Release Date: March 16, 2022

This is the eleventh maintenance release of Python 3.9

Note: The release you're looking at is Python 3.9.11, a bugfix release for the legacy 3.9 series. Python 3.11 is now the latest feature release series of Python 3. Get the latest release of 3.11.x here.

Security content in this release

• 15 (sic!) CVEs: libexpat upgraded from 2.4.1 to 2.4.7 (BPO-46794, BPO-46932, BPO-46811, BPO-46784, BPO-46400)
• CVE-2022-0778: OpenSSL upgraded from 1.1.1l to 1.1.1n in macOS and Windows installers (BPO-47024)
• CVE-2016-3189, CVE-2019-12900: bzip2 upgraded from 1.0.6 to 1.0.8 in Windows installers (BPO-44549)
• CVE-2022-26488: Windows installer now ensures the correct path is being repaired when "Add to PATH" is used (BPO-46948)
• CVE-2021-28363: bundled pip upgraded from 21.2.4 to 22.0.4 (BPO-46985)
• authorization bypass fixed in urllib.request (BPO-46756)
• REDoS avoided in importlib.metadata (BPO-46474)
• SQLite upgraded from 3.36.0 to 3.37.2 in macOS and Windows installers (BPO-45925)

Major new features of the 3.9 series, compared to 3.8

Some of the new major new features and changes in Python 3.9 are:

• PEP 573, Module State Access from C Extension Methods
• PEP 584, Union Operators in dict
• PEP 585, Type Hinting Generics In Standard Collections
• PEP 593, Flexible function and variable annotations
• PEP 602, Python adopts a stable annual release cadence
• PEP 614, Relaxing Grammar Restrictions On Decorators
• PEP 615, Support for the IANA Time Zone Database in the Standard Library
• PEP 616, String methods to remove prefixes and suffixes
• PEP 617, New PEG parser for CPython
• BPO 38379, garbage collection does not block on resurrected objects;
• BPO 38692, os.pidfd_open added that allows process management without races and signals;
• BPO 39926, Unicode support updated to version 13.0.0;
• BPO 1635741, when Python is initialized multiple times in the same process, it does not leak memory anymore;
• A number of Python builtins (range, tuple, set, frozenset, list, dict) are now sped up using PEP 590 vectorcall;
• A number of Python modules (_abc, audioop, _bz2, _codecs, _contextvars, _crypt, _functools, _json, _locale, operator, resource, time, _weakref) now use multiphase initialization as defined by PEP 489;
• A number of standard library modules (audioop, ast, grp, _hashlib, pwd, _posixsubprocess, random, select, struct, termios, zlib) are now using the stable ABI defined by PEP 384.

You can find a more comprehensive list in this release's "What's New" document.

More resources

• Online Documentation
• PEP 596, 3.9 Release Schedule
• Report bugs at https://bugs.python.org.
• Help fund Python and its community.

And Now for Something Completely Different

King Arthur: I am your king.
Peasant Woman: Well, I didn't vote for you.
King Arthur: You don't vote for kings.
Peasant Woman: Well, how'd you become king, then?
(Angelic music plays...)
King Arthur: The Lady of the Lake, her arm clad in the purest shimmering samite, held aloft Excalibur from the bosom of the water, signifying by divine providence that I, Arthur, was to carry Excalibur. That is why I am your king.
Dennis the Peasant: Listen. Strange women lying in ponds distributing swords is no basis for a system of government. Supreme executive power derives from a mandate from the masses, not from some farcical aquatic ceremony.

Full Changelog