Why Does Python Provide Only Source Releases for Some Security Updates?

[u/Porcela]

I have a question about installers. Once a release enters the security-fixes-only phase, what is the purpose of releasing only source files and not providing installers or other binary distributions?

Is it because they expect people to keep using that version without migrating for as long as possible?

For example, Python 3.13.17, released on October 21, still came with installers, but Python 3.13.18 was released with source files only.

[u/Diapolo10]

The expectation is that after a cut-off date, any further patches would only really matter to specific corporate long-term use where there are restrictions for updating minor versions (so for example going from 3.13 to 3.14 would be difficult). For ordinary users, those patches shouldn't matter, and people are encouraged to use more up-to-date versions instead.

Would it be nice if they released binary releases of those anyway? Sure, I guess, but not many people would actually benefit from that.

When was the last time you bothered updating your Python runtime to a specific patch version?

[u/rosereed1 → u/Diapolo10]

yeah plus the orgs that actually need those old security patches usually have their own internal build pipelines anyway

[u/Porcela → u/Diapolo10]

I tried to get lates 3.13.18 installer, but I couldn't find that.

Did I missed my chance to upgrade from Python 3.13 to 3.14 or later version?

[u/Gnaxe → u/Porcela]

No, what do you mean? No binary has been revoked. You don't have to go through every increment when upgrading. You can skip versions. You may have to fix more things if you skip too much at once, but patch versions aren't supposed to break compatibility. It's unlikely you were relying on a bug. Upgrading by one or two minor versions isn't hard. We do it all the time.

[u/SwampFalc → u/Porcela]

Typically, you need to follow a step-by-step update path when upgrading an installed application, with saved data.

The step-by-step path is there to transform your saved data from a known format, into the newer format.

Python has no saved data. You can update to whatever version you want, whenever you want.

[u/itlogicpartnersllc]

its mainly a maintenance trade off. once a python branch enters security only mode the focus shifts to essenrtial fixes rather than building and testing installers.

[u/POGtastic]

Anybody who has the requirements for a specific older version of Python is going to have some bespoke process for updating Python and will have no problem compiling from source.

Unless you have a specific reason, you should be running the latest stable version that you can easily install on your machine. For most people, that's whatever the version is currently front-and-center on the website. (Here in Linux-land, it's whatever version of Python is available in your distro's package repository).

[u/socal_nerdtastic]

In short: Making an installer takes effort. It's just not worth it.