Python 3.13.4

What's new in this version:

Tests:
- Fix multiprocessing interrupt test. Add an event to synchronize the parent process with the child process: wait until the child process starts sleeping
- Fix TestPyReplAutoindent.test_auto_indent_default() doesn’t run input_code.
- The iOS testbed will now select the most recently released “SE-class” device for testing if a device isn’t explicitly specified.
- The test helper that counts the list of open file descriptors now uses the optimised /dev/fd approach on all Apple platforms, not just macOS. This avoids crashes caused by guarded file descriptors.

Security:
- Fixes multiple issues that allowed tarfile extraction filters (filter="data" and filter="tar") to be bypassed using crafted symlinks and hard links.
Addresses CVE 2024-12718, CVE 2025-4138, CVE 2025-4330, and CVE 2025-4517.
- Fix use-after-free in the “unicode-escape” decoder with a non-“strict” error handler.
- Short-circuit the processing of long IPv6 addresses early in ipaddress to prevent excessive memory consumption and a minor denial-of-service.

Library:
- ast.dump() now only omits None and [] values if they are default values.
- Fix parsing long IPv6 addresses with embedded IPv4 address.
- Built-in HACL* and OpenSSL implementations of hash function constructors now correctly accept the same documented named arguments. For instance, md5() could be previously invoked as md5(data=data) or md5(string=string) depending on the underlying implementation but these calls were not compatible
- curses.window.getch() now correctly handles signals
-multiprocessing.freeze_support() now checks for work on any “spawn” start method platform rather than only on Windows.
- Fix asyncio to not close subprocess pipes which would otherwise error out when the event loop is already closed.
- Fixed UnboundLocalError that could occur during email header parsing if an expected trailing delimiter is missing in some contexts.
-Remove import of C implementation of io.FileIO from Python implementation which has its own implementation
- Emit RuntimeWarning in the Python implementation of io when the file-like object is not closed explicitly in the presence of multiple I/O layers.
- The tarfile module now handles UnicodeEncodeError in the same way as OSError when cannot extract a member.
- Fix interaction of the new REPL and -X showrefcount command line option.
- The generated directory listing page in http.server.SimpleHTTPRequestHandler now only shows the decoded path component of the requested URL, and not the query and fragment.
- Fix handling paths that end with a percent-encoded slash (%2f or %2F) in http.server.SimpleHTTPRequestHandler.
- ipaddress: fix collisions in __hash__() for IPv4Network and IPv6Network objects.
- In 3.13.3 we accidentally changed the signature of the asyncio create_task() family of methods and how it calls a custom task factory in a backwards incompatible way. Since some 3rd party libraries have already made changes to work around the issue that might break if we simply reverted the changes, we’re instead changing things to be backwards compatible with 3.13.2 while still supporting those workarounds for 3.13.3. In particular, the special-casing of name and context is back (until 3.14) and consequently eager tasks may still find that their name hasn’t been set before they execute their first yielding await.
-Raise ValueError in open() if opener returns a negative file-descriptor in the Python implementation of io to match the C implementation.
-Fix handling of invalid markup declarations in html.parser.HTMLParser.
- random.getrandbits() can now generate more that 231 bits. random.randbytes() can now generate more that 256 MiB.
- Fix attribute caching issue when setting ctypes._Pointer._type_ in the undocumented and deprecated ctypes.SetPointerType() function and the undocumented set_type() method.
- ldexp() on Windows doesn’t round subnormal results before Windows 11, but should. Python’s math.ldexp() wrapper now does round them, so results may change slightly, in rare cases of very small results, on Windows versions before 11.
- Use original timeout value for subprocess.TimeoutExpired when the func subprocess.run() is called with a timeout instead of sometimes a confusing partial remaining time out value used internally on the final wait().
- xml.etree.ElementTree: Fix a crash in Element.__deepcopy__ when the element is concurrently mutated
- Bump the version of pip bundled in ensurepip to version 25.1.1
- Fix error when pyrepl is suspended, then resumed and terminated.
- Fix a crash when using _align_ = 0 and _fields_ = [] in a ctypes.Structure.
- Include the valid typecode ‘w’ in the error message when an invalid typecode is passed to array.array.
- Fix PyREPL on Windows: characters entered via AltGr are swallowed
- Fix support of Bluetooth sockets on NetBSD and DragonFly BSD.
- QueueListener.start now raises a RuntimeError if the listener is already started.
- Fix a NULL pointer dereference when a C function called using ctypes with restype py_object returns NULL.
- Fix instance error suggestions trigger potential exceptions in object.__getattr__() in traceback.
- A traceback.TracebackException now correctly renders the __context__ and __cause__ attributes from falsey Exception, and the exceptions attribute from falsey ExceptionGroup.
- Fixed the SystemError in cProfile when locating the actual C function of a method raises an exception.
- Prevent exceptions that evaluate as falsey (namely, when their __bool__ method returns False or their __len__ method returns 0) from being ignored by concurrent.futures.ProcessPoolExecutor and concurrent.futures.ThreadPoolExecutor.
- Respect follow_wrapped for __init__() and __new__() methods when getting the class signature for a class with inspect.signature(). Preserve class signature after wrapping with warnings.deprecated()
-Ignore log messages generated during handling of log messages, to avoid deadlock or infinite recursion.
- Improve error reporting for incorrect format in time.strptime().
- Systems using LibreSSL now successfully build.
- Avoid exiting the new REPL and offer suggestions even if there are non-string candidates when errors occur.
- Fix configparser.ConfigParser parsing empty interpolation with allow_no_value set to True.
- Fix REPL traceback reporting when using compile() with an inexisting file
- http.cookiejar.join_header_words() is now more similar to the original Perl version. It now quotes the same set of characters and always quote values that end with "\n".
- Fix missing socket.CAN_RAW_ERR_FILTER constant in the socket module on Linux systems. It was missing since Python 3.11.