Skip to content

Commit 8baa5a0

Browse files
fgmacedofgmacedo
committed
chore: prepare release 3.2.0
- Set the release date (June 16, 2026). - Scope the security note: state the affected versions (>= 3.0.0, < 3.2.0) and clarify that only loading SCXML documents from untrusted sources was affected, not machines defined in Python. - Refresh translation catalog source references (no new translatable strings). Signed-off-by: Fernando Macedo <fgmacedo@gmail.com>
1 parent af3db7d commit 8baa5a0

5 files changed

Lines changed: 92 additions & 77 deletions

File tree

‎docs/releases/3.2.0.md‎

Lines changed: 16 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
# StateChart 3.2.0
22

3-
*Not released yet*
3+
*June 16, 2026*
44

55
```{warning}
66
**Python 3.9 support dropped.** StateMachine 3.2.0 requires Python 3.10 or
@@ -36,6 +36,21 @@ will continue to run unchanged on 3.2.
3636

3737
### SCXML datamodel is now safe by default (GHSA-v4jc-pm6r-3vj8, CVE-2026-47103)
3838

39+
```{note}
40+
**Affected versions:** `>= 3.0.0, < 3.2.0` (fixed in 3.2.0).
41+
42+
**Am I affected?** Only if you *load statechart documents from an untrusted or
43+
third-party source* through the (experimental, previously undocumented) SCXML
44+
loader — `statemachine.io.scxml.SCXMLProcessor` or parsing a `.scxml` file. That
45+
loader is the only path that ever evaluated expressions from a document with
46+
`eval`/`exec`.
47+
48+
If you define your machines in Python with `StateMachine` / `StateChart` — the
49+
normal way to use this library — you are **not** affected. "SCXML" here names the
50+
W3C *execution model* the engine implements, not a file you load: nothing from a
51+
document is evaluated, because there is no document.
52+
```
53+
3954
SCXML is *executable content* per the W3C specification: `cond`/`expr`
4055
attributes and `<script>` elements are evaluated in the datamodel language,
4156
and this library implements a Python datamodel. Previously

‎statemachine/locale/en/LC_MESSAGES/statemachine.po‎

Lines changed: 19 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ msgid ""
55
msgstr ""
66
"Project-Id-Version: 3.1.1\n"
77
"Report-Msgid-Bugs-To: fgmacedo@gmail.com\n"
8-
"POT-Creation-Date: 2026-05-18 16:16-0300\n"
8+
"POT-Creation-Date: 2026-06-16 23:00-0300\n"
99
"PO-Revision-Date: 2026-02-24 14:31-0300\n"
1010
"Last-Translator: Fernando Macedo <fgmacedo@gmail.com>\n"
1111
"Language: en\n"
@@ -16,25 +16,25 @@ msgstr ""
1616
"Content-Transfer-Encoding: 8bit\n"
1717
"Generated-By: Babel 2.18.0\n"
1818

19-
#: statemachine/callbacks.py:404 statemachine/callbacks.py:409
19+
#: statemachine/callbacks.py:398 statemachine/callbacks.py:403
2020
#, python-brace-format
2121
msgid "Did not found name '{}' from model or statemachine"
2222
msgstr "Did not found name '{}' from model or statemachine"
2323

24-
#: statemachine/configuration.py:129
24+
#: statemachine/configuration.py:128
2525
msgid ""
2626
"There's no current state set. In async code, did you activate the initial"
2727
" state? (e.g., `await sm.activate_initial_state()`)"
2828
msgstr ""
2929
"There's no current state set. In async code, did you activate the initial"
3030
" state? (e.g., `await sm.activate_initial_state()`)"
3131

32-
#: statemachine/dispatcher.py:126
32+
#: statemachine/dispatcher.py:123
3333
#, python-brace-format
3434
msgid "Failed to parse boolean expression '{}'"
3535
msgstr "Failed to parse boolean expression '{}'"
3636

37-
#: statemachine/event.py:95
37+
#: statemachine/event.py:94
3838
#, python-brace-format
3939
msgid ""
4040
"Event() received a non-string 'id' ({cls_name}). To combine multiple "
@@ -43,12 +43,12 @@ msgstr ""
4343
"Event() received a non-string 'id' ({cls_name}). To combine multiple "
4444
"transitions under one event, use the | operator: t1 | t2."
4545

46-
#: statemachine/event.py:131
46+
#: statemachine/event.py:130
4747
#, python-brace-format
4848
msgid "Cannot add callback '{}' to an event with no transitions."
4949
msgstr "Cannot add callback '{}' to an event with no transitions."
5050

51-
#: statemachine/event.py:164
51+
#: statemachine/event.py:163
5252
#, python-brace-format
5353
msgid "Event {} cannot be called without a SM instance"
5454
msgstr "Event {} cannot be called without a SM instance"
@@ -63,7 +63,7 @@ msgstr "{!r} is not a valid state value."
6363
msgid "Can't {} when in {}."
6464
msgstr "Can't {} when in {}."
6565

66-
#: statemachine/factory.py:81
66+
#: statemachine/factory.py:77
6767
#, python-brace-format
6868
msgid ""
6969
"There should be one and only one initial state. Your currently have "
@@ -72,7 +72,7 @@ msgstr ""
7272
"There should be one and only one initial state. Your currently have "
7373
"these: {0}"
7474

75-
#: statemachine/factory.py:198
75+
#: statemachine/factory.py:194
7676
#, python-brace-format
7777
msgid ""
7878
"There should be one and only one initial state. You currently have these:"
@@ -81,12 +81,12 @@ msgstr ""
8181
"There should be one and only one initial state. You currently have these:"
8282
" {!r}"
8383

84-
#: statemachine/factory.py:213
84+
#: statemachine/factory.py:209
8585
#, python-brace-format
8686
msgid "Cannot declare transitions from final state. Invalid state(s): {}"
8787
msgstr "Cannot declare transitions from final state. Invalid state(s): {}"
8888

89-
#: statemachine/factory.py:225
89+
#: statemachine/factory.py:221
9090
#, python-brace-format
9191
msgid ""
9292
"All non-final states should have at least one outgoing transition. These "
@@ -95,7 +95,7 @@ msgstr ""
9595
"All non-final states should have at least one outgoing transition. These "
9696
"states have no outgoing transition: {!r}"
9797

98-
#: statemachine/factory.py:239
98+
#: statemachine/factory.py:235
9999
#, python-brace-format
100100
msgid ""
101101
"All non-final states should have at least one path to a final state. "
@@ -104,7 +104,7 @@ msgstr ""
104104
"All non-final states should have at least one path to a final state. "
105105
"These states have no path to a final state: {!r}"
106106

107-
#: statemachine/factory.py:252
107+
#: statemachine/factory.py:248
108108
#, python-brace-format
109109
msgid ""
110110
"There are unreachable states. The statemachine graph should have a single"
@@ -113,7 +113,7 @@ msgstr ""
113113
"There are unreachable states. The statemachine graph should have a single"
114114
" component. Disconnected states: {}"
115115

116-
#: statemachine/factory.py:289
116+
#: statemachine/factory.py:285
117117
#, python-brace-format
118118
msgid ""
119119
"Invalid entry in 'listeners': {!r}. Expected a class, callable, or "
@@ -122,7 +122,7 @@ msgstr ""
122122
"Invalid entry in 'listeners': {!r}. Expected a class, callable, or "
123123
"listener instance."
124124

125-
#: statemachine/factory.py:388
125+
#: statemachine/factory.py:384
126126
#, python-brace-format
127127
msgid "An event in the '{}' has no id."
128128
msgstr "An event in the '{}' has no id."
@@ -132,20 +132,20 @@ msgstr "An event in the '{}' has no id."
132132
msgid "{!r} is not a valid state machine name."
133133
msgstr "{!r} is not a valid state machine name."
134134

135-
#: statemachine/state.py:250
135+
#: statemachine/state.py:249
136136
msgid "'donedata' can only be specified on final states."
137137
msgstr "'donedata' can only be specified on final states."
138138

139-
#: statemachine/statemachine.py:169
139+
#: statemachine/statemachine.py:167
140140
msgid "There are no states or transitions."
141141
msgstr "There are no states or transitions."
142142

143-
#: statemachine/statemachine.py:239
143+
#: statemachine/statemachine.py:237
144144
#, python-brace-format
145145
msgid "State overriding is not allowed. Trying to add '{}' to {}"
146146
msgstr "State overriding is not allowed. Trying to add '{}' to {}"
147147

148-
#: statemachine/transition.py:75
148+
#: statemachine/transition.py:74
149149
#, python-brace-format
150150
msgid ""
151151
"Not a valid internal transition from source {source!r}, target {target!r}"

‎statemachine/locale/hi_IN/LC_MESSAGES/statemachine.po‎

Lines changed: 19 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ msgid ""
55
msgstr ""
66
"Project-Id-Version: 3.1.1\n"
77
"Report-Msgid-Bugs-To: fgmacedo@gmail.com\n"
8-
"POT-Creation-Date: 2026-05-18 16:16-0300\n"
8+
"POT-Creation-Date: 2026-06-16 23:00-0300\n"
99
"PO-Revision-Date: 2024-06-07 17:41-0300\n"
1010
"Last-Translator: Fernando Macedo <fgmacedo@gmail.com>\n"
1111
"Language: hi_IN\n"
@@ -16,25 +16,25 @@ msgstr ""
1616
"Content-Transfer-Encoding: 8bit\n"
1717
"Generated-By: Babel 2.18.0\n"
1818

19-
#: statemachine/callbacks.py:404 statemachine/callbacks.py:409
19+
#: statemachine/callbacks.py:398 statemachine/callbacks.py:403
2020
#, python-brace-format
2121
msgid "Did not found name '{}' from model or statemachine"
2222
msgstr "मॉडल या स्टेटमशीन में नाम '{}' नहीं मिला"
2323

24-
#: statemachine/configuration.py:129
24+
#: statemachine/configuration.py:128
2525
msgid ""
2626
"There's no current state set. In async code, did you activate the initial"
2727
" state? (e.g., `await sm.activate_initial_state()`)"
2828
msgstr ""
2929
"कोई वर्तमान स्टेट सेट नहीं है। असिंक्रोनस कोड में, क्या आपने प्रारंभिक "
3030
"स्टेट को सक्रिय किया? (उदाहरण: `await sm.activate_initial_state()`)"
3131

32-
#: statemachine/dispatcher.py:126
32+
#: statemachine/dispatcher.py:123
3333
#, python-brace-format
3434
msgid "Failed to parse boolean expression '{}'"
3535
msgstr "बूलियन अभिव्यक्ति '{}' को पार्स करने में विफल रहा"
3636

37-
#: statemachine/event.py:95
37+
#: statemachine/event.py:94
3838
#, python-brace-format
3939
msgid ""
4040
"Event() received a non-string 'id' ({cls_name}). To combine multiple "
@@ -43,12 +43,12 @@ msgstr ""
4343
"Event() को एक गैर-स्ट्रिंग 'id' ({cls_name}) मिला। एक ही इवेंट के तहत कई "
4444
"ट्रांज़िशन को जोड़ने के लिए, | ऑपरेटर का उपयोग करें: t1 | t2।"
4545

46-
#: statemachine/event.py:131
46+
#: statemachine/event.py:130
4747
#, python-brace-format
4848
msgid "Cannot add callback '{}' to an event with no transitions."
4949
msgstr "बिना ट्रांज़िशन वाले इवेंट में कॉलबैक '{}' नहीं जोड़ सकते।"
5050

51-
#: statemachine/event.py:164
51+
#: statemachine/event.py:163
5252
#, python-brace-format
5353
msgid "Event {} cannot be called without a SM instance"
5454
msgstr "इवेंट {} को SM इंस्टेंस के बिना कॉल नहीं किया जा सकता"
@@ -63,14 +63,14 @@ msgstr "{!r} एक मान्य स्टेट मान नहीं ह
6363
msgid "Can't {} when in {}."
6464
msgstr "{} स्थिति में {} नहीं कर सकते।"
6565

66-
#: statemachine/factory.py:81
66+
#: statemachine/factory.py:77
6767
#, python-brace-format
6868
msgid ""
6969
"There should be one and only one initial state. Your currently have "
7070
"these: {0}"
7171
msgstr "एक और केवल एक प्रारंभिक स्टेट होना चाहिए। वर्तमान में आपके पास ये हैं: {0}"
7272

73-
#: statemachine/factory.py:198
73+
#: statemachine/factory.py:194
7474
#, python-brace-format
7575
msgid ""
7676
"There should be one and only one initial state. You currently have these:"
@@ -79,12 +79,12 @@ msgstr ""
7979
"एक और केवल एक प्रारंभिक स्टेट होना चाहिए। वर्तमान में आपके पास ये हैं: "
8080
"{!r}"
8181

82-
#: statemachine/factory.py:213
82+
#: statemachine/factory.py:209
8383
#, python-brace-format
8484
msgid "Cannot declare transitions from final state. Invalid state(s): {}"
8585
msgstr "अंतिम स्टेट से ट्रांज़िशन घोषित नहीं कर सकते। अमान्य स्टेट: {}"
8686

87-
#: statemachine/factory.py:225
87+
#: statemachine/factory.py:221
8888
#, python-brace-format
8989
msgid ""
9090
"All non-final states should have at least one outgoing transition. These "
@@ -93,7 +93,7 @@ msgstr ""
9393
"सभी गैर-अंतिम स्टेट में कम से कम एक आउटगोइंग ट्रांज़िशन होना चाहिए। इन "
9494
"स्टेट में कोई आउटगोइंग ट्रांज़िशन नहीं है: {!r}"
9595

96-
#: statemachine/factory.py:239
96+
#: statemachine/factory.py:235
9797
#, python-brace-format
9898
msgid ""
9999
"All non-final states should have at least one path to a final state. "
@@ -102,7 +102,7 @@ msgstr ""
102102
"सभी गैर-अंतिम स्टेट में अंतिम स्टेट तक कम से कम एक पथ होना चाहिए। इन "
103103
"स्टेट में अंतिम स्टेट तक कोई पथ नहीं है: {!r}"
104104

105-
#: statemachine/factory.py:252
105+
#: statemachine/factory.py:248
106106
#, python-brace-format
107107
msgid ""
108108
"There are unreachable states. The statemachine graph should have a single"
@@ -111,7 +111,7 @@ msgstr ""
111111
"कुछ स्टेट पहुंच योग्य नहीं हैं। स्टेटमशीन ग्राफ में एक ही घटक होना चाहिए।"
112112
" डिस्कनेक्टेड स्टेट: {}"
113113

114-
#: statemachine/factory.py:289
114+
#: statemachine/factory.py:285
115115
#, python-brace-format
116116
msgid ""
117117
"Invalid entry in 'listeners': {!r}. Expected a class, callable, or "
@@ -120,7 +120,7 @@ msgstr ""
120120
"'listeners' में अमान्य प्रविष्टि: {!r}। एक क्लास, कॉलेबल, या लिसनर "
121121
"इंस्टेंस अपेक्षित है।"
122122

123-
#: statemachine/factory.py:388
123+
#: statemachine/factory.py:384
124124
#, python-brace-format
125125
msgid "An event in the '{}' has no id."
126126
msgstr "'{}' में एक इवेंट का आईडी नहीं है।"
@@ -130,22 +130,22 @@ msgstr "'{}' में एक इवेंट का आईडी नहीं
130130
msgid "{!r} is not a valid state machine name."
131131
msgstr "{!r} एक मान्य स्टेटमशीन नाम नहीं है।"
132132

133-
#: statemachine/state.py:250
133+
#: statemachine/state.py:249
134134
msgid "'donedata' can only be specified on final states."
135135
msgstr "'donedata' केवल अंतिम स्टेट पर निर्दिष्ट किया जा सकता है।"
136136

137-
#: statemachine/statemachine.py:169
137+
#: statemachine/statemachine.py:167
138138
msgid "There are no states or transitions."
139139
msgstr "कोई स्टेट या ट्रांज़िशन नहीं हैं।"
140140

141-
#: statemachine/statemachine.py:239
141+
#: statemachine/statemachine.py:237
142142
#, python-brace-format
143143
msgid "State overriding is not allowed. Trying to add '{}' to {}"
144144
msgstr ""
145145
"स्टेट ओवरराइड करना अनुमति नहीं है। '{}' को {} में जोड़ने की कोशिश कर रहे "
146146
"हैं"
147147

148-
#: statemachine/transition.py:75
148+
#: statemachine/transition.py:74
149149
#, python-brace-format
150150
msgid ""
151151
"Not a valid internal transition from source {source!r}, target {target!r}"

0 commit comments

Comments
 (0)