Python 3.13.4, 3.12.11, 3.11.13, 3.10.18 and 3.9.23 are now available! (original) (raw)
Python Release Party
It was only meant to be release day for 3.13.4 today, but poor number 13 looked so lonely… And hey, we had a couple of tarfile CVEs that we had to fix. So most of the Release Managers and all the Developers-in-Residence (including Security Developer-in-Residence @sethmlarson) came together to make it a full release party.
Security content in these releases
- gh-135034: Fixes multiple issues that allowed
tarfileextraction filters (filter="data"andfilter="tar") to be bypassed using crafted symlinks and hard links.Addresses CVE 2024-12718, CVE 2025-4138, CVE 2025-4330, CVE-2025-4435, and CVE 2025-4517. - gh-133767: Fix use-after-free in the “unicode-escape” decoder with a non-“strict” error handler.
- gh-128840: Short-circuit the processing of long IPv6 addresses early in ipaddress to prevent excessive memory consumption and a minor denial-of-service.
In addition to the security fixes mentioned above, a few additional changes to the ipaddress were backported to make the security fixes feasible. (See the full changelogs for each release for more details.)
Python 3.13.4
In addition to the security fixes, the fourth maintenance release of Python 3.13 contains more than 300 bugfixes, build improvements and documentation changes.
Python 3.12.11
Python 3.11.13
Python 3.10.18
Python 3.9.23
Additional security content in this release (already fixed in older releases for the other versions):
- gh-80222: Fix bug in the folding of quoted strings when flattening an email message using a modern email policy. Previously when a quoted string was folded so that it spanned more than one line, the surrounding quotes and internal escapes would be omitted. This could theoretically be used to spoof header lines using a carefully constructed quoted string if the resulting rendered email was transmitted or re-parsed.
Stay safe and upgrade!
As always, upgrading is highly recommended to all users of affected versions.
Enjoy the new releases
Thanks to all of the many volunteers who help make Python Development and these releases possible! Please consider supporting our efforts by volunteering yourself or through organization contributions to the Python Software Foundation.
Regards from your very tired tireless release team,
Thomas Wouters @thomas
Pablo Galindo Salgado @pablogsal
Łukasz Langa @ambv
Ned Deily @nad
Steve Dower @steve.dower
brettcannon (Brett Cannon) June 3, 2025, 10:00pm 2
WASI builds for 3.13, 3.12, and 3.11 at Releases · brettcannon/cpython-wasi-build · GitHub (the 3.12 and 3.11 builds were mainly to test some new build infrastructure).
barry (Barry Warsaw) June 3, 2025, 10:35pm 3
CI images are built now too.
steve.dower (Steve Dower) June 5, 2025, 3:14pm 4
Heads up, we’ll be getting a 3.13.5 sooner than we hoped expected: Heads up: 3.13.5 release coming soon
encukou (Petr Viktorin) June 5, 2025, 4:40pm 5
Thank you for these releases!
With PEP 706 (the tarfile filters), I put the heavy burden of securely unpacking tarballs on the CPython team.
I still stand by what I said in the PEP – Python and its docs are the best place to improve things. Asking every individual user to review tarballs before unpacking was not the right thing to do. But doing this right is not easy, and as I feared, I didn’t get it right, leading to this expensive fix-up.
Thank you for putting in the work – especially to the volunteers on the team.
stankudrow (Stanley Kudrow) June 9, 2025, 1:36pm 6
Hello.
When the installers for MacOS and so on are expected to be posted for the v3.12.11? The version 3.12.11 for MacOS is inaccessible (e.g., uv python install 3.12.11 results in “error: No download found for request: cpython-3.12.11-macos-x86_64-none”).
Sorry if my question should not be here, a first-timer.
Thank you.
vstinner (Victor Stinner) June 9, 2025, 1:38pm 7
See Python Release Python 3.12.11 | Python.org :
No installers
According to the release calendar specified in PEP 693, Python 3.12 is now in the “security fixes only” stage of its life cycle: the 3.12 branch only accepts security fixes, and releases of those are made irregularly in source-only form until October 2028. Python 3.12 isn’t receiving regular bug fixes anymore, and binary installers are no longer provided for it. Python 3.12.10 was the last full bugfix release of Python 3.12 with binary installers.
hugovk (Hugo van Kemenade) June 9, 2025, 2:05pm 8
For third-party installation with uv, make sure you have at least uv 0.7.11, which added Python 3.12.11 for macOS.
notatallshaw (Damian Shaw) June 9, 2025, 2:22pm 9
As mentioned the latest uv has 3.12.11 available for macOS.
This is because uv uses python build standalone: GitHub - astral-sh/python-build-standalone: Produce redistributable builds of Python
But uv keeps an internal mapping of available Python releases, so to get new versions of Python you must use new versions of uv. New versions available are included in their release notes: Release 0.7.11 · astral-sh/uv · GitHub
hero (hero) June 13, 2025, 7:48am 10
Hello, may I ask if Python 3.11.13 will have a Windows installer package? Currently, I only see the source release available.
ambv (Łukasz Langa) June 13, 2025, 7:50am 11
Celex (Alexander Winkler) October 16, 2025, 11:26am 12
Hi, I just noticed that with the version 3.13.4, the venv modules Activate.ps1 signature block has been removed. But I wasn’t able to find anything about it. Was this an intentional change?
steve.dower (Steve Dower) October 16, 2025, 3:23pm 13
No, not intentional. I’ll take a look. (Later: release-tools#294)
Celex (Alexander Winkler) December 3, 2025, 10:15am 14
Don’t wanna be a pedant, but I thought with the pull request you linked merged, that new releases should have the signature blocks back. But I just looked into the Activate.ps1 from python 3.14.1 and it is still missing
steve.dower (Steve Dower) December 3, 2025, 1:50pm 15
Yeah, looks like the legacy MSI didn’t pick it up properly for some reason. All the other distros seem to have it. If there’s no bug filed by later tonight then I’ll file one myself, probably won’t get looked at until next year I expect, but we aren’t planning any more releases before then anyway.
Celex (Alexander Winkler) March 24, 2026, 10:56am 16
Just looked into it again, still no signature block in the most recent release (3.14.3) 
steve.dower (Steve Dower) March 24, 2026, 3:50pm 17
My bad, I never filed the bug or did anything to fix it. Making one now (edit: here)