[3.12] gh-151544: Fixes CVE-2026-12003 by removing the fallback to %VPATH%/Modules/Setup.local for discovering sources in getpath.py (GH-151545)

[miss-islington]

(cherry picked from commit 9e863fa)

Co-authored-by: Steve Dower steve.dower@python.org

• Issue: [CVE-2026-12003] In-tree search paths can be enabled without modifying install directory #151544

[read-the-docs-community]

Documentation build overview

📚 cpython-previews | 🛠️ Build #33172856 | 📁 Comparing 67067a9 against main (9e863fa)

  🔍 Preview build  

539 files changed · + 3 added · ± 480 modified · - 56 deleted

+ Added

• c-api/objbuffer.html
• library/2to3.html
• library/tkinter.tix.html

± Modified

• about.html
• bugs.html
• copyright.html
• glossary.html
• index.html
• license.html
• py-modindex.html
• c-api/abstract.html
• c-api/allocation.html
• c-api/apiabiversion.html
• and 470 more...

- Deleted

• 404.html
• improve-page-nojs.html
• improve-page.html
• _static/tachyon-example-flamegraph.html
• _static/tachyon-example-heatmap.html
• c-api/curses.html
• c-api/extension-modules.html
• c-api/interp-lifecycle.html
• c-api/lifecycle.html
• c-api/monitoring.html
• and 46 more...

[zooba]

@Yhg1s This is ready for merging - it's possible that the WASI issue that held up 3.14 and 3.13 fixes also applies here, but it was a tier 3 platform for 3.12 (and obviously doesn't affect CI), so I'm not sure it's worth updating the tools to get the new command line argument to override argv[0] that's needed to fix the not-quite-right in-tree builds that might be broken (was that sentence enough of a mouthful of caveats? 🙃 )

#151928 has the extra fixes, but they likely don't backport cleanly because of the frequent changes to the WASI build scripts around this time.

Let me know what you'd prefer here.

[Yhg1s]

#151928 has the extra fixes, but they likely don't backport cleanly because of the frequent changes to the WASI build scripts around this time.

Let me know what you'd prefer here.

I'll let WASM/WASI folks complain and suggest a fix if it doesn't build and they still care about 3.12 :)