August was a month for reading release notes rather than writing new code. Python 3.15 stopped accepting changes to its application binary interface, and three older branches got security patches with real CVEs behind them. Four separate AI libraries shipped breaking releases in ten days, and the last of them knocked over a downstream framework, which then took about nine hours to ship a fix.
If you maintain anything that pins a dependency, then this was less a month of new toys and more a month of checking what you’re standing on.
There was one new piece of syntax to look forward to, though, and it closes a gap that has irritated everyone writing asynchronous code for years. On August 3, Yury Selivanov, the Steering Council’s appointed delegate for the PEP, accepted PEP 828.
Join Now: Click here to join the Real Python Newsletter and you’ll never miss another Python tutorial, course, or news update.
Async Generators Finally Get yield from
Sync generators have had yield from since Python 3.3. Async generators never got an equivalent, so delegating to another async generator has always meant writing the loop by hand:
async def wrapper():
async for item in numbers():
yield item
That works right up until it doesn’t. The manual loop only forwards values in one direction. If a caller uses .asend() to push a value back into wrapper(), or .athrow() to raise inside it, or .aclose() to shut it down, then none of that reaches numbers(). The loop swallows it. Worse, there’s no way to capture what the inner generator returned, because StopAsyncIteration has never carried a value.
PEP 828 fixes both problems by allowing yield from inside async generators, starting in Python 3.16:
async def numbers():
yield 1
yield 2
return "done"
async def wrapper():
result = yield from numbers()
print(result)
The delegation becomes the interpreter’s job. Values, exceptions, and close requests all propagate through to the inner generator the way they do in sync code, and the PEP adds a .value attribute to StopAsyncIteration so the return statement finally means something.
Note: If the difference between .asend() and a plain async for is new to you, then Python’s asyncio: A Hands-On Walkthrough and How to Use Generators and yield in Python cover both halves of what PEP 828 is joining together.
The PEP’s tracking issue closed on August 7, targeting Python 3.16. That’s a wait, but this is the kind of change that deletes a category of bug rather than adding a feature you have to learn.
Python Releases and PEP Highlights
Three releases, seven new PEP drafts, a rejection, and a withdrawal. The releases matter more than usual this month because two of them close doors rather than open them: one freezes an interface for the rest of the 3.15 series, and the other patches holes that have gone unfixed considerably longer than anyone would like. The PEPs are the opposite, all possibility and no obligation, which makes them the fun part.
Release Candidate 1 Freezes the ABI
Python 3.15.0rc1 arrived on August 4, exactly on the schedule August’s Python news laid out. The headline isn’t a feature, because the feature set has been settled since the freeze back in May. It’s that the application binary interface, or ABI, is now locked for the entire 3.15 series. From here, only reviewed bug fixes land.
For most people, that’s trivia. If you ship a C extension module, then it’s the moment your build either works or doesn’t, and you have until October to find out.
That contract between compiled extensions and the interpreter puts a lot of weight on three letters. If you want it unpacked, then Quansight’s tour of the CPython ABI remains the clearest walkthrough of what’s being promised, and we covered the free-threaded stable ABI in May’s Python news.
The release candidate bundles what 3.15 has been assembling all year: frozendict, sentinel, explicit lazy imports, UTF-8 by default, unpacking in comprehensions, a JIT worth roughly 8 to 9 percent on x86-64 Linux, and official macOS installers that now ship the free-threaded build by default.
Release candidate 2 followed on September 1, and PEP 790 schedules the final release for October 1. That last date is a target rather than a promise, but the direction is set. If you’ve been meaning to test against 3.15, then the excuse that it’s still changing expired on August 4.
Three Branches Get a Security Release
On August 12, Python 3.12.14, 3.11.16, and 3.10.21 shipped together, and this batch has teeth. CVE-2026-4224 covers unbounded recursion in XML parsing, and CVE-2026-3644 covers control characters slipping into HTTP cookies.
Alongside those sit a symlink bypass in the tarfile extraction filter, a Windows-only path bug in shutil.unpack_archive() for ZIP files, buffer issues in bz2 and lzma, and an FTP PASV validation flaw that completes a fix first issued back in 2021.
The tarfile one is worth pausing on because it’s a hole in the safety net itself, not in the risky path you’d expect. Here’s the call that’s supposed to be safe:
