Thanks to visit codestin.com
Credit goes to github.com

Skip to content

[3.14] gh-144125: email: verify headers are sound in BytesGenerator#144182

Merged
hugovk merged 1 commit intopython:3.14from
miss-islington:backport-052e55e-3.14
Jan 25, 2026
Merged

[3.14] gh-144125: email: verify headers are sound in BytesGenerator#144182
hugovk merged 1 commit intopython:3.14from
miss-islington:backport-052e55e-3.14

Conversation

@miss-islington
Copy link
Copy Markdown
Contributor

@miss-islington miss-islington commented Jan 23, 2026

(cherry picked from commit 052e55e)

Co-authored-by: Seth Michael Larson [email protected]
Co-authored-by: Denis Ledoux [email protected]
Co-authored-by: Denis Ledoux [email protected]
Co-authored-by: Petr Viktorin [email protected]
Co-authored-by: Bas Bloemsaat [email protected]

(cherry picked from commit 052e55e)

Co-authored-by: Seth Michael Larson <[email protected]>
Co-authored-by: Denis Ledoux <[email protected]>
Co-authored-by: Denis Ledoux <[email protected]>
Co-authored-by: Petr Viktorin <[email protected]>
Co-authored-by: Bas Bloemsaat <[email protected]>
@hugovk
Copy link
Copy Markdown
Member

hugovk commented Jan 25, 2026

+ /github/workspace/build-out/cpython-install/bin/python3 -m pip install hypothesis
/github/workspace/build-out/cpython-install/bin/python3: No module named pip
2026-01-25 12:57:47,206 - root - ERROR - Building fuzzers failed.

An unrelated problem in oss-fuzz?

Copy link
Copy Markdown
Member

@pablogsal pablogsal left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@hugovk hugovk merged commit 7877fe4 into python:3.14 Jan 25, 2026
93 of 97 checks passed
@miss-islington miss-islington deleted the backport-052e55e-3.14 branch January 25, 2026 17:18
ihvo pushed a commit to ihvo/azurelinux that referenced this pull request Apr 24, 2026
Verified against python/cpython that every CVE patch on the 3.12 fork has a
3.14-branch backport PR that merged before 3.14.4's release on 2026-04-07:

  CVE-2026-0672 β†’ PR python/cpython#144089 (merged 2026-01-23)
  CVE-2026-0865 β†’ PRs python/cpython#143972 + #144761 (merged 2026-01-17 / 02-21)
  CVE-2026-1299 β†’ PR python/cpython#144182 (merged 2026-01-25)
  CVE-2026-4519 β†’ PRs python/cpython#146214 + #148042 (merged 2026-03-23 / 04-03)

The CVE-2025-* patches are even older and were already in 3.14.0 (GA 2025-10).
Carrying patches we don't need adds hunk-maintenance cost, rebase risk, and
auditor confusion with no upside.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

Development

Successfully merging this pull request may close these issues.

4 participants