Version 1.3.3 is the current supported release. Security fixes are maintained on the 1.3.x line.

The supported runtime is CPython >=3.13,<3.14 with bytecode>=0.17,<0.18. Expanding that boundary requires a new compatibility and verifier qualification pass.

Use GitHub private vulnerability reporting / Security Advisories for Karvp/cpython-extensions when available. Do not post exploit details publicly before maintainers have had an opportunity to triage the issue.

Include, when relevant:

• package version, CPython patch version, OS, and architecture;
• a minimal source-file reproducer;
• affected subsystem and selected mode/backend;
• explain_extensions() / verify_code() output;
• runtime_diagnostics(full=True) output for runtime/native issues;
• whether the issue can crash CPython, corrupt state, cross a documented control-flow boundary, bypass a guard/verifier, or publish unverified artifacts.

Examples include:

• invalid generated bytecode or stack-depth accounting;
• verifier acceptance of an invalid control-flow/exception-region edge;
• strict-goto boundary bypass;
• specialization or guarded-inline deoptimization that selects non-equivalent state;
• races outside the documented transformation/live-mode contract;
• memory-safety or stale-state failures in the optional _livegate extension;
• live dispatch that violates Python key/equality semantics or writes an invalid jump gate;
• runtime qualification that falsely accepts an unsupported interpreter, executes application code, or retains unbounded state;
• release/publishing failures that could publish bytes different from the validated artifacts.

Documented hazards of explicit low-level modes (enable_goto(mode="unsafe"), live switch modes) are not vulnerabilities by themselves; behavior outside their documented boundary may be.

python_extensions._livegate is an optional accelerator. live_engine="auto" falls back when the native module is unavailable or fails its self-test. Live switch is unsupported on free-threaded CPython 3.13.

For native/live reports, include live_engine, switch mode, route-key shape, concurrency/re-entry mode, and whether the issue reproduces with live_engine="ctypes" or portable mode.

Stable releases use reproducible artifact checks, checksum verification, metadata validation, GitHub Release asset verification, and PyPI Trusted Publishing through OIDC. Stable publication is restricted to the exact validated v<package-version> tag and protected pypi environment.

Never commit API tokens, private/signing keys, package-index credentials, or other secrets.