Repository navigation
Support Python 3.15 #306
Description
Activity
The security audit of the Python 3.15 changes (based on 3.15.0rc1) is done; the result is in PR #328. Full rationale:
docs/contributing/changes_from314to315.rst.Findings requiring action:
- Lazy imports (PEP 810) compiled silently: they add no new AST node, only a new
is_lazyfield onImport/ImportFrom, so the default-denygeneric_visitdid not catch them. At run time they resolve through the new__lazy_import__builtin instead of__import__, bypassing a guarded__import__. → now explicitly disallowed. - Unpacking in comprehensions (PEP 798) compiled silently (reuses the existing
Starrednode resp. aDictCompwithout value) and fully executed when guards are provided. The unpacked value is iterated without calling_getiter_, unlike the equivalent nested comprehension. → now explicitly disallowed. - Reviewing
INSPECT_ATTRIBUTESfor the new 3.15 attributes revealed that the async-generator attributesag_await/ag_frame/ag_codewere missing entirely → now blocked. The newgi_state/cr_state/ag_stateattributes only return state strings and stay accessible (likegi_running).
Checked, no action needed: unary
+inmatchpatterns (matchis denied anyway); new builtinsfrozendict/sentinel(allow-list); removedast.Num/Str/Bytes/NameConstant/Ellipsis(unused);compile()/ast.parse()moduleparameter.Remaining after the 3.15.0 final release (October 2026): drop
pip_pre = py315: truefromtox.iniand move the sdist/wheel build job intests.ymlfrompy314topy315.— Comment created by Claude
Reacted by mtoepfl- Lazy imports (PEP 810) compiled silently: they add no new AST node, only a new
- added a commit that references this issue
on Aug 19, 2026 Released in https://pypi.org/project/RestrictedPython/8.5/
Reacted by Jens Vagelpohl
Look through the change log of Python 3.15 (once the first release candidate version is released end of July 2026 (see https://peps.python.org/pep-0790/) for potential issues which need to be handled by
RestrictedPythonto prevent access to otherwise forbidden data/objects.There is no need to support new language features of Python 3.15 right now, let's see how they evolve after they can be used,
Open tasks:
Allow to use the package with Python 3.15 -- Caution: No security audit has been done so far.