To Dan's L's point, though. This is stupid. Python3.11 is supported for security fixes for another year-plus. It's got an active 2025 CVE with what looks like a reasonable fix, even if "unofficial".
Blocking on "we can't accept the changes unless upstream says they're okay" -- upstream thinks "the code we have, with the active CVE" is okay, otherwise they would have, yanno, put out a new release. Because it's still supported. Otherwise, that statement about support and EOL dates is meaningless. Yes, developer fatigue is a thing, god knows I've hit it myself when Life Happened. And yeah, pkg-audit needs a knob that exempts specific CVEID's/vuxml entries/packages from its alert. If you've looked at your system, read the tea leaves, asked other knowledgeable people, asked your favorite LLM, and asked your magic 8 ball and you say "okay, this is an imap and pop3 vuln, I am sure I'm not using those libs" OR "I have patched the code that consumes those functions" OR "in fact I've deleted them post-install, let me go on with life", you should be able to. -Dan > On Aug 8, 2026, at 11:27 PM, Dag-Erling Smørgrav <[email protected]> wrote: > > Charlie Li <[email protected]> writes: >> Nothing will be backported until upstream can verify that the fixes do >> not break existing (correct) behaviour. Currently only the imaplib >> (CVE-2025-15366) fixes are present in the latest upstream >> lang/python31{3,4,5}. > > Not true. The patches I posted _are_ from upstream 3.15. There is an > additional commit to imaplib commit which we could include: > > commit d0921efb665aff26b378f495e5ff84f7e3fe649d > Author: Serhiy Storchaka <[email protected]> > AuthorDate: Sun Jul 5 18:25:36 2026 +0300 > Commit: GitHub <[email protected]> > CommitDate: Sun Jul 5 18:25:36 2026 +0300 > > gh-143921: Narrow the control character check in imaplib commands > (GH-153067) > > Only NUL, CR and LF are rejected now. Other control characters are > valid in quoted strings and can occur in mailbox names returned by > the server, so they are now accepted and sent quoted. > > Co-authored-by: Claude Fable 5 <[email protected]> > > Upstream 3.13.15 and 3.14.7 already have both imaplib patches but not > the poplib patch. > > DES > -- > Dag-Erling Smørgrav - [email protected] >
