Repository navigation
Support Python 3.15 #306
Description
Look through the change log of Python 3.15 (once the first release candidate version is released end of July 2026 (see https://peps.python.org/pep-0790/) for potential issues which need to be handled by RestrictedPython to prevent access to otherwise forbidden data/objects.
There is no need to support new language features of Python 3.15 right now, let's see how they evolve after they can be used,
Open tasks:
- make package installable and fix tests
- Change log:
Allow to use the package with Python 3.15 -- Caution: No security audit has been done so far. - cut an alpha dev release
- security audit after rc1 Python release (detailed instructions)
- Prepare for a new Python version after its rc1 release (detailed instructions)
- Create a copy of this ticket for Python 3.16 (first alpha is expected to land late 2026)
Activity
icemac commentedon Aug 18, 2026
The security audit of the Python 3.15 changes (based on 3.15.0rc1) is done; the result is in PR #328. Full rationale:
docs/contributing/changes_from314to315.rst.Findings requiring action:
is_lazyfield onImport/ImportFrom, so the default-denygeneric_visitdid not catch them. At run time they resolve through the new__lazy_import__builtin instead of__import__, bypassing a guarded__import__. → now explicitly disallowed.Starrednode resp. aDictCompwithout value) and fully executed when guards are provided. The unpacked value is iterated without calling_getiter_, unlike the equivalent nested comprehension. → now explicitly disallowed.INSPECT_ATTRIBUTESfor the new 3.15 attributes revealed that the async-generator attributesag_await/ag_frame/ag_codewere missing entirely → now blocked. The newgi_state/cr_state/ag_stateattributes only return state strings and stay accessible (likegi_running).Checked, no action needed: unary
+inmatchpatterns (matchis denied anyway); new builtinsfrozendict/sentinel(allow-list); removedast.Num/Str/Bytes/NameConstant/Ellipsis(unused);compile()/ast.parse()moduleparameter.Remaining after the 3.15.0 final release (October 2026): drop
pip_pre = py315: truefromtox.iniand move the sdist/wheel build job intests.ymlfrompy314topy315.— Comment created by Claude
Security audit of the Python 3.15 changes (#328)
icemac commentedon Aug 19, 2026
Released in https://pypi.org/project/RestrictedPython/8.5/