Python 3.9.22

Author: ambv

Include/patchlevel.h

@@ -18,12 +18,12 @@
 /*--start constants--*/
 #define PY_MAJOR_VERSION        3
 #define PY_MINOR_VERSION        9
-#define PY_MICRO_VERSION        21
+#define PY_MICRO_VERSION        22
 #define PY_RELEASE_LEVEL        PY_RELEASE_LEVEL_FINAL
 #define PY_RELEASE_SERIAL       0
 
 /* Version as a string */
-#define PY_VERSION              "3.9.21+"
+#define PY_VERSION              "3.9.22"
 /*--end constants--*/
 
 /* Version as a single 4-byte hex number, e.g. 0x010502B2 == 1.5.2b2.

Misc/NEWS.d/3.9.22.rst

@@ -0,0 +1,70 @@
+.. date: 2025-04-07-04-11-08
+.. gh-issue: 131809
+.. nonce: 4MBDuy
+.. release date: 2025-04-08
+.. section: Security
+
+Update bundled libexpat to 2.7.1
+
+..
+
+.. date: 2025-03-14-23-28-39
+.. gh-issue: 131261
+.. nonce: 0aB6nM
+.. section: Security
+
+Upgrade to libexpat 2.7.0
+
+..
+
+.. date: 2025-01-28-14-08-03
+.. gh-issue: 105704
+.. nonce: EnhHxu
+.. section: Security
+
+When using :func:`urllib.parse.urlsplit` and :func:`urllib.parse.urlparse`
+host parsing would not reject domain names containing square brackets (``[``
+and ``]``). Square brackets are only valid for IPv6 and IPvFuture hosts
+according to `RFC 3986 Section 3.2.2
+<https://www.rfc-editor.org/rfc/rfc3986#section-3.2.2>`__.
+
+..
+
+.. date: 2024-08-06-12-27-34
+.. gh-issue: 121284
+.. nonce: 8rwPxe
+.. section: Security
+
+Fix bug in the folding of rfc2047 encoded-words when flattening an email
+message using a modern email policy. Previously when an encoded-word was too
+long for a line, it would be decoded, split across lines, and re-encoded.
+But commas and other special characters in the original text could be left
+unencoded and unquoted. This could theoretically be used to spoof header
+lines using a carefully constructed encoded-word if the resulting rendered
+email was transmitted or re-parsed.
+
+..
+
+.. date: 2024-05-24-21-00-52
+.. gh-issue: 119511
+.. nonce: jKrXQ8
+.. section: Security
+
+Fix a potential denial of service in the :mod:`imaplib` module. When
+connecting to a malicious server, it could cause an arbitrary amount of
+memory to be allocated. On many systems this is harmless as unused virtual
+memory is only a mapping, but if this hit a virtual address size limit it
+could lead to a :exc:`MemoryError` or other process crash. On unusual
+systems or builds where all allocated memory is touched and backed by actual
+ram or storage it could've consumed resources doing so until similarly
+crashing.
+
+..
+
+.. date: 2024-07-19-12-22-48
+.. gh-issue: 121277
+.. nonce: wF_zKd
+.. section: Documentation
+
+Writers of CPython's documentation can now use ``next`` as the version for
+the ``versionchanged``, ``versionadded``, ``deprecated`` directives.

Misc/NEWS.d/next/Documentation/2024-07-19-12-22-48.gh-issue-121277.wF_zKd.rst

@@ -1,4 +1,4 @@
-This is Python version 3.9.21
+This is Python version 3.9.22
 =============================
 
 .. image:: https://travis-ci.org/python/cpython.svg?branch=3.9
@@ -267,4 +267,4 @@ This Python distribution contains *no* GNU General Public License (GPL) code,
 so it may be used in proprietary projects.  There are interfaces to some GNU
 code but these are entirely optional.
 
-All trademarks referenced herein are property of their respective holders.
+All trademarks referenced herein are property of their respective holders.