René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Missing Windows releases for CVE-2026-115557 Python patches: 3.11.18, 3.12.16, 3.13.18","articleBody":"\u003c!--- Please direct any generic questions related to actions to our support community forum at https://github.community/c/code-to-cloud/github-actions/41 --->\n\u003c!--- Before opening up a new bug report, please make sure to check for similar existing issues -->\n\n**Description:**\n\nCPython 3.11.18, 3.12.16, 3.13.18, 3.14.10, and 3.15.2 patch the `ssl` module to reject the compromised eMudhra/emSign intermediate CAs (CVE-2026-115557). `setup-python` resolves 3.14.10 and 3.15.2 to Windows interpreters cleanly, but the 3.11.18, 3.12.16, and 3.13.18 releases in [actions/python-versions](https://github.com/actions/python-versions/) ship no Windows binaries, so `python-version: '~3.11.18'` (and the corresponding `~3.12.16` / `~3.13.18`) cannot resolve a safe interpreter on Windows runners.\n\nFor 3.13 this looks like a per-patch regression: the previous patch 3.13.17 shipped Windows builds ([release 3.13.17-39711892467](https://github.com/actions/python-versions/releases/tag/3.13.17-39711892467) has 6 `win32-*.zip` assets), but 3.13.18 ([release 3.13.18-40336726450](https://github.com/actions/python-versions/releases/tag/3.13.18-40336726450)) ships 16 Linux/RHEL/freethreaded assets and zero Windows. For 3.11 and 3.12 the series stopped producing Windows at 3.11.9 and 3.12.10 respectively (both well before CVE-2026-115557), so the gap is older.\n\nConcrete Windows-ceiling per series in actions/python-versions today:\n\n| Series | Latest Windows release | CVE-fixed floor | Gap |\n| --- | --- | --- | --- |\n| 3.11 | 3.11.9 | 3.11.18 | 9 patches |\n| 3.12 | 3.12.10 | 3.12.16 | 6 patches |\n| 3.13 | 3.13.17 | 3.13.18 | 1 patch |\n| 3.14 | 3.14.10 | 3.14.10 | OK |\n| 3.15 | 3.15.2 | 3.15.2 | OK |\n\nPlease rebuild and publish Windows binaries at least for the CVE-fixed patches (3.11.18, 3.12.16, 3.13.18) so that CI that pins to the patched floor via `setup-python` works on Windows.\n\n**Action version:**\nactions/setup-python@v6.3.0 (same gap on earlier v5/v4).\n\n**Platform:**\n- [ ] Ubuntu\n- [ ] macOS\n- [x] Windows\n\n**Runner type:**\n- [x] Hosted\n- [ ] Self-hosted\n\n**Tools version:**\n3.11.18, 3.12.16, 3.13.18.\n\n**Repro steps:**\n\n```yaml\njobs:\n  windows:\n    runs-on: windows-latest\n    steps:\n      - uses: actions/setup-python@v6\n        with:\n          python-version: '~3.13.18'    # or ~3.11.18, or ~3.12.16\n```\n\nFails with \"Version 3.13.18 … was not found in the local cache … versions-manifest.json\" because the manifest lists no Windows build for 3.13.18.\n\nConfirmed against the live manifest at \u003chttps://raw.githubusercontent.com/actions/python-versions/main/versions-manifest.json>:\n\n- 3.11.18 — `files[]` has no `platform: win32` entry (6 Linux + 2 RHEL)\n- 3.12.16 — same (8 non-Windows)\n- 3.13.18 — 16 non-Windows (incl. freethreaded) + no `win32`\n- 3.13.17 — 2 `win32` entries present\n- 3.14.10 — 2 `win32` entries present\n- 3.15.2 — 2 `win32` entries present\n\n**Expected behavior:**\n`python-version: '~3.11.18'` (or `~3.12.16` / `~3.13.18`) resolves to a Windows-amd64 interpreter whose `ssl` module carries the CVE-2026-115557 fix.\n\n**Actual behavior:**\nResolution fails on Windows runners because the python-versions releases for those three patches ship only Linux and RHEL binaries. Workaround today is [`setup-uv`](https://github.com/astral-sh/setup-uv) + `uv python install`, which pulls from python-build-standalone (has every patch for every platform), but that's a lot of overhead to work around a build-matrix gap.\n\n**Context:**\nThis came up while hardening CI for the eMudhra/emSign CA incident. Several downstream projects ([NVIDIA/cuda-python#3275](https://github.com/NVIDIA/cuda-python/pull/3275), [cupy/cupy#10438](https://github.com/cupy/cupy/pull/10438)) hit this gap and had to work around it.","author":{"url":"https://github.com/leofang","@type":"Person","name":"leofang"},"datePublished":"2026-11-01T19:38:42Z","url":"https://github.com/actions/setup-python/issues/1383"}