[ Web Proxy ]
URL:
Viewing: https://github-redirect.dependabot.com/python/cpython/pull/158430 [Back]  [Original]

[3.14] gh-157579: Fix race condition in the cleanup of `tempfile.TemporaryDirectory` (GH-157580) by miss-islington Pull Request #158430 python/cpython GitHub
Skip to content

Navigation Menu

Sign in

Repository navigation

More items

[3.14] gh-157579: Fix race condition in the cleanup of tempfile.TemporaryDirectory (GH-157580) - #158430

Merged
encukou merged 2 commits into
python:3.14from
miss-islington:backport-5c20517-3.14
Oct 9, 2026
Merged

encukou merged 2 commits into
python:3.14from
miss-islington:backport-5c20517-3.14

Conversation

@miss-islington [@miss-islington]

@miss-islington [@miss-islington] miss-islington commented Sep 29, 2026 •
edited by bedevere-app Bot
Loading

Copy link
Copy Markdown
Contributor

(cherry picked from commit 5c20517)

Co-authored-by: Stan Ulbrych stan@python.org
Co-authored-by: Petr Viktorin encukou@gmail.com

[Go]
raryDirectory` (pythonGH-157580)

(cherry picked from commit 5c20517)

Co-authored-by: Stan Ulbrych <stan@python.org>
Co-authored-by: Petr Viktorin <encukou@gmail.com>
This partially backports commit 86b8617
(pythonGH-146195); making existing tests use the helper is omitted.

encukou commented Sep 30, 2026

Copy link
Copy Markdown
Member

!buildbot root

[Go]

Copy link
Copy Markdown

New build scheduled with the buildbot fleet by @encukou for commit fb187f1

Results will be shown at:

https://buildbot.python.org/all/#/grid?branch=refs%2Fpull%2F158430%2Fmerge

The command will test the builders whose names match following regular expression: root

The builders matched are:

  • AMD64 Debian root PR
[Go]

encukou commented Oct 2, 2026

Copy link
Copy Markdown
Member

!buildbot Android

[Go]

Copy link
Copy Markdown

New build scheduled with the buildbot fleet by @encukou for commit fb187f1

Results will be shown at:

https://buildbot.python.org/all/#/grid?branch=refs%2Fpull%2F158430%2Fmerge

The command will test the builders whose names match following regular expression: Android

The builders matched are:

  • aarch64 Android PR
  • AMD64 Android PR
[Go]
jkreileder added a commit to jkreileder/cf-ips-to-hcloud-fw that referenced this pull request Oct 4, 2026
1527)

Grype matches CVE-2026-12345 (TemporaryDirectory cleanup race, medium)
against the python 3.14.8 binary in the base image and lists a fix only
in 3.15.0. The fix is merged on main and 3.15 (python/cpython#157580,
#158431); the 3.14 backport (python/cpython#158430) is still open.

Refs #1412

Signed-off-by: Jrgen Kreileder <jk@blackdown.de>
@encukou [@encukou] encukou added the test-with-buildbots Test PR w/ buildbots; report in status section label Oct 8, 2026

Copy link
Copy Markdown

New build scheduled with the buildbot fleet by @encukou for commit fb187f1

Results will be shown at:

https://buildbot.python.org/all/#/grid?branch=refs%2Fpull%2F158430%2Fmerge

If you want to schedule another build, you need to add the test-with-buildbots label again.

[Go]
@bedevere-bot [@bedevere-bot] bedevere-bot removed the test-with-buildbots Test PR w/ buildbots; report in status section label Oct 8, 2026

encukou commented Oct 9, 2026

Copy link
Copy Markdown
Member

Buildbot failures are pre-existing or unrelated.

[Go]
Hide details View details
encukou merged commit 58ed025 into python:3.14 Oct 9, 2026
125 of 137 checks passed
miss-islington deleted the backport-5c20517-3.14 branch October 9, 2026 13:17
@encukou [@encukou] encukou added the needs backport to 3.12 only security fixes label Oct 9, 2026

Copy link
Copy Markdown

Thanks @miss-islington for the PR, and @encukou for merging it .. I'm working now to backport this PR to: 3.12.

[Go]

Copy link
Copy Markdown

Sorry, @miss-islington and @encukou, I could not cleanly backport this to 3.12 due to a conflict.

Please backport manually with cherry_picker, see the devguide for more information.

cherry_picker 58ed0259cae509a19138795df302fe60b544dc74 3.12
[Go]

bedevere-app Bot commented Oct 9, 2026

Copy link
Copy Markdown

GH-159074 is a backport of this pull request to the 3.12 branch.

[Go]
@bedevere-app [@bedevere-app] bedevere-app Bot removed the needs backport to 3.12 only security fixes label Oct 9, 2026
octo-sts-6 Bot pushed a commit to wolfi-dev/os that referenced this pull request Oct 15, 2026
86351)

- 3.14.8_git20261008  3.14.8_git20261014 (43a8cdc5): includes 58ed0259 (python/cpython#158430), CVE-2026-12345
- epoch 1  0

Signed-off-by: Brian Carey <brian.carey@chainguard.dev>

Export:  184aecb619f668b88e22293178b1c4d328061be2
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Footer

© 2026 GitHub, Inc.

Web Proxy Viewer  |  New URL  |  Original Page