--- title: #492: Codeberg Puts Head in Sand | daily.dev description: A Python-focused podcast episode covers three security releases for Python 3.12.14, 3.11.16, and 3.10.21 patching multiple CVEs including tarfile... canonical: https://daily.dev/posts/492-codeberg-puts-head-in-sand-l3akgberi twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: #492: Codeberg Puts Head in Sand | daily.dev og:description: A Python-focused podcast episode covers three security releases for Python 3.12.14, 3.11.16, and 3.10.21 patching multiple CVEs including tarfile... og:url: https://daily.dev/posts/492-codeberg-puts-head-in-sand-l3akgberi og:image: https://api.daily.dev/og/posts/l3AKGBerI.png og:image:alt: #492: Codeberg Puts Head in Sand og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # #492: Codeberg Puts Head in Sand **[Planet Python](https://daily.dev/sources/planetpython)** · 9 min read · 0 upvotes · 0 comments ## Summary A Python-focused podcast episode covers three security releases for Python 3.12.14, 3.11.16, and 3.10.21 patching multiple CVEs including tarfile path-traversal bypasses, expat crashes, and cookie header injection. It also discusses Armin Ronacher's critique of Codeberg's new terms banning AI-generated code, questioning whether repository hosts should judge code by how it was produced rather than by behavior, and covers Brett Cannon's proposal for reproducible builds on PyPI to close supply-chain gaps. Extras mention Python 3.14.7, MCP protocol updates, and uv adding post-quantum key exchange support. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What CVEs were fixed in the Python 3.12.14, 3.11.16, and 3.10.21 security releases? Four new CVEs were patched: CVE-2026-2297 (SourcelessFileLoader not using io.open_code() for .pyc files), CVE-2026-4224 (expat crash on deeply nested content models), CVE-2026-3644 (control characters accepted in http.cookies.Morsel), plus completion of the older CVE-2021-4189 fix in ftplib.ftpcp. A tarfile symlink escape that bypassed the earlier CVE-2025-4330 data filter fix was also closed, with extract() now applying the filter to link targets too. _Developers tracking Python's security patch cadence can follow CVE fixes like these on daily.dev._ ### What does Codeberg's new terms of service say about AI-generated code? Codeberg's updated terms prohibit hosting projects that are mostly written with generative AI. Armin Ronacher's essay 'Codeberg Divides' argues this creates a vague, hard-to-enforce boundary since modern codebases mix handwritten code, completions, agents, and generated refactors, and warns it undermines Codeberg's position as a predictable, neutral GitHub alternative for the open source community. _Anyone weighing where to host open source projects amid shifting AI-code policies can follow the Codeberg debate on daily.dev._ ### What is missing for reproducible builds on PyPI according to Brett Cannon? Nothing currently records the exact source code or build tools behind a PyPI distribution. Wheels can use PEP 770 SBOMs in .dist-info/sboms/, but sdists cannot since they're just a tarball with a precalculated PKG-INFO. Brett Cannon proposes adding source and build-tool metadata to sdist/wheel metadata and having trusted third parties report successful reproductions back to PyPI, framed as an opt-in perk roughly equivalent to SLSA build level 1. _Developers hardening their Python supply chain against build-process attacks can track this reproducible-builds proposal on daily.dev._ ## Similar posts on daily.dev - [Episode \#309: Exploring Complex Systems & Maintainable Data Science Pipelines – The Real Python Podcast](https://daily.dev/posts/episode-309-exploring-complex-systems-maintainable-data-science-pipelines-the-real-python-podc-gdpzsjumh) · Real Python · 0 upvotes · 0 comments - [\#491: Feeling Judged](https://daily.dev/posts/491-feeling-judged-ttagl1kj8) · Planet Python · 0 upvotes · 0 comments - [Python 3.12.13, 3.11.15 and 3.10.20 are now available\!](https://daily.dev/posts/python-3-12-13-3-11-15-and-3-10-20-are-now-available--wefozmp5m) · Python Insider · 0 upvotes · 0 comments - [PyCoder’s Weekly](https://daily.dev/posts/pycoder-s-weekly-0wba8c5pq) · Planet Python · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#python](https://daily.dev/tags/python) [View this post on daily.dev](https://daily.dev/posts/492-codeberg-puts-head-in-sand-l3akgberi) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"#492: Codeberg Puts Head in Sand","url":"https://daily.dev/posts/492-codeberg-puts-head-in-sand-l3akgberi","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/492-codeberg-puts-head-in-sand-l3akgberi"},"datePublished":"2026-08-18T19:54:22.052Z","dateModified":"2026-09-14T06:30:33.907Z","description":"A Python-focused podcast episode covers three security releases for Python 3.12.14, 3.11.16, and 3.10.21 patching multiple CVEs including tarfile...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/a76521799ddb2db691b39f52a78ceda9?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/a76521799ddb2db691b39f52a78ceda9?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Planet Python","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Planet Python","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/eac3cc584cb043b5a242d13752bd3d0c","url":"https://daily.dev/sources/planetpython"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/492-codeberg-puts-head-in-sand-l3akgberi","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,python","timeRequired":"PT9M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Planet Python","item":"https://daily.dev/sources/planetpython"},{"@type":"ListItem","position":3,"name":"#492: Codeberg Puts Head in Sand"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/492-codeberg-puts-head-in-sand-l3akgberi#faq","mainEntity":[{"@type":"Question","name":"What CVEs were fixed in the Python 3.12.14, 3.11.16, and 3.10.21 security releases?","acceptedAnswer":{"@type":"Answer","text":"Four new CVEs were patched: CVE-2026-2297 (SourcelessFileLoader not using io.open_code() for .pyc files), CVE-2026-4224 (expat crash on deeply nested content models), CVE-2026-3644 (control characters accepted in http.cookies.Morsel), plus completion of the older CVE-2021-4189 fix in ftplib.ftpcp. A tarfile symlink escape that bypassed the earlier CVE-2025-4330 data filter fix was also closed, with extract() now applying the filter to link targets too. Developers tracking Python's security patch cadence can follow CVE fixes like these on daily.dev."}},{"@type":"Question","name":"What does Codeberg's new terms of service say about AI-generated code?","acceptedAnswer":{"@type":"Answer","text":"Codeberg's updated terms prohibit hosting projects that are mostly written with generative AI. Armin Ronacher's essay 'Codeberg Divides' argues this creates a vague, hard-to-enforce boundary since modern codebases mix handwritten code, completions, agents, and generated refactors, and warns it undermines Codeberg's position as a predictable, neutral GitHub alternative for the open source community. Anyone weighing where to host open source projects amid shifting AI-code policies can follow the Codeberg debate on daily.dev."}},{"@type":"Question","name":"What is missing for reproducible builds on PyPI according to Brett Cannon?","acceptedAnswer":{"@type":"Answer","text":"Nothing currently records the exact source code or build tools behind a PyPI distribution. Wheels can use PEP 770 SBOMs in .dist-info/sboms/, but sdists cannot since they're just a tarball with a precalculated PKG-INFO. Brett Cannon proposes adding source and build-tool metadata to sdist/wheel metadata and having trusted third parties report successful reproductions back to PyPI, framed as an opt-in perk roughly equivalent to SLSA build level 1. Developers hardening their Python supply chain against build-process attacks can track this reproducible-builds proposal on daily.dev."}}]} ```