From 4c8d361216394199dd107f668761912544c5ef30 Mon Sep 17 00:00:00 2001 From: Steve Dower Date: Tue, 4 Nov 2025 19:20:20 +0000 Subject: [PATCH 1/5] gh-140849: Update bundled liblzma to 5.8.1 on Windows --- .../2025-11-04-19-20-05.gh-issue-140849.YjB2ZZ.rst | 1 + PCbuild/get_externals.bat | 2 +- PCbuild/liblzma.vcxproj | 9 +++++---- PCbuild/liblzma.vcxproj.filters | 9 +++------ PCbuild/python.props | 2 +- 5 files changed, 11 insertions(+), 12 deletions(-) create mode 100644 Misc/NEWS.d/next/Windows/2025-11-04-19-20-05.gh-issue-140849.YjB2ZZ.rst diff --git a/Misc/NEWS.d/next/Windows/2025-11-04-19-20-05.gh-issue-140849.YjB2ZZ.rst b/Misc/NEWS.d/next/Windows/2025-11-04-19-20-05.gh-issue-140849.YjB2ZZ.rst new file mode 100644 index 00000000000000..6f25b8675663fd --- /dev/null +++ b/Misc/NEWS.d/next/Windows/2025-11-04-19-20-05.gh-issue-140849.YjB2ZZ.rst @@ -0,0 +1 @@ +Update bundled liblzma to version 5.8.1. diff --git a/PCbuild/get_externals.bat b/PCbuild/get_externals.bat index 319024e0f50f46..95feabe67f7bdb 100644 --- a/PCbuild/get_externals.bat +++ b/PCbuild/get_externals.bat @@ -59,7 +59,7 @@ set libraries=%libraries% mpdecimal-4.0.0 set libraries=%libraries% sqlite-3.50.4.0 if NOT "%IncludeTkinterSrc%"=="false" set libraries=%libraries% tcl-core-8.6.15.0 if NOT "%IncludeTkinterSrc%"=="false" set libraries=%libraries% tk-8.6.15.0 -set libraries=%libraries% xz-5.2.5 +set libraries=%libraries% xz-5.8.1 set libraries=%libraries% zlib-ng-2.2.4 set libraries=%libraries% zstd-1.5.7 diff --git a/PCbuild/liblzma.vcxproj b/PCbuild/liblzma.vcxproj index 97938692328495..291eca8ba22973 100644 --- a/PCbuild/liblzma.vcxproj +++ b/PCbuild/liblzma.vcxproj @@ -92,7 +92,7 @@ WIN32;HAVE_CONFIG_H;_LIB;%(PreprocessorDefinitions) - $(lzmaDir)windows/vs2019;$(lzmaDir)src/liblzma/common;$(lzmaDir)src/common;$(lzmaDir)src/liblzma/api;$(lzmaDir)src/liblzma/check;$(lzmaDir)src/liblzma/delta;$(lzmaDir)src/liblzma/lz;$(lzmaDir)src/liblzma/lzma;$(lzmaDir)src/liblzma/rangecoder;$(lzmaDir)src/liblzma/simple;%(AdditionalIncludeDirectories) + $(lzmaDir)windows;$(lzmaDir)src/liblzma/common;$(lzmaDir)src/common;$(lzmaDir)src/liblzma/api;$(lzmaDir)src/liblzma/check;$(lzmaDir)src/liblzma/delta;$(lzmaDir)src/liblzma/lz;$(lzmaDir)src/liblzma/lzma;$(lzmaDir)src/liblzma/rangecoder;$(lzmaDir)src/liblzma/simple;%(AdditionalIncludeDirectories) 4244;4267;4996;%(DisableSpecificWarnings) %(AdditionalOptions) -Wno-deprecated-declarations @@ -102,9 +102,7 @@ - - @@ -135,6 +133,7 @@ + @@ -163,6 +162,7 @@ + @@ -212,6 +212,7 @@ + @@ -239,7 +240,7 @@ - + diff --git a/PCbuild/liblzma.vcxproj.filters b/PCbuild/liblzma.vcxproj.filters index ebe2a7d5fa9e5d..a06ba70a15212a 100644 --- a/PCbuild/liblzma.vcxproj.filters +++ b/PCbuild/liblzma.vcxproj.filters @@ -18,6 +18,9 @@ Source Files + + Source Files + Source Files @@ -54,15 +57,9 @@ Source Files - - Source Files - Source Files - - Source Files - Source Files diff --git a/PCbuild/python.props b/PCbuild/python.props index cc1572526559ce..ad772b8f1c5c89 100644 --- a/PCbuild/python.props +++ b/PCbuild/python.props @@ -77,7 +77,7 @@ $(ExternalsDir)sqlite-3.50.4.0\ $(ExternalsDir)bzip2-1.0.8\ - $(ExternalsDir)xz-5.2.5\ + $(ExternalsDir)xz-5.8.1\ $(ExternalsDir)libffi-3.4.4\ $(libffiDir)$(ArchName)\ $(libffiOutDir)include From 3e65a23923b6d07ffb1c5feae253be196d72109c Mon Sep 17 00:00:00 2001 From: Steve Dower Date: Tue, 4 Nov 2025 19:48:06 +0000 Subject: [PATCH 2/5] Update filters --- PCbuild/liblzma.vcxproj.filters | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/PCbuild/liblzma.vcxproj.filters b/PCbuild/liblzma.vcxproj.filters index a06ba70a15212a..aabe8bd50bd9a0 100644 --- a/PCbuild/liblzma.vcxproj.filters +++ b/PCbuild/liblzma.vcxproj.filters @@ -225,6 +225,9 @@ Source Files + + Source Files + @@ -425,7 +428,10 @@ Header Files - + + Header Files + + Header Files From 37a6245775a5d80ed8d9951f60def4b440e63e7a Mon Sep 17 00:00:00 2001 From: Steve Dower Date: Tue, 4 Nov 2025 22:21:28 +0000 Subject: [PATCH 3/5] Update xz sbom entry --- Misc/externals.spdx.json | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/Misc/externals.spdx.json b/Misc/externals.spdx.json index 59aceedb94d4c7..966c8673052313 100644 --- a/Misc/externals.spdx.json +++ b/Misc/externals.spdx.json @@ -154,21 +154,21 @@ "checksums": [ { "algorithm": "SHA256", - "checksumValue": "a15c168e39e87d750c3dc766edc7f19bdda57dacf01e509678467eace91ad282" + "checksumValue": "9ba013411a7b0cd8dbf2b6ef42d3add2c847671b780c8792fed7131d7ab2d130" } ], - "downloadLocation": "https://github.com/python/cpython-source-deps/archive/refs/tags/xz-5.2.5.tar.gz", + "downloadLocation": "https://github.com/python/cpython-source-deps/archive/refs/tags/xz-5.8.1.tar.gz", "externalRefs": [ { "referenceCategory": "SECURITY", - "referenceLocator": "cpe:2.3:a:tukaani:xz:5.2.5:*:*:*:*:*:*:*", + "referenceLocator": "cpe:2.3:a:tukaani:xz:5.8.1:*:*:*:*:*:*:*", "referenceType": "cpe23Type" } ], "licenseConcluded": "NOASSERTION", "name": "xz", "primaryPackagePurpose": "SOURCE", - "versionInfo": "5.2.5" + "versionInfo": "5.8.1" }, { "SPDXID": "SPDXRef-PACKAGE-zlib-ng", From 8fa2f5c580c09a7563e6be59754d3534b7dd0ef5 Mon Sep 17 00:00:00 2001 From: Steve Dower Date: Wed, 5 Nov 2025 00:21:54 +0000 Subject: [PATCH 4/5] Remove lzip decoder --- PCbuild/get_externals.bat | 2 +- PCbuild/liblzma.vcxproj | 1 - PCbuild/liblzma.vcxproj.filters | 3 --- PCbuild/python.props | 2 +- 4 files changed, 2 insertions(+), 6 deletions(-) diff --git a/PCbuild/get_externals.bat b/PCbuild/get_externals.bat index 95feabe67f7bdb..115203cecc8e48 100644 --- a/PCbuild/get_externals.bat +++ b/PCbuild/get_externals.bat @@ -59,7 +59,7 @@ set libraries=%libraries% mpdecimal-4.0.0 set libraries=%libraries% sqlite-3.50.4.0 if NOT "%IncludeTkinterSrc%"=="false" set libraries=%libraries% tcl-core-8.6.15.0 if NOT "%IncludeTkinterSrc%"=="false" set libraries=%libraries% tk-8.6.15.0 -set libraries=%libraries% xz-5.8.1 +set libraries=%libraries% xz-5.8.1.1 set libraries=%libraries% zlib-ng-2.2.4 set libraries=%libraries% zstd-1.5.7 diff --git a/PCbuild/liblzma.vcxproj b/PCbuild/liblzma.vcxproj index 291eca8ba22973..20147f6e574d08 100644 --- a/PCbuild/liblzma.vcxproj +++ b/PCbuild/liblzma.vcxproj @@ -133,7 +133,6 @@ - diff --git a/PCbuild/liblzma.vcxproj.filters b/PCbuild/liblzma.vcxproj.filters index aabe8bd50bd9a0..2180284aa232da 100644 --- a/PCbuild/liblzma.vcxproj.filters +++ b/PCbuild/liblzma.vcxproj.filters @@ -225,9 +225,6 @@ Source Files - - Source Files - diff --git a/PCbuild/python.props b/PCbuild/python.props index ad772b8f1c5c89..7840e2a1cfc8e2 100644 --- a/PCbuild/python.props +++ b/PCbuild/python.props @@ -77,7 +77,7 @@ $(ExternalsDir)sqlite-3.50.4.0\ $(ExternalsDir)bzip2-1.0.8\ - $(ExternalsDir)xz-5.8.1\ + $(ExternalsDir)xz-5.8.1.1\ $(ExternalsDir)libffi-3.4.4\ $(libffiDir)$(ArchName)\ $(libffiOutDir)include From d6a667b5bb654705f8ad048f50a2230d7146756c Mon Sep 17 00:00:00 2001 From: Steve Dower Date: Wed, 5 Nov 2025 00:23:19 +0000 Subject: [PATCH 5/5] SBOM and extra file --- Misc/externals.spdx.json | 8 ++++---- PCbuild/liblzma.vcxproj | 1 - PCbuild/liblzma.vcxproj.filters | 3 --- 3 files changed, 4 insertions(+), 8 deletions(-) diff --git a/Misc/externals.spdx.json b/Misc/externals.spdx.json index 966c8673052313..dba01de8352d52 100644 --- a/Misc/externals.spdx.json +++ b/Misc/externals.spdx.json @@ -154,21 +154,21 @@ "checksums": [ { "algorithm": "SHA256", - "checksumValue": "9ba013411a7b0cd8dbf2b6ef42d3add2c847671b780c8792fed7131d7ab2d130" + "checksumValue": "1bfaba0ccacc6681d3ba85335cc7f49c24cf6f9d16f848cbd153b896d8a7d631" } ], - "downloadLocation": "https://github.com/python/cpython-source-deps/archive/refs/tags/xz-5.8.1.tar.gz", + "downloadLocation": "https://github.com/python/cpython-source-deps/archive/refs/tags/xz-5.8.1.1.tar.gz", "externalRefs": [ { "referenceCategory": "SECURITY", - "referenceLocator": "cpe:2.3:a:tukaani:xz:5.8.1:*:*:*:*:*:*:*", + "referenceLocator": "cpe:2.3:a:tukaani:xz:5.8.1.1:*:*:*:*:*:*:*", "referenceType": "cpe23Type" } ], "licenseConcluded": "NOASSERTION", "name": "xz", "primaryPackagePurpose": "SOURCE", - "versionInfo": "5.8.1" + "versionInfo": "5.8.1.1" }, { "SPDXID": "SPDXRef-PACKAGE-zlib-ng", diff --git a/PCbuild/liblzma.vcxproj b/PCbuild/liblzma.vcxproj index 20147f6e574d08..75d4e16234618e 100644 --- a/PCbuild/liblzma.vcxproj +++ b/PCbuild/liblzma.vcxproj @@ -211,7 +211,6 @@ - diff --git a/PCbuild/liblzma.vcxproj.filters b/PCbuild/liblzma.vcxproj.filters index 2180284aa232da..42feca5a3414bf 100644 --- a/PCbuild/liblzma.vcxproj.filters +++ b/PCbuild/liblzma.vcxproj.filters @@ -428,8 +428,5 @@ Header Files - - Header Files - \ No newline at end of file