746 and 842 - Python changes

modules/release-notes/pages/developers/Development_Python.adoc

@@ -3,3 +3,40 @@ include::{partialsdir}/entities.adoc[]
 
 [[sect-python]]
 = Python
+
+== Python 3.11
+
+Fedora 37 provides the Python stack in version 3.11, up from version 3.10 in the previous release. Notable changes include:
+
+* Exception Groups and `except*`
+* Enhanced error locations in tracebacks
+* Support for parsing TOML in the standard library
+* A massive speed improvement compared to Python 3.10
+
+Typing features:
+
+* Variadic generics
+* Marking individual `TypedDict` items as required or potentially-missing
+* Self type
+* Arbitrary literal string type
+* Dataclass transforms
+
+For a full list of changes, see the link:https://docs.python.org/3.11/whatsnew/3.11.html[What's New In Python 3.11] upstream document. Also see link:https://docs.python.org/3.11/whatsnew/3.11.html#porting-to-python-3-11[Porting to Python 3.11] if you have Python programs running on an older version.
+
+[[default-shebangs]]
+== Add -P to default shebangs
+
+All Python 3 shebang RPM macros in Fedora 37 have been changed to contain one more flag: `-P`. Previously, they contained `-s`, now they contain `-sP`. The `-P` flag was introduced in Python 3.11.
+
+The new flag stops Python from prepending a potentially unsafe path to `sys.path`. This causes Python programs in `/usr/bin` to be less fragile towards random files present in the same directory, making debugging certain types of issues easier and enhancing security.
+
+The following RPM macros are affected by this change:
+
+* `%{py3_shbang_opts}`
+* `%{py3_shbang_opts_nodash}`
+* `%{py3_shebang_flags}`
+* `%{py_shbang_opts}`
+* `%{py_shbang_opts_nodash}`
+* `%{py_shebang_flags}`
+
+For a detailed explanation of what this change means, a list of affected packages, and information on how to opt out of this change (or explicitly opt in) if needed, see the link:https://fedoraproject.org/wiki/Changes/PythonSafePath#Detailed_Description[Fedora Wiki].

modules/release-notes/pages/sysadmin/Distribution.adoc

@@ -33,3 +33,7 @@ The server documentation link:https://docs.fedoraproject.org/en-US/fedora-server
 == boot.iso now uses GRUB2 on BIOS systems
 
 See xref:sysadmin/Installation.adoc#boot-iso-grub2[Distribution].
+
+== Python3 packages are now built with -P
+
+See xref:developers/Development_Python.adoc#default-shebangs[Python].

modules/release-notes/pages/sysadmin/Security.adoc

@@ -12,3 +12,7 @@ The ability for an IoT or Edge device to be plugged in and automatically onboard
 With this update, Fedora IoT provides the FIDO Device Onboarding software stack for Zero Touch Onboarding.
 
 The aim is to demonstrate the use of the leading edge open industry protocols for onboarding IoT and Edge devices.
+
+== Python3 packages are now built with -P
+
+See xref:developers/Development_Python.adoc#default-shebangs[Python].