From f6d62e43cf3ed8f3852848c0a649cccf4e1c935c Mon Sep 17 00:00:00 2001 From: donbarbos Date: Thu, 13 Aug 2026 09:23:00 +0400 Subject: [PATCH 1/2] [pyexpat] Billion laughs mitigation methods backported to 3.10, 3.11, 3.12 --- stdlib/pyexpat/__init__.pyi | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/stdlib/pyexpat/__init__.pyi b/stdlib/pyexpat/__init__.pyi index 83841a226a53..de2471f92acd 100644 --- a/stdlib/pyexpat/__init__.pyi +++ b/stdlib/pyexpat/__init__.pyi @@ -1,4 +1,3 @@ -import sys from _typeshed import ReadableBuffer, SupportsRead from collections.abc import Callable from pyexpat import errors as errors, model as model @@ -33,11 +32,9 @@ class XMLParserType: # Added in Python 3.10.20, 3.11.15, 3.12.3, 3.13.10, 3.14.1 def SetAllocTrackerActivationThreshold(self, threshold: int, /) -> None: ... def SetAllocTrackerMaximumAmplification(self, max_factor: float, /) -> None: ... - if sys.version_info >= (3, 13): - # Added in Python 3.13.4, 3.14.6 - def SetBillionLaughsAttackProtectionActivationThreshold(self, threshold: int, /) -> None: ... - def SetBillionLaughsAttackProtectionMaximumAmplification(self, max_factor: float, /) -> None: ... - + # Added in Python 3.10.19, 3.11.14, 3.12.12, 3.13.4, 3.14.6 + def SetBillionLaughsAttackProtectionActivationThreshold(self, threshold: int, /) -> None: ... + def SetBillionLaughsAttackProtectionMaximumAmplification(self, max_factor: float, /) -> None: ... @property def intern(self) -> dict[str, str]: ... buffer_size: int From 2352fb2b47f70f2aa4658fdf36b986397ae7a9be Mon Sep 17 00:00:00 2001 From: donbarbos Date: Thu, 13 Aug 2026 09:29:20 +0400 Subject: [PATCH 2/2] Update allowlists --- stdlib/@tests/stubtest_allowlists/darwin-py310.txt | 5 +++++ stdlib/@tests/stubtest_allowlists/darwin-py311.txt | 5 +++++ stdlib/@tests/stubtest_allowlists/darwin-py312.txt | 5 +++++ stdlib/@tests/stubtest_allowlists/win32-py310.txt | 5 +++++ stdlib/@tests/stubtest_allowlists/win32-py311.txt | 5 +++++ stdlib/@tests/stubtest_allowlists/win32-py312.txt | 5 +++++ 6 files changed, 30 insertions(+) diff --git a/stdlib/@tests/stubtest_allowlists/darwin-py310.txt b/stdlib/@tests/stubtest_allowlists/darwin-py310.txt index 86b8608f39eb..4d3b8964872e 100644 --- a/stdlib/@tests/stubtest_allowlists/darwin-py310.txt +++ b/stdlib/@tests/stubtest_allowlists/darwin-py310.txt @@ -58,6 +58,11 @@ tarfile.LinkFallbackError tarfile.TarFile._extract_member tarfile.TarFile.makelink_with_filter +# Incompatible changes introduced in Python 3.10.19 +# (Remove once 3.10.19 becomes available for GitHub Actions) +pyexpat.XMLParserType.SetBillionLaughsAttackProtectionActivationThreshold +pyexpat.XMLParserType.SetBillionLaughsAttackProtectionMaximumAmplification + # Incompatible changes introduced in Python 3.10.20 # (Remove once 3.10.20 becomes available for GitHub Actions) email._header_value_parser.make_parenthesis_pairs diff --git a/stdlib/@tests/stubtest_allowlists/darwin-py311.txt b/stdlib/@tests/stubtest_allowlists/darwin-py311.txt index 24b7d5d8ceca..58ed2b6b27c7 100644 --- a/stdlib/@tests/stubtest_allowlists/darwin-py311.txt +++ b/stdlib/@tests/stubtest_allowlists/darwin-py311.txt @@ -33,6 +33,11 @@ tarfile.LinkFallbackError tarfile.TarFile._extract_member tarfile.TarFile.makelink_with_filter +# Incompatible changes introduced in Python 3.11.14 +# (Remove once 3.11.14 becomes available for GitHub Actions) +pyexpat.XMLParserType.SetBillionLaughsAttackProtectionActivationThreshold +pyexpat.XMLParserType.SetBillionLaughsAttackProtectionMaximumAmplification + # Incompatible changes introduced in Python 3.11.15 # (Remove once 3.11.15 becomes available for GitHub Actions) email._header_value_parser.make_parenthesis_pairs diff --git a/stdlib/@tests/stubtest_allowlists/darwin-py312.txt b/stdlib/@tests/stubtest_allowlists/darwin-py312.txt index 003efdd5b489..38f151441b3b 100644 --- a/stdlib/@tests/stubtest_allowlists/darwin-py312.txt +++ b/stdlib/@tests/stubtest_allowlists/darwin-py312.txt @@ -20,6 +20,11 @@ tarfile.LinkFallbackError tarfile.TarFile._extract_member tarfile.TarFile.makelink_with_filter +# Incompatible changes introduced in Python 3.12.12 +# (Remove once 3.12.12 becomes available for GitHub Actions) +pyexpat.XMLParserType.SetBillionLaughsAttackProtectionActivationThreshold +pyexpat.XMLParserType.SetBillionLaughsAttackProtectionMaximumAmplification + # Incompatible changes introduced in Python 3.12.13 # (Remove once 3.12.13 becomes available for GitHub Actions) email._header_value_parser.make_parenthesis_pairs diff --git a/stdlib/@tests/stubtest_allowlists/win32-py310.txt b/stdlib/@tests/stubtest_allowlists/win32-py310.txt index 304b21a96405..5ef3b597fc63 100644 --- a/stdlib/@tests/stubtest_allowlists/win32-py310.txt +++ b/stdlib/@tests/stubtest_allowlists/win32-py310.txt @@ -58,6 +58,11 @@ tarfile.LinkFallbackError tarfile.TarFile._extract_member tarfile.TarFile.makelink_with_filter +# Incompatible changes introduced in Python 3.10.19 +# (Remove once 3.10.19 becomes available for GitHub Actions) +pyexpat.XMLParserType.SetBillionLaughsAttackProtectionActivationThreshold +pyexpat.XMLParserType.SetBillionLaughsAttackProtectionMaximumAmplification + # Incompatible changes introduced in Python 3.10.20 # (Remove once 3.10.20 becomes available for GitHub Actions) email._header_value_parser.make_parenthesis_pairs diff --git a/stdlib/@tests/stubtest_allowlists/win32-py311.txt b/stdlib/@tests/stubtest_allowlists/win32-py311.txt index 1499d0da2abe..38c8daf436c6 100644 --- a/stdlib/@tests/stubtest_allowlists/win32-py311.txt +++ b/stdlib/@tests/stubtest_allowlists/win32-py311.txt @@ -33,6 +33,11 @@ tarfile.LinkFallbackError tarfile.TarFile._extract_member tarfile.TarFile.makelink_with_filter +# Incompatible changes introduced in Python 3.11.14 +# (Remove once 3.11.14 becomes available for GitHub Actions) +pyexpat.XMLParserType.SetBillionLaughsAttackProtectionActivationThreshold +pyexpat.XMLParserType.SetBillionLaughsAttackProtectionMaximumAmplification + # Incompatible changes introduced in Python 3.11.15 # (Remove once 3.11.15 becomes available for GitHub Actions) email._header_value_parser.make_parenthesis_pairs diff --git a/stdlib/@tests/stubtest_allowlists/win32-py312.txt b/stdlib/@tests/stubtest_allowlists/win32-py312.txt index eb780c0d569a..c22d4e4cf3cf 100644 --- a/stdlib/@tests/stubtest_allowlists/win32-py312.txt +++ b/stdlib/@tests/stubtest_allowlists/win32-py312.txt @@ -20,6 +20,11 @@ tarfile.LinkFallbackError tarfile.TarFile._extract_member tarfile.TarFile.makelink_with_filter +# Incompatible changes introduced in Python 3.12.12 +# (Remove once 3.12.12 becomes available for GitHub Actions) +pyexpat.XMLParserType.SetBillionLaughsAttackProtectionActivationThreshold +pyexpat.XMLParserType.SetBillionLaughsAttackProtectionMaximumAmplification + # Incompatible changes introduced in Python 3.12.13 # (Remove once 3.12.13 becomes available for GitHub Actions) email._header_value_parser.make_parenthesis_pairs