[QGIS-Developer] Python 3.14 Support / Roadmap for QGIS and OSGeo4W on Windows

[Jürgen E. Fischer]

Hi Oliver,

On Tue, 22. Sep 2026 at 13:06:04 +0000, Schäfer, Oliver via QGIS-Developer wrote:
> We understand that QGIS for Windows relies on the OSGeo4W packaging and that
> individual vulnerabilities may already be patched there. To help us assess
> the situation and provide reliable feedback to our internal security team, we
> would appreciate clarification on the following points:
 
> 1. Is it currently possible to obtain or build a Windows version of QGIS
>    using Python 3.14?

There might be conda and vcpkg might be already using a newer version of Python.

And you can always build it yourself. QGIS doesn't depend on a specific version
of Python.


> 2. If not, is a migration of QGIS / OSGeo4W to Python 3.14 planned or being
>    considered?

Considered in the form that it's not currently required and Python 3.12 will
keep getting security updates for two more years.  So it will have to be
updated before that.


> 3. Are there any major technical blockers currently preventing such a
>    migration?

None particular.  It just means rebuilding a lot of packages using newer
dependencies.

 
> 4. Is there a roadmap or rough timeline for moving away from Python 3.12?

None particular either.


> 5. How are security vulnerabilities reported by Microsoft Defender typically
>    addressed within the current OSGeo4W packaging?

Python is usually updated when there are new point releases.  But some
vulnerabilies have been addressed earlier than that.

But that's independent of Microsoft Defender.

Generally reported vulnerabilities by scanners (for instance on the security
mailing list) often turn out to be false positives for various reasons:

- sometimes because the scanner just checks to the latest version and flags
  older ones although older branches were also fixed, or
- it flags client libraries although the issue only applies to the server (eg.
  for PostgreSQL),
- most if not all understandably fail to recognize that a issue was fixed with
  a patch, because that doesn't change the version number at all.


Jürgen

-- 
Jürgen E. Fischer           norBIT GmbH             Tel. +49-4931-918175-31
Dipl.-Inf. (FH)             Rheinstraße 13          Fax. +49-4931-918175-50
Software Engineer           D-26506 Norden            https://www.norbit.de
QGIS release manager (PSC)  Germany                  Matrix: @jef:osgeo.org
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <http://lists.osgeo.org/pipermail/qgis-developer/attachments/20260922/71fdadfb/attachment.sig>