[QGIS-Developer] Python 3.14 Support / Roadmap for QGIS and OSGeo4W on Windows

[Schäfer, Oliver]

Hello Jürgen,

thank you very much for the clarification.

Just one final question:

Is there currently any way to obtain an official Windows build of QGIS based on Python 3.14 from the QGIS / OSGeo4W project, or would this currently only be possible through custom builds?

If such a build is not available, would commercial support or sponsored development be an option to help accelerate this work?

Thank you again for your time and support.

Best regards,

Oliver Schäfer

-----Ursprüngliche Nachricht-----
Von: QGIS-Developer <qgis-developer-bounces at lists.osgeo.org> Im Auftrag von Jürgen E. Fischer via QGIS-Developer
Gesendet: Dienstag, 22. September 2026 17:53
An: qgis-developer at lists.osgeo.org
Betreff: Re: [QGIS-Developer] Python 3.14 Support / Roadmap for QGIS and OSGeo4W on Windows

[Sie erhalten nicht häufig E-Mails von qgis-developer at lists.osgeo.org. Weitere Informationen, warum dies wichtig ist, finden Sie unter https://aka.ms/LearnAboutSenderIdentification ]

"Attention! External Mail. Be careful with Links/Attachments!"

Hi Oliver,

On Tue, 22. Sep 2026 at 13:06:04 +0000, Schäfer, Oliver via QGIS-Developer wrote:
> We understand that QGIS for Windows relies on the OSGeo4W packaging
> and that individual vulnerabilities may already be patched there. To
> help us assess the situation and provide reliable feedback to our
> internal security team, we would appreciate clarification on the following points:

> 1. Is it currently possible to obtain or build a Windows version of QGIS
>    using Python 3.14?

There might be conda and vcpkg might be already using a newer version of Python.

And you can always build it yourself. QGIS doesn't depend on a specific version of Python.


> 2. If not, is a migration of QGIS / OSGeo4W to Python 3.14 planned or being
>    considered?

Considered in the form that it's not currently required and Python 3.12 will keep getting security updates for two more years.  So it will have to be updated before that.


> 3. Are there any major technical blockers currently preventing such a
>    migration?

None particular.  It just means rebuilding a lot of packages using newer dependencies.


> 4. Is there a roadmap or rough timeline for moving away from Python 3.12?

None particular either.


> 5. How are security vulnerabilities reported by Microsoft Defender typically
>    addressed within the current OSGeo4W packaging?

Python is usually updated when there are new point releases.  But some vulnerabilies have been addressed earlier than that.

But that's independent of Microsoft Defender.

Generally reported vulnerabilities by scanners (for instance on the security mailing list) often turn out to be false positives for various reasons:

- sometimes because the scanner just checks to the latest version and flags
  older ones although older branches were also fixed, or
- it flags client libraries although the issue only applies to the server (eg.
  for PostgreSQL),
- most if not all understandably fail to recognize that a issue was fixed with
  a patch, because that doesn't change the version number at all.


Jürgen

--
Jürgen E. Fischer           norBIT GmbH             Tel. +49-4931-918175-31
Dipl.-Inf. (FH)             Rheinstraße 13          Fax. +49-4931-918175-50
Software Engineer           D-26506 Norden            https://www.norbit.de/
QGIS release manager (PSC)  Germany                  Matrix: @jef:osgeo.org