Merge branch 'main' of https://github.com/python/cpython into pep-828/implementation

Author: ZeroIntensity

.github/dependabot.yml

@@ -28,6 +28,17 @@ updates:
     cooldown:
       default-days: 14
 
+  - package-ecosystem: "npm"
+    directory: "/Platforms/emscripten/browser_test/"
+    schedule:
+      interval: "quarterly"
+    labels: ["OS-emscripten", "skip issue", "skip news"]
+    groups:
+      npm:
+        patterns: ["*"]
+    cooldown:
+      default-days: 14
+
   # Release branches: Dependabot only reads this file from the default
   # branch, so each branch that should get its own actions bumps needs an
   # entry here with `target-branch`. Add one when a new release branch is
@@ -117,3 +128,29 @@ updates:
         patterns: ["*"]
     cooldown:
       default-days: 14
+
+  # Only bump bugfix branches for npm. Remove
+  # the entry when branch goes security-only.
+  - package-ecosystem: "npm"
+    target-branch: "3.15"
+    directory: "/Platforms/emscripten/browser_test/"
+    schedule:
+      interval: "quarterly"
+    labels: ["OS-emscripten", "skip issue", "skip news"]
+    groups:
+      npm:
+        patterns: ["*"]
+    cooldown:
+      default-days: 14
+
+  - package-ecosystem: "npm"
+    target-branch: "3.14"
+    directory: "/Platforms/emscripten/browser_test/"
+    schedule:
+      interval: "quarterly"
+    labels: ["OS-emscripten", "skip issue", "skip news"]
+    groups:
+      npm:
+        patterns: ["*"]
+    cooldown:
+      default-days: 14

.github/workflows/build.yml

@@ -346,18 +346,28 @@ jobs:
         run: python3 Platforms/Android ci --fast-ci ${{ matrix.arch }}-linux-android
 
   build-ios:
-    name: iOS
+    name: >-
+      iOS
+      ${{ fromJSON(matrix.free-threading) && '(free-threading)' || '' }}
     needs: build-context
     if: needs.build-context.outputs.run-ios == 'true'
     timeout-minutes: 60
     runs-on: macos-26
+    strategy:
+      fail-fast: false
+      matrix:
+        free-threading:
+        - false
+        - true
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
       - name: Build and test
-        run: python3 Platforms/Apple ci iOS --fast-ci
+        run: >-
+          python3 Platforms/Apple ci iOS --fast-ci
+          ${{ fromJSON(matrix.free-threading) && '--abiflags t' || '' }}
 
   build-emscripten:
     name: 'Emscripten'
@@ -481,53 +491,6 @@ jobs:
     if: fromJSON(needs.build-context.outputs.run-tests)
     uses: ./.github/workflows/reusable-test-lazy-imports-all.yml
 
-  build-asan:
-    name: 'Address sanitizer'
-    runs-on: ${{ matrix.os }}
-    timeout-minutes: 60
-    needs: build-context
-    if: needs.build-context.outputs.run-ubuntu == 'true'
-    strategy:
-      fail-fast: false
-      matrix:
-        os: [ubuntu-26.04]
-    env:
-      OPENSSL_VER: 3.5.9
-      PYTHONSTRICTEXTENSIONBUILD: 1
-      ASAN_OPTIONS: detect_leaks=0:allocator_may_return_null=1:handle_segv=0
-    steps:
-    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      with:
-        persist-credentials: false
-    - name: Runner image version
-      run: echo "IMAGE_OS_VERSION=${ImageOS}-${ImageVersion}" >> "$GITHUB_ENV"
-    - name: Register gcc problem matcher
-      run: echo "::add-matcher::.github/problem-matchers/gcc.json"
-    - name: Install dependencies
-      run: sudo ./.github/workflows/posix-deps-apt.sh
-    - name: Configure OpenSSL env vars
-      run: |
-        echo "MULTISSL_DIR=${GITHUB_WORKSPACE}/multissl" >> "$GITHUB_ENV"
-        echo "OPENSSL_DIR=${GITHUB_WORKSPACE}/multissl/openssl/${OPENSSL_VER}" >> "$GITHUB_ENV"
-        echo "LD_LIBRARY_PATH=${GITHUB_WORKSPACE}/multissl/openssl/${OPENSSL_VER}/lib" >> "$GITHUB_ENV"
-    - name: 'Restore OpenSSL build'
-      id: cache-openssl
-      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-      with:
-        path: ./multissl/openssl/${{ env.OPENSSL_VER }}
-        key: ${{ matrix.os }}-multissl-openssl-${{ env.OPENSSL_VER }}
-    - name: Install OpenSSL
-      if: steps.cache-openssl.outputs.cache-hit != 'true'
-      run: python3 Tools/ssl/multissltests.py --steps=library --base-directory "$MULTISSL_DIR" --openssl "$OPENSSL_VER" --system Linux
-    - name: Configure CPython
-      run: ./configure --config-cache --with-address-sanitizer --without-pymalloc --with-openssl="$OPENSSL_DIR"
-    - name: Build CPython
-      run: make -j4
-    - name: Display build info
-      run: make pythoninfo
-    - name: Tests
-      run: xvfb-run make ci
-
   build-san:
     # ${{ '' } is a hack to nest jobs under the same sidebar category.
     name: Sanitizers${{ '' }}  # zizmor: ignore[obfuscation]
@@ -544,6 +507,9 @@ jobs:
         sanitizer:
         - TSan
         include:
+        - check-name: Address
+          sanitizer: ASan
+          free-threading: false
         - check-name: Undefined behavior
           sanitizer: UBSan
           free-threading: false
@@ -657,7 +623,6 @@ jobs:
     - build-wasi
     - test-hypothesis
     - test-lazy-imports-all
-    - build-asan
     - build-san
     - cross-build-linux
     - cifuzz
@@ -704,7 +669,6 @@ jobs:
             build-ubuntu-installed,
             build-ubuntu-ssltests,
             test-hypothesis,
-            build-asan,
             build-san,
             cross-build-linux,
             '

.github/workflows/reusable-san.yml

@@ -43,6 +43,15 @@ jobs:
         # please update the versions in `Tools/pixi-packages/variants.yaml` too.
         echo "CC=clang" >> "$GITHUB_ENV"
         echo "CXX=clang++" >> "$GITHUB_ENV"
+    - name: ASan option setup
+      if: inputs.sanitizer == 'ASan'
+      run: |
+        echo "MULTISSL_DIR=${GITHUB_WORKSPACE}/multissl" >> "$GITHUB_ENV"
+        echo "OPENSSL_DIR=${GITHUB_WORKSPACE}/multissl/openssl/${OPENSSL_VER}" >> "$GITHUB_ENV"
+        echo "ASAN_OPTIONS=${SAN_LOG_OPTION} detect_leaks=0 allocator_may_return_null=1 handle_segv=0" >> "$GITHUB_ENV"
+        echo "PYTHONSTRICTEXTENSIONBUILD=1" >> "$GITHUB_ENV"
+      env:
+        SAN_LOG_OPTION: log_path=${{ github.workspace }}/san_log
     - name: TSan option setup
       if: inputs.sanitizer == 'TSan'
       run: |
@@ -88,24 +97,27 @@ jobs:
     - name: Add ccache to PATH
       run: |
         echo "PATH=/usr/lib/ccache:$PATH" >> "$GITHUB_ENV"
-    - name: 'Restore OpenSSL build (TSan)'
+    - name: 'Restore OpenSSL build'
       id: cache-openssl
-      if: inputs.sanitizer == 'TSan'
+      if: inputs.sanitizer == 'TSan' || inputs.sanitizer == 'ASan'
       uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: ./multissl/openssl/${{ env.OPENSSL_VER }}
-        key: ${{ env.IMAGE_OS_VERSION }}-multissl-openssl-tsan-${{ env.OPENSSL_VER }}
-    - name: Install OpenSSL (TSan)
+        key: >-
+          ${{ env.IMAGE_OS_VERSION }}-multissl-openssl-${{
+            inputs.sanitizer == 'TSan' && 'tsan-' || ''
+          }}${{ env.OPENSSL_VER }}
+    - name: Install OpenSSL
       if: >-
-        inputs.sanitizer == 'TSan'
+        (inputs.sanitizer == 'TSan' || inputs.sanitizer == 'ASan')
         && steps.cache-openssl.outputs.cache-hit != 'true'
       run: >-
         python3 Tools/ssl/multissltests.py
         --steps=library
         --base-directory="${MULTISSL_DIR}"
         --openssl="${OPENSSL_VER}"
         --system=Linux
-        --tsan
+        ${{ inputs.sanitizer == 'TSan' && '--tsan' || '' }}
     # gh-157958: -O2 instead of the pydebug default -Og to avoid a clang 21
     # compile-time blowup on some interpreter files.
     # (https://github.com/llvm/llvm-project/issues/179695)
@@ -117,14 +129,20 @@ jobs:
         --config-cache
         OPT="-O2 -g"
         ${{
-          inputs.sanitizer == 'TSan'
+          inputs.sanitizer == 'ASan'
+          && '--with-address-sanitizer --without-pymalloc'
+          || inputs.sanitizer == 'TSan'
           && '--with-thread-sanitizer'
           || inputs.sanitizer == 'MSan'
           && '--with-memory-sanitizer'
           || '--with-undefined-behavior-sanitizer --with-strict-overflow'
         }}
         ${{ inputs.sanitizer == 'MSan' && '--with-assertions' || '--with-pydebug' }}
-        ${{ inputs.sanitizer == 'TSan' && '--with-openssl="$OPENSSL_DIR" --with-openssl-rpath=auto' || '' }}
+        ${{
+          (inputs.sanitizer == 'TSan' || inputs.sanitizer == 'ASan')
+          && '--with-openssl="$OPENSSL_DIR" --with-openssl-rpath=auto'
+          || ''
+        }}
         ${{ inputs.free-threading && '--disable-gil' || '' }}
     - name: Build CPython
       run: make -j4

.gitignore

@@ -76,10 +76,10 @@ Lib/test/data/*
 Apple/iOS/Frameworks/
 Apple/iOS/Resources/Info.plist
 Apple/testbed/build
-Apple/testbed/Python.xcframework/*/bin
-Apple/testbed/Python.xcframework/*/include
-Apple/testbed/Python.xcframework/*/lib
-Apple/testbed/Python.xcframework/*/Python.framework
+Platforms/Apple/testbed/Python*.xcframework/*/bin
+Platforms/Apple/testbed/Python*.xcframework/*/include
+Platforms/Apple/testbed/Python*.xcframework/*/lib
+Platforms/Apple/testbed/Python*.xcframework/*/Python*.framework
 Apple/testbed/*Testbed.xcodeproj/project.xcworkspace
 Apple/testbed/*Testbed.xcodeproj/xcuserdata
 Mac/Makefile

Doc/builtins/functions.rst

@@ -110,7 +110,7 @@ are always available.  They are listed here in alphabetical order.
 
    .. versionadded:: 3.10
 
-   .. versionchanged:: next
+   .. versionchanged:: 3.16
       Added the *stop_value* and *stop_exception* parameters.
 
 .. function:: all(iterable, /)
@@ -1241,7 +1241,7 @@ are always available.  They are listed here in alphabetical order.
       for item in iter(input_queue.get_nowait, stop_exception=queue.Empty):
           process_item(item)
 
-   .. versionchanged:: next
+   .. versionchanged:: 3.16
       Added the *stop_exception* parameter
       and allowed passing *stop_value* by keyword.
 

Doc/builtins/stdtypes.rst

@@ -5254,7 +5254,7 @@ copying.
       .. versionchanged:: 3.5
          The source format is no longer restricted when casting to a byte view.
 
-      .. versionchanged:: next
+      .. versionchanged:: 3.16
          Casting a multi-dimensional F-contiguous view to a one-dimensional
          view is now supported.
 
@@ -5331,7 +5331,7 @@ copying.
 
       .. versionadded:: 3.3
 
-      .. versionchanged:: next
+      .. versionchanged:: 3.16
          Added the *order* parameter.
 
    .. attribute:: readonly

Doc/c-api/capsule.rst

@@ -119,7 +119,7 @@ Refer to :ref:`using-capsules` for more information on using these objects.
    .. versionchanged:: 3.3
       *no_block* has no effect anymore.
 
-   .. versionchanged:: next
+   .. versionchanged:: 3.16
       Submodules are now imported if needed.
 
 

Doc/c-api/complex.rst

@@ -198,5 +198,5 @@ the :ref:`Number Protocol <number>` API or use native complex types, like
 
    .. deprecated:: 3.15
 
-   .. versionchanged:: next
+   .. versionchanged:: 3.16
       This function leaves :c:data:`errno` unchanged on success.

Doc/c-api/function.rst

@@ -14,6 +14,10 @@ There are a few functions specific to Python functions.
 
    The C structure used for functions.
 
+   In the free-threaded build, direct access to mutable fields requires
+   synchronization if another thread may modify the function. See
+   :ref:`freethreading-extensions-howto`.
+
 
 .. c:var:: PyTypeObject PyFunction_Type
 
@@ -71,6 +75,11 @@ There are a few functions specific to Python functions.
    This is normally a :class:`string <str>` containing the module name,
    but can be set to any other object by Python code.
 
+   In the free-threaded build, if the attribute may be modified concurrently,
+   convert the borrowed reference to a strong reference with :c:func:`Py_XNewRef`
+   immediately, before calling any other Python API. The same applies to
+   :c:func:`PyFunction_GET_MODULE`.
+
 
 .. c:function:: PyObject* PyFunction_GetDefaults(PyObject *op)
 

Doc/c-api/import.rst

@@ -417,6 +417,10 @@ Importing Modules
    (Custom importers should do this in their
    :py:meth:`~importlib.abc.Loader.exec_module` method.)
 
+   If the spec's name is dotted and *initfunc* creates the module using only
+   the last component of the name, the module's :attr:`~module.__name__`
+   is set to the full name from the spec.
+
    On error, return NULL with an exception set.
 
    .. versionadded:: 3.15