gh-137586: Add NEWS entries for MacOSX webbrowser change

secengjeff · secengjeff · commit 60662214f7c8 · 2026-03-25T18:42:25.000-07:00
diff --git a/Misc/NEWS.d/next/Library/2026-03-26-01-42-20.gh-issue-137586.KmHRwR.rst b/Misc/NEWS.d/next/Library/2026-03-26-01-42-20.gh-issue-137586.KmHRwR.rst
@@ -0,0 +1,3 @@
+Add :class:`MacOSX` to :mod:`webbrowser` for macOS, which opens URLs via
+``/usr/bin/open`` instead of piping AppleScript to ``osascript``.
+Deprecate :class:`MacOSXOSAScript` in favour of :class:`MacOSX`.
diff --git a/Misc/NEWS.d/next/Security/2026-03-26-01-42-15.gh-issue-137586.j3SkOm.rst b/Misc/NEWS.d/next/Security/2026-03-26-01-42-15.gh-issue-137586.j3SkOm.rst
@@ -0,0 +1,4 @@
+Fix a PATH-injection vulnerability in :mod:`webbrowser` on macOS where
+``osascript`` was invoked without an absolute path. The new :class:`MacOSX`
+class uses ``/usr/bin/open`` directly, eliminating the dependency on
+``osascript`` entirely.

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,3 @@`
	`1`	+Add :class:`MacOSX` to :mod:`webbrowser` for macOS, which opens URLs via
	`2`	+``/usr/bin/open`` instead of piping AppleScript to ``osascript``.
	`3`	+Deprecate :class:`MacOSXOSAScript` in favour of :class:`MacOSX`.