Import CPython 3.14.7+ stable branch (2026-08-20)

Summary:
Imported python/cpython `3.14.7+` from upstream rev [`cb76caa`](https://www.github.com/python/cpython/commit/cb76caaa6467f0ae8f9d58b5956211ed855a8905) (committed 2026-08-20 01:52:17+00:00).

# Commit Info

- Base: (`3.14.7+`) - [`90a1f02`](https://www.github.com/python/cpython/commit/90a1f02b7da0c356d10a23f1faee7dc063f887ed) (commit date: 2026-08-18 13:09:24+00:00)
- Imported: (`3.14.7+`) - [`cb76caa`](https://www.github.com/python/cpython/commit/cb76caaa6467f0ae8f9d58b5956211ed855a8905) (commit date: 2026-08-20 01:52:17+00:00)

# Noteworthy file changes

- Low-signal files (1 added) (NEWS.d, docs, .github)

Complete list of added/removed files: https://www.internalfb.com/intern/everpaste/?color=0&handle=GBUqjSB4cps3hbkDAKjvKW5V5M8Lbr0LAAAz

Reviewed By: itamaro

Differential Revision: D116769448

fbshipit-source-id: 663aae0327fba5ae554bce1786ab3fe5f5ba0d98

Author: generatedunixname1734921407115435

.github/workflows/build.yml

@@ -52,6 +52,7 @@ jobs:
   check-abi:
     name: 'Check if the ABI has changed'
     runs-on: ubuntu-22.04  # 24.04 causes spurious errors
+    timeout-minutes: 30
     needs: build-context
     if: needs.build-context.outputs.run-tests == 'true'
     steps:

Doc/library/asyncio-task.rst

@@ -853,17 +853,13 @@ Timeouts
    Wait for the *aw* :ref:`awaitable <asyncio-awaitables>`
    to complete with a timeout.
 
-   If *aw* is a coroutine it is automatically scheduled as a Task.
-
    *timeout* can either be ``None`` or a float or int number of seconds
    to wait for.  If *timeout* is ``None``, block until the future
    completes.
 
-   If a timeout occurs, it cancels the task and raises
-   :exc:`TimeoutError`.
+   If a timeout occurs, it cancels *aw* and raises :exc:`TimeoutError`.
 
-   To avoid the task :meth:`cancellation <Task.cancel>`,
-   wrap it in :func:`shield`.
+   To prevent *aw* from being cancelled, wrap it in :func:`shield`.
 
    The function will wait until the future is actually cancelled,
    so the total wait time may exceed the *timeout*. If an exception
@@ -904,6 +900,10 @@ Timeouts
    .. versionchanged:: 3.11
       Raises :exc:`TimeoutError` instead of :exc:`asyncio.TimeoutError`.
 
+   .. versionchanged:: 3.12
+      Implemented using :func:`asyncio.timeout`, a coroutine passed as *aw*
+      is no longer wrapped in a :class:`Task` when *timeout* is positive.
+
 
 Waiting primitives
 ==================

Doc/library/stdtypes.rst

@@ -706,7 +706,7 @@ A hexadecimal string takes the form::
 
    [sign] ['0x'] integer ['.' fraction] ['p' exponent]
 
-where the optional ``sign`` may by either ``+`` or ``-``, ``integer``
+where the optional ``sign`` may be either ``+`` or ``-``, ``integer``
 and ``fraction`` are strings of hexadecimal digits, and ``exponent``
 is a decimal integer with an optional leading sign.  Case is not
 significant, and there must be at least one hexadecimal digit in
@@ -1345,7 +1345,7 @@ Mutable sequence types also support the following methods:
    :no-typesetting:
 .. method:: sequence.pop(index=-1, /)
 
-   Retrieve the item at *index* and also removes it from *sequence*.
+   Retrieve the item at *index* and also remove it from *sequence*.
    By default, the last item in *sequence* is removed and returned.
 
 .. method:: bytearray.remove(value, /)
@@ -2120,7 +2120,7 @@ expression support in the :mod:`re` module).
    one character, ``False`` otherwise.  Alphabetic characters are those characters defined
    in the Unicode character database as "Letter", i.e., those with general category
    property being one of "Lm", "Lt", "Lu", "Ll", or "Lo".  Note that this is different
-   from the `Alphabetic property defined in the section 4.10 'Letters, Alphabetic, and
+   from the `Alphabetic property defined in section 4.10 'Letters, Alphabetic, and
    Ideographic' of the Unicode Standard
    <https://www.unicode.org/versions/Unicode16.0.0/core-spec/chapter-4/#G91002>`_.
    For example:
@@ -3032,7 +3032,7 @@ replacement field. For example::
    '0.333333'
    >>> f'{one_third:_^+10}'
    '___+1/3___'
-   >>> >>> f'{one_third!r:_^20}'
+   >>> f'{one_third!r:_^20}'
    '___Fraction(1, 3)___'
    >>> f'{one_third = :~>10}~'
    'one_third = ~~~~~~~1/3~'
@@ -3042,12 +3042,12 @@ replacement field. For example::
 Template String Literals (t-strings)
 ------------------------------------
 
-An :dfn:`t-string` (formally a :dfn:`template string literal`) is
+A :dfn:`t-string` (formally a :dfn:`template string literal`) is
 a string literal that is prefixed with ``t`` or ``T``.
 
 These strings follow the same syntax and evaluation rules as
 :ref:`formatted string literals <stdtypes-fstrings>`,
-with for the following differences:
+with the following differences:
 
 * Rather than evaluating to a ``str`` object, template string literals evaluate
   to a :class:`string.templatelib.Template` object.
@@ -3074,7 +3074,7 @@ with for the following differences:
   The :class:`!Interpolation` instance for the expression will be created as
   normal, except that :attr:`~string.templatelib.Interpolation.conversion` will
   be set to '``r``' (:func:`repr`) by default.
-  If an explicit conversion or format specifier are provided,
+  If an explicit conversion or format specifier is provided,
   this will override the default behaviour.
 
 
@@ -3451,7 +3451,7 @@ objects.
 
    .. classmethod:: fromhex(string, /)
 
-      This :class:`bytearray` class method returns bytearray object, decoding
+      This :class:`bytearray` class method returns a bytearray object, decoding
       the given string object.  The string must contain two hexadecimal digits
       per byte, with ASCII whitespace being ignored.
 
@@ -4387,7 +4387,7 @@ the ``%`` operator (modulo).
 This is also known as the bytes *formatting* or *interpolation* operator.
 Given ``format % values`` (where *format* is a bytes object), ``%`` conversion
 specifications in *format* are replaced with zero or more elements of *values*.
-The effect is similar to using the :c:func:`sprintf` in the C language.
+The effect is similar to using the :c:func:`sprintf` function in the C language.
 
 If *format* requires a single argument, *values* may be a single non-tuple
 object. [5]_  Otherwise, *values* must be a tuple with exactly the number of
@@ -4587,8 +4587,8 @@ copying.
    :class:`!memoryview`\s are :ref:`generic <generics>` over the type of their
    underlying data.
 
-   ``len(view)`` is equal to the length of :class:`~memoryview.tolist`, which
-   is the nested list representation of the view. If ``view.ndim = 1``,
+   ``len(view)`` is equal to the length of :meth:`~memoryview.tolist`, which
+   is the nested list representation of the view. If ``view.ndim == 1``,
    this is equal to the number of elements in the view.
 
    .. versionchanged:: 3.12
@@ -4673,7 +4673,7 @@ copying.
       :class:`collections.abc.Sequence`
 
    .. versionchanged:: 3.5
-      memoryviews can now be indexed with tuple of integers.
+      memoryviews can now be indexed with a tuple of integers.
 
    .. versionchanged:: 3.14
       memoryview is now a :term:`generic type`.
@@ -6073,7 +6073,7 @@ enables cleaner type hinting syntax compared to subscripting :class:`typing.Unio
 
    .. note::
 
-      The ``|`` operand cannot be used at runtime to define unions where one or
+      The ``|`` operator cannot be used at runtime to define unions where one or
       more members is a forward reference. For example, ``int | "Foo"``, where
       ``"Foo"`` is a reference to a class not yet defined, will fail at
       runtime. For unions which include forward references, present the
@@ -6232,7 +6232,7 @@ Methods
 Methods are functions that are called using the attribute notation.
 There are two flavors: :ref:`built-in methods <builtin-methods>`
 (such as :meth:`~list.append` on lists)
-and :ref:`class instance method <instance-methods>`.
+and :ref:`class instance methods <instance-methods>`.
 Built-in methods are described with the types that support them.
 
 If you access a method (a function defined in a class namespace) through an

Doc/library/tarfile.rst

@@ -1100,6 +1100,10 @@ reused in custom filters:
     paths (in case the name is absolute
     even after stripping slashes, e.g. ``C:/foo`` on Windows).
     This raises :class:`~tarfile.AbsolutePathError`.
+  - Normalize filenames (:attr:`TarInfo.name`) that contain ``..`` components
+    using :func:`os.path.normpath`.
+    Note that this removes internal ``..`` components, which may change the
+    meaning of the name if it traverses symbolic links.
   - :ref:`Refuse <tarfile-extraction-refuse>` to extract files whose absolute
     path (after following symlinks) would end up outside the destination.
     This raises :class:`~tarfile.OutsideDestinationError`.
@@ -1108,6 +1112,10 @@ reused in custom filters:
 
   Return the modified ``TarInfo`` member.
 
+  .. versionchanged:: next
+
+     Filenames containing ``..`` components are now normalized.
+
 .. function:: data_filter(member, path)
 
   Implements the ``'data'`` filter.

Lib/asyncio/tasks.py

@@ -440,15 +440,13 @@ def _release_waiter(waiter, *args):
 async def wait_for(fut, timeout):
     """Wait for the single Future or coroutine to complete, with timeout.
 
-    Coroutine will be wrapped in Task.
-
     Returns result of the Future or coroutine.  When a timeout occurs,
-    it cancels the task and raises TimeoutError.  To avoid the task
-    cancellation, wrap it in shield().
+    it cancels fut and raises TimeoutError.  To prevent fut from being
+    cancelled, wrap it in shield().
 
-    If the wait is cancelled, the task is also cancelled.
+    If the wait is cancelled, fut is also cancelled.
 
-    If the task suppresses the cancellation and returns a value instead,
+    If fut suppresses the cancellation and returns a value instead,
     that value is returned.
 
     This function is a coroutine.

Lib/tarfile.py

@@ -819,6 +819,13 @@ def _get_filtered_attrs(member, dest_path, for_data=True):
         # For example, 'C:/foo' on Windows.
         raise AbsolutePathError(member)
     # Ensure we stay in the destination
+    if '..' in name.replace(os.sep, '/').split('/'):
+        # Directories are created from the name as given, so a name that
+        # leaves the destination part-way through would create them
+        # outside it even if the resolved path stays inside.
+        normalized = os.path.normpath(name)
+        if normalized != name:
+            name = new_attrs['name'] = normalized
     target_path = os.path.realpath(os.path.join(dest_path, name),
                                    strict=os.path.ALLOW_MISSING)
     if os.path.commonpath([target_path, dest_path]) != dest_path:

Lib/test/test_tarfile.py

@@ -3981,6 +3981,20 @@ def test_absolute(self):
                         tarfile.AbsolutePathError,
                         """['"].*escaped.evil['"] has an absolute path""")
 
+    def test_parent_dir_out_and_back(self):
+        # Test a member that leaves the destination and comes back.
+        # The containment check looks at the resolved path, which stays
+        # inside, but the intermediate directories are created from the
+        # name as given, which does not.
+        with ArchiveMaker() as arc:
+            arc.add(f'../escaped.evil/../{self.destdir.name}/sub/file',
+                    content='content')
+
+        for filter in 'tar', 'data':
+            with self.subTest(filter):
+                with self.check_context(arc.open(), filter):
+                    self.expect_file('sub/file', content='content')
+
     @symlink_test
     def test_parent_symlink(self):
         # Test interplaying symlinks

Misc/NEWS.d/next/Security/2026-08-13-13-08-11.gh-issue-155999.Xt4rWq.rst

@@ -0,0 +1,5 @@
+Fix the :mod:`tarfile` ``tar`` and ``data`` extraction filters creating
+directories outside the destination for members whose name leaves the
+destination and returns to it, such as ``../evil/../dest/sub/file``. The
+containment check used the resolved path, but intermediate directories were
+created from the name as given.