security supply chain

The vulnerability tracked as CVE‑2024‑3651 — a denial‑of‑service condition caused by quadratic complexity in the kjd/idna library’s idna.encode() routine — is real, patched upstream in idna 3.7, and has been mapped by multiple distributors to packaged Python runtimes. Microsoft’s public advisory...