Python 3.6.5 (64-bit)

What's new in this version:

Security:
- Minimal fix to prevent buffer overrun in os.symlink on Windows
- Regexes in difflib and poplib were vulnerable to catastrophic backtracking. These regexes formed potential DOS vectors (REDOS). They have been refactored.

Core and Builtins:
- Fixed jumping out of “with” block by setting f_lineno.
- Prevent jumps from ‘return’ and ‘exception’ trace events.
- Update Valgrind suppression list to account for the rename of Py_ADDRESS_IN_RANG to address_in_range.
- Pdb and other debuggers dependent on bdb.py will correctly step over (next command) native coroutines.
- Improve suggestion when the Python 2 form of print statement is either present on the same line as the header of a compound statement or else terminated by a semi-colon instead of a newline.
- Fix possible crashing in builtin Unicode decoders caused by write out-of- bound errors when using customized decode error handlers.
- Improved frozenset() hash to create more distinct hash values when faced with datasets containing many similar values.
- The __debug__ constant is now optimized out at compile time.
- sys.flags.hash_randomization is now properly set to 0 when hash randomization is turned off by PYTHONHASHSEED=0.
- The optimizer is now protected from spending much time doing complex calculations and consuming much memory for creating large constants in constant folding.
- repr() on a dict containing its own values() or items() no longer raises RecursionError; OrderedDict similarly. Instead, use ..., as for other recursive structures.
- Leading whitespace is now correctly ignored when generating suggestions for converting Py2 print statements to Py3 builtin print function calls.
- The repr of deeply nested dict now raises a RecursionError instead of crashing due to a stack overflow.

Library:
- lib2to3 now properly supports trailing commas after *args and **kwargs in function signatures.
- Avoid failing in multiprocessing.Process if the standard streams are closed or None at exit.
- Skip sending/receiving data after SSL transport closing.
- Fix ctypes pass-by-value for structs on 64-bit Cygwin/MinGW.
- Fix inspect.signature() for single-parameter partialmethods.
- Expose several missing constants in zlib and fix corresponding documentation.
- Fixed tarfile.itn handling of out-of-bounds float values.
- The ssl module now detects missing NPN support in LibreSSL.
- dbm.open() now encodes filename with the filesystem encoding rather than default encoding.
- In os.dup2, don’t check every call whether the dup3 syscall exists or not.
- Rewrite confusing message from setup.py upload from “No dist file created in earlier command” to the more helpful “Must create and upload files in one command”.
- In tkinter, after_cancel(None) now raises a ValueError instead of canceling the first scheduled function.
- Make sure sys.argv remains as a list when running trace.
- Fixed asyncio.Condition issue which silently ignored cancellation after notifying and cancelling a conditional lock.
- Fixed refleaks of __init__() methods in various modules.
- Fixed guessing quote and delimiter in csv.Sniffer.sniff() when only the last field is quoted.
- socket: Remove TCP_FASTOPEN, TCP_KEEPCNT flags on older version Windows during run-time.
- Fix a rare but potential pre-exec child process deadlock in subprocess on POSIX systems when marking file descriptors inheritable on exec in the child process. This bug appears to have been introduced in 3.4.
- The ctypes module used to depend on indirect linking for dlopen. The shared extension is now explicitly linked against libdl on platforms with dl.
- Fixed asyncio.Lock() safety issue which allowed acquiring and locking the same lock multiple times, without it being free.
- Do not include name field in SMTP envelope from address.
- Fix email address header parsing error when the username is an empty quoted string.
- distutils’ upload command no longer corrupts tar files ending with a CR byte, and no longer tries to convert CR to CRLF in any of the upload text fields.
- uuid.uuid1 no longer raises an exception if a 64-bit hardware address is encountered.
- Fix the error handling in Aifc_read.initfp() when the SSND chunk is not found.
- On FreeBSD and Solaris, os.strerror() now always decode the byte string from the current locale encoding, rather than using ASCII/surrogateescape in some cases.
- The nis module is now compatible with new libnsl and headers location.
- Improve ABCMeta._dump_registry() output readability
- glibc has removed Sun RPC. Use replacement libtirpc headers and library in nis module.
- Ensure that truncate() preserves the file position (as reported by tell()) after writes longer than the buffer size.
- Don’t unsubscribe signals in asyncio UNIX event loop on interpreter shutdown.
- The SSL module no longer sends IP addresses in SNI TLS extension on platforms with OpenSSL 1.0.2+ or inet_pton.
- urllib.parse.urlsplit() does not convert zone-id (scope) to lower case for scoped IPv6 addresses in hostnames now.
- Fix bdist_wininst of distutils for CRT v142: it binary compatible with CRT v140.
- A single empty field is now always quoted when written into a CSV file. This allows to distinguish an empty row from a row consisting of a single empty field.
- Raise NotImplementedError instead of SystemError on platforms where chmod(..., follow_symlinks=False) is not supported.
- The getnode() ip getter now uses ‘ip link’ instead of ‘ip link list’.
- Ensure TCP_NODELAY is set on Linux.
- The locale.localeconv() function now sets temporarily the LC_CTYPE locale to the LC_NUMERIC locale to decode decimal_point and thousands_sep byte strings if they are non-ASCII or longer than 1 byte, and the LC_NUMERIC locale is different than the LC_CTYPE locale. This temporary change affects other threads. Same change for the str.format() method when formatting a number (int, float, float and subclasses) with the n type (ex: '{:n}'.format(1234)).
- Importing native path module (posixpath, ntpath) now works even if the os module still is not imported.

Documentation:
- Clarify docs for -O and -OO. Patch by Terry Reedy
- Update link to w3c doc for xml default namespaces
- Document __getattr__() behavior when property get() method raises AttributeError
- Modify RE examples in documentation to use raw strings to prevent DeprecationWarning and add text to REGEX HOWTO to highlight the deprecation
- Improve docstrings for pathlib.PurePath subclasses
- Explain real behaviour of sys.settrace and sys.setprofile and their C-API counterparts regarding which type of events are received in each function

Tests:
- Fix failing test_asyncio on macOS 10.12.2+ due to transport of KqueueSelector loop was not being closed
- Fix test_hashlib to not fail if the _md5 module is not built
- Fix faulthandler_suppress_crash_report() used to prevent core dump files when testing crashes. getrlimit() returns zero on success
- Debian Unstable has disabled TLS 1.0 and 1.1 for SSLv23_METHOD(). Change TLS/SSL protocol of some tests to PROTOCOL_TLS or PROTOCOL_TLSv1_2 to make them pass on Debian

Build:
- Fix segfault of the crypt module when libxcrypt is provided instead of libcrypt at the system

Windows:
- Fix potential use of uninitialized memory in nt._getfinalpathname
- Fix a memory leak in os.chdir() on Windows if the current directory is set to a UNC path
- Fixed WindowsConsoleIO.write() for writing empty data
- Ensures activate.bat can handle Unicode contents
- Improves handling of denormalized executable path when launching Python
- Use the correct encoding for ipconfig output in the uuid module
- Fix os.readlink() on Windows, which was mistakenly treating the PrintNameOffset field of the reparse data buffer as a number of characters instead of bytes
- Create standalone _distutils_findvs module

macOS:
- Provide an additional, more modern macOS installer variant that supports macOS 10.9+ systems in 64-bit mode only. Upgrade the supplied third-party libraries to OpenSSL 1.0.2n, XZ 5.2.3, and SQLite 3.22.0. The 10.9+ installer now links with and supplies its own copy of Tcl/Tk 8.6.8.

IDLE:
- Set __file__ while running a startup file. Like Python, IDLE optionally runs one startup file in the Shell window before presenting the first interactive input prompt. For IDLE, -s runs a file named in environmental variable IDLESTARTUP or PYTHONSTARTUP; -r file runs file. Python sets __file__ to the startup file name before running the file and unsets it before the first prompt. IDLE now does the same when run normally, without the -n option
- Simplify and rename StringTranslatePseudoMapping in pyparse
- Change str to code in pyparse
- Remove unused code in pyparse module
- Add tests for pyparse
- Using the system and place-dependent default encoding for open() is a bad idea for IDLE’s system and location-independent files
- Add “encoding=utf-8” to open() in IDLE’s test_help_about. GUI test test_file_buttons() only looks at initial ascii-only lines, but failed on systems where open() defaults to ‘ascii’ because readline() internally reads and decodes far enough ahead to encounter a non-ascii character in CREDITS.txt
- Update configdialog General tab docstring to add new widgets to the widget list

Tools/Demos:
- 2to3 and lib2to3 can now read pickled grammar files using pkgutil.get_data() rather than probing the filesystem. This lets 2to3 and lib2to3 work when run from a zipfile
- Fix pygettext not extracting docstrings for functions with type annotated arguments

C API:
- Undocumented C API for OrderedDict has been excluded from the limited C API. It was added by mistake and actually never worked in the limited C API