python

A GitHub advisory published October 13 for SAP's Cloud SDK for Python lists CVE-2026-89111, a CVSS 10.0 OAuth2 SSRF flaw, as affecting versions before 0.45.2.

Python.org lists 3.15.0 as the stable release dated Oct. 9, 2026, with explicit lazy imports, new frozendict and sentinel built-in types, and UTF-8 as the default encoding.

The October 8 release changes hf jobs stats to exit after one snapshot unless -f is passed, fixes an hf_xet version-lookup race, and repairs HfFileSystem cache bugs.

Astral's Ruff 0.17.0 release notes, dated October 9, list code-signed executables, a default Python version of 3.11, changed default rules and the removal of ruff-lsp support.

The Django project's October 6 security releases fix one low and three moderate issues, plus a bypass of an earlier nested-geometry mitigation; the post lists severity but no CVSS scores.

uv 0.12.23 adds a frozen-lockfile preview letting sync, export and tree run from uv.lock alone, the latest in a run of releases focused on lockfile fidelity.

Python 3.14.8, 3.13.16, 3.12.15, 3.11.17 and 3.10.22 fix CVEs in tarfile, ssl, zipfile and urllib; 3.10 reaches end of life with its final release.

A high-severity flaw in the official MCP Python SDK let a malicious server redirect OAuth credentials to an attacker's endpoint; fixes ship in 1.30.0 and 2.2.0, with extra steps needed.

At RustConf in Montreal, Rust's programming manager outlined CPython's scaled-back plan to add an optional internal Rust API in Python 3.16, along with unresolved technical hurdles.

Cloudflare has moved Python Workers out of beta to general availability, adding native FastAPI, Django, and Flask support plus PostgreSQL and MySQL connectivity via Hyperdrive.

CPython added riscv64-unknown-linux-gnu to PEP 11 as a Tier 3 platform, following months of community testing on RISE Project hardware.

Polars 2.0-rc.1 flips LazyFrame queries to the streaming engine by default, a change the project says should be roughly 5x faster while removing melt(), join_nulls, and other older APIs.