Python 3.15 ships and 3.10 is unsupported: a security upgrade checklist

What changed

Python 3.15 is out, and in his write-up Simon Willison points to the official What's new in Python 3.15 guide, curated this year by 3.14 and 3.15 release manager Hugo van Kemenade. Willison maintains open source projects that support every supported Python version. For him, the release also means dropping Python 3.10, which the Python devguide lists as no longer supported.

This is a language-release story rather than a vulnerability disclosure. It still matters to security teams, because the interpreter version is a dependency like any other, and an unsupported one is a standing exposure.

Why an unsupported interpreter is a security problem

Once a Python branch leaves support, upstream stops issuing fixes for it. Any flaw found in the interpreter or standard library afterwards has no upstream patch for 3.10. Services, CI images, build containers and internal tooling pinned to 3.10 then depend on a distro vendor's backports, or on nothing.

Library maintainers face a related pressure. Willison says he can now drop 3.10 and use 3.11 features, and that he updated several cookiecutter templates to test against 3.11 through 3.15. As maintainers make the same move, packages pinned to 3.10 will increasingly be unable to take new releases of their dependencies.

Two 3.15 features worth a security review

Explicit lazy imports (PEP 810)

PEP 810 lets code write lazy import json or lazy from pathlib import Path. The module is then loaded the first time one of its names is used. Willison's motivation was slow startup in his LLM command-line tool, caused by heavy plugin dependencies.

Our analysis, not a claim from the source: deferring an import also defers any code that module runs when it loads. Reviewers who audit dependencies for import-time side effects, a common place for malicious packages to hide payloads, should not assume everything executes at startup. A lazily imported module may first run deep inside a request path. Tooling that expects imports at start-up, such as sandboxes, allow-lists and runtime monitors, should be tested against lazy imports.

Tachyon, the sampling profiler

Python 3.15 introduces profiling.sampling, a low-overhead sampling profiler called Tachyon. It can attach to a running process by PID and produce flame graphs, heat maps and Firefox profiler output. The tracing profiler cProfile is renamed profiling.tracing. Willison reports that attaching to a running process needed sudo on macOS.

Attaching to a live process exposes its execution details, so keep that ability restricted in production. Check what your container and host policies allow before enabling it.

A practical upgrade checklist

1. 1Inventory every place Python 3.10 runs: base images, CI runners, serverless runtimes and developer machines.
2. 2Move 3.10 workloads to a supported version, and test against 3.15 in CI before adopting it in production.
3. 3Re-run dependency resolution and vulnerability scanning on the new interpreter, since some packages will have dropped 3.10.
4. 4Decide your policy on lazy imports and on profiler attach permissions before developers start using them.