Python 3.12.2 (64-bit)

What's new in this version:

Security:
- Skip .pth files with names starting with a dot or hidden file attribute

Core and Builtins:
- Changed socket type validation in create_datagram_endpoint() to accept all non-stream sockets. This fixes a regression in compatibility with raw sockets
- Fix a RuntimeWarning emitted when assign an integer-like value that is not an instance of int to an attribute that corresponds to a C struct member of type T_UINT and T_ULONG. Fix a double RuntimeWarning emitted when assign a negative integer value to an attribute that corresponds to a C struct member of type T_UINT
- Fix a regression in the codeop module that was causing it to incorrectly identify incomplete f-strings. Patch by Pablo Galind
- Check for a valid tp_version_tag before performing bytecode specializations that rely on this value being usable
- Fix an error that was causing the parser to try to overwrite existing errors and crashing in the process. Patch by Pablo Galind
- Fix segfault in the compiler on with statement with 19 context managers
- Use per AST-parser state rather than global state to track recursion depth within the AST parser to prevent potential race condition due to simultaneous parsing
- The issue primarily showed up in 3.11 by multithreaded users of ast.parse(). In 3.12 a change to when garbage collection can be triggered prevented the race condition from occurring
- Correctly compute end column offsets for multiline tokens in the tokenize module. Patch by Pablo Galind
- Fix SystemError in the import statement and in __reduce__() methods of builtin types when __builtins__ is not a dict
- Fix UnicodeEncodeError when email.message.get_payload() reads a message with a Unicode surrogate character and the message content is not well-formed for surrogateescape encoding. Patch by Sidney Markowitz

Library:
- Update bundled pip to 24.0
- tarfile no longer ignores errors when trying to extract a directory on top of a file
- Fix support of explicit option value “–” in argparse (e.g. --option=--)
- Fix ctypes structs with array on Windows ARM64 platform by setting MAX_STRUCT_SIZE to 32 in stgdict. Patch by Diego Russ
- Fix a leak of open socket in rare cases when error occurred in ssl.SSLSocket creation
- email.policy.EmailPolicy.fold() now always encodes non-ASCII characters in headers if utf8 is false
- Make the result of termios.tcgetattr() reproducible on Alpine Linux. Previously it could leave a random garbage in some fields
- Revert changes in gh-106584 which made calls of TestResult methods startTest() and stopTest() unbalanced
- Ignore an OSError in asyncio.BaseEventLoop.create_server() when IPv6 is available but the interface cannot actually support it
- Dismiss the FileNotFound error in ctypes.util.find_library() and just return None on Linux
- The tty.setcbreak() and new tty.cfmakecbreak() no longer clears the terminal input ICRLF flag. This fixes a regression introduced in 3.12 that no longer matched how OSes define cbreak mode in their stty(1) manual pages
- Avoid reference cycle in ElementTree.iterparse. The iterator returned by ElementTree.iterparse may hold on to a file descriptor. The reference cycle prevented prompt clean-up of the file descriptor if the returned iterator was not exhausted
- OSError raised when run a subprocess now only has filename attribute set to cwd if the error was caused by a failed attempt to change the current directory
- Enum: correctly handle tuple subclasses in custom __new__
- Fix a reference leak in asyncio.selector_events.BaseSelectorEventLoop when SSL handshakes fail. Patch contributed by Jamie Phan
- Fix possible OverflowError in socket.socket.sendfile() when pass count larger than 2 GiB on 32-bit platform
- Fixed a bug in fractions.Fraction where an invalid string using d in the decimals part creates a different error compared to other invalid letters/characters. Patch by Jeremiah Gabriel Pascual
- Fix the behavior of tag_unbind() methods of tkinter.Text and tkinter.Canvas classes with three arguments. Previously, widget.tag_unbind(tag, sequence, funcid) destroyed the current binding for sequence, leaving sequence unbound, and deleted the funcid command. Now it removes only funcid from the binding for sequence, keeping other commands, and deletes the funcid command. It leaves sequence unbound only if funcid was the last bound command
- Fix tkinter method winfo_pathname() on 64-bit Windows
- unittest runner: Don’t exit 5 if tests were skipped. The intention of exiting 5 was to detect issues where the test suite wasn’t discovered at all. If we skipped tests, it was correctly discovered
- Silence unraisable AttributeError when warnings are emitted during Python finalization
- Restore the ability for zipfile to extractall from zip files with a “/” directory entry in them as is commonly added to zips by some wiki or bug tracker data exporters
- Fix UnicodeEncodeError in email when re-fold lines that contain unknown-8bit encoded part followed by non-unknown-8bit encoded part
- In asyncio.StreamReaderProtocol.connection_made(), there is callback that logs an error if the task wrapping the “connected callback” fails. This callback would itself fail if the task was cancelled. Prevent this by checking whether the task was cancelled first. If so, close the transport but don’t log an error
- Fix resource warnings for unclosed files in pickle and pickletools command line interfaces
- Increase the backlog for multiprocessing.connection.Listener objects created by multiprocessing.manager and multiprocessing.resource_sharer to significantly reduce the risk of getting a connection refused error when creating a multiprocessing.connection.Connection to them
- Make sure that webbrowser.MacOSXOSAScript sends webbrowser.open audit event
- When a second reference to a string appears in the input to pickle, and the Python implementation is in use, we are guaranteed that a single copy gets pickled and a single object is shared when reloaded. Previously, in protocol 0, when a string contained certain characters (e.g. newline) it resulted in duplicate objects
- Fix multiprocessing logger for %(filename)s
- Fix segfaults in the _elementtree module. Fix first segfault during deallocation of _elementtree.XMLParser instances by keeping strong reference to pyexpat module in module state for capsule lifetime. Fix second segfault which happens in the same deallocation process by keeping strong reference to _elementtree module in XMLParser structure for _elementtree module lifetime
- Fix import of unittest.mock when CPython is built without docstrings
- Fix regression in Python 3.12 where Protocol classes that were not marked as runtime-checkable would be unnecessarily introspected, potentially causing exceptions to be raised if the protocol had problematic members. Patch by Alex Waygood
- Fix rendering tracebacks for exceptions with a broken __getattr__
- Fix an AttributeError during asyncio SSL protocol aborts in SSL-over-SSL scenarios
- Update bundled pip to 23.3.2
- Make http.client.HTTPResponse.read1 and http.client.HTTPResponse.readline close IO after reading all data when content length is known. Patch by Illia Volochii
- Fix shutil.copymode() and shutil.copystat() on Windows. Previously they worked differenly if dst is a symbolic link: they modified the permission bits of dst itself rather than the file it points to if follow_symlinks is true or src is not a symbolic link, and did not modify the permission bits if follow_symlinks is false and src is a symbolic link
- Detect line numbers of properties in doctests
- signal.signal() and signal.getsignal() no longer call repr on callable handlers. asyncio.run() and asyncio.Runner.run() no longer call repr on the task results. Patch by Yilei Yang
- Fix ctypes structs with array on PPC64LE platform by setting MAX_STRUCT_SIZE to 64 in stgdict. Patch by Diego Russo
- Ignore FileNotFoundError when remove a temporary directory in the multiprocessing finalizer
- Fix a crash in socket.if_indextoname() with specific value (UINT_MAX). Fix an integer overflow in socket.if_indextoname() on 64-bit non-Windows platforms
- Improve handling of pdb convenience variables to avoid replacing string contents
- Fix a regression caused by a fix to gh-93162 whereby you couldn’t configure a QueueHandler without specifying handlers
- Fix crash during garbage collection of the io.BytesIO buffer object
- Show the Tcl/Tk patchlevel (rather than version) in tkinter._test()
- Protect zipfile from “quoted-overlap” zipbomb. It now raises BadZipFile when try to read an entry that overlaps with other entry or central directory
- On Windows, closing the connection writer when cleaning up a broken multiprocessing.Queue queue is now done for all queues, rather than only in concurrent.futures manager thread. This can prevent a deadlock when a multiprocessing worker process terminates without cleaning up. This completes the backport of patches by Victor Stinner and Serhiy Storchaka
- Fix race condition in trace. Instead of checking if a directory exists and creating it, directly call os.makedirs() with the kwarg exist_ok=True
- Set unixfrom envelope in mailbox.mbox and mailbox.MMDF
- Fix stacklevel in InvalidTZPathWarning during zoneinfo module import
- Allow ctypes.Union to be nested in ctypes.Structure when the system endianness is the opposite of the classes
- Fix null pointer dereference in lzma._decode_filter_properties() due to improper handling of BCJ filters with properties of zero length. Patch by Radislav Chugunov
- When os.fork() is called from a foreign thread (aka _DummyThread), the type of the thread in a child process is changed to _MainThread. Also changed its name and daemonic status, it can be now joined
- bpo-35928: io.TextIOWrapper now correctly handles the decoding buffer after read() and write()
- bpo-26791: shutil.move() now moves a symlink into a directory when that directory is the target of the symlink. This provides the same behavior as the mv shell command. The previous behavior raised an exception. Patch by Jeffrey Kintscher
- bpo-36959: Fix some error messages for invalid ISO format string combinations in strptime() that referred to directives not contained in the format string. Patch by Gordon P. Hemsley
- bpo-18060: Fixed a class inheritance issue that can cause segfaults when deriving two or more levels of subclasses from a base class of Structure or Union

Documentation:
- Improved markup for valid options/values for methods ttk.treeview.column and ttk.treeview.heading, and for Layouts
- Document that the asyncio module contains code taken from v0.16.0 of the uvloop project, as well as the required MIT licensing information

Tests:
- Fix test_tarfile_vs_tar in test_shutil for macOS, where system tar can include more information in the archive than shutil.make_archive
- Fix test.test_zipfile.test_core.TestWithDirectory.test_create_directory_with_write test in AIX by doing a bitwise AND of 0xFFFF on mode , so that it will be in sync with zinfo.external_attr
- bpo-40648: Test modes that file can get with chmod() on Windows.

Build:
- Fixed the check-clean-src step performed on out of tree builds to detect errant $(srcdir)/Python/frozen_modules/*.h files and recommend appropriate source tree cleanup steps to get a working build again.
- Fix the build for the case that WITH_PYMALLOC_RADIX_TREE=0 set.
- bpo-11102: The os.major(), os.makedev(), and os.minor() functions are now available on HP-UX v3.
- bpo-36351: Do not set ipv6type when cross-compiling.

Windows:
- Update Windows build to use OpenSSL 3.0.13
- Update Windows builds to use zlib v1.3.1
- The py.exe launcher will no longer attempt to run the Microsoft Store redirector when launching a script containing a /usr/bin/env sheban
- Process privileges that are activated for creating directory junctions are now restored afterwards, avoiding behaviour changes in other parts of the program
- os.stat() calls were returning incorrect time values for files that could not be accessed directly
- multiprocessing: On Windows, fix a race condition in Process.terminate(): no longer set the returncode attribute to always call WaitForSingleObject() in Process.wait(). Previously, sometimes the process was still running after TerminateProcess() even if GetExitCodeProcess() is not STILL_ACTIVE. Patch by Victor Stinner
- Correctly sort and remove duplicate environment variables in _winapi.CreateProcess()
- bpo-37308: Fix mojibake in mmap.mmap when using a non-ASCII tagname argument on Windows

IDLE:
- In idlelib code, stop redefining built-ins ‘dict’ and ‘object’
- Improve the lists of features, editor key bindings, and shell key bingings in the IDLE doc
- Fix rare failure of test.test_idle, in test_configdialog
- Fix the “Help -> IDLE Doc” menu bug in 3.11.7 and 3.12.1
- Fix test_editor hang on macOS Catalina
- Fix processing unsaved files when quitting IDLE on macOS
- Revise IDLE bindings so that events from mouse button 4/5 on non-X11 windowing systems (i.e. Win32 and Aqua) are not mistaken for scrolling
- bpo-13586: Enter the selected text when opening the “Replace” dialog

Tools/Demos:
- Update GitHub CI workflows to use OpenSSL 3.0.13 and multissltests to use 1.1.1w, 3.0.13, 3.1.5, and 3.2.1
- Fix a bug in Argument Clinic that generated incorrect code for methods with no parameters that use the METH_METHOD | METH_FASTCALL | METH_KEYWORDS calling convention. Only the positional parameter count was checked; any keyword argument passed would be silently accepted.