Skip to content

LibPack 26.3 v3.5.6

Latest
Latest

Choose a tag to compare

View all tags
@chennes chennes released this 07 Nov 19:56
3.5.6
dc89aa4

LibPack 26.3 v3.5.6

LibPack 3.5.6 is a security release. Its purpose is to address the eMudhra / emSign CA certificate security incident. It also corrects the compiler toolset used to build the libraries, as described below; there are no other functional changes from LibPack 3.5.5. All users of LibPack 3.5.5 and earlier are encouraged to upgrade.

Debugging symbol (PDB) files are available for the Release builds as a separate download for developers who need them. Debug builds include the PDB files directly in the main download.

About the vulnerability

In October 2026 the private keys of eight eMudhra intermediate CA certificates were found to be compromised. Because those intermediates chained to a root that was trusted by the CA bundles shipped with Python tooling, an attacker holding the keys could mount a man-in-the-middle attack against TLS clients, including connections to python.org and pypi.org.

Earlier LibPacks are affected in two ways: the bundled Python accepts certificates issued by these intermediates, and both certifi and the copy of certifi vendored inside pip include the emSign ECC Root CA - G3 root. LibPack 3.5.6 addresses both:

  • Python 3.14.10 rejects the compromised intermediate keys in the ssl module, regardless of the SSLContext configuration (CVE-2026-115557, gh-160040).
  • certifi 2026.10.23 removes the affected emSign ECC Root CA - G3 root from the CA bundle (GHSA-6q48-6c7w-9gw2). The unaffected emSign Root CA - G1 root remains in the bundle, as it does upstream.
  • pip 26.3 vendors the same certifi release.

Further details and guidance are available in the Python announcement.

Compiler toolset

All libraries compiled for this LibPack now use the Visual Studio 2022 (v143) toolset. In LibPack 3.5.5, CMake selected the newest installed Visual Studio regardless of the requested version, so most libraries, including Boost and OpenCASCADE, were compiled with Visual Studio 2026 (v145). Static libraries built that way cannot be safely linked by developers using Visual Studio 2022.

As a result, the Boost library file names change from vc145 to vc143, for example boost_filesystem-vc143-mt-x64-1_91.dll. Projects that locate Boost through its CMake configuration files are not affected, and they can be built with either Visual Studio 2022 or Visual Studio 2026. Anything that refers to the old file names directly must be updated.

New in LibPack 3.5.6:

  • Nothing: no libraries or pip packages were added in this release.

Removed since LibPack 3.5.5:

  • Nothing: no libraries or pip packages were removed in this release.

Version updates from LibPack 3.5.5 are:

  • Python 3.14.7 → 3.14.10 (this also updates the OpenSSL bundled with Python from 3.5.7 to 3.5.9)

Updated pip requirements:

  • certifi 2026.7.22 → 2026.10.23
  • pip 26.2.1 → 26.3
  • mypy_extensions 1.1.0 → 1.2.0 (an unpinned dependency of mypy)

The Python update also includes other upstream security fixes, among them CVE-2026-114583 in tarfile. See the Python 3.14.10 release page and the full changelog.

Apart from the items above, the pinned libraries and the Release pip packages are unchanged from LibPack 3.5.5. Please refer to the 3.5.5 release notes for the complete list, as well as the ARM64 caveats, which continue to apply.

Two exceptions apply. Debug LibPacks also receive newer versions of their unpinned build tooling. In addition, SWIG is now built from the 4.4.1 release, the version listed in the 3.5.5 release notes; LibPack 3.5.5 actually contained a development snapshot that reported version 4.6.0.

Assets 8
Loading