[Python] Bump Python from 3.14.6 to 3.14.7

[hayat01sh1da]

1. Overview

This Pull Request bumps the CPython toolchain pinned by coding-tests from 3.14.6 to 3.14.7.
CPython 3.14.7 is the seventh maintenance release of the 3.14 series, published on 2026-08-05 with roughly 499 bugfixes, build improvements and documentation changes from 86 contributors since 3.14.6.
The pin drives the pyenv interpreter behind every Python kata under python/ and the versions advertised throughout the documentation.
The bump is patch-level, so it carries no language-syntax, standard-library API or ABI break; the motivation is the security content, above all the tarfile extraction-filter bypass (gh-151558) and the quadratic-parsing denial-of-service fixes in html.parser and xml.etree.ElementTree.
Every one of the 3 touched files only restates the interpreter version, so none of this repository's own code changes behaviour.

2. Key Changes & Differences

2-1. Files Touched in This Repository

Code/Library/Package	Before	After	Changes & Differences
.python-version	3.14.6	3.14.7	pyenv interpreter pin for the whole repository. pyenv install 3.14.7 is required locally before the Python tracks are run again.
SECURITY.md	3.14.6	3.14.7	The supported-versions table now advertises CPython 3.14.7 as the Python runtime baseline of this repository.
python/README.md	3.14.6	3.14.7	Environment section and the recorded pytest headers (platform linux -- Python ...) now read 3.14.7.

2-2. Upstream Differences between CPython 3.14.6 and 3.14.7

CPython 3.14.7 landed on 2026-08-05 with roughly 499 bugfixes, build improvements and documentation changes from 86 contributors.
It is a patch release of the 3.14 series, so the language grammar, the standard-library API surface and the ABI are all unchanged; the following is what actually differs behind the version string.

Security

• gh-151558 — closed a bypass of the tarfile extraction filter (a follow-up to CVE-2025-4330) where a crafted archive could still create symlinks pointing outside the destination directory.
• gh-151987 — tarfile.TarFile.extract() now applies the configured filter to link targets as well, not only to regular members.
• gh-151981 — tarfile seeking now stops at the end of the stream instead of running past it.
• gh-153030 — removed the quadratic complexity in html.parser.HTMLParser when incrementally parsing unterminated constructs, a denial-of-service vector for streamed input.
• gh-152674 — xml.etree.ElementTree no longer degrades to quadratic behaviour for XPath index predicates on large documents.
• gh-152216 — the bundled libexpat is updated to 2.8.2.
• gh-150743 — http.client now caps chunked-response trailer lines and interim responses at 100 each, mitigating a denial-of-service vector from hostile servers.
• gh-143921 — imaplib rejects NUL, CR and LF inside IMAP commands, closing a command-injection vector.
• gh-143927 — configparser normalises line endings inside multi-line values.
• gh-151544 — Modules/Setup.local is no longer treated as a source-tree indicator; pybuilddir.txt is used instead.

Core and Builtins

• gh-151238 — fixed an interpreter crash while compiling concatenated f-strings / t-strings after an error.
• gh-154709 — fixed an out-of-bounds access in reverse dictionary iterators.
• gh-154275 — fixed a crash on deeply nested __parameters__ in types.GenericAlias.
• gh-151912 — fixed a crash in type() when the metaclass tp_new slot is NULL.
• gh-151763 — fixed a crash in types.CodeType deallocation and on memory-allocation failure.
• gh-154695 — asyncio.Task with eager_start=True no longer raises AttributeError.
• gh-151218 — PyConfig_Set() and sys.set_int_max_str_digits() now replace sys.flags instead of mutating it in place.
• gh-133931, gh-153298, gh-153809, gh-153932, gh-151644 — a batch of free-threaded-build data races and crashes (function-object attributes, types.GenericAlias.__parameters__, asyncio.Task deallocation, enumerate.__reduce__(), sys.setdlopenflags()).

Library

• gh-155063 — the bundled pip is bumped to 26.2.1.
• gh-155009 — argparse.ArgumentParser preserves the program name taken from sys.argv[0].
• gh-154936 — the JSON decoder reports the correct position for invalid control characters.
• gh-98820, gh-109638 — removed the quadratic and exponential running time of csv.Sniffer.sniff() on quote-heavy input.
• gh-151814 — fixed unbounded memory growth in io.TextIOWrapper on repeated empty writes.
• gh-151295, gh-148660, gh-151403, gh-151416 — fixed use-after-free and crash paths in bytes.join(), collections.OrderedDict.copy(), subprocess.Popen and os.spawnv() when the input sequence mutates mid-call.
• gh-79366, gh-73458 — fixed a logging race when a handler is removed during emit() and a hang in logging.config.listen() on port errors.
• gh-152569, gh-153761, gh-119710, gh-145030 — asyncio fixes: leaked waiting tasks in wait(), a dropped connection when sock_accept() is cancelled, a hang in subprocess wait() with inherited pipes, and write-pipe transports on macOS / Solaris.
• gh-151665, gh-150641 — inspect.signature() now handles lazy type-alias evaluators, and typing.evaluate_forward_ref() no longer leaks internal names.
• gh-154892, gh-152305, gh-154460, gh-154389 — date and time fixes: a zoneinfo C-accelerator crash with datetime subclasses, AttributeError from the pure-Python datetime.time.strftime(), a wrong ISO 8601 week number on OpenBSD, and uuid.uuid1() returning a version-4 UUID on OpenBSD.
• gh-154399, gh-109940 — venv activation fixes for non-interactive csh and for VIRTUAL_ENV_DISABLE_PROMPT on Windows.
• gh-93251, gh-154551, gh-117807 — locale-encoding fixes in socket, ctypes.util.find_library() and mimetypes.

3. Summary

• Pinned CPython moves from 3.14.6 to 3.14.7 across 3 files; no source code, dependency constraint or workflow logic changes.
• Picks up the 3.14.7 security content: the tarfile extraction-filter bypass (gh-151558) and link-target filtering (gh-151987), the html.parser and xml.etree.ElementTree quadratic-parsing denial-of-service fixes (gh-153030, gh-152674), the http.client trailer and interim-response caps (gh-150743), the imaplib control-character rejection (gh-143921) and bundled libexpat 2.8.2 (gh-152216).
• Run pyenv install 3.14.7 and pyenv rehash locally before touching the Python tracks again; CI resolves the pin on its own.
• The bundled pip in 3.14.7 is 26.2.1 (gh-155063), which already matches the pip version documented in the READMEs, so no further documentation change is needed.

4. References

• .python-version
• SECURITY.md
• python/README.md
• Python Release Python 3.14.7 | Python.org
• Python 3.14.7 and 3.13.15 are now available! | Python Insider
• Changelog — Python 3.14.7 documentation
• What's new in Python 3.14
• Python Release Python 3.14.6 | Python.org

[hayat01sh1da]