GeezerVison is showing github.com — Release 2026-04 follow-up · Issue #2085 · winpython/winpython
Release 2026-04 follow-up #2085DescriptionDate: end October 2026
wanted:
- security based release:
- python 3.15.2, 3.14.10, 3.13.18
- wppm -sa : security-audit, check your current packages version with security alerts posted
- as said "uv" Charlie Marsh, AI implies unsafe memory langages must die very quickly
- WinPython-3.15 slim is with:
- 90% of packages
- but not jupyterlab: pyyaml and h5py strained maintainers
- speeding-up with AI:
- simplify the monitoring process of new packages versions
- automate to improve security of the publishing process
- usefull "Local AI" level: jupyter-ai
- WinPython-3.10.14slim_post1 re-spin is to provide a more compressed -mx9 version, back below 650 MB of virustotal.com (nothing else changed)
remark:
- october 20-26th 2026 security shows the model of fire & forget has a weakness:
- using only wheels protects the emiter
- so adding the wppm -sa / --audit option for any users to check himself easily
- maybe some patch releases of pylock.toml shall exist per version
- free-threading maturity > python-3.15 : PEP-805-safe-parallel-python
- JIT maturity > python-3.15: PEP 836 – JIT Go Brrr
- Local AI hypothesis:
- Q4 2026 for MainStream Laptops,
- Q2 2027 for Most Laptops
- OpenAI / Microsoft / Meta / Google ... do love Python, the Python community is blessed to have these supporters
Activitystonebig commented on Aug 16, 2026 ContributorAuthor More actions Audit-trail:
- HouseKeeping and re-organization with Claude before new cycle:
- removes "--pre" as a default build option
- by default, only build on wheels
- switch to new build_winpython_cycle.yml cloud workflow
- get package version assistance from Claude (check_updates.py):
- spyder-6.1.6 indirectly requires autopep-2.0.4 via python-lsp-server[all] ... signaling it's old
- mistralai[workflow-payload-encryption] limits to cryptography-47.0.4 ... removing mistralai
- httpie is help-essly flawed and un-maintained: removing
- updating to pass security advisory: pyjwt, pygments, nbconvert, gitpython, mako, pypdf, joserfc, soupsieve, bleach, yt-dlp, asteval, ujson, pydantic-settings, mistune, nltk, pyasn1, aiphttp, h2, sqlparse
- wtf: did put cython-3.3.0a1 in release of last cycle, was intended only for 3.15... so ''--pre" removal will avoid it next time
- reduce manual preparation work
- 80 packages upgrades
- security check: tornado-6.5.8, pypdf-6.16.2
- Python-3.15.0rc2 (2026-09-01)
- remark: AI is essential for security defense, nowodays
- remark: reading that new AI-dev oriented Windows 11 will pre-install python-3.14
- Claude taking a stab at simplifying the Cloud run+publishing (simpler than Riemann hypothesis, so I believe in you):
- an option "all" in build_winpython_cycle.yml to launch all builds at once
- publish direct from the workflow (to github): now 30 minutes from click to "draft" published on github
- automate the changelog
- as part of security enforcement, slimf version is not built until tornado publishes a free-threading compatible wheel
- AI summary:
- Claude did miss one cloud CI fail, had to notice
- Claude automating things makes things less pretty, but automation is a must, may tweak after living the result
b1 (2026-09-07)
- remark: Python at 52% tutorial marketshare on pypl.github.io as of early september 2026
- Claude proposed something not pertinent, asked to revert with explanation ... may help AI get your taste, and your brain to stay a brain
- python-3.15 arrivals:
- scikit-learn-1.9.1, numba-0.68.0rc1, matplotlib-3.11.2 , 61% coverage
- scipy-1.8.1
- pandas-3.0.6, statsmodels-0.15.0, plotnine-0.15.8, aiofile-3.11.1, 71% coverage
- all other small ones:
- 3.15 slim at 78% coverage,
- 3.15 slimf at 71% coverage
- datasette-0.65.5 security fix
- httpx2-2.11.0 security fix
- gitpython-3.1.62 security fix
- pydantic-2.14.0b2, so ok for python-3.15 and 3.15t
- remark: still no jupyterlab possible on 3.15 (pywinpty)... but numba rc, the historic bottleneck, is this time 3 weeks ahead of release
b2 (2026-09-27: 78% of a python-3.15 slim)
- markupsafe-3.0.4 for python-3.15 and 3.15f
- numba-0.68.0 for python-3.15
- include missing upgrade packages
- 3.15 slim at 82% coverage,
- 3.15 slimf at 74% coverage
- Python-3.15.0rc3 (2026-10-01)
- remark: Python at 53.9% tutorial marketshare on pypl.github.io ... It may reflect now the % of code read by eyes
- remark: jupyterlab is a concern for Python on windows, as pywinpty maintainer has disappeared from github
- remark: python-3.15.0 will be the first version with numba available at launch day, previously it was the last package made available
- remark: about 7 packages update for security fix
- remark: mistral-vibe with it's strict (and old) dependancies version is an examlpe of what can't go in winpython
- remark; jupyter-ai is more flexible... but may need nodejs for most clients
b3 (2026-10-04: python-3.15 slim at 82% of Python-3.14 slim)
- httptools-0.9.0, pyarrow-26.0.0, streamlit-1.59.1 for python-3.15
- pydantic-2.14.0
- polars-2.0.0
- aiohttp for 3.15
- python-3.15.0 final
- include missing upgrade packages
- 3.15 slim at 87% coverage,
- 3.15 slimf at 77% coverage
- Qt stack but missing h5py, so spyder and plotpy
- include missing upgrade packages
- 3.15 slim at 90% coverage,
- 3.15 slimf at 77% coverage
- security: langgraph-sdk-0.4.4, multidict-6.9.1, werkzeug-3.1.9
- simplify a little maintenance: pushing pylock and requirements to cloud
- jupyter-ai (for slim)
b4 (2026-10-11: python-3.15 slim at 90% of Python-3.14 slim: qt stack, yet no spyder nor jupyterlab)
- pywinpty-3.1.0 for python-3.15.0 (2026-10-15)
- tornado-6.6rc1 for python -3.15t
- 2026-10-26 security:
- nltk removed: too slow to fix a ceuity and now sha-256 of pip and of github do contradict for nltk-3.10.4
- brotli removed: too slow, then a security fix
- python-3.15.2, python-3.14.10, python-3.13.18 , do secure the certificate issue
pip-26.2.3 (as pip-26.2.2 certifi-2026-10-20 said too nuclear)
- duckdb-2.0.0
- PyYAML-7.0.0 for python-3.15 jupyterlab is blocking 46 packages. will bring 3.15 slim straight to 97%
- remark: intresting in these more costly disk times: polars free-threading is bloked per a GB space limie on pypi Project Limit Request: polars-runtime-compat - 50 GB pypi/support#11990
- polars-2.1 handles recursive CTE (when no truly recursive CTE ?)
- morning fix to wppm: wppm-17.13.20261027
- re-spin to be package security-alert free on release... also it doesn't stay that long nowodays
- remark: with pip-26.2.2, local build is now 10% faster
- include wppm -sa : security-audit, gives packages version with security alerts posted
- wppm-17.14.20261027, with wppm -sa self audit feature... the most important thing of this cycle.
- Aaaaaaaaargh: between each local build run, security alerts are poping-up, learning osv.dev (ran by google team) is not particularly more active
- Aaaaaaaaa: another alert, 1 hour later, so before one cycle.. it starts to be long in the tooth
rc (2026-10-2x)
- postponed next cycle:
- h5py for python-3.15 for python-3.15 plotpy and keras , 3 packages
- scikit-image-0.27.0 for python-3.15 (october 27th for a rc1... )
- polars for 3.15t not yet there... surely next weeks
- SIMPLIFY: wppm.piptree easier to use in jupyterlite ?
- adjust further Distribution size ?
- an opencv torch ultralytic thing ?
stonebig commented on Sep 6, 2026 ContributorAuthor More actions WinPython 2026-04 (2026-09-07)
Changes from WinPython 2026-04:
- Infrastructure:
- SIMPLIFY the check for packages in need of security fix, mature upgrade, new version, blocked
- SECURITY drop non-wheel package: tornado for free-threading
- python-3.15.0rc2
- SIMPLIFY publication: build all versions in one "build_winpython_cycle.yml" step, to publish automaticaly on github
- New Packages:
- rfc3987-syntax, lark from jsonschema[format-nongpl]
- Upgraded Packages:
- jupyterlab-4.6.3, cython-3.2.9, scipy-1.18.1
- and 70 other packages
- Removed Packages:
- mistralai
- no slimf (python free-threading) till a tornado wheel
- Differences among builds:
Built and published directly on a github tag via Github Actions:
Binaries at:
Next build: b2
- automate and simplify further
- larger 3.15 slim
| MD5 |
SHA-1 |
SHA-256 |
Binary |
Size |
blake2b-256 |
| 430faa12fa929eacaf9868cbce3d64d9 |
07fea4652db1691542a2925c833e3842d2d34644 |
45e7bd15541fdb2bb58ffb5422a8e475fa153ebea69ff9aa6535eea32f60b015 |
WinPython64-3.13.15.1dotb1.exe |
16 919 571 Bytes |
502120beb76c72a28dca25193a02e3c682eec46d1c5c423f2c1ba4c965f88fdb |
| 933dde9c81b24fa17e6e30cefabdad95 |
4fb442bddf3948b9e25ce732b79a0b50e89427c7 |
16dfd808265848b8f25dfd3ccc1303a4f7a97cb10b7445310d2e6143d172d264 |
WinPython64-3.13.15.1dotb1.zip |
28 168 602 Bytes |
a26e528d39d4599928938bff2725ac002218edf08a55f479e6451863a3ed45ba |
| 6ad3ad79b9d01a03dc82e5af29644d09 |
1596b055e84aed0c48d62be5624a20bf75b32a3c |
36a77b9ad390256f86ea326236080aff43b0fdb959ca62c3b40dabb393b873ca |
WinPython64-3.13.15.1slimb1.7z |
667 336 194 Bytes |
eb1daa370c58158284a71291646deb5743fe3b937df6c15698ae2080e286f8da |
| ab5dcf794965ff93e6689f02144c0350 |
5f43d286488806d77bd4d176b11e31787d850f75 |
0419d8f5cef34add65d72c69b038e84a59c6ceca2b787664c666fdeb0dc42dcd |
WinPython64-3.13.15.1slimb1.exe |
667 552 486 Bytes |
6107e1d4b75352f7b26ae825a207c47390730b796d50afd2bda6e79767c98025 |
| e20d30bfd8139ce42843267b41336a50 |
b5b1a1247b3963472ad98b614efaec0a81be4dc5 |
033af848fd1ec0d5085a4435dc510f24a3f2b52b2294a80c8ca0be340e1004b2 |
WinPython64-3.14.7.1dotb1.exe |
18 033 292 Bytes |
c3b0f087228649630d8185ce3e50bfcfb5df898fbc2722294905608621b39f4c |
| 3583bb0f40bfe37842ef61a37bbe76b1 |
bd77e4359d3fdf1d7e53234507a3fc1b5746e3c6 |
1116cded18ca8c4caf44fab3815ee90cace866ee348768a9a3ddffa3d9eb9de2 |
WinPython64-3.14.7.1dotb1.zip |
28 666 890 Bytes |
345b1c946b7c896cc60d4692e309b37f4a8632bc3077f2be9109b4be89316f9a |
| ecaa0fa0f772691dbae054c8ed4f3c05 |
d910b97e2e2339d57013313f7f4dd6190f0b4f73 |
c23b5b00f5348d67448d1be32ef0de32b8e4dc831ed1e864337c7290f80977d0 |
WinPython64-3.14.7.1dotfb1.exe |
18 110 256 Bytes |
f1ab93c26b2e721fb83b2c6bc00f720e9e0729cc46ea324048ca21de6e7b4cca |
| 6250b1f57c191e4a259e5cd78220ebbc |
54bce3c21d7b33f1fe51bee27704c0af175e712a |
d9be9888c1e73a048efb15162ec22009dec533d16c7a224948db8657ab867cd3 |
WinPython64-3.14.7.1dotfb1.zip |
28 891 612 Bytes |
acd2aa40668fcc35905499f76be40b316d737464a128e6a68131efc024e02384 |
| bf67a294c104c4828c3770fb89fd7df1 |
4512fc7bac284c7a97b6576cce9a61d50da87c1a |
2b20f19ae7ddc072461bd34473aeea201b16ff1e127768b84d4fd27c96671d39 |
WinPython64-3.14.7.1slimb1.7z |
672 525 665 Bytes |
4e56ce31de0a65f2478a4f2afab09b6e6384d616ef4a9a5c2f91953b0433ae8f |
| 29f89fcb9266febc817684ea55987a13 |
c62f19340ea3394b48eced71b2773ad57094f750 |
14ef0e3bd40404bdbb7d0ff9edac472a14d8d3227746132549e44522d9d1558f |
WinPython64-3.14.7.1slimb1.exe |
672 744 315 Bytes |
c43b9ea973c2e3164b05f3605de3d863158828a0ae0e28c32f4a8c223ba95b12 |
| c62c9ce10fef326307592ececba9ba86 |
2620b29acca7bdda321f5f89e9379158961a2dfc |
afda16453238217e7b008a1ee473df4e5050989d792f2e6b16db2b3324e05b6e |
WinPython64-3.14.7.1slimfb1.7z |
432 086 571 Bytes |
abe7f853d9029931827233d10b62d25be2a0db87e7df88cc13db2ed59e4255cc |
| ff90ead96caa74d76229d51de78272a9 |
eb891e6221ad5c2e29a2caf17d581d9017ae692e |
745ac81fb52a5f7e4f5063c64a103df9185269d68ddb89d5570de0546d599149 |
WinPython64-3.14.7.1slimfb1.exe |
432 302 734 Bytes |
01843032acc8a95c1cf65fc0d7601af5ea5edef6bc078392234bf070c79416da |
| 88facd0ec8d0857721981d47edceede9 |
b9d3d43886183cdd6d824c2921f7cbc3c8ea9494 |
a7a2b048c60fd568ccd090be1ad4b05efc4f2df677fadd8f8c214b6ca5eb6383 |
WinPython64-3.15.0.5dotb1.exe |
18 835 124 Bytes |
fe27e1b08701b856fe1603f2344108ba019b5e1d23a9b7c21a91f52dc405cecc |
| b32786764ab8d99811314e43a0379a4f |
3eefa2f1b9715568cc0a55533e29bdb0c5df3f48 |
f8f5bd99d28180d5a1969ab8e7595425695c64b88383f32a94c718b76b3e6ccc |
WinPython64-3.15.0.5dotb1.zip |
29 873 249 Bytes |
93a071597f11a73f32bfff55c0eebc11c1e88edc38f6f4bed12d6861fd974ebc |
| 714dd924b8cc30edff5991370b6dea07 |
79fb16ce508f45f2f20f54ba66cd26c9b0ed5db1 |
1b8653e7a0028a067a657c6b1a6489f5e10a375ce5a0c68c6f408102f744a2e5 |
WinPython64-3.15.0.5dotfb1.exe |
18 869 142 Bytes |
550d093d01529b805f9a5267cdee8f4147fa711a9fdd218a849d4515fcaacec3 |
| 8e6a79f66a2d3cff4dddcebdebd57044 |
18092c8580abc64e40c3c59abe9628b55d5b3819 |
08dfa882a4ed089774bb7366489520550c08c432d40daf85574c03bc5b7199c4 |
WinPython64-3.15.0.5dotfb1.zip |
29 975 740 Bytes |
cf134caf42342f930d70965ef135b4e72ba223d0f00eb01e3fd14678b67b54e9 |
| a0d7fd21d2c11676980c9fee47f7a13d |
d3e6bb148f9f30aaf05f25aa7b9ee1de67777853 |
732da78395096b9218b426e746c6750fb809ddc318984b63d226c0dc421b18ee |
WinPython64-3.15.0.5slimb1.7z |
265 114 289 Bytes |
e44fe1b42f0cfa1891e8365de22640897bfc0d05c73c145a13fb8f7f60815a5f |
| 9728c4088b3a773c4003130e96677ef9 |
a5baeace656613fb7e6af09fba92a1fac0e87000 |
f46c31476edf53f2ca7264d4919dea70f0a7d7ff62eb0ca6c7ebc48a5b3f45b9 |
WinPython64-3.15.0.5slimb1.exe |
265 329 895 Bytes |
56fcb4994332f6cc24d19413735f7602ed378a46d8f07823257b76eb8516a347 |
stonebig commented on Sep 27, 2026 ContributorAuthor More actions WinPython 2026-04 b2 (2026-09-27)
Changes from WinPython 2026-04 b1:
- Infrastructure:
- only wheels, but specific beta wheels for 3.15: pydantic-2.14.0b2, numba-0.68.0rc1, llvmlite-0.50.0rc3
- python-3.15.0 slim and slimf: slim at 78% of usual packages (missing jupyterlab and qt stack)
- New Packages:
- Upgraded Packages:
- Removed Packages:
- tornado-6.6a1 wheels now exists for python free-threading
- Differences among builds:
- slimf (free-threading) are missing Qt
- python-3.15 is missing jupyterlab (because of markupsafe, pyyaml, pywinpty)
Built and published directly on a github tag via Github Actions:
Binaries at:
Next build: b3
- numba official
- hope of unlocking news for markupsafe, pyyaml, pywinpty
- what-to-do about spyder/python-3.15
stonebig commented on Oct 4, 2026 ContributorAuthor More actions WinPython 2026-04 b3 (2026-10-04)
Changes from WinPython 2026-04 b2:
- Infrastructure:
- still one specific beta wheels for 3.15: pydantic-2.14.0b2
- python-3.15.0 slim and slimf progress: slim at 82% of usual packages (missing jupyterlab and qt stack)
- New Packages:
- Upgraded Packages:
- Removed Packages:
- Differences among builds:
- slimf (free-threading) are missing Qt
- python-3.15 is missing jupyterlab (because of pyyaml, pywinpty)
Built and published directly on a github tag via Github Actions:
Binaries at:
Next build: rc
- a workaround for pyyaml and pywnpty, so jupyterlab can be on python-3.15 ?
- python-3.15 slim reaching 88% of packages would be a grand success.
- may shift by 1 week to get jupyterlab: spyder or jupyterlab, one must be on board
stonebig commented on Oct 11, 2026 ContributorAuthor More actions WinPython 2026-04 b4 (2026-10-11)
Changes from WinPython 2026-04 b3:
- Infrastructure:
- python-3.15.0 final
- python-3.15.0 slim at 90% of usual packages (missing jupyterlab and spyder)
- New Packages:
- Upgraded Packages:
- Removed Packages:
- Differences among builds:
- slimf (free-threading) are missing Qt
- python-3.15 is missing jupyterlab (because of pyyaml, pywinpty)
Built and published directly on a github tag via Github Actions:
Binaries at:
Next build: final
- pyyaml for python-3.15, tornado-6.6 final
- shifted by 1 week hoping to get spyder or jupyterlab on 3.15, one must be on board
- hoping to get python-3.15.0 slim at 92%
stonebig commented on Oct 27, 2026 ContributorAuthor More actions WinPython 2026-04 final (2026-10-27)
WinPython 2026-04 is the result of 2 month of work to :
- keep packaging updated and improve overal security,
- to push Python-3.15 support,
- to simplify maintenance.
Changes from WinPython 2026-04 b4:
- Infrastructure:
- SECURITY: python-3.15.2, python-3.14.10, python-3.13.8
- SECURITY: pip-26.2.2, certifi-2026.10.23
- SECURITY: wppm -sa / --audit gives users the everyday security bulletin on their current packages version
- just released version shall be wppm -sa alert-free
- simplified local build.
- New Packages:
- Upgraded Packages:
- all security alert fixed ... at the moment of build
- Removed Packages:
- nltk: don't keep slow-on-security packages
- Differences among builds:
- slimf (free-threading) are missing Qt
- python-3.15 is only 90% complete: missing jupyterlab (because of pyyaml)
- jupyter-ai only in 3.13 and 3.14 slim
Built and published directly on a github tag via Github Actions:
Next cycle:
- jupyterlab for python-3.15 on Windows
- improve user security: automatic post-security release of pylock.toml ?
- in the mean time, you can enjoy security alerts per a mere
wppm -sa
| MD5 |
SHA-1 |
SHA-256 |
Binary |
Size |
blake2b-256 |
| 66e3c45e67645c7486e16c922aa18d2b |
ae50dcd112307c3a42fbb0d225a038f44890da40 |
25589c5dc41dbce7154f0815ab438833948310cbeb1d12ba906117fae7d224a9 |
WinPython64-3.13.18.0dot.exe |
16 739 371 Bytes |
be24c42ee806576140fc554d81362d7ee8be44756275254bc93dc0ad0939dc4d |
| ac27b4cf65a839cfcf56c789e6caf707 |
8f0d9fb3a3fd754748c793e370da495ebc366313 |
50c4f17809457e411c2db30959c8fb25a958ff3a6f624080044992809509bc37 |
WinPython64-3.13.18.0dot.zip |
27 838 192 Bytes |
ed1348c1001951d3ec3e4c213dc1f4ee3fb245350b191fd01d4c81bd217167c0 |
| 33c3dc2656fbfa7c030168b0d797fd8b |
e714150a7917c5f8dbd480589d1674bd53b5932c |
41708849c273cb053ec676294aaed39fd385cff6c100164b6226f55e38b011b9 |
WinPython64-3.13.18.0slim.7z |
673 534 389 Bytes |
585bcc3758c85723bfb40f30e5524a95b98a9dc944951de8bed8785e0fd2a605 |
| 10bbf9cbac67c7a362478faa248d29e2 |
9b8dcb388f38d687cfb7b5a26cf21310ae8308a2 |
a47a3a5a68635930085ccc3841658633c3ac851081873bdc48341527a61f11ab |
WinPython64-3.13.18.0slim.exe |
673 750 232 Bytes |
a0cf43073ce9cbb27b58083c836151f6f91c4023bf6841604a5e8678495d9dbc |
| 2f56e3f6f279b1574124b492d312c677 |
04f0cb408f941e253c31f0d37992fe6ddf0b14c1 |
27b7400ea21faf4530384381d26f0a379c758e445e05c504c0e3dd52330e9871 |
WinPython64-3.14.10.0dot.exe |
18 248 659 Bytes |
126eefda8f1774c967dc6df0db318defcbf79f7368ca4226b833ddf9a7f700c3 |
| f0c3f6c062721300c769982e4d46674a |
9825516726dfb06e0657a42871b34fe87096d83e |
9f54ca38f54b4ce8213925af4d7cf5b13cef724b2853408e010e5ee44e0bcc54 |
WinPython64-3.14.10.0dot.zip |
28 829 421 Bytes |
2487bd3159e5365fd93971dd4b8444a82108f1b97bb82b7a6e3713bcc28cd144 |
| e22509bda496b5f71b050c6abc5a3a6d |
a85b18462479af44ea8b2be33c5c1c106b0beea5 |
87a880d4c476b63ffaa22bf59de5f2b5b211adc6e6d5e57ca94c6f0a25c840d0 |
WinPython64-3.14.10.0dotf.exe |
18 332 072 Bytes |
851b0217eef81682ae068aff4694265579d60c47d11c473f57649aa2e934d6e2 |
| 0cb972e0fc8f4bfb55e81a46aed05c7f |
49124fea27d46230c9a78b20f8d3a5c785f05e38 |
9c63dacae921ef8250704d910c9d04bfacf37e962c52b13e5737fc3695ec1132 |
WinPython64-3.14.10.0dotf.zip |
29 066 048 Bytes |
01332b59efd04466acc8ca5b1db14462a923425b240755ebb73189d2d0773d37 |
| a130fa33164991a66882f3976be78319 |
169908b34c644868985b39f77429b8db8c1aa6ef |
0188dfddeaea19a42ddd6e41ac22711b8790364eed7990f0d6c38ee586838cd0 |
WinPython64-3.14.10.0slim.7z |
682 187 410 Bytes |
195b715282ae6dd61e57ae49119805a2b74d07fce1eb293c9d7e23b121665fc2 |
| 739ebce1a0376877633314d66088412e |
ae55a85589fd8b19804bb9e31641cb418558313d |
d164a73c9f3e202a9d78e819ea4cadf7d75db0fc719a502cf4eb49bfc0293c31 |
WinPython64-3.14.10.0slim.exe |
682 403 379 Bytes |
56ba100aebd6c818c80cda7b51407a803352f7a587991e01ca0f4a114c69a2c2 |
| f7228cfd12fbe54558675b6832ca50a7 |
acdeee5fc3aed1805de156eb093c4bb7f4dbdb0b |
e86c9a83b286689ceb121e799e2be2033f4454b41e6e17b7a23331285301c670 |
WinPython64-3.14.10.0slimf.7z |
431 609 058 Bytes |
41cb2fb15cfe7b4ff969bd933e0bc00afd7318ea7c7245e8665795a1a4096753 |
| ef3f86795f0566ed64c3eaed9276a8b0 |
03ae88438ce1e0415dd3ad75af0e1afd0676b596 |
f6642d708da42974ecfdcf0e6e71f033f2b60eb42c2779f0f7b4a5b93930cf7c |
WinPython64-3.14.10.0slimf.exe |
431 824 652 Bytes |
97c60eefd7e69e54a24a0e313daf9a39ace0fbde4212f6f76ed23a97ced1b803 |
| f094e1778957744edbbcbf0a652dc7cf |
ecca0932fded05b57cc74e4e55361ce924516aed |
b1f27e22b795c902087f28d1f716a484fb59f9452fe40844b54d81fdb7680d39 |
WinPython64-3.15.2.0dot.exe |
19 031 887 Bytes |
b34c64a950a9edd654d7249fe5e37a43f659c1b28dd4a927f3f92a78b5f9741d |
| 9baed0dd1e9a456a954e552bc4f5a63d |
9b59c0f2ec378a5dc3415becc7a3fb4d8f388fba |
6728ce28222d8d585a5984746768f7d37b0e17bac88de0fd7e4207c2656e680f |
WinPython64-3.15.2.0dot.zip |
29 982 984 Bytes |
0cd89f10be83c8779cb7908b682a79d6a7c58b28e5585a14d3d621e415db3158 |
| e6728377e0975772b5a2b9f56ccb382b |
0e4b70be5c0411e0f6ef16567c20d45ddf0864aa |
042be98592bf0446ec257c490814d915edd8f9987c8a63879582715f18fc7d50 |
WinPython64-3.15.2.0dotf.exe |
19 072 621 Bytes |
93f8e9512d61e9170b4244ef8cf8f1fd416d4cc8867717474d438cc6775cfa0b |
| d3741a096891708c75b12911985ae949 |
6f2c3fd6d0fd82dfe3ab8bc0e65a9b6c896a5bd9 |
ebef1c113244d49f429db66454c57bb0a7538deb4eb0c647e220319e8379e619 |
WinPython64-3.15.2.0dotf.zip |
30 103 590 Bytes |
8a31524e04c6626a336a702e19bec2c122b1b90be5c99ba02753ff82739242cf |
| 648023f2153086fe0726f6bf16696665 |
e3af1de113f73a186bb6b321b0262667be440325 |
567596ca306ea8f1162c6c681777ca1f342f8b0ab071d7eca22b63f2eb0c6760 |
WinPython64-3.15.2.0slim.7z |
538 907 332 Bytes |
540b181e4fd1e2536624b727792b77e8a9b343aa9e8baede73157ed2d2131b7a |
| 6540c6ded602c8522d0008adf4c4e0eb |
b4f93433e8bc8164f71d2576eaccf62a65d2e760 |
20769ff2e8b91653913e8cceb875f87b65905f67536f0b3a147ec65b7e68f448 |
WinPython64-3.15.2.0slim.exe |
539 122 799 Bytes |
04c3ab8230afb87f52feb11c202492fefdd10422594ab6b0d492c00bc8189e40 |
| 707cdcdd9514df5b7dba778c4050cd78 |
0c9f4e8dd043eb1afa7508bc2bc65570dbbfc4aa |
77989212ebc0bd39b202f71a5941bd4e2a7897887586b2e1216ca553b38ae13f |
WinPython64-3.15.2.0slimf.7z |
310 351 294 Bytes |
d46d86dbc648b2a1f18576c32e5346c6f108932f5b692ca4607daf20a40eb775 |
| 0b7cd528f051043578965792de47d011 |
ebab912dc73afc3558015fc59cccd13357379fef |
c3e83f71a357956aa8d9a98d852e7f51bee43d98c662a38925d521d95b9753c5 |
WinPython64-3.15.2.0slimf.exe |
310 566 930 Bytes |
573752fba9a47874b3ea8f9a0f93065a9adc391f02afb6917d5630ca49af64f9 |
pylock and requirements versions: (now also in the winpython/changelogs comits), and how-to use with pip:
. with a requirement file:
. pip download --dest C:\your_temp_Wheelhouse --no-deps --require-hashes -r requir.64-3_14_10_0slim.txt
. pip install --no-deps --no-index --trusted-host=None --find-links=C:\your_temp_Wheelhouse --require-hashes -r requir.64-3_14_10_0slim.txt
. with a pylock file:
. pip install --no-deps --require-hashes -r pylock.64-3_14_10_0slim.toml --no-warn-script-location
| MD5 |
SHA-1 |
SHA-256 |
Binary |
Size |
blake2b-256 |
| d7933836c16931d2db62b1b6fa14fe7c |
2674501a91a1e30d82bd3f5d475e508e08abc846 |
a71c8603e1a1ab51f06475ffd16b1e55d75b1f8a1d4a62d2acafed8f0b569418 |
pylock.64-3_13_18_0dot.toml |
3 062 Bytes |
8e420ded8548ab32a6a909ffc876ec08aae656df9ccd53ce635928d02db7ca60 |
| 9123e32c0bde06b662f53b04ce65ebb3 |
473bbbc98897f2b56eba20145f5cb4092bca9139 |
c08412e66eb198d4464a37f5ce8d5ad2e6cc0d08f9ce2423862d3e0699c82d71 |
pylock.64-3_13_18_0slim.toml |
199 999 Bytes |
8706371f179b9804add5b5bd7da4d74ba4ef9980ba77d3887b91649d1528a44f |
| d7933836c16931d2db62b1b6fa14fe7c |
2674501a91a1e30d82bd3f5d475e508e08abc846 |
a71c8603e1a1ab51f06475ffd16b1e55d75b1f8a1d4a62d2acafed8f0b569418 |
pylock.64-3_14_10_0dot.toml |
3 062 Bytes |
8e420ded8548ab32a6a909ffc876ec08aae656df9ccd53ce635928d02db7ca60 |
| d7933836c16931d2db62b1b6fa14fe7c |
2674501a91a1e30d82bd3f5d475e508e08abc846 |
a71c8603e1a1ab51f06475ffd16b1e55d75b1f8a1d4a62d2acafed8f0b569418 |
pylock.64-3_14_10_0dotf.toml |
3 062 Bytes |
8e420ded8548ab32a6a909ffc876ec08aae656df9ccd53ce635928d02db7ca60 |
| 0e9afce865fd5f2666b02a13aa465b8b |
a4617fd860136516bbefb1a398384666d35eb0db |
57240682d61f8ae514d457c15c20a679f344d0089d92bc9d6f71540022edbcac |
pylock.64-3_14_10_0slim.toml |
210 287 Bytes |
9e0bddfed22469d4c8cde6d5e23aaf8faede172323e4752bd930cabb6c40c666 |
| 9d92799f52316f97d42a23332e694aa1 |
5d69eaac91a41e028f5216e8594f6f46027093f9 |
989148c42740c9d828654b164650495da880989d9378e14bbe2128accc28abba |
pylock.64-3_14_10_0slimf.toml |
177 514 Bytes |
313358f7c5ab719a6ea56456149d87726fb91931912dc58bbf4aaa4b4dc5a3fc |
| d7933836c16931d2db62b1b6fa14fe7c |
2674501a91a1e30d82bd3f5d475e508e08abc846 |
a71c8603e1a1ab51f06475ffd16b1e55d75b1f8a1d4a62d2acafed8f0b569418 |
pylock.64-3_15_2_0dot.toml |
3 062 Bytes |
8e420ded8548ab32a6a909ffc876ec08aae656df9ccd53ce635928d02db7ca60 |
| d7933836c16931d2db62b1b6fa14fe7c |
2674501a91a1e30d82bd3f5d475e508e08abc846 |
a71c8603e1a1ab51f06475ffd16b1e55d75b1f8a1d4a62d2acafed8f0b569418 |
pylock.64-3_15_2_0dotf.toml |
3 062 Bytes |
8e420ded8548ab32a6a909ffc876ec08aae656df9ccd53ce635928d02db7ca60 |
| be295a85f57f937d11da4ef89e6cd20d |
5a66a229ef7efbb0e064a931d148d47ce909773d |
1224f58aa47a0339d0ce90cc71506f32587a49ca09f763476cede70436a3f409 |
pylock.64-3_15_2_0slim.toml |
179 316 Bytes |
b8cf00492f08462f40f90478b39aabdb7216c6b36ef84b511ab1609f2399eb80 |
| 8a3b68f9a9155c0c577a6560601abb8d |
9930935e50ad079ec77e0c2f97745e0ee56f9697 |
4147b9fd7ccb466e8562f49a5e72c347ba2e94327a16a51b84da60c1c791572a |
pylock.64-3_15_2_0slimf.toml |
155 335 Bytes |
dac5ef7cd9e8909d60adcffe3f60cc27c2c32f6e1ead099552634f21b9c33f21 |
| b07c2406db39392bf612207b17a8b7dd |
93a515d2a3ade580965fa69ab97b477a676cc738 |
3374bb78e1a5f947f5a83cc851cb0267169ff18dad673cb043f790af7f71b7b6 |
requir.64-3_13_18_0dot.txt |
836 Bytes |
39b912da1f4ebf4b749a8c047c7647e819e6820becce9c97fbda7da40d9a52c5 |
| 09be08047c51ff68b7068d37fcb02bd9 |
d96003d8b699a5d36853c45cb829b10ed92ca5b0 |
fef1766e3f5f5837abca76019bef00d7c48f2c84893ff69efa45797b44d6ed97 |
requir.64-3_13_18_0slim.txt |
54 914 Bytes |
e32843746abf18ea6fc21526e0d8aa6c390093007df6dbb2e540c7f5c229ad80 |
| b07c2406db39392bf612207b17a8b7dd |
93a515d2a3ade580965fa69ab97b477a676cc738 |
3374bb78e1a5f947f5a83cc851cb0267169ff18dad673cb043f790af7f71b7b6 |
requir.64-3_14_10_0dot.txt |
836 Bytes |
39b912da1f4ebf4b749a8c047c7647e819e6820becce9c97fbda7da40d9a52c5 |
| b07c2406db39392bf612207b17a8b7dd |
93a515d2a3ade580965fa69ab97b477a676cc738 |
3374bb78e1a5f947f5a83cc851cb0267169ff18dad673cb043f790af7f71b7b6 |
requir.64-3_14_10_0dotf.txt |
836 Bytes |
39b912da1f4ebf4b749a8c047c7647e819e6820becce9c97fbda7da40d9a52c5 |
| 0fbb565cceaffa86a1109118755bbd8c |
1e0fcc4599c84bc45e186ebe6234535f947130b8 |
7f974186f719bbf1a8b4bef813ddeee4e424278d08b7f687a838443fc5b3d260 |
requir.64-3_14_10_0slim.txt |
57 786 Bytes |
480710d5c727a6332c2109621e1fc123ad32e124d6d89725985fe2ecbe1a0a6e |
| 44f66ac76ac86d20b8389ee7ab2ca23d |
01875465f7e040ff7002b2792f70fa3fc1b908fa |
ff63920d075cf5b0ce975b265491104ecb87d73be568b049220b4b9996ecad0f |
requir.64-3_14_10_0slimf.txt |
48 791 Bytes |
f469f0f5e296164ec5f0fd8563afa038c918db9abcde678ba49eb4c4d4c17deb |
| b07c2406db39392bf612207b17a8b7dd |
93a515d2a3ade580965fa69ab97b477a676cc738 |
3374bb78e1a5f947f5a83cc851cb0267169ff18dad673cb043f790af7f71b7b6 |
requir.64-3_15_2_0dot.txt |
836 Bytes |
39b912da1f4ebf4b749a8c047c7647e819e6820becce9c97fbda7da40d9a52c5 |
| b07c2406db39392bf612207b17a8b7dd |
93a515d2a3ade580965fa69ab97b477a676cc738 |
3374bb78e1a5f947f5a83cc851cb0267169ff18dad673cb043f790af7f71b7b6 |
requir.64-3_15_2_0dotf.txt |
836 Bytes |
39b912da1f4ebf4b749a8c047c7647e819e6820becce9c97fbda7da40d9a52c5 |
| d809427d604bb7ec5fbe926f44fedc05 |
ea92e994616517a257fcc82f05693ed5e4980645 |
3f374149e31eaa4b3b6e33bbb464ed31892aa00ec98215d085c4cce1c2f40600 |
requir.64-3_15_2_0slim.txt |
49 304 Bytes |
83faaea4f3823f07a33a6be40cba337cbf1590c22fda9be55c6720454940f6b7 |
| 0204ce22c52879e634e69eee5da4aafa |
ef205d78eb98a905630ceb51a99d9a7e92f56bdd |
fc7efae9ffcd0170e1f0bb27a04b958fd310d24870e795ad66faa961cf630983 |
requir.64-3_15_2_0slimf.txt |
42 727 Bytes |
d53a395c088b0257b5cf413e65986e094385909e7d2e3bf3c19e80913c470dac |
2026-10-29 re-spin of WinPython-3.14.10 in a more compressed for to get back below 650Mo:
| MD5 |
SHA-1 |
SHA-256 |
Binary |
Size |
blake2b-256 |
| 89757aa24963eabbc61fe08cedba33ac |
93cc782bd24e29f7c71eed819f3a19753f28012a |
99df4d8f58db2fdcda3e629cba5d1550207b396a27c74b78bd96b753530bb217 |
WinPython64-3.14.10.0slim_post1.7z |
667 873 591 Bytes |
590a6085fbcfa53cd71329dee3a0b4ffd62ac08c2f196a2ddc6d2b8c6127d90b |
| 436fea539e8ec3c146c0e7395aa91c76 |
69f919858af98db2ac8d7277c471306a844ccb74 |
b9bb622ee95e78a326ddce9e1a808e3c38edc6853bda58a6c078fd05b866a771 |
WinPython64-3.14.10.0slim_post1.exe |
668 088 786 Bytes |
2dc1614b9322a92e62867c4bf63f3aafacf168adc81fd9ef8ba9cf9b403c6c42 |
stonebig commented on Oct 29, 2026 ContributorAuthor More actions Post-mortem of the cycle (2026-10-29):
- security is not a given, can be lost overnight, so users can now self-check packages alert with
- winpython-3.14.10.slim is slightly too big for virustotal.com by 1Mo, found after release (sorry), forcing:
- a re-spin for winpython-3.14.10.slim with higher compression, -mx7 instead of -mx9, to fit back into 650mo, with nothing else changed
- the need to add the option to launch only "slim" in build_winpython_cycle.yml and have a "post" parameter added in cycle/2026_04.toml
- ==> re-spin is winpython-3.14.10.slim_post1
- a warning shall now be raised in the cloud build if an object is > 650MB , to avoid post-production inconvenience next time.
stonebig commented on Oct 29, 2026 ContributorAuthor More actions default of sourceforge is switched to WinPython64-3.14.10.0slim_post1.exe stonebig commented on Oct 29, 2026 ContributorAuthor More actions And now, new thing, the advisory updates after release:
- like radio-activity, it was already there in the past
- but now, it's easier to check with 'wppm --audit'
- also an hour-fresh alert on pydantic like https://github.com/pydantic/pydantic/releases/tag/v2.14.2 is on the release tag at 2026-10-29 18:00:00Z , but not immediatley published on osv.dev ... an impossibly long 1 hour lag ?
Rule-of-thumb: with AI advent, it seems about 2 security alert per day, alert importance depending of your usage and internet connexion
Security updates
Advisories published 2026-10-28:
| Package |
From → To |
Advisory |
Severity |
Summary |
| langgraph |
1.2.11 → 1.2.14 |
GHSA-3fx2-cqw9-xr3c |
medium |
Unencoded identifiers in LangGraph SDK v3 streaming can redirect authenticated GET requests (also fixed in langgraph-sdk 0.4.6) |
| tornado |
6.5.10 → 6.6 |
GHSA-pcg2-g6cj-q92c |
medium |
Quadratic CPU usage when parsing HTTP headers with line folding |
| tornado |
6.5.10 → 6.6 |
GHSA-pw9p-v7r6-gx4p |
low |
Open redirect in RedirectHandler via protocol-relative URLs |
| tornado |
6.5.10 → 6.6 |
GHSA-r4j5-9xpp-3985 |
medium |
Event loop blocking and excess memory use from chunked bodies with many small chunks |
stonebig commented on Oct 31, 2026 ContributorAuthor More actions 2026-10-31 update by Claude : "For security alone, none of these justifies a re-spin; they can wait for the next normal cycle."
alerts:
Nothing is critical. 12 of the 17 advisories are High, and all 12 are denial of service.
All 17 are gone at the target versions (checked on osv.dev).
| Package |
Update |
High |
Moderate |
Low |
What it is |
| pypdf |
6.21.2 -> 6.21.4 |
7 |
|
|
Infinite loops, memory and CPU blowups on a crafted PDF. |
| pyasn1 |
0.6.4 -> 0.6.5 |
4 |
|
|
Quadratic CPU when decoding BER/DER. |
| joserfc |
1.7.4 -> 1.7.6 |
1 |
1 |
|
Unbounded JWE recipients (CPU); JWS size guard (allocation). |
| tornado |
6.5.10 -> 6.6 |
|
2 |
1 |
HTTP header and chunked-body DoS; open redirect in RedirectHandler. |
| langgraph |
1.2.11 -> 1.2.14 |
|
1 |
|
SDK v3 streaming identifiers can redirect authenticated requests. |
- No code execution: none of the 17 allows it. Only two aren't DoS, the tornado redirect and the langgraph one. The langgraph one has limited confidentiality impact and requires login.
- pypdf: you need a malicious PDF and someone has to open it. In a desktop distribution that's the most realistic trigger, but it only hangs that process.
- pyasn1 and joserfc: these only matter if a service decodes untrusted input. pyasn1 usually comes in as a dependency.
- tornado: this mainly affects public servers. Jupyter on localhost isn't exposed in the usual setup.
... we shall not forget that Claude is a bit enthousiastic about itself
MetadataMetadataDevelopmentNo branches or pull requestsIssue actions
|
