Missing Windows releases for CVE-2026-115557 Python patches: 3.11.18, 3.12.16, 3.13.18 #1383

Description:

CPython 3.11.18, 3.12.16, 3.13.18, 3.14.10, and 3.15.2 patch the ssl module to reject the compromised eMudhra/emSign intermediate CAs (CVE-2026-115557). setup-python resolves 3.14.10 and 3.15.2 to Windows interpreters cleanly, but the 3.11.18, 3.12.16, and 3.13.18 releases in actions/python-versions ship no Windows binaries, so python-version: '~3.11.18' (and the corresponding ~3.12.16 / ~3.13.18) cannot resolve a safe interpreter on Windows runners.

For 3.13 this looks like a per-patch regression: the previous patch 3.13.17 shipped Windows builds (release 3.13.17-39711892467 has 6 win32-*.zip assets), but 3.13.18 (release 3.13.18-40336726450) ships 16 Linux/RHEL/freethreaded assets and zero Windows. For 3.11 and 3.12 the series stopped producing Windows at 3.11.9 and 3.12.10 respectively (both well before CVE-2026-115557), so the gap is older.

Concrete Windows-ceiling per series in actions/python-versions today:

Please rebuild and publish Windows binaries at least for the CVE-fixed patches (3.11.18, 3.12.16, 3.13.18) so that CI that pins to the patched floor via setup-python works on Windows.

Action version:
actions/setup-python@v6.3.0 (same gap on earlier v5/v4).

Platform:

• Ubuntu
• macOS
• Windows

Runner type:

• Hosted
• Self-hosted

Tools version:
3.11.18, 3.12.16, 3.13.18.

Repro steps:

jobs:
  windows:
    runs-on: windows-latest
    steps:
      - uses: actions/setup-python@v6
        with:
          python-version: '~3.13.18'    # or ~3.11.18, or ~3.12.16

Fails with "Version 3.13.18 … was not found in the local cache … versions-manifest.json" because the manifest lists no Windows build for 3.13.18.

Confirmed against the live manifest at https://raw.githubusercontent.com/actions/python-versions/main/versions-manifest.json:

• 3.11.18 — files[] has no platform: win32 entry (6 Linux + 2 RHEL)
• 3.12.16 — same (8 non-Windows)
• 3.13.18 — 16 non-Windows (incl. freethreaded) + no win32
• 3.13.17 — 2 win32 entries present
• 3.14.10 — 2 win32 entries present
• 3.15.2 — 2 win32 entries present

Expected behavior:
python-version: '~3.11.18' (or ~3.12.16 / ~3.13.18) resolves to a Windows-amd64 interpreter whose ssl module carries the CVE-2026-115557 fix.

Actual behavior:
Resolution fails on Windows runners because the python-versions releases for those three patches ship only Linux and RHEL binaries. Workaround today is setup-uv + uv python install, which pulls from python-build-standalone (has every patch for every platform), but that's a lot of overhead to work around a build-matrix gap.

Context:
This came up while hardening CI for the eMudhra/emSign CA incident. Several downstream projects (NVIDIA/cuda-python#3275, cupy/cupy#10438) hit this gap and had to work around it.