News

Python 3.14.7 Released: What's in the Changelog

Python 3.14.7, the seventh maintenance release of the 3.14 series, landed on August 5, 2026 with around 499 bug fixes and several notable security patches, including a credential-scoping CVE fix and archive-extraction hardening.

Anton Jacker

Sep 3, 2026 — 1 min read

Python 3.14.7, the seventh maintenance release of the 3.14 series, was released on August 5, 2026. It contains around 499 bug fixes, build improvements, and documentation changes from 86 contributors since 3.14.6, and it is a bug-fix-only release (no new features).

Security fixes

CVE-2026-15806 (urllib): HTTPPasswordMgr credentials are now scoped to the URL scheme, so credentials stored for an HTTPS URL are no longer reused for a matching HTTP URL.
tarfile: The tar and data extraction filters no longer create directories outside the destination for members whose name leaves the destination and then returns to it.
shutil: Fixed a vulnerability in shutil.unpack_archive() for ZIP files on Windows that allowed writing files outside the destination tree when an archive path contained a Windows drive prefix.
compile() / ast.parse(): Fixed an out-of-bounds read when an AST object is passed with mode='func_type'.
Bundled dependency: The bundled libexpat was updated to version 2.8.4.

Core and runtime

The generational cycle garbage collector was forward-ported to the default 3.14 build, replacing the incremental collector. The free-threaded collector is left unchanged.

These are the headline entries; the release also rolls up many additional bug fixes and documentation updates across the standard library. For the complete list, see the full release notes and the 3.14.7 download page.

If you are on the 3.14 series, upgrading to 3.14.7 is recommended. Happy coding! 🐍

Reading and Writing Images in Python: JPEG, PNG, and WebP with Pillow

A code-first tour of handling JPEG, PNG, and WebP in Python with Pillow — opening, converting, compressing, and batch-processing images.

Always-Sorted, Never Slow: A Practical Deep Dive into Python's heapq

Learn how Python's heapq module gives you fast priority queues and top-k queries without a heavy dependency — with runnable examples for task scheduling, streaming data, and Dijkstra's algorithm.

Python This Week — September 2, 2026: 3.15 RC2, a pip Security Fix, and PSF Board Voting Opens

Python 3.15.0 release candidate 2 shipped September 1 ahead of the October 1 final, bringing lazy imports, a built-in frozendict, and the Tachyon profiler. Plus: pip patches CVE-2026-13346, PSF board voting opens, and uv keeps shipping.

Lazy by Design: A Practical Deep Dive into Python Generators and yield

Learn how Python generators and the yield keyword let you process huge or infinite data streams with almost no memory, build clean data pipelines, and even send values back in — plus the pitfalls that trip people up.