semvec/pypi-packages huggingface dataset:
filelock-lts-py310 2025.68146.1
Python 3.9 compatible filelock with CVE-2025-68146 patch
License: Unlicense
Requires Python: <3.11,>=3.10

# Filelock LTS (py3.10) - ➡️ REDIRECT


> **⚠️ Disclaimer:** This project is **not affiliated with, endorsed by, or associated with** the official `filelock` maintainers. All patches and releases are independently maintained and provided on a best-effort basis to support legacy environments.


| **Metric** | **Details** |
|:---|:---|
| **CVE** | [CVE-2025-68146](https://nvd.nist.gov/vuln/detail/CVE-2025-68146) |
| **Version** | `2025.68146` |
| **Base Core** | `filelock Upstream >= 3.20.1` |
| **Python** | `Python 3.10` |
| **License** | Unlicense (Public Domain) |

---

## ➡️ Modern Python Redirect
This package ensures you are using a secure version of filelock on Python 3.10.

Since Python 3.10 is supported by the official upstream maintainers, this LTS package acts as a **Meta-Package / Proxy**.

### How it works
Installing this package automatically installs the official `filelock >= 3.20.1`, which contains the official fix for CVE-2025-68146.

```bash
pip install filelock-lts-py3.10
```

### Why use this?
- **Consistency**: Use `filelock-lts` across your entire fleet (legacy and modern) without changing requirements files.
- **Continuity**: Ensures automated security redirect logic remains active even if upstream release patterns change.


## 🔮 The Future: Proactive Dependency Security
The Filelock LTS ecosystem is evolving to provide earlier visibility and stronger controls around dependency risk:

1.  **Early Warning Releases**: Placeholder LTS releases may be published when a potential upstream security issue is under investigation, allowing users to prepare before official advisories are issued.
2.  **Runtime Policy Enforcement (Optional)**: An opt-in runtime module that detects vulnerable dependency versions at runtime and enforces user-configured policies (warn, block, or isolate).
3.  **Configurable Security Policies**: Teams can choose how unpatched dependencies are handled based on their risk tolerance and operational needs.
filelock-lts-py39 2025.68146.2
Python 3.9 compatible filelock with CVE-2025-68146 patch
License: Unlicense
Requires Python: <3.10,>=3.9

# Filelock LTS (py3.9) - 🛡️ PATCHED (Backport)


> **⚠️ Disclaimer:** This project is **not affiliated with, endorsed by, or associated with** the official `filelock` maintainers. All patches and releases are independently maintained and provided on a best-effort basis to support legacy environments.


| **Metric** | **Details** |
|:---|:---|
| **CVE** | [CVE-2025-68146](https://nvd.nist.gov/vuln/detail/CVE-2025-68146) |
| **Version** | `2025.68146` |
| **Base Core** | `filelock 3.19.1` |
| **Python** | `Python 3.9` |
| **License** | Unlicense (Public Domain) |

---

## 🛡️ Security Patch Overview
**This release backports the complete upstream security fix for CVE-2025-68146 to Python 3.9.**

While upstream `filelock` patched this issue in versions requiring Python 3.10+, millions of installations on older Python versions remain vulnerable. This package restores full security parity for legacy environments.

### The Problem
*   **Vulnerability:** CVE-2025-68146 (Symlink/Junction TOCTOU Attack)
*   **Impact:** Local attackers can truncate or corrupt arbitrary files via race conditions involving symlinks (Linux/Unix) or Junctions (Windows).
*   **Context:** Official upstream patches are not available for Python 3.9.

### The Solution
This package is a **drop-in replacement**. It contains the original source code of `filelock 3.19.1` but applies the specific security patches manually to both Unix and Windows drivers.

```bash
pip install filelock-lts-py3.9==2025.68146
```

## ⚙️ Technical Details
This release includes the full dual-platform fix:

**Unix / Linux / macOS:**
- Enforces `os.O_NOFOLLOW` flag during lock file creation.
- Prevents the kernel from following attacker-controlled symlinks.

**Windows:**
- Implements explicit Reparse Point detection using `kernel32.GetFileAttributesW` via ctypes.
- Refuses to acquire locks if the target is a Symbolic Link or Directory Junction.
- Mitigates specific Windows-based TOCTOU attacks.

**Verification:** You can compare the source tree of this branch against the official filelock 3.19.1 tag. The changes are strictly limited to `_unix.py` and `_windows.py` security logic.


## 🔮 The Future: Proactive Dependency Security
The Filelock LTS ecosystem is evolving to provide earlier visibility and stronger controls around dependency risk:

1.  **Early Warning Releases**: Placeholder LTS releases may be published when a potential upstream security issue is under investigation, allowing users to prepare before official advisories are issued.
2.  **Runtime Policy Enforcement (Optional)**: An opt-in runtime module that detects vulnerable dependency versions at runtime and enforces user-configured policies (warn, block, or isolate).
3.  **Configurable Security Policies**: Teams can choose how unpatched dependencies are handled based on their risk tolerance and operational needs.
filelock-lts-py38 2025.68146.2
Python 3.8 filelock with CVE-2025-68146 security patch (symlink attack prevention via O_NOFOLLOW)
License: Unlicense
Requires Python: <3.9,>=3.8

# Filelock LTS (py3.8) - 🛡️ PATCHED (Backport)


> **⚠️ Disclaimer:** This project is **not affiliated with, endorsed by, or associated with** the official `filelock` maintainers. All patches and releases are independently maintained and provided on a best-effort basis to support legacy environments.


| **Metric** | **Details** |
|:---|:---|
| **CVE** | [CVE-2025-68146](https://nvd.nist.gov/vuln/detail/CVE-2025-68146) |
| **Version** | `2025.68146` |
| **Base Core** | `filelock 3.16.1` |
| **Python** | `Python 3.8` |
| **License** | Unlicense (Public Domain) |

---

## 🛡️ Security Patch Overview
**This release backports the complete upstream security fix for CVE-2025-68146 to Python 3.8.**

While upstream `filelock` patched this issue in versions requiring Python 3.10+, millions of installations on older Python versions remain vulnerable. This package restores full security parity for legacy environments.

### The Problem
*   **Vulnerability:** CVE-2025-68146 (Symlink/Junction TOCTOU Attack)
*   **Impact:** Local attackers can truncate or corrupt arbitrary files via race conditions involving symlinks (Linux/Unix) or Junctions (Windows).
*   **Context:** Official upstream patches are not available for Python 3.8.

### The Solution
This package is a **drop-in replacement**. It contains the original source code of `filelock 3.16.1` but applies the specific security patches manually to both Unix and Windows drivers.

```bash
pip install filelock-lts-py3.8==2025.68146
```

## ⚙️ Technical Details
This release includes the full dual-platform fix:

**Unix / Linux / macOS:**
- Enforces `os.O_NOFOLLOW` flag during lock file creation.
- Prevents the kernel from following attacker-controlled symlinks.

**Windows:**
- Implements explicit Reparse Point detection using `kernel32.GetFileAttributesW` via ctypes.
- Refuses to acquire locks if the target is a Symbolic Link or Directory Junction.
- Mitigates specific Windows-based TOCTOU attacks.

**Verification:** You can compare the source tree of this branch against the official filelock 3.16.1 tag. The changes are strictly limited to `_unix.py` and `_windows.py` security logic.


## 🔮 The Future: Proactive Dependency Security
The Filelock LTS ecosystem is evolving to provide earlier visibility and stronger controls around dependency risk:

1.  **Early Warning Releases**: Placeholder LTS releases may be published when a potential upstream security issue is under investigation, allowing users to prepare before official advisories are issued.
2.  **Runtime Policy Enforcement (Optional)**: An opt-in runtime module that detects vulnerable dependency versions at runtime and enforces user-configured policies (warn, block, or isolate).
3.  **Configurable Security Policies**: Teams can choose how unpatched dependencies are handled based on their risk tolerance and operational needs.
filelock-lts-py37 2025.68146.2
Python 3.7 filelock with CVE-2025-68146 security patch (symlink attack prevention via O_NOFOLLOW)
License: Unlicense
Requires Python: <3.8,>=3.7

# Filelock LTS (py3.7) - 🛡️ PATCHED (Backport)


> **⚠️ Disclaimer:** This project is **not affiliated with, endorsed by, or associated with** the official `filelock` maintainers. All patches and releases are independently maintained and provided on a best-effort basis to support legacy environments.


| **Metric** | **Details** |
|:---|:---|
| **CVE** | [CVE-2025-68146](https://nvd.nist.gov/vuln/detail/CVE-2025-68146) |
| **Version** | `2025.68146` |
| **Base Core** | `filelock 3.12.2` |
| **Python** | `Python 3.7` |
| **License** | Unlicense (Public Domain) |

---

## 🛡️ Security Patch Overview
**This release backports the complete upstream security fix for CVE-2025-68146 to Python 3.7.**

While upstream `filelock` patched this issue in versions requiring Python 3.10+, millions of installations on older Python versions remain vulnerable. This package restores full security parity for legacy environments.

### The Problem
*   **Vulnerability:** CVE-2025-68146 (Symlink/Junction TOCTOU Attack)
*   **Impact:** Local attackers can truncate or corrupt arbitrary files via race conditions involving symlinks (Linux/Unix) or Junctions (Windows).
*   **Context:** Official upstream patches are not available for Python 3.7.

### The Solution
This package is a **drop-in replacement**. It contains the original source code of `filelock 3.12.2` but applies the specific security patches manually to both Unix and Windows drivers.

```bash
pip install filelock-lts-py3.7==2025.68146
```

## ⚙️ Technical Details
This release includes the full dual-platform fix:

**Unix / Linux / macOS:**
- Enforces `os.O_NOFOLLOW` flag during lock file creation.
- Prevents the kernel from following attacker-controlled symlinks.

**Windows:**
- Implements explicit Reparse Point detection using `kernel32.GetFileAttributesW` via ctypes.
- Refuses to acquire locks if the target is a Symbolic Link or Directory Junction.
- Mitigates specific Windows-based TOCTOU attacks.

**Verification:** You can compare the source tree of this branch against the official filelock 3.12.2 tag. The changes are strictly limited to `_unix.py` and `_windows.py` security logic.


## 🔮 The Future: Proactive Dependency Security
The Filelock LTS ecosystem is evolving to provide earlier visibility and stronger controls around dependency risk:

1.  **Early Warning Releases**: Placeholder LTS releases may be published when a potential upstream security issue is under investigation, allowing users to prepare before official advisories are issued.
2.  **Runtime Policy Enforcement (Optional)**: An opt-in runtime module that detects vulnerable dependency versions at runtime and enforces user-configured policies (warn, block, or isolate).
3.  **Configurable Security Policies**: Teams can choose how unpatched dependencies are handled based on their risk tolerance and operational needs.
filelock-lts 2025.68146.2
LTS Security release for filelock (CVE-2025-68146 Patch) - Meta-package
License: Unlicense
Requires Python: >=3.7

# Filelock LTS: The CVE-Aware Ecosystem 🛡️


> **⚠️ Disclaimer:** This project is **not affiliated with, endorsed by, or associated with** the official `filelock` maintainers. All patches and releases are independently maintained and provided on a best-effort basis to support legacy environments.


![alt text](https://img.shields.io/badge/Security-Patched-success) ![alt text](https://img.shields.io/badge/CVE-2025--68146-Fixed-blue)

A unified security ecosystem ensuring filelock safety across ALL Python versions (3.7 - 3.14).

## 🚨 The Vulnerability: CVE-2025-68146
A critical Time-of-Check-Time-of-Use (TOCTOU) race condition allows local attackers to truncate or corrupt sensitive files via symlink or junction attacks.

## 🛡️ The Solution
This repository acts as a smart dispatcher. Installing `filelock-lts` automatically delivers the correct security strategy for your Python runtime:

| Python Version | Strategy | Base Version | Status |
|:---|:---|:---|:---|
| 3.7 | Custom Backport | 3.12.2 | 🛡️ SECURED (Unix + Win32) |
| 3.8 | Custom Backport | 3.16.1 | 🛡️ SECURED (Unix + Win32) |
| 3.9 | Custom Backport | 3.19.1 | 🛡️ SECURED (Unix + Win32) |
| 3.10+ | Upstream Proxy | Official >= 3.20.1 | ✅ REDIRECTED |

## 📦 Installation
**Standard Installation (Recommended):**

```bash
pip install filelock-lts
```

This automatically selects the correct package for your environment.

**Specific Version Targeting:**

```bash
pip install filelock-lts-py38  # For Python 3.8 specifically
```


## 🔮 The Future: Proactive Dependency Security
The Filelock LTS ecosystem is evolving to provide earlier visibility and stronger controls around dependency risk:

1.  **Early Warning Releases**: Placeholder LTS releases may be published when a potential upstream security issue is under investigation, allowing users to prepare before official advisories are issued.
2.  **Runtime Policy Enforcement (Optional)**: An opt-in runtime module that detects vulnerable dependency versions at runtime and enforces user-configured policies (warn, block, or isolate).
3.  **Configurable Security Policies**: Teams can choose how unpatched dependencies are handled based on their risk tolerance and operational needs.


## 🏗️ Architecture
- **main**: The metadata dispatcher (this branch).
- **py3.X**: Isolated branches containing specific source code or dependency definitions for that Python version.

## 🤝 License
Unlicense (Public Domain). Security belongs to everyone.