What the developer wrote
Authored by Sjors Provoost
Don't pin Python patch version
.python-version always matches the minimum supported Python version.
It's main purpose is to catch accidental use of too modern syntax
in scripts and functional tests.
We (currently) don't specify a minimum patch version, so it's not
necessary to do so here. The minor verion is enough.
This also avoids requiring users to keep a potentially unsafe old
patch version installed.
What changed, and why it matters
This commit changes a single configuration file used by developers so it only specifies the broad Python version (3.10) instead of an exact patch release (3.10.14). The stated goal is to avoid forcing developers to keep an old, potentially insecure Python patch release installed. It is a tooling/development hygiene change, not a fix for an exploitable vulnerability in Bitcoin Core itself.
No security action required for Bitcoin Core users or operators. Developers using pyenv may simply ensure a supported Python 3.10.x release is available. Treat as routine repository hygiene.
Security signals we found
Commit message mentions avoiding a 'potentially unsafe old patch version' of Python
Change is limited to a development environment version pin
No code, build script, or dependency change in the project itself
Evidence from the diff
The .python-version file is used by pyenv to select a Python interpreter for local development. Previously it pinned 3.10.14; now it requests any 3.10.x release. The commit message explicitly frames the change as avoiding the requirement to maintain an old patch version that may have known security issues. No Bitcoin Core source code, consensus logic, networking, or wallet code is modified.
Changed components
.python-versionInspect captured patch +1 / −1
diff --git a/.python-version b/.python-version
index 1445aee8..c8cfe395 100644
--- a/.python-version
+++ b/.python-version
@@ -1 +1 @@
-3.10.14
+3.10
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.