Skip to content

[3.11] gh-145599, CVE 2026-3644: Reject control characters in http.cookies.Morsel.update() (GH-145600) #185855

[3.11] gh-145599, CVE 2026-3644: Reject control characters in http.cookies.Morsel.update() (GH-145600)

[3.11] gh-145599, CVE 2026-3644: Reject control characters in http.cookies.Morsel.update() (GH-145600) #185855

Triggered via pull request March 16, 2026 13:54
Status Success
Total duration 38m 44s
Artifacts 1

build.yml

on: pull_request
Check for source changes
12s
Check for source changes
Matrix: macOS / build and test
Matrix: Ubuntu / build and test
Matrix: Ubuntu SSL tests with OpenSSL
Check if the ABI has changed
1m 25s
Check if the ABI has changed
All required checks pass
4s
All required checks pass
Fit to window
Zoom out
Zoom in

Annotations

15 warnings
Check for source changes
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: Ana06/get-changed-files@v2.3.0. Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
Check if the ABI has changed
The `python-version` input is not set. The version of Python currently in `PATH` will be used.
Check if generated files are up to date
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: hendrikmuhs/ccache-action@v1.2. Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
macOS / build and test (macos-14)
`$HOMEBREW_NO_INSTALLED_DEPENDENTS_CHECK` is set: not checking for outdated dependents or dependents with broken linkage!
macOS / build and test (macos-14)
tcl-tk@8 8.6.17 is already installed and up-to-date. To reinstall 8.6.17, run: brew reinstall tcl-tk@8
macOS / build and test (macos-14)
gdbm 1.26 is already installed and up-to-date. To reinstall 1.26, run: brew reinstall gdbm
macOS / build and test (macos-14)
xz 5.8.2 is already installed and up-to-date. To reinstall 5.8.2, run: brew reinstall xz
macOS / build and test (macos-14)
pkgconf 2.5.1 is already installed and up-to-date. To reinstall 2.5.1, run: brew reinstall pkgconf
Ubuntu / build and test (ubuntu-22.04)
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: hendrikmuhs/ccache-action@v1.2. Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
Address sanitizer
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: hendrikmuhs/ccache-action@v1.2. Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
macOS / build and test (macos-15-intel)
`$HOMEBREW_NO_INSTALLED_DEPENDENTS_CHECK` is set: not checking for outdated dependents or dependents with broken linkage!
macOS / build and test (macos-15-intel)
tcl-tk@8 8.6.17 is already installed and up-to-date. To reinstall 8.6.17, run: brew reinstall tcl-tk@8
macOS / build and test (macos-15-intel)
gdbm 1.26 is already installed and up-to-date. To reinstall 1.26, run: brew reinstall gdbm
macOS / build and test (macos-15-intel)
xz 5.8.2 is already installed and up-to-date. To reinstall 5.8.2, run: brew reinstall xz
macOS / build and test (macos-15-intel)
pkgconf 2.5.1 is already installed and up-to-date. To reinstall 2.5.1, run: brew reinstall pkgconf

Artifacts

Produced during runtime
Name Size Digest
doc-html
12 MB
sha256:4547b543ecc345f5bb535d30d448c71d882b49359116644f1f4b62de1ceba185