Bump Pythons to 3.12.14/3.13.15/3.14.7, Pyodide 314.0.6, dart_bridge 1.8.0 - #40
Merged
Conversation
…1.8.0
CPython micro bumps across all three minors, with standalone_release_date moved
from 20260623 to 20260901 -- the first python-build-standalone release carrying
all three (20260825 has them too; 20260901 is the newest). Pyodide 3.14 goes
314.0.3 -> 314.0.6; 3.13 (0.29.4) and 3.12 (0.27.7) are already on the newest
release of their respective lines. dart_bridge 1.8.0 per flet-dev/dart-bridge.
The workflow_dispatch choice list in build-python-version.yml is the one other
place full versions are spelled out, so it moves with the manifest.
Refresh the vendored 3.13 iOS patch for 3.13.15
-----------------------------------------------
3.13.15 back-ported the macOS 27 dup3/pipe2 change from 3.14, splitting
if test "$ac_sys_system" != "iOS" ; then
AC_CHECK_FUNCS([dup3 getentropy getgroups pipe2 system])
fi
into a getentropy/getgroups/system check gated on iOS and a separate dup3/pipe2
check gated on iOS *and* Darwin. Our back-port widens that gate to the other
Apple platforms, so its hunk no longer applied: one hunk failed in configure.ac
and one in configure (42/43 and 35/36 applying). The 3.12 patch is unaffected --
3.12.14 does not carry the change.
Both gates now get the tvOS/visionOS/watchOS arms, which preserves the patch's
intent: dup3 and pipe2 were in the widened set before the split, so dropping
them from it would have quietly re-enabled two symbols on those platforms.
Nothing here builds tvOS/visionOS/watchOS, so this is inert for our matrix --
it just keeps the vendored patch faithful to the beeware back-port it came from.
Verified by extracting the pristine 3.12.14 and 3.13.15 tarballs and applying
each patch with `patch -p1`: zero rejects, no offsets, no fuzz, and the merged
configure/configure.ac agree with each other.
FeodorFitsner
added a commit
to flet-dev/serious-python
that referenced
this pull request
Sep 2, 2026
The first Python version move since 4.3.x -- every 4.4/4.5 release re-pinned python-build for Apple signing work without a Python version changing. Re-pins the bundled snapshot to python-build 20260902 (dart_bridge 1.7.1 -> 1.8.0) and regenerates the committed version tables from its manifest.json. All three micros are security releases, sharing a quadratic-complexity DoS fix in incremental html.parser.HTMLParser parsing (gh-153030) and one for xml.etree.ElementTree XPath index predicates (gh-152674). They do not share the libexpat fix. 3.12.14 shipped a week after the other two and bundles libexpat 2.8.3 for CVE-2026-72522; 3.13.15 and 3.14.7 still bundle 2.8.2. Checked in each runtime's own Modules/expat/expat.h rather than taken from the release notes. It only matters for apps parsing untrusted XML, and upstream picks it up in the next 3.13/3.14 micro, but the changelogs say so rather than implying all three are equally current. Pyodide 3.14 moves 314.0.3 -> 314.0.6. 3.13 (0.29.4) and 3.12 (0.27.7) stay put -- each is already newest on its line, so only the 3.14 row moved. Verified on the published 20260902 artifacts rather than assumed: * python-ios-dart-3.14.7 -- PY_VERSION 3.14.7, and 56 XCFrameworks plus 112 slice frameworks all signed and securely timestamped by Apple Distribution: Appveyor Systems Inc. (GXXRQJK434). Zero unsigned bundles, zero missing timestamps -- the same counts 4.5.1 recorded for 3.14.6, so the both-layer signing from 4.5.x survived a full rebuild of every framework. * python-ios-dart-3.13.15 -- PY_VERSION 3.13.15, 168 bundles signed, and HAVE_DUP3/HAVE_PIPE2 correctly undefined in pyconfig.h. That last one is the load-bearing check: 3.13.15 back-ported the macOS 27 dup3/pipe2 change (gh-153711), which split the configure gate that python-build's vendored Apple-tooling patch widens, and the patch had to be refreshed for it (flet-dev/python-build#40). An undefined pair confirms the refreshed gate landed. * The release carries all 30 runtime tarballs -- every platform x every version -- plus manifest.json. README's Python-versions table is updated, including its 3.14 Pyodide cell, which had drifted to 314.0.0 (the generator does not touch README). bridge_example's "Test environment" table still reads CPython 3.14.6: it records the conditions its benchmark numbers were measured under, so it is left alone.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Manifest
standalone_release_date(all three)pyodide_versiondart_bridge_version20260901is the newest python-build-standalone release and the first that carries all three micros (20260825has them too). Pyodide0.29.4(3.13) and0.27.7(3.12) are already the newest on their lines, so they stay put — only the 3.14 line moved.The
workflow_dispatchchoice list inbuild-python-version.ymlis the only other place full versions are spelled out, so it moves with the manifest. (The remaining3.14.6hits in the repo are all illustrative comments.)Refresh the vendored 3.13 iOS patch for 3.13.15
3.13.15 back-ported the macOS 27
dup3/pipe2change from 3.14, splittinginto a
getentropy getgroups systemcheck gated on iOS and a separatedup3 pipe2check gated on iOS and Darwin. Our back-port widens that gate to the other Apple platforms, so its hunk no longer applied — one hunk failed inconfigure.ac, one inconfigure(42/43 and 35/36 applying). The 3.12 patch is unaffected; 3.12.14 does not carry the change.Both gates now get the tvOS/visionOS/watchOS arms. That preserves the patch's intent:
dup3andpipe2were in the widened set before the split, so leaving them out of it would have quietly re-enabled two symbols on those platforms. Nothing here builds tvOS/visionOS/watchOS, so it is inert for our matrix — it just keeps the vendored patch faithful to the beeware back-port it came from.Verification
Extracted the pristine 3.12.14 and 3.13.15 tarballs from python.org and applied each vendored patch with
patch -p1, perdarwin/ios_patches/README.md:configureandconfigure.acagree with each other on both gatesUpstream availability confirmed for every version bumped here (astral-sh/python-build-standalone
20260901, pyodide/pyodide314.0.6, flet-dev/dart-bridgev1.8.0).CI on this PR exercises the full matrix without publishing a release.