python
Version: 3.14.5The Python programming language
What is python?
The Python programming language
How to use this package
Quick install
Installs the package into the current environment for this session. Use --build or --runtime to persist it as a build-time or runtime dependency.
min add pythonDeclare as a task dependency in minimal.toml
Listing the package under tasks.<name>.packages makes it available inside that task’s sandbox.
[tasks.dev]
packages = ["python"]Build-time vs runtime
Choose build-time for tools needed during compilation, runtime for dynamic libraries loaded at runtime.
min add --build python
min add --runtime pythonDependencies (15)
| Name | Version | Kind |
|---|---|---|
| base | — | build |
| bash | 5.3 | runtime |
| expat | 2.7.5 | runtime |
| gdbm | 1.26 | build |
| glibc CVE:3 | 2.42 | runtime |
| libffi | 3.5.2 | runtime |
| make | 4.4.1 | build |
| ncurses | 6.5-20250830 | build |
| openssl CVE:1 | 3.6.2 | runtime |
| pkgconf | 2.5.1 | build |
| sqlite | 3.50.4 | build |
| toolchain | — | build |
| util-linux | 2.42.1 | build |
| xz | 5.8.3 | runtime |
| zlib | 1.3.2 | runtime |
Dependants (41)
| Name | Version |
|---|---|
| android-sdk | 11076708 |
| boost CVE:2 | 1.91.0-1 |
| bun | 1.3.14 |
| cabal | 3.12.1.0 |
| cython | 3.2.1 |
| deno | 2.8.2 |
| diffoscope | 306 |
| expect | 5.45.4 |
| flit-core | 3.12.0 |
| fontconfig | 2.17.1 |
| foundationdb | 7.3.69 |
| gcloud | 568.0.0 |
| ghc | 9.10.3 |
| git | 2.54.0 |
| glib | 2.86.4 |
| glibc CVE:3 | 2.42 |
| gradle | 9.3.1 |
| graphviz | 14.1.1 |
| hex-patch | 1.12.5 |
| libevent | 2.1.12-stable |
| libglvnd | 1.7.0 |
| libxcb | 1.17.0 |
| llvm | 21.1.8 |
| llvm-bootstrap | 21.1.8 |
| mesa | 25.3.5 |
| meson | 1.10.1 |
| meson-python | 0.18.0 |
| mono | 6.12.0.206 |
| next | 16.2.6 |
| ninja | 1.13.2 |
| node | 25.8.2 |
| node-lts | 24.14.1 |
| numpy | 2.3.5 |
| py-build | 1.3.0 |
| py-packaging | 25.0 |
| pyproject-hooks | 1.2.0 |
| pyproject-metadata | 0.9.1 |
| rust | 1.95.0 |
| setuptools | 82.0.1 |
| xcb-proto | 1.17.0 |
| z3 | 4.16.0 |
- [ Diff ] +3 / -2
- [ Diff ] +14 / -8
- [ Diff ] +20 / -10
- [ Diff ] -1
- [ Diff ] -1
- [ Diff ] +1
- [ Diff ] +3 / -1
- [ Diff ] +5 / -5
- [ Diff ] +5 / -5
- [ Diff ] +1 / -1
- [ Diff ] +1 / -1
- [ Diff ] +1 / -1
- [ Diff ] +5
- [ Diff ] +6 / -1
- [ Diff ] +1 / -1
- [ Diff ] +7 / -4
- [ Diff ] +8 / -5
- [ Diff ] +46 / -2
- [ Diff ] +66
Showing 11 advisories, 5 of which are transitive via python's dependencies
No advisories match the current filters.
| Status | IDs | Package | Severity | |||
|---|---|---|---|---|---|---|
| Critical ( 1 ) | ||||||
| Under investigation | python | Critical: 9.8 | ||||
Summary`xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\r\n\r\nFully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch. Affected ranges
CVSS vector:
| ||||||
| High ( 7 ) | ||||||
| Under investigation | python | High | ||||
Summarybz2.BZ2Decompressor objects could be reused after a decompression error. If an application caught the resulting OSError and retried with the same decompressor, crafted input could cause the decompressor to resume from an invalid internal state and perform out-of-bounds writes to a stack buffer. This could crash the process when processing untrusted data. Affected ranges
| ||||||
| Under investigation | python | High: 7.5 | ||||
SummaryIf `shutil.unpack_archive()` is given a ZIP archive with an absolute Windows path containing a drive (`C:\\...`) then the archive will be extracted outside the target directory which is different than other operating systems. Only Windows is affected by this vulnerability. Affected ranges
CVSS vector:
| ||||||
| Affected: 2.42 | glibc | High: 7.5 | ||||
SummaryNo summary published for this advisory. Via: glibc Affected ranges
CVSS vector:
References | ||||||
| Affected: 2.42 | glibc | High: 7.5 | ||||
SummaryNo summary published for this advisory. Via: glibc Affected ranges
CVSS vector:
References | ||||||
| Affected: 2.42 | glibc | High: 8.4 | ||||
SummaryNo summary published for this advisory. Via: glibc Affected ranges
CVSS vector:
| ||||||
| Affected: 3.6.2 | openssl | High: 7.5 | ||||
SummaryNo summary published for this advisory. Via: openssl Affected ranges
CVSS vector:
References
| ||||||
| Resolved in 0df65d82dbc41e8da00adb243de5918db532c8a6 | openssl | High | ||||
SummaryHeap-buffer-overflow in asn1_ex_i2c Via: openssl Affected ranges
Fixed in:
References | ||||||
| Medium ( 3 ) | ||||||
| Under investigation | python | Medium | ||||
Summarytarfile.data_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extractall() to write files outside the destination directory, subject to the permissions of the extracting process. Affected ranges
| ||||||
| Under investigation | python | Medium | ||||
Summaryunicodedata.normalize() can take excessive CPU time when processing specially crafted Unicode input containing long runs of combining characters with alternating Canonical Combining Class values. This affects all normalization forms. Affected ranges
| ||||||
| Under investigation | python | Medium | ||||
SummaryThe ftpcp() function in Lib/ftplib.py was not updated when CVE-2021-4189 was fixed. While makepasv() was patched to replace server-supplied PASV host addresses with the actual peer address (getpeername()[0]), ftpcp() still calls parse227() directly and passes the raw attacker-controllable IP address and port to target.sendport(). This patch is related to CVE-2021-4189. Affected ranges
| ||||||
| Low ( 0 ) | ||||||
| Unknown ( 0 ) | ||||||
43 components
No components match your filter.
| Packages | Version |
|---|---|
| python ROOT | 3.14.5 |
| acl | 2.3.2 |
| attr | 2.5.2 |
| bash | 5.3 |
| bash-bootstrap | 5.3 |
| binutils | 2.46.1 |
| bison | 3.8.2 |
| bzip2 | 1.0.8 |
| coreutils | 9.11 |
| diffutils | 3.12 |
| expat | 2.7.5 |
| file | 5.47 |
| findutils | 4.10.0 |
| flex | 2.6.4 |
| gawk | 5.4.0 |
| gawk-bootstrap | 5.3.2 |
| gcc | 15.2.0 |
| gdbm | 1.26 |
| glibc | 2.42 |
| gmp | 6.3.0 |
| grep | 3.12 |
| gzip | 1.14 |
| libcap | 2.78 |
| libffi | 3.5.2 |
| linux_headers | 6.12.43 |
| lz4 | 1.10.0 |
| m4 | 1.4.21 |
| make | 4.4.1 |
| mpc | 1.4.0 |
| mpfr | 4.2.2 |
| ncurses | 6.5-20250830 |
| openssl | 3.6.2 |
| pcre2 | 10.47 |
| perl | 5.42.0 |
| pkgconf | 2.5.1 |
| readline | 8.3 |
| sed | 4.9 |
| sqlite | 3.50.4 |
| tar | 1.35 |
| util-linux | 2.42.1 |
| xz | 5.8.3 |
| zlib | 1.3.2 |
| zstd | 1.5.7 |