Import CPython 3.14.5+ stable branch (2026-05-11)

Summary:
Imported python/cpython `3.14.5+` from upstream rev [`74cca9a`](https://www.github.com/python/cpython/commit/74cca9a92fb7d653e404843a56b8bdc7b0afdbbf) (committed 2026-05-11 09:57:50+00:00).

# Commit Info

Base: (`3.14.5rc1+`) - [`9d5857c`](https://www.github.com/python/cpython/commit/9d5857cfa363f67f1319c8bbb7626207f6896a52) (commit date: 2026-05-10 04:10:20+00:00)
Imported: (`3.14.5+`) - [`74cca9a`](https://www.github.com/python/cpython/commit/74cca9a92fb7d653e404843a56b8bdc7b0afdbbf) (commit date: 2026-05-11 09:57:50+00:00)

# Noteworthy file changes

- Low-signal files (3 added, 13 removed) (NEWS.d, docs, .github)

Complete list of added/removed files: https://www.internalfb.com/intern/everpaste/?color=0&handle=GNmifSPA55KZQc4PAIHSyzTV12Fabr0LAAAz

Reviewed By: itamaro

Differential Revision: D104683745

fbshipit-source-id: 018b0d9f06350a3dea56aa87d948942ee10aa507

Author: generatedunixname1734921407115435

Include/patchlevel.h

@@ -20,11 +20,11 @@
 #define PY_MAJOR_VERSION        3
 #define PY_MINOR_VERSION        14
 #define PY_MICRO_VERSION        5
-#define PY_RELEASE_LEVEL        PY_RELEASE_LEVEL_GAMMA
-#define PY_RELEASE_SERIAL       1
+#define PY_RELEASE_LEVEL        PY_RELEASE_LEVEL_FINAL
+#define PY_RELEASE_SERIAL       0
 
 /* Version as a string */
-#define PY_VERSION              "3.14.5rc1+meta"
+#define PY_VERSION              "3.14.5+meta"
 /*--end constants--*/
 
 

Lib/pydoc_data/module_docs.py

@@ -830,16 +830,22 @@ def _get_filtered_attrs(member, dest_path, for_data=True):
         if member.islnk() or member.issym():
             if os.path.isabs(member.linkname):
                 raise AbsoluteLinkError(member)
+            # A link member that resolves to the destination directory itself
+            # would replace it with a (sym)link, redirecting the destination
+            # for all subsequent members.
+            if target_path == dest_path:
+                raise OutsideDestinationError(member, target_path)
             normalized = os.path.normpath(member.linkname)
             if normalized != member.linkname:
                 new_attrs['linkname'] = normalized
             if member.issym():
-                target_path = os.path.join(dest_path,
-                                           os.path.dirname(name),
-                                           member.linkname)
+                # The symlink is created at `name` with trailing separators
+                # stripped, so its target is relative to the directory
+                # containing that path.
+                link_dir = os.path.dirname(name.rstrip('/' + os.sep))
+                target_path = os.path.join(dest_path, link_dir, normalized)
             else:
-                target_path = os.path.join(dest_path,
-                                           member.linkname)
+                target_path = os.path.join(dest_path, normalized)
             target_path = os.path.realpath(target_path,
                                            strict=os.path.ALLOW_MISSING)
             if os.path.commonpath([target_path, dest_path]) != dest_path:

Lib/pydoc_data/topics.py

@@ -672,6 +672,20 @@ def test_change_size_2(self):
         parser.Parse(xml2, True)
         self.assertEqual(self.n, 4)
 
+    @support.requires_resource('cpu')
+    @support.requires_resource('walltime')
+    @support.bigmemtest(size=2**31, memuse=4, dry_run=False)
+    def test_large_character_data_does_not_crash(self):
+        # See https://github.com/python/cpython/issues/148441
+        parser = expat.ParserCreate()
+        parser.buffer_text = True
+        parser.buffer_size = 2**31 - 1  # INT_MAX
+        N = 2049 * (1 << 20) - 3  # Character data greater than INT_MAX
+        self.assertGreater(N, parser.buffer_size)
+        parser.CharacterDataHandler = lambda text: None
+        xml_data = b"<r>" + b"A" * N + b"</r>"
+        self.assertEqual(parser.Parse(xml_data, True), 1)
+
 class ElementDeclHandlerTest(unittest.TestCase):
     def test_trigger_leak(self):
         # Unfixed, this test would leak the memory of the so-called

Lib/tarfile.py

@@ -3682,6 +3682,39 @@ class TestExtractionFilters(unittest.TestCase):
     # The destination for the extraction, within `outerdir`
     destdir = outerdir / 'dest'
 
+    @classmethod
+    def setUpClass(cls):
+        # Posix and Windows have different pathname resolution:
+        # either symlink or a '..' component resolve first.
+        # Let's see which we are on.
+        if os_helper.can_symlink():
+            testpath = os.path.join(TEMPDIR, 'resolution_test')
+            os.mkdir(testpath)
+
+            # testpath/current links to `.` which is all of:
+            #   - `testpath`
+            #   - `testpath/current`
+            #   - `testpath/current/current`
+            #   - etc.
+            os.symlink('.', os.path.join(testpath, 'current'))
+
+            # we'll test where `testpath/current/../file` ends up
+            with open(os.path.join(testpath, 'current', '..', 'file'), 'w'):
+                pass
+
+            if os.path.exists(os.path.join(testpath, 'file')):
+                # Windows collapses 'current\..' to '.' first, leaving
+                # 'testpath\file'
+                cls.dotdot_resolves_early = True
+            elif os.path.exists(os.path.join(testpath, '..', 'file')):
+                # Posix resolves 'current' to '.' first, leaving
+                # 'testpath/../file'
+                cls.dotdot_resolves_early = False
+            else:
+                raise AssertionError('Could not determine link resolution')
+        else:
+            cls.dotdot_resolves_early = False
+
     @contextmanager
     def check_context(self, tar, filter, *, check_flag=True):
         """Extracts `tar` to `self.destdir` and allows checking the result
@@ -3853,10 +3886,19 @@ def test_parent_symlink(self):
                     + "which is outside the destination")
 
             with self.check_context(arc.open(), 'data'):
-                self.expect_exception(
-                    tarfile.LinkOutsideDestinationError,
-                    """'parent' would link to ['"].*outerdir['"], """
-                    + "which is outside the destination")
+                if self.dotdot_resolves_early:
+                    # 'current/../..' normalises to '..', which is rejected.
+                    self.expect_exception(
+                        tarfile.LinkOutsideDestinationError,
+                        """'parent' would link to ['"].*outerdir['"], """
+                        + "which is outside the destination")
+                else:
+                    # 'current/..' normalises to '.'; the rewritten link is
+                    # created and 'parent/evil' lands harmlessly inside the
+                    # destination.
+                    self.expect_file('current', symlink_to='.')
+                    self.expect_file('parent', symlink_to='.')
+                    self.expect_file('evil')
 
         else:
             # No symlink support. The symlinks are ignored.
@@ -3946,35 +3988,6 @@ def test_parent_symlink2(self):
         # Test interplaying symlinks
         # Inspired by 'dirsymlink2b' in jwilk/traversal-archives
 
-        # Posix and Windows have different pathname resolution:
-        # either symlink or a '..' component resolve first.
-        # Let's see which we are on.
-        if os_helper.can_symlink():
-            testpath = os.path.join(TEMPDIR, 'resolution_test')
-            os.mkdir(testpath)
-
-            # testpath/current links to `.` which is all of:
-            #   - `testpath`
-            #   - `testpath/current`
-            #   - `testpath/current/current`
-            #   - etc.
-            os.symlink('.', os.path.join(testpath, 'current'))
-
-            # we'll test where `testpath/current/../file` ends up
-            with open(os.path.join(testpath, 'current', '..', 'file'), 'w'):
-                pass
-
-            if os.path.exists(os.path.join(testpath, 'file')):
-                # Windows collapses 'current\..' to '.' first, leaving
-                # 'testpath\file'
-                dotdot_resolves_early = True
-            elif os.path.exists(os.path.join(testpath, '..', 'file')):
-                # Posix resolves 'current' to '.' first, leaving
-                # 'testpath/../file'
-                dotdot_resolves_early = False
-            else:
-                raise AssertionError('Could not determine link resolution')
-
         with ArchiveMaker() as arc:
 
             # `current` links to `.` which is both the destination directory
@@ -4010,7 +4023,7 @@ def test_parent_symlink2(self):
 
         with self.check_context(arc.open(), 'data'):
             if os_helper.can_symlink():
-                if dotdot_resolves_early:
+                if self.dotdot_resolves_early:
                     # Fail when extracting a file outside destination
                     self.expect_exception(
                             tarfile.OutsideDestinationError,
@@ -4130,6 +4143,76 @@ def test_sly_relative2(self):
                     + """['"].*moo['"], which is outside the """
                     + "destination")
 
+    @symlink_test
+    @os_helper.skip_unless_symlink
+    def test_normpath_realpath_mismatch(self):
+        # The link-target check must validate the value that will actually
+        # be written to disk (the normalised linkname), not the original.
+        # Here 'a' is a symlink to a deep nonexistent path, so realpath()
+        # of 'a/../../...' stays inside the destination while normpath()
+        # collapses 'a/..' lexically and escapes.
+        depth = len(self.destdir.parts) + 5
+        deep = '/'.join(f'p{i}' for i in range(depth))
+        sneaky = 'a/' + '../' * depth + 'flag'
+        for kind in 'symlink_to', 'hardlink_to':
+            with self.subTest(kind):
+                with ArchiveMaker() as arc:
+                    arc.add('a', symlink_to=deep)
+                    arc.add('escape', **{kind: sneaky})
+                with self.check_context(arc.open(), 'data'):
+                    self.expect_exception(
+                        tarfile.LinkOutsideDestinationError)
+
+    @symlink_test
+    @os_helper.skip_unless_symlink
+    def test_symlink_trailing_slash(self):
+        # A trailing slash on a symlink member's name must not cause the
+        # link target to be resolved relative to the wrong directory.
+        with ArchiveMaker() as arc:
+            t = tarfile.TarInfo('x/')
+            t.type = tarfile.SYMTYPE
+            t.linkname = '..'
+            arc.tar_w.addfile(t)
+            arc.add('x/escaped', content='hi')
+
+        with self.check_context(arc.open(), 'data'):
+            self.expect_exception(tarfile.LinkOutsideDestinationError)
+
+    @symlink_test
+    @os_helper.skip_unless_symlink
+    def test_link_at_destination(self):
+        # A link member whose name resolves to the destination directory
+        # itself must be rejected: otherwise the destination is replaced
+        # by a symlink and later members can be redirected through it.
+        for name in '', '.', './':
+            with ArchiveMaker() as arc:
+                t = tarfile.TarInfo(name)
+                t.type = tarfile.SYMTYPE
+                t.linkname = '.'
+                arc.tar_w.addfile(t)
+
+            with self.check_context(arc.open(), 'data'):
+                self.expect_exception(tarfile.OutsideDestinationError)
+
+    @symlink_test
+    @os_helper.skip_unless_symlink
+    def test_empty_name_symlink_chain(self):
+        # Regression test for a chain of empty-named symlinks that
+        # incrementally redirects the destination outwards.
+        with ArchiveMaker() as arc:
+            for name, target in [('', ''), ('a/', '..'),
+                                 ('', 'dummy'), ('', 'a'),
+                                 ('b/', '..'),
+                                 ('', 'dummy'), ('', 'a/b')]:
+                t = tarfile.TarInfo(name)
+                t.type = tarfile.SYMTYPE
+                t.linkname = target
+                arc.tar_w.addfile(t)
+            arc.add('escaped', content='hi')
+
+        with self.check_context(arc.open(), 'data'):
+            self.expect_exception(tarfile.FilterError)
+
     @symlink_test
     def test_deep_symlink(self):
         # Test that symlinks and hardlinks inside a directory

Lib/test/test_pyexpat.py

@@ -0,0 +1,122 @@
+.. date: 2026-04-06-13-55-00
+.. gh-issue: 148178
+.. nonce: Rs7kLm
+.. release date: 2026-05-10
+.. section: Security
+
+Hardened :mod:`!_remote_debugging` by validating remote debug offset tables
+before using them to size memory reads or interpret remote layouts.
+
+..
+
+.. date: 2026-04-20-15-25-55
+.. gh-issue: 146270
+.. nonce: qZYfyc
+.. section: Core and Builtins
+
+Fix a sequential consistency bug in ``structmember.c``.
+
+..
+
+.. date: 2025-08-01-20-31-30
+.. gh-issue: 137293
+.. nonce: 4x3JbV
+.. section: Core and Builtins
+
+Fix :exc:`SystemError` when searching ELF Files in :func:`sys.remote_exec`.
+
+..
+
+.. date: 2026-05-07-21-58-17
+.. gh-issue: 149388
+.. nonce: DDBPeA
+.. section: Library
+
+Make :class:`!asyncio.windows_utils.PipeHandle` closing idempotent.
+
+..
+
+.. date: 2026-05-04-19-28-48
+.. gh-issue: 149377
+.. nonce: WNlc8Y
+.. section: Library
+
+Update bundled pip to 26.1.1
+
+..
+
+.. date: 2026-04-25-14-11-24
+.. gh-issue: 138907
+.. nonce: u21Wnh
+.. section: Library
+
+Support :rfc:`9309` in :mod:`urllib.robotparser`.
+
+..
+
+.. date: 2026-04-15-16-08-12
+.. gh-issue: 148615
+.. nonce: Uvx50R
+.. section: Library
+
+Fix :mod:`pdb` to accept standard -- end of options separator. Reported by
+haampie. Patched by Shrey Naithani.
+
+..
+
+.. date: 2026-02-19-04-40-57
+.. gh-issue: 130750
+.. nonce: 0hW52O
+.. section: Library
+
+Restore quoting of choices in :mod:`argparse` error messages for improved
+clarity and consistency with documentation.
+
+..
+
+.. date: 2025-12-06-08-48-26
+.. gh-issue: 141449
+.. nonce: hQvNW_
+.. section: Library
+
+Improve tests and documentation for non-function callables as
+:term:`annotate functions <annotate function>`.
+
+..
+
+.. date: 2026-05-05-18-49-44
+.. gh-issue: 149425
+.. nonce: QnQL8j
+.. section: Tests
+
+Increase time delta in
+``test.test_zipfile.test_core.OtherTests.test_write_without_source_date_epoch``
+
+..
+
+.. date: 2026-05-05-17-08-36
+.. gh-issue: 145736
+.. nonce: JYdLx4
+.. section: Tests
+
+Fix test_tkinter test_configure_values test case backport miss for Tk 9.
+
+..
+
+.. date: 2026-05-06-18-23-36
+.. gh-issue: 142295
+.. nonce: O9RmZH
+.. section: macOS
+
+For Python macOS framework builds, update Info.plist files to be more
+compliant with current Apple guidelines. Original patch contributed by
+Martinus Verburg.
+
+..
+
+.. date: 2026-05-05-18-42-59
+.. gh-issue: 124111
+.. nonce: WmQG7S
+.. section: macOS
+
+Update macOS installer to use Tcl/Tk 9.0.3.