fix: Updating Python toolchains to patch CVE-2025-47273 (#3053)
Updating to a slightly newer build (20250612 instead of 20250610) of
several Python toolchains that includes a newer version of setuptools
that is no longer vulnerable to CVE-2025-47273.
Also added support for Python 3.13.5, since a patched toolchain build
for 3.13.4 is not available (and since 3.13.5 was released).
See
https://github.com/astral-sh/python-build-standalone/commit/5cc924bf04b73004c57bf438476255c1b5b63e9f#diff-860ea5e06ac2e2191008bbf2de9b216ed11533780f270b5e0cdfc31b37b3b3df
and
https://github.com/astral-sh/python-build-standalone/releases/tag/20250612
diff --git a/CHANGELOG.md b/CHANGELOG.md
index ea76c5a..d8dda48 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -60,6 +60,13 @@
* (gazelle) Types for exposed members of `python.ParserOutput` are now all public.
* (gazelle) Removed the requirement for `__init__.py`, `__main__.py`, or `__test__.py` files to be
present in a directory to generate a `BUILD.bazel` file.
+* (toolchain) Updated the following toolchains to build 20250612 to patch CVE-2025-47273:
+ * 3.9.23
+ * 3.10.18
+ * 3.11.13
+ * 3.12.11
+ * 3.14.0b2
+* (toolchain) Python 3.13 now references 3.13.5
{#v0-0-0-fixed}
### Fixed
diff --git a/python/versions.bzl b/python/versions.bzl
index 44af7ba..72ff7c2 100644
--- a/python/versions.bzl
+++ b/python/versions.bzl
@@ -187,17 +187,17 @@
"strip_prefix": "python",
},
"3.9.23": {
- "url": "20250610/cpython-{python_version}+20250610-{platform}-{build}.tar.gz",
+ "url": "20250612/cpython-{python_version}+20250612-{platform}-{build}.tar.gz",
"sha256": {
- "aarch64-apple-darwin": "f1a60528b6088ee8b8a34ca0e960998f4f664bed300ec0bbfe9d66ccbda74e50",
- "aarch64-unknown-linux-gnu": "2871cf240bce3c021de829d73da04026febd7a775d1a1a1b37603ec6419fb6c1",
- "ppc64le-unknown-linux-gnu": "2ba44a8e084a4661dbe50c0f0e3cf0a57227c6f1cff13fc2ae2f4d8ceae699fc",
- "riscv64-unknown-linux-gnu": "7a735aebfc8b19a8af1f03e28babaf18a46cf8db0a931343dac1269376a1f693",
- "s390x-unknown-linux-gnu": "27cfc030f782e2683c664e41dcef36051467c98676e133cbef04d4b7155ac4aa",
- "x86_64-apple-darwin": "debd576badb6fdabb793ec9956512102f5a813c837449b1fe007c0af977db36c",
- "x86_64-pc-windows-msvc": "28fbf2026929e00a300466220917c7029a69331700badb34b1691f1a99aa38e3",
- "x86_64-unknown-linux-gnu": "21440e51aee78f3d92faf9375a90713542d8332e83d94c284f8f3d52c58eb5ca",
- "x86_64-unknown-linux-musl": "7a881405a41cb4edf8c0d7c469c2f4759f601bc6f3c47978424a1ab1d0f1fada",
+ "aarch64-apple-darwin": "75c2bcc055088e9d20109910c82960bfe4ec5c1ea481e2176002aad4d7049eab",
+ "aarch64-unknown-linux-gnu": "1925b9aa73cd11633daa01756e32f9c319340c25e5338b151477691e8d99494b",
+ "ppc64le-unknown-linux-gnu": "bf0ebbf8842aff64955ec2d9c8bdc4fef266ffd2a92cff13d2c761e7a0039331",
+ "riscv64-unknown-linux-gnu": "a1623c1a3f4a91e4e022c08a8efb2177195bcdfcf715e1eb1612930324c68e3f",
+ "s390x-unknown-linux-gnu": "39806ac64f2375e1b6e4b0f378d01add441f1d81953629f828224a9b874a640a",
+ "x86_64-apple-darwin": "6565c263f28ae466f1b81cb902ac002bfcad7b1b04863e3576baa6c968dbf83a",
+ "x86_64-pc-windows-msvc": "42a80636326ca998fadb8840de4cb50716f6df63f815a8e71a4c922d3d6c00d0",
+ "x86_64-unknown-linux-gnu": "110ddaca41601b431041db6b4778584f671ca109ca25ef19fe32796026678358",
+ "x86_64-unknown-linux-musl": "c3bdcc5ce8ee357d856b22f6aa72da3126dd400ac9a643e5df91625376efc23a",
},
"strip_prefix": "python",
},
@@ -337,17 +337,17 @@
"strip_prefix": "python",
},
"3.10.18": {
- "url": "20250610/cpython-{python_version}+20250610-{platform}-{build}.tar.gz",
+ "url": "20250612/cpython-{python_version}+20250612-{platform}-{build}.tar.gz",
"sha256": {
- "aarch64-apple-darwin": "a6590f71f670c7d121ac4f068dc83e271cf03309b80b1fa5890ee4875b7b691d",
- "aarch64-unknown-linux-gnu": "b4d7cfb2cb5163da1ae5955ae8b33ac0b356780483d2993099899cf59efaea70",
- "ppc64le-unknown-linux-gnu": "36aeae5cc61ff07c78b061f1b6aac628998a380ad45fadc82b8764185544fd7f",
- "riscv64-unknown-linux-gnu": "2f6dd270598b655db5da5d98d1c43e560f6fb46c67a8fd68ff9b11ee9f6d79ff",
- "s390x-unknown-linux-gnu": "616e56fe69c97a1d0ff13c00f337b2a91c972323c5d9a1828fdfc4d764b440fa",
- "x86_64-apple-darwin": "4d72c1c1dcd2c4fe80055ef1b24fe4146f2de938aea1e3676faf91476f3f17e8",
- "x86_64-pc-windows-msvc": "867b6dbcdb71d8ebb709ff54fbca8ad43d05cc21e5c157f39745c4dc44c1f8e2",
- "x86_64-unknown-linux-gnu": "58f88ed6117078fdbc98976c9bc83b918f1f9c0c2ec21b80a582104f4839861c",
- "x86_64-unknown-linux-musl": "d782c0569d6d7e21a5ed195ad7b41d0af8456b031e0814714d18cdeaa876f262",
+ "aarch64-apple-darwin": "ff6c9dd7172f82064f8d39fd4cd5d6bec77895ccffe480d846ff4a9750d14093",
+ "aarch64-unknown-linux-gnu": "11cc65da5cb3a469bc67b6f91bac5ec00d2070394f462ef8867a4db8d0fc6903",
+ "ppc64le-unknown-linux-gnu": "9fa6a75eb527016b0731faf2c9238dc4958ba85c41806f4c89efa6e12608cf86",
+ "riscv64-unknown-linux-gnu": "723a026f2184b4785a55da22b52ed0c0612f938c28ac6400b314b61e1daf10de",
+ "s390x-unknown-linux-gnu": "c43782f3efe25e0a0c62376643bd1bcdbde05c988aa86cc497df8031d619364a",
+ "x86_64-apple-darwin": "92ecfbfb89e8137cc88cabc2f408d00758d67454d07c1691706d3dcccc8fc446",
+ "x86_64-pc-windows-msvc": "d26dba4ec86f49ecbc6800e55f72691b9873115fa7c00f254f28dc04a03e8c13",
+ "x86_64-unknown-linux-gnu": "c28f5698033f3ba47f0c0f054fcf6b9134ff5082b478663c7c7c25bb7e0c4422",
+ "x86_64-unknown-linux-musl": "1b5c269a5eb04681e475aec673b1783e5f939f37dce305cd2e96eb0df186e9a2",
},
"strip_prefix": "python",
},
@@ -467,17 +467,17 @@
"strip_prefix": "python",
},
"3.11.13": {
- "url": "20250610/cpython-{python_version}+20250610-{platform}-{build}.tar.gz",
+ "url": "20250612/cpython-{python_version}+20250612-{platform}-{build}.tar.gz",
"sha256": {
- "aarch64-apple-darwin": "365037494ba4f53563c22292e49a8e4d0d495bcb6534fca9666bdd1b474abf36",
- "aarch64-unknown-linux-gnu": "a5954f147e87d9bff3d9733ebb3e74fe997eec5b38eaf5cb4429038228962a16",
- "ppc64le-unknown-linux-gnu": "9214126866418f290fda88832fa3e244630f918ebc8a4a9ee15ba922e9c98afd",
- "riscv64-unknown-linux-gnu": "fd99008c3123f50ec2ad407c5c1e17c1a86590daaf88dae8e6f1fd28f099b7c2",
- "s390x-unknown-linux-gnu": "e27ab1fff8bf9e507677252a03ed524c685a8629b56475e26ab6dd0f88465179",
- "x86_64-apple-darwin": "b49044115a545e67d73f5265a613a25da7c9523431281aa7b94691f1013355af",
- "x86_64-pc-windows-msvc": "c0f89e3776211147817d54084fa046e2603571e18ff2ae4a4a8ff84ca4f7defc",
- "x86_64-unknown-linux-gnu": "d93a7699505ee0ac7dec0f09324ffb19a31cce3066a287bb1fe95285ce3ea0c7",
- "x86_64-unknown-linux-musl": "499121bb917e5baeeb954f76bdbce36bb63af579ff1530966ae2280e8d812c5b",
+ "aarch64-apple-darwin": "e272f0baca8f5a3cef29cc9c7418b80d0316553062ad3235205a33992155043c",
+ "aarch64-unknown-linux-gnu": "c6959d0c17fc221a9acc56e4827f3fe7386b610402055950e4b767b3b6871a40",
+ "ppc64le-unknown-linux-gnu": "22ab07e9bd167e2a7852a7b11b31cd91d090f3658e2ffc5bc6428751942cb1b9",
+ "riscv64-unknown-linux-gnu": "4ca57a3e139cf47803909a88f4f3940d9ecfde42d8089a11f42074859bc9a122",
+ "s390x-unknown-linux-gnu": "23cbd87fe9549ddda635ba9fb36b3622b5c939a10a39b25cd8c2587bb65e62ef",
+ "x86_64-apple-darwin": "e2a3e2434ba140615f01ed9328e063076c8282a38c11cab983bdcd5d1bd582da",
+ "x86_64-pc-windows-msvc": "cc28397fa47d28b98e1dc880b98cb061b76c88116b1d6028e04443f7221b30da",
+ "x86_64-unknown-linux-gnu": "4dd2c710a828c8cfff384e0549141016a563a5e153d2819a7225ccc05a1a17c7",
+ "x86_64-unknown-linux-musl": "130c6b55b06c92b7f952271fabedcdcfc06ac4717c133e0985ba27f799ed76b6",
},
"strip_prefix": "python",
},
@@ -590,17 +590,17 @@
"strip_prefix": "python",
},
"3.12.11": {
- "url": "20250610/cpython-{python_version}+20250610-{platform}-{build}.tar.gz",
+ "url": "20250612/cpython-{python_version}+20250612-{platform}-{build}.tar.gz",
"sha256": {
- "aarch64-apple-darwin": "9c5826a93ddc15e8aa08de1e6e65b3ae0d45ea8eb0c2e9547b80ff4121b870ce",
- "aarch64-unknown-linux-gnu": "eb33bc5a87443daf2fd218109df811bc4e4ea5ef9aec4fad75aa55da0258b96f",
- "ppc64le-unknown-linux-gnu": "7b90bc528c5ddf30579dec52926d68fa6d5c90b65e24fc185d5fe283fdf0cbd9",
- "riscv64-unknown-linux-gnu": "0f3103675102e351762a8fe574eae20335552a246a45a006d2a9ca14ce0952f8",
- "s390x-unknown-linux-gnu": "a7ff0432208450ccebd5d328f69b84cc7c25b4af54fbab44803ddb11a2da5028",
- "x86_64-apple-darwin": "199631baa35f3747ddfa2f1e28fc062b97ccd15b94a60c9294d4d129a73c9e53",
- "x86_64-pc-windows-msvc": "e05fa165841c416d60365ca2216cad570f05ae5d3d027b9ad3beaad0529dd8cc",
- "x86_64-unknown-linux-gnu": "77ab3efe5c6637fe8da0fdfbff5de1730c3b824874fe1368917886908b4c517b",
- "x86_64-unknown-linux-musl": "9dd768494c4a34abcec316bc4802e957db98ed283024b527c0c40dfefd08b6fe",
+ "aarch64-apple-darwin": "c6d4843e8af496f034176908ae3384556680284653a4bff45eff07e43fe4ae34",
+ "aarch64-unknown-linux-gnu": "19e8d91b8c5cdb41c485e0d7daa726db6dd64c9a459029f738d5e55ad8da7c6f",
+ "ppc64le-unknown-linux-gnu": "32f489b4142ced7a3b476e25ac91ada4dc8aada1e771718a3aa9a0c818500a45",
+ "riscv64-unknown-linux-gnu": "0c1a3e976a117bf40ce8d75ad4806166e503d554263a9051f7606dbeb01d91ee",
+ "s390x-unknown-linux-gnu": "ee1a8451aaf49af330884553e2850961539b0563404c26241265ab0f0c929001",
+ "x86_64-apple-darwin": "7e3468bde68650fb8f63b663a24c56d0bb3353abd16158939b1de0ad60dab195",
+ "x86_64-pc-windows-msvc": "7b93afa91931dbc37b307a81b8680b30193736b5ef29a44ef6452f702c306e7a",
+ "x86_64-unknown-linux-gnu": "8e8bb0dbc815fb0b3912e0d8fc0a4f4aaac002bfc1f6cb0fcd278f2888f11bcf",
+ "x86_64-unknown-linux-musl": "b7464442265092259ee5f2e258c09cace4958f6b8733cff5e32bf8d2d6556a2a",
},
"strip_prefix": "python",
},
@@ -760,26 +760,67 @@
"x86_64-unknown-linux-gnu-freethreaded": "python/install",
},
},
- "3.14.0b2": {
- "url": "20250610/cpython-{python_version}+20250610-{platform}-{build}.{ext}",
+ "3.13.5": {
+ "url": "20250612/cpython-{python_version}+20250612-{platform}-{build}.{ext}",
"sha256": {
- "aarch64-apple-darwin": "6607351d140e83feb6e11dbde46ab5f99fa9fe039bdbaa12611d26bda0ed9343",
- "aarch64-unknown-linux-gnu": "cc388d567f7c23921e0bef8dcae959dfab9ee24d10aeeb23688b21eac402817f",
- "ppc64le-unknown-linux-gnu": "f9379ecc5dc71f9c58adf03d5524176ec36e1b40c788d29c260df54d09ad351c",
- "riscv64-unknown-linux-gnu": "e6fbe4f7928ec606edee1506752659bf59216fdb208c744d268082ec79b16f42",
- "s390x-unknown-linux-gnu": "1cf32c1173adc1cb70952bb47c92177a196f9e83b7a874f09599682e92ba0010",
- "x86_64-apple-darwin": "a6d8196b174409e0ce67829c4e4ee5005c4be20a2efb41116e0521ad1fa1a717",
- "x86_64-pc-windows-msvc": "0d88ec80c6c3e3ac462368850c19d3930bf2b1a1a5fe89da60c8534d0fac1a01",
- "x86_64-unknown-linux-gnu": "93b29eea5214d19f0420ef8e459b007e15ea58349d60811122c78241fe51cb92",
- "x86_64-unknown-linux-musl": "90e90a58ebff3416eb5a3f93ecb59b6eda945e2b706f5c13b0ba85f6b2bee130",
- "aarch64-apple-darwin-freethreaded": "af0f34aa0dcd02bd3d960a1572a1ed8a17d55b373a22866f05041aaf16f8607d",
- "aarch64-unknown-linux-gnu-freethreaded": "e76c7ab98e1c0f86a6996d1ec775ba8497bf46aa8ffa8c7b0f2e761f37305329",
- "ppc64le-unknown-linux-gnu-freethreaded": "df2ae00827406e247f1aaaec76ffc7963b909c81075fc9940eee1ea9f753dd16",
- "riscv64-unknown-linux-gnu-freethreaded": "09e347cb5f29e0eafd1eba73105ea9d853184b55fbaf4746cebec217430d6db5",
- "s390x-unknown-linux-gnu-freethreaded": "f911605eee0eb7845a69acaf8bfb2e1811c76e9a5e3980d97fae93135df4b773",
- "x86_64-apple-darwin-freethreaded": "dd27d519cf2a04917cb566366d6539477791d1b2f1fb42037d9179f469ff55a9",
- "x86_64-pc-windows-msvc-freethreaded": "da966a17e434094d8f10b719d93c782d82eaf5207f2843cbaa58c3d91a8f0e32",
- "x86_64-unknown-linux-gnu-freethreaded": "abd60d3a302e9d9c32ec78581fb3a9903079c56ec7a949ce658a7950423f350a",
+ "aarch64-apple-darwin": "d7867270b8c7be69ec26a351afb6bf24802b1cd9818e8426bd69d439a619bf2d",
+ "aarch64-unknown-linux-gnu": "685971ded0af96d1685941243ae1853c70c482b6f858dd86818760776d9c3cb9",
+ "ppc64le-unknown-linux-gnu": "ee15fcf2b64034dba13127aa37992edacf2efe1b2bb3d62ffd45eb9bea7b2d83",
+ "riscv64-unknown-linux-gnu": "c0f160ef9ab39c0f0e5baa00b1ecc3fff322c4ccbf1f04646c74559274ad5fc1",
+ "s390x-unknown-linux-gnu": "49131a3d16c13aea76f9ef5ce57fc612a3062fc866f6fcf971e0de8f8a9b8a8f",
+ "x86_64-apple-darwin": "d881b0226f1bef59b480c713126c54430a93ea21e5b39394c66927a412dd9907",
+ "x86_64-pc-windows-msvc": "8f4d4c7d270406be1f8f93b9fd2fd13951e4da274ba59d170f411a20cb1725b3",
+ "x86_64-unknown-linux-gnu": "f50dc28cfe99eccdadd4e74c2384607f7d5f50fc47447a39a4e24a793c07a9eb",
+ "x86_64-unknown-linux-musl": "c4bc1cda684320455d41e56980adbacbda269c78527f3ee926711d5d0ff33834",
+ "aarch64-apple-darwin-freethreaded": "a29cb4ef8adcd343e0f5bc5c4371cbc859fc7ce6d8f1a3c8d0cd7e44c4b9b866",
+ "aarch64-unknown-linux-gnu-freethreaded": "0ef13d13e16b4e58f167694940c6db54591db50bbc7ba61be6901ed5a69ad27b",
+ "ppc64le-unknown-linux-gnu-freethreaded": "66545ad4b09385750529ef09a665fc0b0ce698f984df106d7b167e3f7d59eace",
+ "riscv64-unknown-linux-gnu-freethreaded": "a82a741abefa7db61b2aeef36426bd56da5c69dc9dac105d68fba7fe658943ca",
+ "s390x-unknown-linux-gnu-freethreaded": "403c5758428013d5aa472841294c7b6ec91a572bb7123d02b7f1de24af4b0e13",
+ "x86_64-apple-darwin-freethreaded": "52aeb1b4073fa3f180d74a0712ceabc86dd2b40be499599e2e170948fb22acde",
+ "x86_64-pc-windows-msvc-freethreaded": "9da2f02d81597340163174ee91d91a8733dad2af53fc1b7c79ecc45a739a89d5",
+ "x86_64-unknown-linux-gnu-freethreaded": "33fdd6c42258cdf0402297d9e06842b53d9413d70849cee61755b9b5fb619836",
+ },
+ "strip_prefix": {
+ "aarch64-apple-darwin": "python",
+ "aarch64-unknown-linux-gnu": "python",
+ "ppc64le-unknown-linux-gnu": "python",
+ "s390x-unknown-linux-gnu": "python",
+ "riscv64-unknown-linux-gnu": "python",
+ "x86_64-apple-darwin": "python",
+ "x86_64-pc-windows-msvc": "python",
+ "x86_64-unknown-linux-gnu": "python",
+ "x86_64-unknown-linux-musl": "python",
+ "aarch64-apple-darwin-freethreaded": "python/install",
+ "aarch64-unknown-linux-gnu-freethreaded": "python/install",
+ "ppc64le-unknown-linux-gnu-freethreaded": "python/install",
+ "riscv64-unknown-linux-gnu-freethreaded": "python/install",
+ "s390x-unknown-linux-gnu-freethreaded": "python/install",
+ "x86_64-apple-darwin-freethreaded": "python/install",
+ "x86_64-pc-windows-msvc-freethreaded": "python/install",
+ "x86_64-unknown-linux-gnu-freethreaded": "python/install",
+ },
+ },
+ "3.14.0b2": {
+ "url": "20250612/cpython-{python_version}+20250612-{platform}-{build}.{ext}",
+ "sha256": {
+ "aarch64-apple-darwin": "35c02e465af605eafd29d5931daadce724eeb8a3e7cc7156ac046991cb24f1c1",
+ "aarch64-unknown-linux-gnu": "8c877a1b50eb2a9b34ddac5d52d50867f11ddc817f257eba4cbbc999a9edf2ea",
+ "ppc64le-unknown-linux-gnu": "735bad9359eb36b55b76d9c6db122fe4357951d7850324c76e168055ca70e0a0",
+ "riscv64-unknown-linux-gnu": "d4140196c052ba5832a439f84f6ca5b136bb16bceb8c5a52f5167a2c3f8b73b1",
+ "s390x-unknown-linux-gnu": "2f440257e02d0a4fb4e93fcbb95b9066ec42bd56a2f03de05f55636e5afcb4b9",
+ "x86_64-apple-darwin": "5144890b991e63fb73e2714c162c901c3b6f289ae0ef742df3673ab9824c844a",
+ "x86_64-pc-windows-msvc": "903cfb0ae1766a572dcf62835ef24d3250a512974dcf785738ac0d6c06c9db5b",
+ "x86_64-unknown-linux-gnu": "1c73b90a8febbd36fc973d7361a1be562e88437d95570721b701f03e59835600",
+ "x86_64-unknown-linux-musl": "9cdd3983abfca2151661c25cb0fae50a30c8961e07d07ba643edab5be277ae09",
+ "aarch64-apple-darwin-freethreaded": "1ae31adfed2a8425f08a945869d3bfd910e97acd150465de257d3ae3da37dc7c",
+ "aarch64-unknown-linux-gnu-freethreaded": "f5fcf5e8310244ccd346aab2abdc2650ffb900a429cfb732c4884e238cba1782",
+ "ppc64le-unknown-linux-gnu-freethreaded": "c1177510c359494b6a70601d9c810cdfc662f834c1d686abd487eb89d7a577ef",
+ "riscv64-unknown-linux-gnu-freethreaded": "cb0f2d86b20f47c70a9c8647b01a35ab7d53cbcbde9ab89ffc8aacafb36cc2e4",
+ "s390x-unknown-linux-gnu-freethreaded": "f38f126b31a55f37829ee581979214a6d2ac8a985ed7915b42c99d52af329d9f",
+ "x86_64-apple-darwin-freethreaded": "4e022b8b7a1b2986aa5780fae34b5a89a1ac5ed11bea0c3349e674a6cb7e31c1",
+ "x86_64-pc-windows-msvc-freethreaded": "35abc125304ec81a7be0d7ac54f515e7addd7dcba912882210d37720eaab1d7e",
+ "x86_64-unknown-linux-gnu-freethreaded": "61383d43f639533a5105abad376bc497cc94dde8a1ed294f523d534c8cd99a8e",
},
"strip_prefix": {
"aarch64-apple-darwin": "python",
@@ -810,7 +851,7 @@
"3.10": "3.10.18",
"3.11": "3.11.13",
"3.12": "3.12.11",
- "3.13": "3.13.4",
+ "3.13": "3.13.5",
"3.14": "3.14.0b2",
}
diff --git a/tests/python/python_tests.bzl b/tests/python/python_tests.bzl
index f0dc482..106cff2 100644
--- a/tests/python/python_tests.bzl
+++ b/tests/python/python_tests.bzl
@@ -325,7 +325,7 @@
"3.10": "3.10.18",
"3.11": "3.11.13",
"3.12": "3.12.11",
- "3.13": "3.13.4",
+ "3.13": "3.13.5",
"3.14": "3.14.0b2",
"3.8": "3.8.20",
"3.9": "3.9.23",
