Merge branch 'main' into abi3t-guide-setuptools-workaround

Author: encukou

.github/CODEOWNERS

@@ -63,14 +63,14 @@
 .azure-pipelines/             @AA-Turner
 
 # GitHub & related scripts
-.github/                                    @ezio-melotti @hugovk @AA-Turner @webknjaz @itamaro @JacobCoffee
-Tools/build/compute-changes.py              @AA-Turner @hugovk @webknjaz
-Lib/test/test_tools/test_compute_changes.py @AA-Turner @hugovk @webknjaz
+.github/                                    @ezio-melotti @hugovk @AA-Turner @webknjaz @itamaro @JacobCoffee @StanFromIreland
+Tools/build/compute-changes.py              @AA-Turner @hugovk @webknjaz @StanFromIreland
+Lib/test/test_tools/test_compute_changes.py @AA-Turner @hugovk @webknjaz @StanFromIreland
 Tools/build/verify_ensurepip_wheels.py      @AA-Turner @pfmoore @pradyunsg
 
 # Pre-commit
-.pre-commit-config.yaml       @hugovk @JacobCoffee
-.ruff.toml                    @hugovk @AlexWaygood @AA-Turner @JacobCoffee
+.pre-commit-config.yaml       @hugovk @JacobCoffee @StanFromIreland
+.ruff.toml                    @hugovk @AlexWaygood @AA-Turner @JacobCoffee @StanFromIreland
 
 # Patchcheck
 Tools/patchcheck/             @AA-Turner @itamaro

.github/ISSUE_TEMPLATE/bug.yml

@@ -16,7 +16,7 @@ body:
         Make sure to also search the [CPython issue tracker](https://github.com/python/cpython/issues?q=is%3Aissue+sort%3Acreated-desc) to check that the bug has not already been reported.
   - type: textarea
     attributes:
-      label: "Bug description:"
+      label: "Bug report"
       description: >
         Give a clear and concise description of what happened.
         Include a [minimal, reproducible example](https://stackoverflow.com/help/minimal-reproducible-example) if possible.

.github/ISSUE_TEMPLATE/crash.yml

@@ -10,8 +10,9 @@ body:
           The CPython interpreter is written in a different programming language, C. A "CPython crash" is when Python itself fails, leading to a traceback in the C stack.
   - type: textarea
     attributes:
-      label: What happened?
+      label: Crash report
       description: >
+        Give a clear and concise description of what happened.
         Include a [minimal, reproducible example](https://stackoverflow.com/help/minimal-reproducible-example) if possible.
         [Copy and paste code where possible rather than using screenshots](https://meta.stackoverflow.com/a/285557/13990016),
         and put any code blocks inside triple backticks.

.github/ISSUE_TEMPLATE/feature.yml

@@ -12,7 +12,7 @@ body:
         Major feature proposals should generally be discussed on [Discourse](https://discuss.python.org/c/ideas/6) before opening a GitHub issue. Wait until it's clear that most people support your idea before filling in this form.
   - type: textarea
     attributes:
-      label: "Proposal:"
+      label: "Feature or enhancement"
       description: >
         Explain your proposal, why it should be implemented, and how it would be used.
         Add examples, if applicable.

.github/workflows/add-issue-header.yml

@@ -268,13 +268,12 @@ jobs:
           # unsupported as it most resembles other 1.1.1-work-a-like ssl APIs
           # supported by important vendors such as AWS-LC.
           - { name: openssl, version: 1.1.1w }
-          - { name: openssl, version: 3.0.22 }
-          - { name: openssl, version: 3.4.7 }
-          - { name: openssl, version: 3.5.8 }
-          - { name: openssl, version: 3.6.4 }
-          - { name: openssl, version: 4.0.2 }
+          - { name: openssl, version: 3.4.8 }
+          - { name: openssl, version: 3.5.9 }
+          - { name: openssl, version: 3.6.5 }
+          - { name: openssl, version: 4.0.3 }
           ## AWS-LC
-          - { name: aws-lc, version: 5.5.0 }
+          - { name: aws-lc, version: 5.10.0 }
     env:
       SSLLIB_VER: ${{ matrix.ssllib.version }}
       MULTISSL_DIR: ${{ github.workspace }}/multissl
@@ -379,7 +378,7 @@ jobs:
     needs: build-context
     if: needs.build-context.outputs.run-ubuntu == 'true'
     env:
-      OPENSSL_VER: 3.5.8
+      OPENSSL_VER: 3.5.9
       PYTHONSTRICTEXTENSIONBUILD: 1
     steps:
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -493,7 +492,7 @@ jobs:
       matrix:
         os: [ubuntu-26.04]
     env:
-      OPENSSL_VER: 3.5.8
+      OPENSSL_VER: 3.5.9
       PYTHONSTRICTEXTENSIONBUILD: 1
       ASAN_OPTIONS: detect_leaks=0:allocator_may_return_null=1:handle_segv=0
     steps:
@@ -587,7 +586,7 @@ jobs:
       - name: Display build info
         run: |
           "$BUILD_DIR/cross-python/bin/python3" -m test.pythoninfo
-      - name: Run test subset with host build
+      - name: Run test subset with cross build
         run: |
           "$BUILD_DIR/cross-python/bin/python3" -m test test_sysconfig test_site test_embed
 

.github/workflows/build.yml

@@ -17,7 +17,7 @@ permissions:
 
 env:
   FORCE_COLOR: 1
-  OPENSSL_VER: 3.5.8
+  OPENSSL_VER: 3.5.9
 
 jobs:
   build-san-reusable:
@@ -90,10 +90,14 @@ jobs:
         --openssl="${OPENSSL_VER}"
         --system=Linux
         --tsan
+    # gh-157958: -O2 instead of the pydebug default -Og to avoid a clang 21
+    # compile-time blowup on some interpreter files.
+    # (https://github.com/llvm/llvm-project/issues/179695)
     - name: Configure CPython
       run: >-
         ./configure
         --config-cache
+        OPT="-O2 -g"
         ${{
           inputs.sanitizer == 'TSan'
           && '--with-thread-sanitizer'

.github/workflows/reusable-san.yml

@@ -35,7 +35,7 @@ jobs:
     runs-on: ${{ inputs.os }}
     timeout-minutes: 60
     env:
-      OPENSSL_VER: 3.5.8
+      OPENSSL_VER: 3.5.9
       PYTHONSTRICTEXTENSIONBUILD: 1
       TERM: linux
     steps:

.github/workflows/reusable-ubuntu.yml

@@ -408,19 +408,19 @@ as operands and always lock both objects:
 iterate through all the passed iterables and do the following:
 
    * :meth:`set.update` and :meth:`set.union` lock both objects only when
-      the other operand is a :class:`set`, :class:`frozenset`, or :class:`dict`.
+     the other operand is a :class:`set`, :class:`frozenset`, or :class:`dict`.
    * :meth:`set.intersection` and :meth:`set.difference` always try to lock
-      all objects.
+     all objects.
 
 :meth:`set.symmetric_difference` tries to lock both objects.
 
 The update variants of the above methods also have some differences between
 them:
 
    * :meth:`set.difference_update` and :meth:`set.intersection_update` try
-      to lock all objects one-by-one.
+     to lock all objects one-by-one.
    * :meth:`set.symmetric_difference_update` only locks the arguments if it is
-      of type :class:`set`, :class:`frozenset`, or :class:`dict`.
+     of type :class:`set`, :class:`frozenset`, or :class:`dict`.
 
 The following methods always try to lock both objects:
 

Doc/builtins/threadsafety.rst

@@ -425,6 +425,10 @@ APIs:
    the UCS1 range, it will be transformed into UCS1
    (:c:macro:`PyUnicode_1BYTE_KIND`).
 
+   All characters must be in range [U+0000; U+10ffff]. If *kind* is
+   :c:macro:`PyUnicode_4BYTE_KIND` and the string contains invalid characters,
+   the behavior is undefined.
+
    .. versionadded:: 3.3
 
 
@@ -1896,10 +1900,13 @@ object.
 
 .. c:function:: int PyUnicodeWriter_WriteUCS4(PyUnicodeWriter *writer, const Py_UCS4 *str, Py_ssize_t size)
 
-   Writer the UCS4 string *str* into *writer*.
+   Write the UCS4 string *str* into *writer*.
 
    *size* is a number of UCS4 characters.
 
+   All characters must be in range [U+0000; U+10ffff]. If the string contains
+   invalid characters, the behavior is undefined.
+
    On success, return ``0``.
    On error, set an exception, leave the writer unchanged, and return ``-1``.
 
@@ -1945,7 +1952,7 @@ object.
    On success, return ``0``.
    On error, set an exception, leave the writer unchanged, and return ``-1``.
 
-.. c:function:: int PyUnicodeWriter_DecodeUTF8Stateful(PyUnicodeWriter *writer, const char *string, Py_ssize_t length, const char *errors, Py_ssize_t *consumed)
+.. c:function:: int PyUnicodeWriter_DecodeUTF8Stateful(PyUnicodeWriter *writer, const char *str, Py_ssize_t size, const char *errors, Py_ssize_t *consumed)
 
    Decode the string *str* from UTF-8 with *errors* error handler and write the
    output into *writer*.