Python full changelog

Security:
gh-145986: xml.parsers.expat: Fixed a crash caused by unbounded C recursion when converting deeply nested XML content models with ElementDeclHandler(). This addresses CVE 2026-4224.
gh-145599: Reject control characters in http.cookies.Morsel update() and js_output(). This addresses CVE 2026-3644.
gh-145506: Fixes CVE 2026-2297 by ensuring that SourcelessFileLoader uses io.open_code() when opening .pyc files.
gh-144370: Disallow usage of control characters in status in wsgiref.handlers to prevent HTTP header injections. Patch by Benedikt Johannes.
gh-143930: Reject leading dashes in URLs passed to webbrowser.open().
Core and Builtins:
gh-148157: Fix an unlikely crash when parsing an invalid type comments for function parameters. Found by OSS Fuzz in #492782951.
gh-148144: Initialize _PyInterpreterFrame.visited when copying interpreter frames so incremental GC does not read an uninitialized byte from generator and frame-object copies.
gh-146615: Fix a crash in __get__() for METH_METHOD descriptors when an invalid (non-type) object is passed as the second argument. Patch by Steven Sun.
gh-146308: Fixed several error handling issues in the _remote_debugging module, including safer validation of remote int objects, clearer asyncio task chain failures, and cache cleanup fixes that avoid leaking or double-freeing metadata on allocation failure. Patch by Pablo Galindo.
gh-146128: Fix a bug which could cause constant values to be partially corrupted in AArch64 JIT code. This issue is theoretical, and hasn’t actually been observed in unmodified Python interpreters.
gh-146250: Fixed a memory leak in SyntaxError when re-initializing it.
gh-146245: Fixed reference leaks in socket when audit hooks raise exceptions in socket.getaddrinfo() and socket.sendto().
gh-146196: Fix potential Undefined Behavior in PyUnicodeWriter_WriteASCII() by adding a zero-length check. Patch by Shamil Abdulaev.
gh-146227: Fix wrong type in _Py_atomic_load_uint16 in the C11 atomics backend (

New features:
PEP 779: Free-threaded Python is officially supported
PEP 649: The evaluation of annotations is now deferred, improving the semantics of using annotations.
PEP 750: Template string literals (t-strings) for custom string processing, using the familiar syntax of f-strings.
PEP 734: Multiple interpreters in the stdlib.
PEP 784: A new module compression.zstd providing support for the Zstandard compression algorithm.
PEP 758: except and except* expressions may now omit the brackets.
Syntax highlighting in PyREPL, and support for color in unittest, argparse, json and calendar CLIs.
PEP 768: A zero-overhead external debugger interface for CPython.
UUID versions 6-8 are now supported by the uuid module, and generation of versions 3-5 are up to 40% faster.
PEP 765: Disallow return/break/continue that exit a finally block.
PEP 741: An improved C API for configuring Python.
A new type of interpreter. For certain newer compilers, this interpreter provides significantly better performance. Opt-in for now, requires building from source.
Improved error messages.
Builtin implementation of HMAC with formally verified code from the HACL* project.
A new command-line interface to inspect running Python processes using asynchronous tasks.
The pdb module now supports remote attaching to a running Python process.
Build changes:
PEP 761: Python 3.14 and onwards no longer provides PGP signatures for release artifacts. Instead, Sigstore is recommended for verifiers.
Official macOS and Windows release binaries include an experimental JIT compiler.
Official Android binary releases are now available.

A new high-frequency, low-overhead, statistical sampling profiler and dedicated profiling package
Python now uses UTF-8 as the default encoding
A new PyBytesWriter C API to create a Python bytes object
Improved error messages

gh-139573: Updated bundled version of OpenSSL to 3.0.18.
Tools/Demos:
gh-139330: SBOM generation tool didn’t cross-check the version and checksum values against the Modules/expat/refresh.sh script, leading to the values becoming out-of-date during routine updates.
gh-132006: XCframeworks now include privacy manifests to satisfy Apple App Store submission requirements.
gh-138171: A script for building an iOS XCframework was added. As part of this change, the top level iOS folder has been moved to be a subdirectory of the Apple folder.
Security:
gh-139400: xml.parsers.expat: Make sure that parent Expat parsers are only garbage-collected once they are no longer referenced by subparsers created by ExternalEntityParserCreate(). Patch by Sebastian Pipping.
Library:
gh-139312: Upgrade bundled libexpat to 2.7.3