on the task results. Patch by Yilei Yang
- Fix ctypes structs with array on PPC64LE platform by setting MAX_STRUCT_SIZE to 64 in stgdict. Patch by Diego Russo
- Ignore FileNotFoundError when remove a temporary directory in the multiprocessing finalizer
- Fix a crash in socket.if_indextoname() with specific value (UINT_MAX). Fix an integer overflow in socket.if_indextoname() on 64-bit non-Windows platforms
- Improve handling of pdb convenience variables to avoid replacing string contents
- Fix a regression caused by a fix to gh-93162 whereby you couldn’t configure a QueueHandler without specifying handlers
- Fix crash during garbage collection of the io.BytesIO buffer object
- Show the Tcl/Tk patchlevel (rather than version) in tkinter._test()
- Protect zipfile from “quoted-overlap” zipbomb. It now raises BadZipFile when try to read an entry that overlaps with other entry or central directory
- On Windows, closing the connection writer when cleaning up a broken multiprocessing.Queue queue is now done for all queues, rather than only in concurrent.futures manager thread. This can prevent a deadlock when a multiprocessing worker process terminates without cleaning up. This completes the backport of patches by Victor Stinner and Serhiy Storchaka
- Fix race condition in trace. Instead of checking if a directory exists and creating it, directly call os.makedirs() with the kwarg exist_ok=True
- Set unixfrom envelope in mailbox.mbox and mailbox.MMDF
- Fix stacklevel in InvalidTZPathWarning during zoneinfo module import
- Allow ctypes.Union to be nested in ctypes.Structure when the system endianness is the opposite of the classes
- Fix null pointer dereference in lzma._decode_filter_properties() due to improper handling of BCJ filters with properties of zero length. Patch by Radislav Chugunov
- When os.fork() is called from a foreign thread (aka _DummyThread), the type of the thread in a child process is changed to _MainThread. Also changed its name and daemonic status, it can be now joined
- bpo-35928: io.TextIOWrapper now correctly handles the decoding buffer after read() and write()
- bpo-26791: shutil.move() now moves a symlink into a directory when that directory is the target of the symlink. This provides the same behavior as the mv shell command. The previous behavior raised an exception. Patch by Jeffrey Kintscher
- bpo-36959: Fix some error messages for invalid ISO format string combinations in strptime() that referred to directives not contained in the format string. Patch by Gordon P. Hemsley
- bpo-18060: Fixed a class inheritance issue that can cause segfaults when deriving two or more levels of subclasses from a base class of Structure or Union

Documentation:
- Improved markup for valid options/values for methods ttk.treeview.column and ttk.treeview.heading, and for Layouts
- Document that the asyncio module contains code taken from v0.16.0 of the uvloop project, as well as the required MIT licensing information

Tests:
- Fix test_tarfile_vs_tar in test_shutil for macOS, where system tar can include more information in the archive than shutil.make_archive
- Fix test.test_zipfile.test_core.TestWithDirectory.test_create_directory_with_write test in AIX by doing a bitwise AND of 0xFFFF on mode , so that it will be in sync with zinfo.external_attr
- bpo-40648: Test modes that file can get with chmod() on Windows.

Build:
- Fixed the check-clean-src step performed on out of tree builds to detect errant $(srcdir)/Python/frozen_modules/*.h files and recommend appropriate source tree cleanup steps to get a working build again
- Fix the build for the case that WITH_PYMALLOC_RADIX_TREE=0 set
- bpo-11102: The os.major(), os.makedev(), and os.minor() functions are now available on HP-UX v3
- bpo-36351: Do not set ipv6type when cross-compiling

macOS:
- Update macOS installer to use SQLite 3.45.1
- Update macOS installer to use OpenSSL 3.0.13
- Running configure ... --with-openssl-rpath=X/Y/Z no longer fails to detect OpenSSL on macOS
- Document that dbm.ndbm can silently corrupt DBM files on updates when exceeding undocumented platform limits, and can crash (segmentation fault) when reading such a corrupted file. (FB8919203
- The freeze tool doesn’t work with framework builds of Python. Document this and bail out early when running the tool with such a build
- Set CFBundleAllowMixedLocalizations to true in the Info.plist for the framework, embedded Python.app and IDLE.app with framework installs on macOS. This allows applications to pick up the user’s preferred locale when that’s different from english
- Make sure the result of sysconfig.get_plaform() includes at least a major and minor versions, even if MACOSX_DEPLOYMENT_TARGET is set to only a major version during build to match the format expected by pip
- Disable a signal handling stress test on macOS due to a bug in macOS (FB13453490)
- Make sure the preprocessor definitions for ALIGNOF_MAX_ALIGN_T, SIZEOF_LONG_DOUBLE and HAVE_GCC_ASM_FOR_X64 are correct for Universal 2 builds on macOS

IDLE:
- In idlelib code, stop redefining built-ins ‘dict’ and ‘object’
- Improve the lists of features, editor key bindings, and shell key bingings in the IDLE doc
- Fix rare failure of test.test_idle, in test_configdialog
- Fix the “Help -> IDLE Doc” menu bug in 3.11.7 and 3.12.1
- Fix test_editor hang on macOS Catalina
- Fix processing unsaved files when quitting IDLE on macOS
- Revise IDLE bindings so that events from mouse button 4/5 on non-X11 windowing systems (i.e. Win32 and Aqua) are not mistaken for scrolling
- bpo-13586: Enter the selected text when opening the “Replace” dialog

Tools/Demos:
- Update GitHub CI workflows to use OpenSSL 3.0.13 and multissltests to use 1.1.1w, 3.0.13, 3.1.5, and 3.2.1
- Fix a bug in Argument Clinic that generated incorrect code for methods with no parameters that use the METH_METHOD | METH_FASTCALL | METH_KEYWORDS calling convention. Only the positional parameter count was checked; any keyword argument passed would be silently accepted.