Skip to content

Security audit of the Python 3.15 changes - #328

Open
icemac wants to merge 1 commit into
masterfrom
python315-security-audit
Open

Security audit of the Python 3.15 changes#328
icemac wants to merge 1 commit into
masterfrom
python315-security-audit

Conversation

@icemac

@icemac icemac commented Aug 18, 2026

Copy link
Copy Markdown
Member

Refs #306. Audit findings and rationale: docs/contributing/changes_from314to315.rst in this diff.

  • Disallow lazy import statements (PEP 810): they bypass a guarded __import__ via the new __lazy_import__ builtin.
  • Disallow unpacking in comprehensions (PEP 798): the unpacked value is iterated without calling _getiter_.
  • Block ag_await/ag_frame/ag_code (pre-existing gap found while checking the new inspect attributes).

Refs #306

- Disallow lazy import statements (PEP 810).
- Disallow unpacking in comprehensions (PEP 798).
- Block the attributes of async generators in INSPECT_ATTRIBUTES.
@icemac icemac self-assigned this Aug 18, 2026
@icemac
icemac requested a review from dataflake August 18, 2026 07:14
@icemac icemac mentioned this pull request Aug 18, 2026
6 tasks

@dataflake dataflake left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you! 🙏

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants