## 13.2 macOS 11.0 (Big Sur) and Apple Silicon Mac support 

As of 3.9.1, Python now fully supports building and running on macOS 11.0 (Big Sur) and on Apple Silicon Macs (based on the $_{ARM64}$architecture). A new universal build variant, universal2 , is now available to natively support both ARM64 and Intel 64 in one set of executables. Binaries can also now be built on current versions of macOS to be deployed on a range of older macOS versions (tested to 10.9) while making some newer OS functions and options conditionally available based on the operating system version in use at runtime (“weaklinking”). 

(Contributed by Ronald Oussoren and Lawrence D’Anna in bpo-41100.) 

## 14 Notable changes in Python 3.9.2 

## 14.1 collections.abc 

collections.abc.Callable generic now flattens type parameters, similar to what typing.Callable currently does. This means that collections.abc.Callable[[int, str], str] will have __args__ of (int, str, str) ; previously this was ([int, str], str) . To allow this change, $_{types.GenericAlias}$can now be subclassed, and a subclass will be returned when subscripting the collections.abc.Callable type. Code which accesses the arguments via typing.get_args() or __args__ need to account for this change. A DeprecationWarning may be emitted for invalid forms of parameterizing collections.abc.Callable which may have passed silently in Python 3.9.1. This $_{DeprecationWarning}$will become a$_{TypeError}$ in Python 3.10. (Contributed by Ken Jin in bpo-42195.) 

## 14.2 urllib.parse 

Earlier Python versions allowed using both $_{;}$and $_{&}$as query parameter separators in urllib.parse. parse_qs() and$_{urllib.parse.parse_qsl()}$ . Due to security concerns, and to conform with newer W3C recommendations, this has been changed to allow only a single separator key, with$_{&}$as the default. This change also affects$_{cgi.parse()}$ and$_{cgi.parse_multipart()}$ as they use the affected functions internally. For more details, please see their respective documentation. (Contributed by Adam Goldschmidt, Senthil Kumaran and Ken Jin in bpo-42967.) 

## 15 Notable changes in Python 3.9.3 

A security fix alters the$_{ftplib.FTP}$behavior to not trust the IPv4 address sent from the remote server when setting up a passive data channel. We reuse the ftp server IP address instead. For unusual code requiring the old behavior, set a$_{trust_server_pasv_ipv4_address}$ attribute on your FTP instance to$_{True}$. (See bpo-43285) 

## 16 Notable changes in Python 3.9.5 

## 16.1 urllib.parse 

The presence of newline or tab characters in parts of a URL allows for some forms of attacks. Following the WHATWG specification that updates RFC 3986 , ASCII newline$_{
}$,$_{\r}$ and tab$_{	}$ characters are stripped from the URL by the parser in$_{urllib.parse}$ preventing such attacks. The removal characters are controlled by a new module level variable$_{urllib.parse._UNSAFE_URL_BYTES_TO_REMOVE}$ . (See bpo-43882) 

