Merge branch 'main'

Author: cdce8p

.editorconfig

@@ -1,11 +1,11 @@
 root = true
 
-[*.{py,c,cpp,h,js,rst,md,yml,yaml,gram}]
+[*.{py,c,cpp,h,js,rst,md,yml,yaml,toml,gram}]
 trim_trailing_whitespace = true
 insert_final_newline = true
 indent_style = space
 
-[*.{py,c,cpp,h,gram}]
+[*.{py,c,cpp,h,toml,gram}]
 indent_size = 4
 
 [*.rst]

.github/CODEOWNERS

@@ -63,7 +63,7 @@
 .azure-pipelines/             @AA-Turner
 
 # GitHub & related scripts
-.github/                                    @ezio-melotti @hugovk @AA-Turner @webknjaz
+.github/                                    @ezio-melotti @hugovk @AA-Turner @webknjaz @itamaro
 Tools/build/compute-changes.py              @AA-Turner @hugovk @webknjaz
 Lib/test/test_tools/test_compute_changes.py @AA-Turner @hugovk @webknjaz
 Tools/build/verify_ensurepip_wheels.py      @AA-Turner @pfmoore @pradyunsg
@@ -73,19 +73,19 @@ Tools/build/verify_ensurepip_wheels.py      @AA-Turner @pfmoore @pradyunsg
 .ruff.toml                    @hugovk @AlexWaygood @AA-Turner
 
 # Patchcheck
-Tools/patchcheck/             @AA-Turner
+Tools/patchcheck/             @AA-Turner @itamaro
 
 
 # ----------------------------------------------------------------------------
 # Build System
 # ----------------------------------------------------------------------------
 
 # Autotools
-configure*                       @erlend-aasland @corona10 @AA-Turner @emmatyping
-Makefile.pre.in                  @erlend-aasland @AA-Turner @emmatyping
-Modules/makesetup                @erlend-aasland @AA-Turner @emmatyping
-Modules/Setup*                   @erlend-aasland @AA-Turner @emmatyping
-Tools/build/regen-configure.sh   @AA-Turner
+configure*                       @erlend-aasland @corona10 @AA-Turner @emmatyping @itamaro
+Makefile.pre.in                  @erlend-aasland @AA-Turner @emmatyping @itamaro
+Modules/makesetup                @erlend-aasland @AA-Turner @emmatyping @itamaro
+Modules/Setup*                   @erlend-aasland @AA-Turner @emmatyping @itamaro
+Tools/build/regen-configure.sh   @AA-Turner @itamaro
 
 # generate-build-details
 Tools/build/generate-build-details.py   @FFY00
@@ -156,16 +156,15 @@ Misc/libabigail.abignore      @encukou
 # ----------------------------------------------------------------------------
 
 # Android
-Android/                      @mhsmith @freakboy3742
+Platforms/Android/            @mhsmith @freakboy3742
 Doc/using/android.rst         @mhsmith @freakboy3742
 Lib/_android_support.py       @mhsmith @freakboy3742
 Lib/test/test_android.py      @mhsmith @freakboy3742
 
 # iOS
 Doc/using/ios.rst             @freakboy3742
 Lib/_ios_support.py           @freakboy3742
-Apple/                        @freakboy3742
-iOS/                          @freakboy3742
+Platforms/Apple/              @freakboy3742
 
 # macOS
 Mac/                          @python/macos-team
@@ -176,8 +175,8 @@ Lib/test/test__osx_support.py @python/macos-team
 Tools/wasm/README.md          @brettcannon @freakboy3742 @emmatyping
 
 # WebAssembly (Emscripten)
-Tools/wasm/config.site-wasm32-emscripten  @freakboy3742 @emmatyping
-Tools/wasm/emscripten                     @freakboy3742 @emmatyping
+Platforms/emscripten          @freakboy3742 @emmatyping
+Tools/wasm/emscripten         @freakboy3742 @emmatyping
 
 # WebAssembly (WASI)
 Platforms/WASI                @brettcannon @emmatyping @savannahostrowski
@@ -574,9 +573,9 @@ Lib/shutil.py                 @giampaolo
 Lib/test/test_shutil.py       @giampaolo
 
 # Site
-Lib/site.py                   @FFY00
-Lib/test/test_site.py         @FFY00
-Doc/library/site.rst          @FFY00
+Lib/site.py                   @FFY00 @warsaw
+Lib/test/test_site.py         @FFY00 @warsaw
+Doc/library/site.rst          @FFY00 @warsaw
 
 # string.templatelib
 Doc/library/string.templatelib.rst        @lysnikolaou @AA-Turner
@@ -587,10 +586,10 @@ Lib/test/test_string/test_templatelib.py  @lysnikolaou @AA-Turner
 **/*sysconfig*                @FFY00
 
 # SQLite 3
-Doc/library/sqlite3.rst       @berkerpeksag @erlend-aasland
-Lib/sqlite3/                  @berkerpeksag @erlend-aasland
-Lib/test/test_sqlite3/        @berkerpeksag @erlend-aasland
-Modules/_sqlite/              @berkerpeksag @erlend-aasland
+Doc/library/sqlite3.rst       @erlend-aasland
+Lib/sqlite3/                  @erlend-aasland
+Lib/test/test_sqlite3/        @erlend-aasland
+Modules/_sqlite/              @erlend-aasland
 
 # Subprocess
 Lib/subprocess.py             @gpshead
@@ -623,9 +622,6 @@ Modules/_typesmodule.c        @AA-Turner
 Lib/unittest/mock.py             @cjw296
 Lib/test/test_unittest/testmock/ @cjw296
 
-# Urllib
-**/*robotparser*              @berkerpeksag
-
 # Venv
 **/*venv*                     @vsajip @FFY00
 

.github/SECURITY.md

@@ -1,17 +1,24 @@
 # Security Policy
 
-## Supported Versions
+Python [provides a security policy and threat model](https://devguide.python.org/security/policy/)
+in the Python Developer's Guide documenting what bugs are vulnerabilities,
+how to structure reports, and what versions of Python accept reports.
 
-The Python team applies security fixes according to the table
-in [the devguide](
-https://devguide.python.org/versions/#supported-versions
-).
+Python Security Response Team (PSRT) members
+balance security work against many other responsibilities. Please be thoughtful
+about the time and attention your report requires. Repeated failure to respect
+the security policy will result in future reports being rejected, or the
+reporter being banned from the ``python`` GitHub organization, regardless of
+technical merit.
 
 ## Reporting a Vulnerability
 
-Please read the guidelines on reporting security issues [on the
-official website](https://www.python.org/dev/security/) for
-instructions on how to report a security-related problem to
-the Python team responsibly.
+The [Python security policy](https://devguide.python.org/security/policy/)
+documents [how to submit a vulnerability report](https://devguide.python.org/security/policy/#how-to-submit-a-vulnerability-report)
+using GitHub Security Advisories. Please read the security policy
+prior to filing a vulnerability report, especially the section on [what information to
+include and exclude](https://devguide.python.org/security/policy/#what-to-include-and-how-to-structure-a-vulnerability-report)
+in vulnerability reports. Following the security policy means the PSRT can
+quickly and efficiently triage your report, not following the security policy
+will only delay triaging your report.
 
-To reach the response team, email `security at python dot org`.

.github/workflows/build.yml

@@ -206,16 +206,16 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        # macos-26 is Apple Silicon, macos-15-intel is Intel.
-        # macos-15-intel only runs tests against the GIL-enabled CPython.
+        # macos-26 is Apple Silicon, macos-26-intel is Intel.
+        # macos-26-intel only runs tests against the GIL-enabled CPython.
         os:
         - macos-26
-        - macos-15-intel
+        - macos-26-intel
         free-threading:
         - false
         - true
         exclude:
-        - os: macos-15-intel
+        - os: macos-26-intel
           free-threading: true
     uses: ./.github/workflows/reusable-macos.yml
     with:
@@ -278,14 +278,13 @@ jobs:
           # unsupported as it most resembles other 1.1.1-work-a-like ssl APIs
           # supported by important vendors such as AWS-LC.
           - { name: openssl, version: 1.1.1w }
-          - { name: openssl, version: 3.0.20 }
-          - { name: openssl, version: 3.3.7 }
-          - { name: openssl, version: 3.4.5 }
-          - { name: openssl, version: 3.5.6 }
-          - { name: openssl, version: 3.6.2 }
-          - { name: openssl, version: 4.0.0 }
+          - { name: openssl, version: 3.0.21 }
+          - { name: openssl, version: 3.4.6 }
+          - { name: openssl, version: 3.5.7 }
+          - { name: openssl, version: 3.6.3 }
+          - { name: openssl, version: 4.0.1 }
           ## AWS-LC
-          - { name: aws-lc, version: 1.72.1 }
+          - { name: aws-lc, version: 5.0.0 }
     env:
       SSLLIB_VER: ${{ matrix.ssllib.version }}
       MULTISSL_DIR: ${{ github.workspace }}/multissl
@@ -399,7 +398,7 @@ jobs:
     needs: build-context
     if: needs.build-context.outputs.run-ubuntu == 'true'
     env:
-      OPENSSL_VER: 3.5.6
+      OPENSSL_VER: 3.5.7
       PYTHONSTRICTEXTENSIONBUILD: 1
     steps:
     - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -507,7 +506,7 @@ jobs:
       matrix:
         os: [ubuntu-24.04]
     env:
-      OPENSSL_VER: 3.5.6
+      OPENSSL_VER: 3.5.7
       PYTHONSTRICTEXTENSIONBUILD: 1
       ASAN_OPTIONS: detect_leaks=0:allocator_may_return_null=1:handle_segv=0
     steps:

.github/workflows/jit.yml

@@ -64,10 +64,10 @@ jobs:
         include:
           - target: i686-pc-windows-msvc/msvc
             architecture: Win32
-            runner: windows-2025-vs2026
+            runner: windows-2025
           - target: x86_64-pc-windows-msvc/msvc
             architecture: x64
-            runner: windows-2025-vs2026
+            runner: windows-2025
           - target: aarch64-pc-windows-msvc/msvc
             architecture: ARM64
             runner: windows-11-arm
@@ -183,6 +183,9 @@ jobs:
           - name: JIT without optimizations (Debug)
             configure_flags: --enable-experimental-jit --with-pydebug
             test_env: "PYTHON_UOPS_OPTIMIZE=0"
+          - name: JIT with stress testing (Debug)
+            configure_flags: --enable-experimental-jit --with-pydebug
+            test_env: "PYTHON_JIT_STRESS=1"
           - name: JIT with tail calling interpreter
             configure_flags: --enable-experimental-jit --with-tail-call-interp --with-pydebug
             use_clang: true

.github/workflows/mypy.yml

@@ -69,12 +69,11 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
-      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+      - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
         with:
           python-version: "3.15"
-          allow-prereleases: true
-          cache: pip
-          cache-dependency-path: Tools/requirements-dev.txt
-      - run: pip install -r Tools/requirements-dev.txt
+          activate-environment: true
+          cache-dependency-glob: Tools/requirements-dev.txt
+      - run: uv pip install -r Tools/requirements-dev.txt
       - run: python3 Misc/mypy/make_symlinks.py --symlink
-      - run: mypy --config-file ${{ matrix.target }}/mypy.ini
+      - run: mypy --num-workers 4 --config-file ${{ matrix.target }}/mypy.ini

.github/workflows/posix-deps-apt.sh

@@ -27,7 +27,7 @@ apt-get -yq --no-install-recommends install \
     zlib1g-dev
 
 # Workaround missing libmpdec-dev on ubuntu 24.04 by building mpdecimal
-# from source. ppa:ondrej/php (launchpad.net) are unreliable 
+# from source. ppa:ondrej/php (launchpad.net) are unreliable
 # (https://status.canonical.com) so fetch the tarball directly
 # from the upstream host.
 # https://www.bytereef.org/mpdecimal/

.github/workflows/reusable-macos.yml

@@ -38,9 +38,8 @@ jobs:
       run: echo "IMAGE_OS_VERSION=${ImageOS}-${ImageVersion}" >> "$GITHUB_ENV"
     - name: Install Homebrew dependencies
       run: |
-        brew install pkg-config openssl@3.5 xz gdbm tcl-tk@9 make
-        # Because alternate versions are not symlinked into place by default:
-        brew link --overwrite tcl-tk@9
+        brew bundle --file=Misc/Brewfile
+        brew install make
     - name: Configure CPython
       run: |
         MACOSX_DEPLOYMENT_TARGET=10.15 \
@@ -55,15 +54,15 @@ jobs:
           --prefix=/opt/python-dev \
           --with-openssl="$(brew --prefix openssl@3.5)"
     - name: Build CPython
-      if : ${{ inputs.free-threading || inputs.os != 'macos-15-intel' }}
+      if : ${{ inputs.free-threading || inputs.os != 'macos-26-intel' }}
       run: gmake -j8
     - name: Build CPython for compiler warning check
-      if : ${{ !inputs.free-threading && inputs.os == 'macos-15-intel' }}
+      if : ${{ !inputs.free-threading && inputs.os == 'macos-26-intel' }}
       run: set -o pipefail; gmake -j8 --output-sync 2>&1 | tee compiler_output_macos.txt
     - name: Display build info
       run: make pythoninfo
     - name: Check compiler warnings
-      if : ${{ !inputs.free-threading && inputs.os == 'macos-15-intel' }}
+      if : ${{ !inputs.free-threading && inputs.os == 'macos-26-intel' }}
       run: >-
         python3 Tools/build/check_warnings.py
         --compiler-output-file-path=compiler_output_macos.txt

.github/workflows/reusable-san.yml

@@ -82,19 +82,16 @@ jobs:
       run: make -j4
     - name: Display build info
       run: make pythoninfo
-    # test_{capi,faulthandler} are skipped under UBSan because
-    # they raise signals that UBSan with halt_on_error=1 intercepts.
     - name: Tests
       run: >-
         ./python -m test
         ${{ inputs.sanitizer == 'TSan' && '--tsan' || '' }}
-        ${{ inputs.sanitizer == 'UBSan' && '-x test_capi -x test_faulthandler' || '' }}
-        -j4
+        -j4 -W --timeout=900 --slowest
     - name: Parallel tests
       if: >-
         inputs.sanitizer == 'TSan'
         && fromJSON(inputs.free-threading)
-      run: ./python -m test --tsan-parallel --parallel-threads=4 -j4
+      run: ./python -m test --tsan-parallel --parallel-threads=4 -j4 -W --timeout=600 --slowest
     - name: Display logs
       if: always()
       run: find "${GITHUB_WORKSPACE}" -name 'san_log.*' | xargs head -n 1000

.github/workflows/reusable-ubuntu.yml

@@ -35,7 +35,7 @@ jobs:
     runs-on: ${{ inputs.os }}
     timeout-minutes: 60
     env:
-      OPENSSL_VER: 3.5.6
+      OPENSSL_VER: 3.5.7
       PYTHONSTRICTEXTENSIONBUILD: 1
       TERM: linux
     steps: