Skip to content

Release 2026-04 follow-up #2085

Closed
Closed
Release 2026-04 follow-up#2085
Milestone
2026-04 python-3.15 final

Description

@stonebig
stonebig
opened on Aug 16, 2026

Date: end October 2026

wanted:

  • security based release:
    • python 3.15.2, 3.14.10, 3.13.18
    • wppm -sa : security-audit, check your current packages version with security alerts posted
    • as said "uv" Charlie Marsh, AI implies unsafe memory langages must die very quickly
  • WinPython-3.15 slim is with:
    • 90% of packages
    • but not jupyterlab: pyyaml and h5py strained maintainers
  • speeding-up with AI:
    • simplify the monitoring process of new packages versions
    • automate to improve security of the publishing process
  • usefull "Local AI" level: jupyter-ai
  • WinPython-3.10.14slim_post1 re-spin is to provide a more compressed -mx9 version, back below 650 MB of virustotal.com (nothing else changed)

remark:

  • october 20-26th 2026 security shows the model of fire & forget has a weakness:
    • using only wheels protects the emiter
    • so adding the wppm -sa / --audit option for any users to check himself easily
    • maybe some patch releases of pylock.toml shall exist per version
  • free-threading maturity > python-3.15 : PEP-805-safe-parallel-python
  • JIT maturity > python-3.15: PEP 836 – JIT Go Brrr
  • Local AI hypothesis:
    • Q4 2026 for MainStream Laptops,
    • Q2 2027 for Most Laptops
    • OpenAI / Microsoft / Meta / Google ... do love Python, the Python community is blessed to have these supporters

Activity

  1. stonebig
    added this to the 2026-04 3.15 final with free-threading milestone on Aug 16, 2026

  2. stonebig commented on Aug 16, 2026

    @stonebig
    stonebig
    on Aug 16, 2026
    ContributorAuthor

    Audit-trail:

    • HouseKeeping and re-organization with Claude before new cycle:
      • removes "--pre" as a default build option
      • by default, only build on wheels
      • switch to new build_winpython_cycle.yml cloud workflow
    • get package version assistance from Claude (check_updates.py):
      • spyder-6.1.6 indirectly requires autopep-2.0.4 via python-lsp-server[all] ... signaling it's old
      • mistralai[workflow-payload-encryption] limits to cryptography-47.0.4 ... removing mistralai
      • httpie is help-essly flawed and un-maintained: removing
      • updating to pass security advisory: pyjwt, pygments, nbconvert, gitpython, mako, pypdf, joserfc, soupsieve, bleach, yt-dlp, asteval, ujson, pydantic-settings, mistune, nltk, pyasn1, aiphttp, h2, sqlparse
      • wtf: did put cython-3.3.0a1 in release of last cycle, was intended only for 3.15... so ''--pre" removal will avoid it next time
      • reduce manual preparation work
      • 80 packages upgrades
      • security check: tornado-6.5.8, pypdf-6.16.2
    • Python-3.15.0rc2 (2026-09-01)
    • remark: AI is essential for security defense, nowodays
    • remark: reading that new AI-dev oriented Windows 11 will pre-install python-3.14
    • Claude taking a stab at simplifying the Cloud run+publishing (simpler than Riemann hypothesis, so I believe in you):
      • an option "all" in build_winpython_cycle.yml to launch all builds at once
      • publish direct from the workflow (to github): now 30 minutes from click to "draft" published on github
      • automate the changelog
    • as part of security enforcement, slimf version is not built until tornado publishes a free-threading compatible wheel
    • AI summary:
      • Claude did miss one cloud CI fail, had to notice
      • Claude automating things makes things less pretty, but automation is a must, may tweak after living the result

    b1 (2026-09-07)

    • remark: Python at 52% tutorial marketshare on pypl.github.io as of early september 2026
    • Claude proposed something not pertinent, asked to revert with explanation ... may help AI get your taste, and your brain to stay a brain
    • python-3.15 arrivals:
      • scikit-learn-1.9.1, numba-0.68.0rc1, matplotlib-3.11.2 , 61% coverage
      • scipy-1.8.1
      • pandas-3.0.6, statsmodels-0.15.0, plotnine-0.15.8, aiofile-3.11.1, 71% coverage
      • all other small ones:
      • 3.15 slim at 78% coverage,
      • 3.15 slimf at 71% coverage
    • datasette-0.65.5 security fix
    • httpx2-2.11.0 security fix
    • gitpython-3.1.62 security fix
    • pydantic-2.14.0b2, so ok for python-3.15 and 3.15t
    • remark: still no jupyterlab possible on 3.15 (pywinpty)... but numba rc, the historic bottleneck, is this time 3 weeks ahead of release

    b2 (2026-09-27: 78% of a python-3.15 slim)

    • markupsafe-3.0.4 for python-3.15 and 3.15f
    • numba-0.68.0 for python-3.15
    • include missing upgrade packages
      • 3.15 slim at 82% coverage,
      • 3.15 slimf at 74% coverage
    • Python-3.15.0rc3 (2026-10-01)
    • remark: Python at 53.9% tutorial marketshare on pypl.github.io ... It may reflect now the % of code read by eyes
    • remark: jupyterlab is a concern for Python on windows, as pywinpty maintainer has disappeared from github
    • remark: python-3.15.0 will be the first version with numba available at launch day, previously it was the last package made available
    • remark: about 7 packages update for security fix
    • remark: mistral-vibe with it's strict (and old) dependancies version is an examlpe of what can't go in winpython
    • remark; jupyter-ai is more flexible... but may need nodejs for most clients

    b3 (2026-10-04: python-3.15 slim at 82% of Python-3.14 slim)

    • httptools-0.9.0, pyarrow-26.0.0, streamlit-1.59.1 for python-3.15
    • pydantic-2.14.0
    • polars-2.0.0
    • aiohttp for 3.15
    • python-3.15.0 final
    • include missing upgrade packages
      • 3.15 slim at 87% coverage,
      • 3.15 slimf at 77% coverage
    • Qt stack but missing h5py, so spyder and plotpy
    • include missing upgrade packages
      • 3.15 slim at 90% coverage,
      • 3.15 slimf at 77% coverage
    • security: langgraph-sdk-0.4.4, multidict-6.9.1, werkzeug-3.1.9
    • simplify a little maintenance: pushing pylock and requirements to cloud
    • jupyter-ai (for slim)

    b4 (2026-10-11: python-3.15 slim at 90% of Python-3.14 slim: qt stack, yet no spyder nor jupyterlab)

    • pywinpty-3.1.0 for python-3.15.0 (2026-10-15)
    • tornado-6.6rc1 for python -3.15t
    • 2026-10-26 security:
      • nltk removed: too slow to fix a ceuity and now sha-256 of pip and of github do contradict for nltk-3.10.4
      • brotli removed: too slow, then a security fix
      • python-3.15.2, python-3.14.10, python-3.13.18 , do secure the certificate issue
      • pip-26.2.3 (as pip-26.2.2 certifi-2026-10-20 said too nuclear)
    • duckdb-2.0.0
    • PyYAML-7.0.0 for python-3.15 jupyterlab is blocking 46 packages. will bring 3.15 slim straight to 97%
    • remark: intresting in these more costly disk times: polars free-threading is bloked per a GB space limie on pypi Project Limit Request: polars-runtime-compat - 50 GB pypi/support#11990
    • polars-2.1 handles recursive CTE (when no truly recursive CTE ?)
    • morning fix to wppm: wppm-17.13.20261027
    • re-spin to be package security-alert free on release... also it doesn't stay that long nowodays
    • remark: with pip-26.2.2, local build is now 10% faster
    • include wppm -sa : security-audit, gives packages version with security alerts posted
    • wppm-17.14.20261027, with wppm -sa self audit feature... the most important thing of this cycle.
    • Aaaaaaaaargh: between each local build run, security alerts are poping-up, learning osv.dev (ran by google team) is not particularly more active
    • Aaaaaaaaa: another alert, 1 hour later, so before one cycle.. it starts to be long in the tooth
    Image

    rc (2026-10-2x)

    • postponed next cycle:
      • h5py for python-3.15 for python-3.15 plotpy and keras , 3 packages
      • scikit-image-0.27.0 for python-3.15 (october 27th for a rc1... )
      • polars for 3.15t not yet there... surely next weeks
      • SIMPLIFY: wppm.piptree easier to use in jupyterlite ?
      • adjust further Distribution size ?
      • an opencv torch ultralytic thing ?
  3. stonebig
    pinned this issue on Aug 23, 2026

  4. stonebig commented on Sep 6, 2026

    @stonebig
    stonebig
    on Sep 6, 2026
    ContributorAuthor

    WinPython 2026-04 (2026-09-07)

    Changes from WinPython 2026-04:

    • Infrastructure:
      • SIMPLIFY the check for packages in need of security fix, mature upgrade, new version, blocked
      • SECURITY drop non-wheel package: tornado for free-threading
      • python-3.15.0rc2
      • SIMPLIFY publication: build all versions in one "build_winpython_cycle.yml" step, to publish automaticaly on github
    • New Packages:
    • rfc3987-syntax, lark from jsonschema[format-nongpl]
    • Upgraded Packages:
      • jupyterlab-4.6.3, cython-3.2.9, scipy-1.18.1
      • and 70 other packages
    • Removed Packages:
      • mistralai
      • no slimf (python free-threading) till a tornado wheel
    • Differences among builds:

    Built and published directly on a github tag via Github Actions:

    Binaries at:

    Next build: b2

    • automate and simplify further
    • larger 3.15 slim
    MD5 SHA-1 SHA-256 Binary Size blake2b-256
    430faa12fa929eacaf9868cbce3d64d9 07fea4652db1691542a2925c833e3842d2d34644 45e7bd15541fdb2bb58ffb5422a8e475fa153ebea69ff9aa6535eea32f60b015 WinPython64-3.13.15.1dotb1.exe 16 919 571 Bytes 502120beb76c72a28dca25193a02e3c682eec46d1c5c423f2c1ba4c965f88fdb
    933dde9c81b24fa17e6e30cefabdad95 4fb442bddf3948b9e25ce732b79a0b50e89427c7 16dfd808265848b8f25dfd3ccc1303a4f7a97cb10b7445310d2e6143d172d264 WinPython64-3.13.15.1dotb1.zip 28 168 602 Bytes a26e528d39d4599928938bff2725ac002218edf08a55f479e6451863a3ed45ba
    6ad3ad79b9d01a03dc82e5af29644d09 1596b055e84aed0c48d62be5624a20bf75b32a3c 36a77b9ad390256f86ea326236080aff43b0fdb959ca62c3b40dabb393b873ca WinPython64-3.13.15.1slimb1.7z 667 336 194 Bytes eb1daa370c58158284a71291646deb5743fe3b937df6c15698ae2080e286f8da
    ab5dcf794965ff93e6689f02144c0350 5f43d286488806d77bd4d176b11e31787d850f75 0419d8f5cef34add65d72c69b038e84a59c6ceca2b787664c666fdeb0dc42dcd WinPython64-3.13.15.1slimb1.exe 667 552 486 Bytes 6107e1d4b75352f7b26ae825a207c47390730b796d50afd2bda6e79767c98025
    e20d30bfd8139ce42843267b41336a50 b5b1a1247b3963472ad98b614efaec0a81be4dc5 033af848fd1ec0d5085a4435dc510f24a3f2b52b2294a80c8ca0be340e1004b2 WinPython64-3.14.7.1dotb1.exe 18 033 292 Bytes c3b0f087228649630d8185ce3e50bfcfb5df898fbc2722294905608621b39f4c
    3583bb0f40bfe37842ef61a37bbe76b1 bd77e4359d3fdf1d7e53234507a3fc1b5746e3c6 1116cded18ca8c4caf44fab3815ee90cace866ee348768a9a3ddffa3d9eb9de2 WinPython64-3.14.7.1dotb1.zip 28 666 890 Bytes 345b1c946b7c896cc60d4692e309b37f4a8632bc3077f2be9109b4be89316f9a
    ecaa0fa0f772691dbae054c8ed4f3c05 d910b97e2e2339d57013313f7f4dd6190f0b4f73 c23b5b00f5348d67448d1be32ef0de32b8e4dc831ed1e864337c7290f80977d0 WinPython64-3.14.7.1dotfb1.exe 18 110 256 Bytes f1ab93c26b2e721fb83b2c6bc00f720e9e0729cc46ea324048ca21de6e7b4cca
    6250b1f57c191e4a259e5cd78220ebbc 54bce3c21d7b33f1fe51bee27704c0af175e712a d9be9888c1e73a048efb15162ec22009dec533d16c7a224948db8657ab867cd3 WinPython64-3.14.7.1dotfb1.zip 28 891 612 Bytes acd2aa40668fcc35905499f76be40b316d737464a128e6a68131efc024e02384
    bf67a294c104c4828c3770fb89fd7df1 4512fc7bac284c7a97b6576cce9a61d50da87c1a 2b20f19ae7ddc072461bd34473aeea201b16ff1e127768b84d4fd27c96671d39 WinPython64-3.14.7.1slimb1.7z 672 525 665 Bytes 4e56ce31de0a65f2478a4f2afab09b6e6384d616ef4a9a5c2f91953b0433ae8f
    29f89fcb9266febc817684ea55987a13 c62f19340ea3394b48eced71b2773ad57094f750 14ef0e3bd40404bdbb7d0ff9edac472a14d8d3227746132549e44522d9d1558f WinPython64-3.14.7.1slimb1.exe 672 744 315 Bytes c43b9ea973c2e3164b05f3605de3d863158828a0ae0e28c32f4a8c223ba95b12
    c62c9ce10fef326307592ececba9ba86 2620b29acca7bdda321f5f89e9379158961a2dfc afda16453238217e7b008a1ee473df4e5050989d792f2e6b16db2b3324e05b6e WinPython64-3.14.7.1slimfb1.7z 432 086 571 Bytes abe7f853d9029931827233d10b62d25be2a0db87e7df88cc13db2ed59e4255cc
    ff90ead96caa74d76229d51de78272a9 eb891e6221ad5c2e29a2caf17d581d9017ae692e 745ac81fb52a5f7e4f5063c64a103df9185269d68ddb89d5570de0546d599149 WinPython64-3.14.7.1slimfb1.exe 432 302 734 Bytes 01843032acc8a95c1cf65fc0d7601af5ea5edef6bc078392234bf070c79416da
    88facd0ec8d0857721981d47edceede9 b9d3d43886183cdd6d824c2921f7cbc3c8ea9494 a7a2b048c60fd568ccd090be1ad4b05efc4f2df677fadd8f8c214b6ca5eb6383 WinPython64-3.15.0.5dotb1.exe 18 835 124 Bytes fe27e1b08701b856fe1603f2344108ba019b5e1d23a9b7c21a91f52dc405cecc
    b32786764ab8d99811314e43a0379a4f 3eefa2f1b9715568cc0a55533e29bdb0c5df3f48 f8f5bd99d28180d5a1969ab8e7595425695c64b88383f32a94c718b76b3e6ccc WinPython64-3.15.0.5dotb1.zip 29 873 249 Bytes 93a071597f11a73f32bfff55c0eebc11c1e88edc38f6f4bed12d6861fd974ebc
    714dd924b8cc30edff5991370b6dea07 79fb16ce508f45f2f20f54ba66cd26c9b0ed5db1 1b8653e7a0028a067a657c6b1a6489f5e10a375ce5a0c68c6f408102f744a2e5 WinPython64-3.15.0.5dotfb1.exe 18 869 142 Bytes 550d093d01529b805f9a5267cdee8f4147fa711a9fdd218a849d4515fcaacec3
    8e6a79f66a2d3cff4dddcebdebd57044 18092c8580abc64e40c3c59abe9628b55d5b3819 08dfa882a4ed089774bb7366489520550c08c432d40daf85574c03bc5b7199c4 WinPython64-3.15.0.5dotfb1.zip 29 975 740 Bytes cf134caf42342f930d70965ef135b4e72ba223d0f00eb01e3fd14678b67b54e9
    a0d7fd21d2c11676980c9fee47f7a13d d3e6bb148f9f30aaf05f25aa7b9ee1de67777853 732da78395096b9218b426e746c6750fb809ddc318984b63d226c0dc421b18ee WinPython64-3.15.0.5slimb1.7z 265 114 289 Bytes e44fe1b42f0cfa1891e8365de22640897bfc0d05c73c145a13fb8f7f60815a5f
    9728c4088b3a773c4003130e96677ef9 a5baeace656613fb7e6af09fba92a1fac0e87000 f46c31476edf53f2ca7264d4919dea70f0a7d7ff62eb0ca6c7ebc48a5b3f45b9 WinPython64-3.15.0.5slimb1.exe 265 329 895 Bytes 56fcb4994332f6cc24d19413735f7602ed378a46d8f07823257b76eb8516a347

  5. stonebig commented on Sep 27, 2026

    @stonebig
    stonebig
    on Sep 27, 2026
    ContributorAuthor

    WinPython 2026-04 b2 (2026-09-27)

    Changes from WinPython 2026-04 b1:

    • Infrastructure:
      • only wheels, but specific beta wheels for 3.15: pydantic-2.14.0b2, numba-0.68.0rc1, llvmlite-0.50.0rc3
      • python-3.15.0 slim and slimf: slim at 78% of usual packages (missing jupyterlab and qt stack)
    • New Packages:
    • Upgraded Packages:
    • Removed Packages:
      • tornado-6.6a1 wheels now exists for python free-threading
    • Differences among builds:
      • slimf (free-threading) are missing Qt
      • python-3.15 is missing jupyterlab (because of markupsafe, pyyaml, pywinpty)

    Built and published directly on a github tag via Github Actions:

    Binaries at:

    Next build: b3

    • numba official
    • hope of unlocking news for markupsafe, pyyaml, pywinpty
    • what-to-do about spyder/python-3.15

  6. stonebig commented on Oct 4, 2026

    @stonebig
    stonebig
    on Oct 4, 2026
    ContributorAuthor

    WinPython 2026-04 b3 (2026-10-04)

    Changes from WinPython 2026-04 b2:

    • Infrastructure:
      • still one specific beta wheels for 3.15: pydantic-2.14.0b2
      • python-3.15.0 slim and slimf progress: slim at 82% of usual packages (missing jupyterlab and qt stack)
    • New Packages:
    • Upgraded Packages:
      • numba, markupsafe
    • Removed Packages:
    • Differences among builds:
      • slimf (free-threading) are missing Qt
      • python-3.15 is missing jupyterlab (because of pyyaml, pywinpty)

    Built and published directly on a github tag via Github Actions:

    Binaries at:

    Next build: rc

    • a workaround for pyyaml and pywnpty, so jupyterlab can be on python-3.15 ?
    • python-3.15 slim reaching 88% of packages would be a grand success.
    • may shift by 1 week to get jupyterlab: spyder or jupyterlab, one must be on board

  7. stonebig commented on Oct 11, 2026

    @stonebig
    stonebig
    on Oct 11, 2026
    ContributorAuthor

    WinPython 2026-04 b4 (2026-10-11)

    Changes from WinPython 2026-04 b3:

    • Infrastructure:
      • python-3.15.0 final
      • python-3.15.0 slim at 90% of usual packages (missing jupyterlab and spyder)
    • New Packages:
      • jupyter-ai
    • Upgraded Packages:
    • Removed Packages:
    • Differences among builds:
      • slimf (free-threading) are missing Qt
      • python-3.15 is missing jupyterlab (because of pyyaml, pywinpty)

    Built and published directly on a github tag via Github Actions:

    Binaries at:

    Next build: final

    • pyyaml for python-3.15, tornado-6.6 final
    • shifted by 1 week hoping to get spyder or jupyterlab on 3.15, one must be on board
    • hoping to get python-3.15.0 slim at 92%

  8. stonebig commented on Oct 27, 2026

    @stonebig
    stonebig
    on Oct 27, 2026
    ContributorAuthor

    WinPython 2026-04 final (2026-10-27)

    WinPython 2026-04 is the result of 2 month of work to :

    • keep packaging updated and improve overal security,
    • to push Python-3.15 support,
    • to simplify maintenance.

    Changes from WinPython 2026-04 b4:

    • Infrastructure:
      • SECURITY: python-3.15.2, python-3.14.10, python-3.13.8
      • SECURITY: pip-26.2.2, certifi-2026.10.23
      • SECURITY: wppm -sa / --audit gives users the everyday security bulletin on their current packages version
      • just released version shall be wppm -sa alert-free
      • simplified local build.
    • New Packages:
    • Upgraded Packages:
      • all security alert fixed ... at the moment of build
    • Removed Packages:
      • nltk: don't keep slow-on-security packages
    • Differences among builds:
      • slimf (free-threading) are missing Qt
      • python-3.15 is only 90% complete: missing jupyterlab (because of pyyaml)
      • jupyter-ai only in 3.13 and 3.14 slim

    Built and published directly on a github tag via Github Actions:

    Next cycle:

    • jupyterlab for python-3.15 on Windows
    • improve user security: automatic post-security release of pylock.toml ?
    • in the mean time, you can enjoy security alerts per a mere wppm -sa
    MD5 SHA-1 SHA-256 Binary Size blake2b-256
    66e3c45e67645c7486e16c922aa18d2b ae50dcd112307c3a42fbb0d225a038f44890da40 25589c5dc41dbce7154f0815ab438833948310cbeb1d12ba906117fae7d224a9 WinPython64-3.13.18.0dot.exe 16 739 371 Bytes be24c42ee806576140fc554d81362d7ee8be44756275254bc93dc0ad0939dc4d
    ac27b4cf65a839cfcf56c789e6caf707 8f0d9fb3a3fd754748c793e370da495ebc366313 50c4f17809457e411c2db30959c8fb25a958ff3a6f624080044992809509bc37 WinPython64-3.13.18.0dot.zip 27 838 192 Bytes ed1348c1001951d3ec3e4c213dc1f4ee3fb245350b191fd01d4c81bd217167c0
    33c3dc2656fbfa7c030168b0d797fd8b e714150a7917c5f8dbd480589d1674bd53b5932c 41708849c273cb053ec676294aaed39fd385cff6c100164b6226f55e38b011b9 WinPython64-3.13.18.0slim.7z 673 534 389 Bytes 585bcc3758c85723bfb40f30e5524a95b98a9dc944951de8bed8785e0fd2a605
    10bbf9cbac67c7a362478faa248d29e2 9b8dcb388f38d687cfb7b5a26cf21310ae8308a2 a47a3a5a68635930085ccc3841658633c3ac851081873bdc48341527a61f11ab WinPython64-3.13.18.0slim.exe 673 750 232 Bytes a0cf43073ce9cbb27b58083c836151f6f91c4023bf6841604a5e8678495d9dbc
    2f56e3f6f279b1574124b492d312c677 04f0cb408f941e253c31f0d37992fe6ddf0b14c1 27b7400ea21faf4530384381d26f0a379c758e445e05c504c0e3dd52330e9871 WinPython64-3.14.10.0dot.exe 18 248 659 Bytes 126eefda8f1774c967dc6df0db318defcbf79f7368ca4226b833ddf9a7f700c3
    f0c3f6c062721300c769982e4d46674a 9825516726dfb06e0657a42871b34fe87096d83e 9f54ca38f54b4ce8213925af4d7cf5b13cef724b2853408e010e5ee44e0bcc54 WinPython64-3.14.10.0dot.zip 28 829 421 Bytes 2487bd3159e5365fd93971dd4b8444a82108f1b97bb82b7a6e3713bcc28cd144
    e22509bda496b5f71b050c6abc5a3a6d a85b18462479af44ea8b2be33c5c1c106b0beea5 87a880d4c476b63ffaa22bf59de5f2b5b211adc6e6d5e57ca94c6f0a25c840d0 WinPython64-3.14.10.0dotf.exe 18 332 072 Bytes 851b0217eef81682ae068aff4694265579d60c47d11c473f57649aa2e934d6e2
    0cb972e0fc8f4bfb55e81a46aed05c7f 49124fea27d46230c9a78b20f8d3a5c785f05e38 9c63dacae921ef8250704d910c9d04bfacf37e962c52b13e5737fc3695ec1132 WinPython64-3.14.10.0dotf.zip 29 066 048 Bytes 01332b59efd04466acc8ca5b1db14462a923425b240755ebb73189d2d0773d37
    a130fa33164991a66882f3976be78319 169908b34c644868985b39f77429b8db8c1aa6ef 0188dfddeaea19a42ddd6e41ac22711b8790364eed7990f0d6c38ee586838cd0 WinPython64-3.14.10.0slim.7z 682 187 410 Bytes 195b715282ae6dd61e57ae49119805a2b74d07fce1eb293c9d7e23b121665fc2
    739ebce1a0376877633314d66088412e ae55a85589fd8b19804bb9e31641cb418558313d d164a73c9f3e202a9d78e819ea4cadf7d75db0fc719a502cf4eb49bfc0293c31 WinPython64-3.14.10.0slim.exe 682 403 379 Bytes 56ba100aebd6c818c80cda7b51407a803352f7a587991e01ca0f4a114c69a2c2
    f7228cfd12fbe54558675b6832ca50a7 acdeee5fc3aed1805de156eb093c4bb7f4dbdb0b e86c9a83b286689ceb121e799e2be2033f4454b41e6e17b7a23331285301c670 WinPython64-3.14.10.0slimf.7z 431 609 058 Bytes 41cb2fb15cfe7b4ff969bd933e0bc00afd7318ea7c7245e8665795a1a4096753
    ef3f86795f0566ed64c3eaed9276a8b0 03ae88438ce1e0415dd3ad75af0e1afd0676b596 f6642d708da42974ecfdcf0e6e71f033f2b60eb42c2779f0f7b4a5b93930cf7c WinPython64-3.14.10.0slimf.exe 431 824 652 Bytes 97c60eefd7e69e54a24a0e313daf9a39ace0fbde4212f6f76ed23a97ced1b803
    f094e1778957744edbbcbf0a652dc7cf ecca0932fded05b57cc74e4e55361ce924516aed b1f27e22b795c902087f28d1f716a484fb59f9452fe40844b54d81fdb7680d39 WinPython64-3.15.2.0dot.exe 19 031 887 Bytes b34c64a950a9edd654d7249fe5e37a43f659c1b28dd4a927f3f92a78b5f9741d
    9baed0dd1e9a456a954e552bc4f5a63d 9b59c0f2ec378a5dc3415becc7a3fb4d8f388fba 6728ce28222d8d585a5984746768f7d37b0e17bac88de0fd7e4207c2656e680f WinPython64-3.15.2.0dot.zip 29 982 984 Bytes 0cd89f10be83c8779cb7908b682a79d6a7c58b28e5585a14d3d621e415db3158
    e6728377e0975772b5a2b9f56ccb382b 0e4b70be5c0411e0f6ef16567c20d45ddf0864aa 042be98592bf0446ec257c490814d915edd8f9987c8a63879582715f18fc7d50 WinPython64-3.15.2.0dotf.exe 19 072 621 Bytes 93f8e9512d61e9170b4244ef8cf8f1fd416d4cc8867717474d438cc6775cfa0b
    d3741a096891708c75b12911985ae949 6f2c3fd6d0fd82dfe3ab8bc0e65a9b6c896a5bd9 ebef1c113244d49f429db66454c57bb0a7538deb4eb0c647e220319e8379e619 WinPython64-3.15.2.0dotf.zip 30 103 590 Bytes 8a31524e04c6626a336a702e19bec2c122b1b90be5c99ba02753ff82739242cf
    648023f2153086fe0726f6bf16696665 e3af1de113f73a186bb6b321b0262667be440325 567596ca306ea8f1162c6c681777ca1f342f8b0ab071d7eca22b63f2eb0c6760 WinPython64-3.15.2.0slim.7z 538 907 332 Bytes 540b181e4fd1e2536624b727792b77e8a9b343aa9e8baede73157ed2d2131b7a
    6540c6ded602c8522d0008adf4c4e0eb b4f93433e8bc8164f71d2576eaccf62a65d2e760 20769ff2e8b91653913e8cceb875f87b65905f67536f0b3a147ec65b7e68f448 WinPython64-3.15.2.0slim.exe 539 122 799 Bytes 04c3ab8230afb87f52feb11c202492fefdd10422594ab6b0d492c00bc8189e40
    707cdcdd9514df5b7dba778c4050cd78 0c9f4e8dd043eb1afa7508bc2bc65570dbbfc4aa 77989212ebc0bd39b202f71a5941bd4e2a7897887586b2e1216ca553b38ae13f WinPython64-3.15.2.0slimf.7z 310 351 294 Bytes d46d86dbc648b2a1f18576c32e5346c6f108932f5b692ca4607daf20a40eb775
    0b7cd528f051043578965792de47d011 ebab912dc73afc3558015fc59cccd13357379fef c3e83f71a357956aa8d9a98d852e7f51bee43d98c662a38925d521d95b9753c5 WinPython64-3.15.2.0slimf.exe 310 566 930 Bytes 573752fba9a47874b3ea8f9a0f93065a9adc391f02afb6917d5630ca49af64f9

    pylock and requirements versions: (now also in the winpython/changelogs comits), and how-to use with pip:
    . with a requirement file:
    . pip download --dest C:\your_temp_Wheelhouse --no-deps --require-hashes -r requir.64-3_14_10_0slim.txt
    . pip install --no-deps --no-index --trusted-host=None --find-links=C:\your_temp_Wheelhouse --require-hashes -r requir.64-3_14_10_0slim.txt
    . with a pylock file:
    . pip install --no-deps --require-hashes -r pylock.64-3_14_10_0slim.toml --no-warn-script-location

    MD5 SHA-1 SHA-256 Binary Size blake2b-256
    d7933836c16931d2db62b1b6fa14fe7c 2674501a91a1e30d82bd3f5d475e508e08abc846 a71c8603e1a1ab51f06475ffd16b1e55d75b1f8a1d4a62d2acafed8f0b569418 pylock.64-3_13_18_0dot.toml 3 062 Bytes 8e420ded8548ab32a6a909ffc876ec08aae656df9ccd53ce635928d02db7ca60
    9123e32c0bde06b662f53b04ce65ebb3 473bbbc98897f2b56eba20145f5cb4092bca9139 c08412e66eb198d4464a37f5ce8d5ad2e6cc0d08f9ce2423862d3e0699c82d71 pylock.64-3_13_18_0slim.toml 199 999 Bytes 8706371f179b9804add5b5bd7da4d74ba4ef9980ba77d3887b91649d1528a44f
    d7933836c16931d2db62b1b6fa14fe7c 2674501a91a1e30d82bd3f5d475e508e08abc846 a71c8603e1a1ab51f06475ffd16b1e55d75b1f8a1d4a62d2acafed8f0b569418 pylock.64-3_14_10_0dot.toml 3 062 Bytes 8e420ded8548ab32a6a909ffc876ec08aae656df9ccd53ce635928d02db7ca60
    d7933836c16931d2db62b1b6fa14fe7c 2674501a91a1e30d82bd3f5d475e508e08abc846 a71c8603e1a1ab51f06475ffd16b1e55d75b1f8a1d4a62d2acafed8f0b569418 pylock.64-3_14_10_0dotf.toml 3 062 Bytes 8e420ded8548ab32a6a909ffc876ec08aae656df9ccd53ce635928d02db7ca60
    0e9afce865fd5f2666b02a13aa465b8b a4617fd860136516bbefb1a398384666d35eb0db 57240682d61f8ae514d457c15c20a679f344d0089d92bc9d6f71540022edbcac pylock.64-3_14_10_0slim.toml 210 287 Bytes 9e0bddfed22469d4c8cde6d5e23aaf8faede172323e4752bd930cabb6c40c666
    9d92799f52316f97d42a23332e694aa1 5d69eaac91a41e028f5216e8594f6f46027093f9 989148c42740c9d828654b164650495da880989d9378e14bbe2128accc28abba pylock.64-3_14_10_0slimf.toml 177 514 Bytes 313358f7c5ab719a6ea56456149d87726fb91931912dc58bbf4aaa4b4dc5a3fc
    d7933836c16931d2db62b1b6fa14fe7c 2674501a91a1e30d82bd3f5d475e508e08abc846 a71c8603e1a1ab51f06475ffd16b1e55d75b1f8a1d4a62d2acafed8f0b569418 pylock.64-3_15_2_0dot.toml 3 062 Bytes 8e420ded8548ab32a6a909ffc876ec08aae656df9ccd53ce635928d02db7ca60
    d7933836c16931d2db62b1b6fa14fe7c 2674501a91a1e30d82bd3f5d475e508e08abc846 a71c8603e1a1ab51f06475ffd16b1e55d75b1f8a1d4a62d2acafed8f0b569418 pylock.64-3_15_2_0dotf.toml 3 062 Bytes 8e420ded8548ab32a6a909ffc876ec08aae656df9ccd53ce635928d02db7ca60
    be295a85f57f937d11da4ef89e6cd20d 5a66a229ef7efbb0e064a931d148d47ce909773d 1224f58aa47a0339d0ce90cc71506f32587a49ca09f763476cede70436a3f409 pylock.64-3_15_2_0slim.toml 179 316 Bytes b8cf00492f08462f40f90478b39aabdb7216c6b36ef84b511ab1609f2399eb80
    8a3b68f9a9155c0c577a6560601abb8d 9930935e50ad079ec77e0c2f97745e0ee56f9697 4147b9fd7ccb466e8562f49a5e72c347ba2e94327a16a51b84da60c1c791572a pylock.64-3_15_2_0slimf.toml 155 335 Bytes dac5ef7cd9e8909d60adcffe3f60cc27c2c32f6e1ead099552634f21b9c33f21
    b07c2406db39392bf612207b17a8b7dd 93a515d2a3ade580965fa69ab97b477a676cc738 3374bb78e1a5f947f5a83cc851cb0267169ff18dad673cb043f790af7f71b7b6 requir.64-3_13_18_0dot.txt 836 Bytes 39b912da1f4ebf4b749a8c047c7647e819e6820becce9c97fbda7da40d9a52c5
    09be08047c51ff68b7068d37fcb02bd9 d96003d8b699a5d36853c45cb829b10ed92ca5b0 fef1766e3f5f5837abca76019bef00d7c48f2c84893ff69efa45797b44d6ed97 requir.64-3_13_18_0slim.txt 54 914 Bytes e32843746abf18ea6fc21526e0d8aa6c390093007df6dbb2e540c7f5c229ad80
    b07c2406db39392bf612207b17a8b7dd 93a515d2a3ade580965fa69ab97b477a676cc738 3374bb78e1a5f947f5a83cc851cb0267169ff18dad673cb043f790af7f71b7b6 requir.64-3_14_10_0dot.txt 836 Bytes 39b912da1f4ebf4b749a8c047c7647e819e6820becce9c97fbda7da40d9a52c5
    b07c2406db39392bf612207b17a8b7dd 93a515d2a3ade580965fa69ab97b477a676cc738 3374bb78e1a5f947f5a83cc851cb0267169ff18dad673cb043f790af7f71b7b6 requir.64-3_14_10_0dotf.txt 836 Bytes 39b912da1f4ebf4b749a8c047c7647e819e6820becce9c97fbda7da40d9a52c5
    0fbb565cceaffa86a1109118755bbd8c 1e0fcc4599c84bc45e186ebe6234535f947130b8 7f974186f719bbf1a8b4bef813ddeee4e424278d08b7f687a838443fc5b3d260 requir.64-3_14_10_0slim.txt 57 786 Bytes 480710d5c727a6332c2109621e1fc123ad32e124d6d89725985fe2ecbe1a0a6e
    44f66ac76ac86d20b8389ee7ab2ca23d 01875465f7e040ff7002b2792f70fa3fc1b908fa ff63920d075cf5b0ce975b265491104ecb87d73be568b049220b4b9996ecad0f requir.64-3_14_10_0slimf.txt 48 791 Bytes f469f0f5e296164ec5f0fd8563afa038c918db9abcde678ba49eb4c4d4c17deb
    b07c2406db39392bf612207b17a8b7dd 93a515d2a3ade580965fa69ab97b477a676cc738 3374bb78e1a5f947f5a83cc851cb0267169ff18dad673cb043f790af7f71b7b6 requir.64-3_15_2_0dot.txt 836 Bytes 39b912da1f4ebf4b749a8c047c7647e819e6820becce9c97fbda7da40d9a52c5
    b07c2406db39392bf612207b17a8b7dd 93a515d2a3ade580965fa69ab97b477a676cc738 3374bb78e1a5f947f5a83cc851cb0267169ff18dad673cb043f790af7f71b7b6 requir.64-3_15_2_0dotf.txt 836 Bytes 39b912da1f4ebf4b749a8c047c7647e819e6820becce9c97fbda7da40d9a52c5
    d809427d604bb7ec5fbe926f44fedc05 ea92e994616517a257fcc82f05693ed5e4980645 3f374149e31eaa4b3b6e33bbb464ed31892aa00ec98215d085c4cce1c2f40600 requir.64-3_15_2_0slim.txt 49 304 Bytes 83faaea4f3823f07a33a6be40cba337cbf1590c22fda9be55c6720454940f6b7
    0204ce22c52879e634e69eee5da4aafa ef205d78eb98a905630ceb51a99d9a7e92f56bdd fc7efae9ffcd0170e1f0bb27a04b958fd310d24870e795ad66faa961cf630983 requir.64-3_15_2_0slimf.txt 42 727 Bytes d53a395c088b0257b5cf413e65986e094385909e7d2e3bf3c19e80913c470dac

    2026-10-29 re-spin of WinPython-3.14.10 in a more compressed for to get back below 650Mo:

    MD5 SHA-1 SHA-256 Binary Size blake2b-256
    89757aa24963eabbc61fe08cedba33ac 93cc782bd24e29f7c71eed819f3a19753f28012a 99df4d8f58db2fdcda3e629cba5d1550207b396a27c74b78bd96b753530bb217 WinPython64-3.14.10.0slim_post1.7z 667 873 591 Bytes 590a6085fbcfa53cd71329dee3a0b4ffd62ac08c2f196a2ddc6d2b8c6127d90b
    436fea539e8ec3c146c0e7395aa91c76 69f919858af98db2ac8d7277c471306a844ccb74 b9bb622ee95e78a326ddce9e1a808e3c38edc6853bda58a6c078fd05b866a771 WinPython64-3.14.10.0slim_post1.exe 668 088 786 Bytes 2dc1614b9322a92e62867c4bf63f3aafacf168adc81fd9ef8ba9cf9b403c6c42

  9. stonebig commented on Oct 29, 2026

    @stonebig
    stonebig
    on Oct 29, 2026
    ContributorAuthor

    Post-mortem of the cycle (2026-10-29):

    • security is not a given, can be lost overnight, so users can now self-check packages alert with
      • wppm -sa or wppm --audit
    • winpython-3.14.10.slim is slightly too big for virustotal.com by 1Mo, found after release (sorry), forcing:
      • a re-spin for winpython-3.14.10.slim with higher compression, -mx7 instead of -mx9, to fit back into 650mo, with nothing else changed
      • the need to add the option to launch only "slim" in build_winpython_cycle.yml and have a "post" parameter added in cycle/2026_04.toml
      • ==> re-spin is winpython-3.14.10.slim_post1
    • a warning shall now be raised in the cloud build if an object is > 650MB , to avoid post-production inconvenience next time.

  10. stonebig commented on Oct 29, 2026

    @stonebig
    stonebig
    on Oct 29, 2026
    ContributorAuthor

    default of sourceforge is switched to WinPython64-3.14.10.0slim_post1.exe

  11. stonebig
    closed this as completedon Oct 29, 2026

  12. stonebig commented on Oct 29, 2026

    @stonebig
    stonebig
    on Oct 29, 2026
    ContributorAuthor

    And now, new thing, the advisory updates after release:

    • like radio-activity, it was already there in the past
    • but now, it's easier to check with 'wppm --audit'
    • also an hour-fresh alert on pydantic like https://github.com/pydantic/pydantic/releases/tag/v2.14.2 is on the release tag at 2026-10-29 18:00:00Z , but not immediatley published on osv.dev ... an impossibly long 1 hour lag ?

    Rule-of-thumb: with AI advent, it seems about 2 security alert per day, alert importance depending of your usage and internet connexion

    Security updates

    Advisories published 2026-10-28:

    Package From → To Advisory Severity Summary
    langgraph 1.2.11 → 1.2.14 GHSA-3fx2-cqw9-xr3c medium Unencoded identifiers in LangGraph SDK v3 streaming can redirect authenticated GET requests (also fixed in langgraph-sdk 0.4.6)
    tornado 6.5.10 → 6.6 GHSA-pcg2-g6cj-q92c medium Quadratic CPU usage when parsing HTTP headers with line folding
    tornado 6.5.10 → 6.6 GHSA-pw9p-v7r6-gx4p low Open redirect in RedirectHandler via protocol-relative URLs
    tornado 6.5.10 → 6.6 GHSA-r4j5-9xpp-3985 medium Event loop blocking and excess memory use from chunked bodies with many small chunks

  13. stonebig commented on Oct 31, 2026

    @stonebig
    stonebig
    on Oct 31, 2026
    ContributorAuthor

    2026-10-31 update by Claude : "For security alone, none of these justifies a re-spin; they can wait for the next normal cycle."

    alerts:

    Nothing is critical. 12 of the 17 advisories are High, and all 12 are denial of service.
    All 17 are gone at the target versions (checked on osv.dev).

    Package Update High Moderate Low What it is
    pypdf 6.21.2 -> 6.21.4 7 Infinite loops, memory and CPU blowups on a crafted PDF.
    pyasn1 0.6.4 -> 0.6.5 4 Quadratic CPU when decoding BER/DER.
    joserfc 1.7.4 -> 1.7.6 1 1 Unbounded JWE recipients (CPU); JWS size guard (allocation).
    tornado 6.5.10 -> 6.6 2 1 HTTP header and chunked-body DoS; open redirect in RedirectHandler.
    langgraph 1.2.11 -> 1.2.14 1 SDK v3 streaming identifiers can redirect authenticated requests.
    • No code execution: none of the 17 allows it. Only two aren't DoS, the tornado redirect and the langgraph one. The langgraph one has limited confidentiality impact and requires login.
    • pypdf: you need a malicious PDF and someone has to open it. In a desktop distribution that's the most realistic trigger, but it only hangs that process.
    • pyasn1 and joserfc: these only matter if a service decodes untrusted input. pyasn1 usually comes in as a dependency.
    • tornado: this mainly affects public servers. Jupyter on localhost isn't exposed in the usual setup.

    ... we shall not forget that Claude is a bit enthousiastic about itself

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions