Given the impact, this should go into trixie-updates.

Sorry, python3.13/3.13.5-2+deb13u3 had a use-after-free error, resulting
in heap corruption, that trips up a number of users. See bug #1141977
for user reports.

Zigo mentioned to me that it broke nova's test suite, and I verified
this.

https://debusine.debian.net/debian/developers/work-request/927219/
The build fails with a couple of:

It also broke building python3.13's own documentation, which is a good
sign that it's a worrying regression.

https://debusine.debian.net/debian/developers/work-request/920956/

[ Reason ]
3.13.5-2+deb13u3 included a cherry-pick to fix a GC bug that affected
OpenStack and existed in 3.13 -> 3.13.12. This depended on a related
memory-handling change, that I missed when I grabbed the fix. This
update includes the missing commit.

It was mentioned in the issue, I forgot to go down the rabbit hole of
investigating the necessity for it.

[ Impact ]
Regression for many Python users :(

[ Tests ]
* The missing commit brings unit tests.
* Python's test suite passes (as it did for u3, sadface)
https://debusine.debian.net/debian/r-stefanor-python/work-request/926428/
* Nova's test suite passes.
https://debusine.debian.net/debian/r-stefanor-python/work-request/927171/
* Users who reported regressions in #1141977 have tested the update and
  reported success.

[ Risks ]
This seems to make things better, rather than worse.

[ Checklist ]
  [x] *all* changes are documented in the d/changelog
  [x] I reviewed all changes and I approve them
  [x] attach debdiff against the package in (old)stable
  [x] the issue is verified as fixed in unstable

[ Changes ]
* Patch: Fix use-after-free in dict.clear() with embedded values.
  Resolves a regression in 3.13.5-2+deb13u3. (Closes: #1141977)

Control: tags -1 + confirmed

Please go ahead.

Regards,

Adam

package release.debian.org
tags 1142261 = trixie pending
thanks

Hi,

The upload referenced by this bug report has been flagged for acceptance into the proposed-updates queue for Debian trixie.

Thanks for your contribution!

Upload details
==============

Package: python3.13
Version: 3.13.5-2+deb13u4

Explanation: fix use-after-free in dict.clear() with embedded values, resolving regression from previous version

package release.debian.org
tags 1142261 = trixie pending
thanks

Hi,

The upload referenced by this bug report has been flagged for acceptance into the proposed-updates queue for Debian trixie.

Thanks for your contribution!

Upload details
==============

Package: python3.13
Version: 3.13.5-2+deb13u4

Explanation: fix use-after-free in dict.clear() with embedded values, resolving regression from previous version

which I know you were expecting to need some additional handling, but
turned out to just work on its own.

We should be able to release the SUA at some point over the weekend.
How does this sound for the announcement?

============
Python is a high-level, interactive, object-oriented language: The
version of Python included in the recent Debian 13.6 point release
introduced a regression which can lead to crashes.

This update resolves that issue.
============

Regards,

Adam

Hi Adam (2026.07.17_17:29:49_+0000)

Yes, I was pleased to see that, great.

LGTM

Stefano

-----------------------------------------------------------------------
Debian Stable Updates Announcement SUA 285-1     https://www.debian.org
debian-release@lists.debian.org                          Stefano Rivera
July 18th, 2026
-----------------------------------------------------------------------

Package              : python3.13
Version              : 3.13.5-2+deb13u4 [trixie]
Importance           : medium

Python is a high-level, interactive, object-oriented language. The version
of Python included in the recent Debian 13.6 point release introduced a
regression which can lead to crashes.

This update resolves that issue.

Upgrade Instructions
--------------------

You can get the updated packages by adding the stable-updates archive
for your distribution to your /etc/apt/sources.list:

 deb https://deb.debian.org/debian trixie-updates main
 deb-src https://deb.debian.org/debian trixie-updates main

You can also use any of the Debian archive mirrors.  See
https://www.debian.org/mirrors/list for the full list of mirrors.

For further information about stable-updates, please refer to
https://lists.debian.org/debian-devel-announce/2011/03/msg00010.html

If you encounter any issues, please don't hesitate to get in touch with
the Debian Release Team at debian-release@lists.debian.org

Thank you Stefano and SRM for handling this so quickly!

I'd like to note that the breakage is a little bit bigger than nova's
test suite and the documentation for python3.13 itself.

After an archive rebuild for Debian 13.6, I found at least 20 packages
with FTBFS issues due to this bug (the 19 packages in the affects field
for Bug #1141977, plus src:python3.13 itself).

So I wonder if it would be feasible/possible (for this one time) to
release Debian 13.7 a little bit before the initially planned date of
2026-09-12?

Thanks.