Python 3.10 is finished, and a tarfile bug is fixed

On 1 October 2026 the Python team published a sweep of releases: 3.10.22, 3.11.17, 3.12.15, 3.13.16, and 3.14.8. Pablo Galindo’s note on the Python blog is blunt about the oldest of them. 3.10.22 is the last 3.10 release. After five years, that series is end of life and will not get more security updates. If a service still runs 3.10, the upgrade plan is now late.

The releases are not only a calendar event. CVE-2026-82049, tracked as gh-157190, fixes a tarfile extraction-filter bug. Hard links that point at symbolic links could expose files outside the destination directory and change their permissions or modification times. Python 3.14 and later were already protected, because os.link() follows symbolic links from 3.14.0b1. Older lines needed the patch.

Support windows differ after this drop. 3.12 keeps security fixes until October 2028, and 3.12.15 is source-only. 3.13.16 is the last full maintenance release of 3.13. Later 3.13 builds will be security-only. 3.13.16 and 3.14.8 ship binary installers. Both of those also update bundled OpenSSL to 3.5.9 on the platforms that bundle it. On 3.13 that means Windows, macOS, and Android, moving off the 3.0 series onto 3.5. On 3.14 it also covers iOS. The source-only 3.10 through 3.12 releases do not bundle OpenSSL, so those installs still depend on the system library.

The action is two checks, not one. Which interpreter version is in production, and which OpenSSL that interpreter actually loads. A patched Python on top of an old system OpenSSL is only half the update. And a box still on 3.10 does not have another Python security release coming.