← All reportsPublic report

python/cpython

The Python programming language

75k stars Python View on GitHubprofiled 11d ago
Try GitZoid
400PRs this week
140Contributors
0Deps scanned
0Issues found
01 · Repo overview

How cpython is put together

This is CPython, the reference implementation of the Python programming language. It is a large multi-language codebase: a C core implementing the interpreter (bytecode compiler, evaluation loop, JIT, garbage collector), a pure-Python standard library under Lib/, public and internal C headers under Include/, an autoconf-based build system (configure.ac/Makefile.pre.in), and a PEG grammar definition in Grammar/python.gram that drives the parser. Data flow follows the classic pipeline: source text is parsed per Grammar/python.gram into an AST, compiled to bytecode code objects, and executed by the ceval interpreter loop with support for generators, frames, exception handling, and optional JIT compilation. The repo also contains platform-specific support (e.g., Platforms/emscripten for WebAssembly builds with Playwright browser tests) and internal maintainer documentation under InternalDocs/.

Languages

CPythonJavaScript/Node.js (test tooling)Autoconf/M4

Frameworks

Playwright (@playwright/test) for emscripten browser testshttp-server (Node static server for browser tests)black (formatter config in Tools/peg_generator/pyproject.toml)ruff (linter via .ruff.toml / Lib/.ruff.toml)

Infrastructure

Azure Pipelines CI (.azure-pipelines/ci.yml)ReadTheDocs (.readthedocs.yml)Emscripten/WebAssembly target (Platforms/emscripten)pre-commit hooks (.pre-commit-config.yaml)Devcontainer (.devcontainer/devcontainer.json)

Major components

Parser & Grammar (Grammar/, Tools/peg_generator)

Defines the PEG grammar (Grammar/python.gram) and token definitions from which the CPython parser and AST are generated.

Interpreter Core (Include/ceval.h, Include/frameobject.h, Include/opcode.h)

Implements the bytecode evaluation loop, frame objects, opcode definitions, stack references, and stack protection as documented in InternalDocs/interpreter.md and related docs.

Object System (Include/object.h, Include/dictobject.h, Include/listobject.h, etc.)

Defines core runtime object types (dict, list, tuple, unicode, set, weakref) and the object protocol, refcounting, and memory management APIs.

Garbage Collector & Memory (InternalDocs/garbage_collector.md, Include/pyatomic.h, Include/refcount.h)

Cyclic garbage collection, atomic reference counting, and QSBR-based reclamation as described in InternalDocs/garbage_collector.md and qsbr.md.

Standard Library (Lib/)

Pure-Python modules shipped with the interpreter, including configparser, socketserver, zipapp, argparse, dataclasses, asyncio-related support, and platform shims like _apple_support.py.

Build & Configuration (configure.ac, Makefile.pre.in, pyconfig.h.in)

Autoconf-driven configure/build system producing pyconfig.h and Makefiles for cross-platform compilation, plus Programs/ helpers like freeze_test_frozenmain.py.

Platform Support (Lib/_apple_support.py, Lib/_android_support.py, Lib/_ios_support.py, Platforms/emscripten)

OS-specific integration such as redirecting stdio to the Apple system log and WebAssembly/emscripten browser test harnesses.

CI & Tooling (.azure-pipelines, .pre-commit-config.yaml, .ruff.toml, .coveragerc)

Continuous integration pipelines, lint/format enforcement (ruff, black), coverage configuration, and pre-commit hooks.

Over the past five weeks the CPython team has been in a hardening and polish phase ahead of Python 3.15, with heavy focus on fixing crashes, data races, and edge-case bugs across curses, sqlite3, asyncio, zipfile, and argparse. A major theme has been converting C module argument parsing to Argument Clinic (especially for curses) and improving documentation quality throughout. The final week also added user-facing improvements like a time-complexity reference page and safety limits on zipfile decompression.

Week by week

2026-08-24A quieter week focused on curses fixes, zipfile decompression limits, and a new guide to how fast built-in types are.latest6 changes

Docs

New page on built-in type performance

Added documentation explaining the time complexity of operations on built-in types like lists and dictionaries.

Fix

Zipfile decompression limits

Bounded how much data zipfile will decompress for bzip2, LZMA, and Zstandard formats to prevent runaway memory use from malicious archives.

Fix

Curses Textbox handles wide characters

Fixed the curses text-entry box so double-width characters no longer break its output gathering.

Fix

Encodings module works from zipped standard library

Unfroze the encodings module to avoid import errors when the standard library is shipped inside a zip file.

Fix

Corrected curses.ERR value

Fixed the value of the error constant returned by curses functions on failure.

Chore

Emscripten toolchain upgraded

Updated the WebAssembly build toolchain to Emscripten 6.0.8.

2026-08-17A very busy 81-commit week dominated by a sweep of curses fixes and cleanups, plus crash repairs in sqlite3, SSL, ctypes, and asyncio.6 changes

Fix

Curses overhaul

Fixed numerous curses issues including window reading bounds, border/box drawing with zero values, color handling, NUL characters in cells, and missing WACS constants.

Fix

Crash fixes in C-backed attributes

Repaired crashes when deleting or misusing attributes on sqlite3 connections/cursors, SSL contexts, and ctypes pointers.

Fix

Asyncio TaskGroup cancellation fix

Fixed TaskGroup losing an outside cancellation after its own cancel() was called, and repaired a socket leak on accepted connections.

Fix

zlib correctness fixes

Made zlib.Decompress.flush() raise an error instead of silently returning corrupted output, and rejected negative lengths in checksum-combining functions.

Refactor

Argument Clinic expansion

Moved more C argument-parsing code into Argument Clinic, including inline parsing of optional groups and shared converters.

Fix

Thread-safety fix for os.scandir

Fixed a crash that could occur when an os.scandir iterator was shared between threads.

2026-08-10The largest week of the period at 133 commits, mixing deep concurrency fixes, pickle/BytesIO corrections, and a batch of curses panel and dbm repairs.6 changes

Fix

Free-threading race condition fixes

Fixed races when updating type slots and subclasses, and reduced lock contention during global-variable specialization under free threading.

Fix

Asyncio hang and leak fixes

Fixed writelines() hanging on empty chunks and shield() leaking tasks through the await graph.

Fix

BytesIO buffer handling improved

Allowed closing BytesIO objects that still have exported buffers and fixed garbage collection of such objects.

Refactor

Constant folding for collections

Long constant lists and sets are now folded into tuples and frozensets at compile time for faster execution.

Fix

Data-loss fix in dbm.dumb.reorganize()

Fixed a bug where reorganizing a dumb database could lose data.

Feature

Rust compression library support

Added support for linking against zlib-rs and libbzip2-rs as alternative implementations.

2026-08-03A 61-commit week centered on argparse refinements, Argument Clinic tooling upgrades, and long-standing small bugs going back years finally closed.6 changes

Feature

copy.replace() support grows

argparse.Namespace now supports copy.replace(), following decimal.Context support added the same week.

Chore

Argument Clinic developer experience

Added --dry-run and --diff options to Argument Clinic and made it handle optional argument groups more robustly.

Fix

zipfile warns about unwritten data

Closing a ZipFile with pending unwritten entries now emits a warning instead of failing silently.

Feature

inspect dedent parameter

inspect.cleandoc() and inspect.getdoc() gained a dedent parameter for controlling whitespace stripping.

Fix

Turtle screen can be recreated

Fixed creating a new turtle graphics screen after closing a previous one, closing a decades-old issue.

Chore

WASI packaging command

Added a 'wasi package' command to help build WebAssembly distributions of Python.

2026-07-27A 70-commit week focused on release-candidate preparation for Python 3.15 alongside concurrency fixes in logging, OrderedDict, and Decimal hashing.6 changes

Chore

3.15 release candidate prep

Updated the bytecode magic number for the 3.15 release candidate and copyedited the 'What's New in Python 3.15' document.

Fix

Logging handler removal race fixed

Fixed a race condition that could occur when removing a logging handler while other threads were logging.

Fix

OrderedDict iterator thread safety

Fixed thread-safety problems when creating OrderedDict iterators concurrently.

Fix

Decimal hash race fixed

Fixed a race condition in computing hash values for Decimal numbers.

Fix

asyncio Future traceback preserved

Fixed asyncio.Future losing its traceback when result() is called repeatedly.

Fix

shutil.copyfile symlink fix

Fixed copying symlinks to special files like devices when follow_symlinks=False is used.

03 · Security check

Dependencies and code review

0 dependencies scanned

Dependency advisories

Security Watch

No known advisories across 0 scanned dependencies.

No known advisories in the scanned dependencies.

Code review

No concrete code-level issues confirmed.

Get this report every week for your repos.

GitZoid learns each repo, reports what changed, and flags what needs attention. One flat price for the whole team.

$19 a month, flat · First 10 outputs free · No card required