Release Date: March 19, 2024
Note: The release you're looking at is Python 3.9.19, a security bugfix release for the legacy 3.9 series. Python 3.12 is now the latest feature release series of Python 3. Get the latest release of 3.12.x here.
- gh-115399 & gh-115398: bundled libexpat was updated to 2.6.0 to address CVE-2023-52425, and control of the new reparse deferral functionality was exposed with new APIs
- gh-109858: is now protected from the “quoted-overlap” zipbomb to address CVE-2024-0450. It now raises when attempting to read an entry that overlaps with another entry or central directory
- gh-91133: cleanup no longer dereferences symlinks when working around file system permission errors to address CVE-2023-6597
- gh-115197: no longer resolves the hostname before checking it against the system’s proxy bypass list on macOS and Windows
- gh-81194: a crash in with a specific value () was fixed. Relatedly, an integer overflow in on 64-bit non-Windows platforms was fixed
- gh-113659: files with names starting with a dot or containing the hidden file attribute are now skipped
- gh-102388: and codecs no longer read out of bounds
According to the release calendar specified in PEP 596, Python 3.9 is now in the "security fixes only" stage of its life cycle: the 3.9 branch only accepts security fixes and releases of those are made irregularly in source-only form until October 2025. Python 3.9 isn't receiving regular bug fixes anymore, and binary installers are no longer provided for it. Python 3.9.13 was the last full bugfix release of Python 3.9 with binary installers.