Python 3.9.7 and 3.8.12 Release Notes – New Features and Fixes

Python 3.9.7 and 3.8.12 have been released, bringing a series of new features, security updates, and bug fixes to the Python programming language.

Main updates

Common updates for 3.9.7 & 3.8.12: Replace tempfile.mktemp() with TemporaryDirectory to avoid race conditions. Update bundled libexpat to 2.4.1, fixing CVE‑2013‑0340 “Billion Laughs” vulnerability (affects Windows and macOS). Sanitize carriage‑return and line‑feed characters in smtplib internal putcmd to prevent unlikely command injection. Fix segmentation fault caused by deep recursion when cleaning method objects. Use new garbage‑collector macros ( Py_TRASHCAN_BEGIN/END ) in frameobject.c . Fix reference leaks in error paths of update_bases() and __build_class__ .

Specific to 3.9.7: Add audit events to the marshal module and stop raising code.__init__ events for each un‑marshaled code object, reducing performance overhead when loading .pyc files. Fix iterator range bug when iterating more than 2**32 times. Resolve race condition in WeakKeyDictionary , WeakValueDictionary , and WeakSet when two threads attempt to delete the last pending item, also fixing asyncio.create_task and preventing data loss during asyncio.run shutdown. Improve syntax error messages for trailing commas in import statements. Restore correct behavior for complex exponentiation where the exponent is a float or complex. Correct placement of asterisk in f‑strings with format specifiers and repeated expressions.

Specific to 3.8.12: Disallow any leading zeros in IPv4 address strings in the ipaddress module, aligning its behavior with modern inet_pton implementations.