Merge pull request #594 from StackVista/bump-python-3.13.18

Update embedded Python and CA certificates

Author: LouisLotter

deps/cpython/SECURITY_PATCHES.md

@@ -1,14 +1,10 @@
-# Embedded CPython security regressions
+# Embedded CPython maintenance
 
-Python 3.13.16 includes the upstream StringPrep Unicode-table and tarfile
-hard-link fixes previously carried as local backports. Their patches remain
-in git history.
+Update embedded CPython to the 3.13.18 maintenance release.
 
 Keep `scripts/test_embedded_python_security.py`: package CI runs it with the
-installed interpreter on native AMD64 and ARM64. It checks IDNA behavior,
-both tarfile extraction filters and the packaged `build.safe_extractall`
-wrapper, including unchanged outside-file contents and metadata.
+installed interpreter on native AMD64 and ARM64. Run as a non-root user so
+all maintained runtime checks execute.
 
 Omnibus must invoke Bazel even at the same Python version so restored caches
-cannot bypass changed source or patch inputs. Existing reviewed VEX and
-exception decisions remain separate from these runtime regressions.
+cannot bypass changed source or patch inputs.

deps/cpython/cpython.MODULE.bazel

@@ -1,6 +1,6 @@
 http_archive = use_repo_rule("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 
-PYTHON_VERSION = "3.13.16"
+PYTHON_VERSION = "3.13.18"
 
 http_archive(
     name = "cpython",
@@ -13,7 +13,7 @@ http_archive(
         "//deps/cpython:0001-customize-windows-build-script.patch",
         "//deps/cpython:0002-Set-the-install-name-to-use-rpath-instead-of-absolut.patch",
     ],
-    sha256 = "cfac63bddf956deafb1172ca131ae5dcaafd6f95056086e233fca205593ed427",
+    sha256 = "99dbc847fb6a3fb26358370fb4c591215864116ebb584f2b89ab0b74c51dfa2a",
     strip_prefix = "Python-{}".format(PYTHON_VERSION),
     url = "https://python.org/ftp/python/{0}/Python-{0}.tgz".format(PYTHON_VERSION),
 )

omnibus/config/software/cacerts.rb

@@ -27,9 +27,9 @@
 
 # Pinned to a dated curl release: the moving cacert.pem breaks every build when
 # curl publishes a new bundle, and this fork has no monitor for it.
-default_version "2026-09-25"
+default_version "2026-10-20"
 source url: "https://curl.se/ca/cacert-#{version}.pem",
-       sha256: "a41b5d356aea97a529fe27e0f7316d2f9d946d75927476cf9cf1b90637d00505",
+       sha256: "796f1389bfea13c0ed78f663b765baaff54a508e5483786bd6ece73c5e3e3cbe",
        target_filename: "cacert.pem"
 
 relative_path "cacerts-#{version}"

omnibus/config/software/python3.rb

@@ -1,6 +1,6 @@
 name "python3"
 
-default_version "3.13.16"
+default_version "3.13.18"
 
 # Omnibus does not fingerprint Bazel source patches. Always invoke Bazel so its
 # own cache validates the CPython inputs, including same-version security fixes.

releasenotes/notes/bump-embedded-python-3-13-18-8d0e3f244cba82f1.yaml

@@ -0,0 +1,4 @@
+---
+enhancements:
+  - |
+    Bump embedded Python to 3.13.18 and refresh the bundled CA certificates.

scripts/test_embedded_python_security.py

@@ -1,20 +1,71 @@
 """Check security fixes using the packaged Python interpreter and dependencies."""
 
+import contextlib
 import hashlib
 import io
+import os
 import platform
+import shutil
 import stringprep
 import sys
 import tarfile
 import tempfile
 import unittest
 from pathlib import Path
+from unittest import mock
 
 import jwt
 from build._compat.tarfile import safe_extractall
 
 
 class EmbeddedPythonSecurityTests(unittest.TestCase):
+    @unittest.skipUnless(
+        os.name == "posix" and shutil.rmtree.avoids_symlink_attacks,
+        "requires POSIX fd-based directory removal",
+    )
+    @unittest.skipIf(hasattr(os, "geteuid") and os.geteuid() == 0, "requires a non-root user")
+    def test_runtime_maintenance(self):
+        with tempfile.TemporaryDirectory() as outside:
+            target = Path(outside) / "file1"
+            target.write_bytes(b"outside")
+            before = target.stat()
+            directory = tempfile.TemporaryDirectory()
+            original = Path(directory.name) / "dir1"
+            moved = Path(directory.name) / "dir1_moved"
+            original.mkdir()
+            (original / "file1").write_bytes(b"inside")
+            original.chmod(0o500)
+            unlink = os.unlink
+            raced = False
+
+            def replace_on_permission_error(path, *, dir_fd=None):
+                nonlocal raced
+                try:
+                    return unlink(path, dir_fd=dir_fd)
+                except PermissionError:
+                    if not original.is_symlink():
+                        original.chmod(0o700)
+                        original.rename(moved)
+                        original.symlink_to(outside, target_is_directory=True)
+                        raced = True
+                    raise
+
+            try:
+                with mock.patch("os.unlink", replace_on_permission_error), contextlib.suppress(OSError):
+                    directory.cleanup()
+                self.assertTrue(raced, "runtime check must execute")
+                self.assertTrue(target.is_file(), "runtime check must preserve the fixture")
+                self.assertEqual(target.read_bytes(), b"outside")
+                after = target.stat()
+                self.assertEqual((after.st_mode, after.st_mtime_ns), (before.st_mode, before.st_mtime_ns))
+            finally:
+                if original.is_symlink():
+                    original.unlink()
+                    moved.rename(original)
+                if original.exists():
+                    original.chmod(0o700)
+                directory.cleanup()
+
     def test_jwt_options_reuse_preserves_claim_verification(self):
         # CVE-2026-103001: an unsigned inspection must not mutate reusable
         # options and disable expiry checking on a later verified decode.

test/new-e2e/tests/agent-platform/common/agent_behaviour.go

@@ -223,7 +223,7 @@ const (
 	ExpectedPythonVersion2 = "2.7.18"
 	// ExpectedPythonVersion3 is the expected python 3 version
 	// Bump this version when deps/cpython/cpython.MODULE.bazel changes
-	ExpectedPythonVersion3 = "3.13.16"
+	ExpectedPythonVersion3 = "3.13.18"
 	// ExpectedUnloadedPython is the status value for uninitialized lazy loaded python runtime
 	ExpectedUnloadedPython = "unused"
 )