Patch release: 2.0.2 — backport toolchain CVE fixes from #3708

[kpark-hrp]

What version of rules_python do you want to patch?

2.0.x (currently 2.0.1). The default toolchain mapping on release/2.0 is:

MINOR_MAPPING = {
    "3.10": "3.10.19",
    "3.11": "3.11.14",
    "3.12": "3.12.12",
    "3.13": "3.13.11",
    "3.14": "3.14.2",
}

The release/2.0 branch ships Python toolchain versions with several known high-severity CVEs that have already been fixed on main but were not backported. Bumping the 2.0 series would let downstream users pick up these fixes without a major-version migration.

What pull requests do you want to backport?

• feat(toolchains): Add 3.10.20, 3.11.15, 3.12.13, 3.13.{12,13} 3.14.{3,4}, 3.15.0a8 #3708 — feat(toolchains): Add 3.10.20, 3.11.15, 3.12.13, 3.13.{12,13}, 3.14.{3,4}, 3.15.0a8

---

Why (security context)

The interpreter binary and the setuptools/_vendor/* bundle shipped inside the python-build-standalone archives that current release/2.0 toolchains point at are flagged with the following CVEs. Each row shows the minimum Python patch release that contains a fix, and whether the release/2.0 default mapping currently satisfies it.

CVE	Severity	Component	Fixed in (per branch)	release/2.0 default status
CVE-2025-13836	High	CPython http.client — memory DoS on attacker-controlled Content-Length	3.10.20, 3.11.15, 3.12.13, 3.13.11, 3.14.1	3.10/3.11/3.12 vulnerable; 3.13/3.14 OK
CVE-2026-24049	High	wheel (vendored at setuptools/_vendor/wheel-*) — affected >=0.40.0, <=0.46.1	python-build-standalone bundle with setuptools ≥ 80.10 (vendors wheel 0.46.3); i.e. ≥ release 20260414, which maps to 3.10.20 / 3.11.15 / 3.12.13 / 3.13.12 / 3.14.3	vulnerable on every minor (current bundles ship wheel 0.45.1)
CVE-2026-23949	High	jaraco.context (vendored at setuptools/_vendor/jaraco.context-*) — affected >=5.2.0, <6.1.0	Same as above (setuptools ≥ 80.10 vendors jaraco.context 6.1.0)	vulnerable on every minor

All three are remediated together by the toolchain bumps introduced in #3708, since the newer python-build-standalone releases pulled in by that PR ship both the patched interpreter and an updated setuptools bundle.

What this would unblock

A 2.0.2 patch release containing #3708 would let release/2.0 consumers move from 3.11.14 → 3.11.15, 3.12.12 → 3.12.13, 3.10.19 → 3.10.20 (and matching 3.13/3.14 minor bumps) by just bumping bazel_dep(name = "rules_python", version = "2.0.2") and updating minor_mapping.