Python 3.10.22 was released on October 1. The release page says it is the final 3.10 release and that the 3.10 series will receive no further security updates.
PEP 619 says 3.10 reached the end-of-life phase as of October 1, 2026. The 3.10 codebase is frozen, and no issues of any kind will be accepted on the bug tracker.
3.10.22 contains CVE-tagged fixes for tarfile extraction-filter bypasses, unbounded allocations when decompressing zipfile bzip2 and LZMA members, and urllib credential scoping, among others. The bundled libexpat was also updated to 2.8.5.
ssl.SSLContext.wrap_bio() now validates arguments including server_hostname. On 3.10, for compatibility, a missing hostname with check_hostname enabled only emits a DeprecationWarning.
3.10.22 is source only. The last 3.10 version with official binary installers was 3.10.11, from April 2023.
Caveats: upstream end of life versus distribution support
This end of life concerns upstream CPython maintenance. OS distributions or commercial vendors may have their own policies, but this article did not check any distribution policy or contract.
Environments installed from installers may not have received the source-only security releases since 3.10.12 through their usual path. Installing 3.10.22 does not extend the upstream support period.
The release page asks users to upgrade to a supported Python version and notes that 3.14 is now the latest feature release series.
Separating the final patch from the runtime move
Listing the services, container base images and scheduled jobs that use 3.10 shows the scope of both tasks.
The final patch applies fixes that already exist, while moving the runtime is about receiving future security fixes. How dependencies and native extensions behave shows up separately on the target version.
Python 3.10.22 is the last security fix for 3.10, and applying it does not restart upstream support for 3.10.