Merge branch '3.11' into backport-7dd8b47-3.11

Author: ambv

Doc/whatsnew/3.11.rst

@@ -2820,3 +2820,18 @@ tarfile
   :func:`~tarfile.TarFile.errorlevel` is zero.
   (Contributed by Matt Prodani and Petr Viktorin in :gh:`112887`
   and CVE 2025-4435.)
+
+
+Notable changes in 3.11.18
+==========================
+
+ssl
+---
+
+* The :mod:`ssl` module now rejects TLS certificate chains that contain one
+  of a set of compromised eMudhra intermediate CA certificates.  The affected
+  certificates are identified by their public key, so cross-signed copies that
+  reuse the same key are blocked as well.  It is a defense-in-depth backstop
+  that applies even when an application supplies its own root CA bundle, and
+  regardless of whether the platform trust store has removed trust.
+  (Contributed by Christian Heimes in :gh:`160040` for CVE 2026-115557.)

PCbuild/find_python.bat

@@ -42,7 +42,7 @@
 @if NOT "%HOST_PYTHON%"=="" @%HOST_PYTHON% -Ec "import sys; assert sys.version_info[:2] >= (3, 9)" >nul 2>nul && (set PYTHON="%HOST_PYTHON%") && (set _Py_Python_Source=found as HOST_PYTHON) && goto :found
 
 @rem If py.exe finds a recent enough version, use that one
-@for %%p in (3.10 3.9) do @py -%%p -EV >nul 2>&1 && (set PYTHON=py -%%p) && (set _Py_Python_Source=found %%p with py.exe) && goto :found
+@for %%p in (3.14 3.13 3.12 3.11 3.10 3.9) do @py -%%p -EV >nul 2>&1 && (set PYTHON=py -%%p) && (set _Py_Python_Source=found %%p with py.exe) && goto :found
 
 @if NOT exist "%_Py_EXTERNALS_DIR%" mkdir "%_Py_EXTERNALS_DIR%"
 @set _Py_NUGET=%NUGET%

Python/makeopcodetargets.py

@@ -3,28 +3,20 @@
 (for compilers supporting computed gotos or "labels-as-values", such as gcc).
 """
 
+import importlib.util
 import os
 import sys
 
 
-try:
-    from importlib.machinery import SourceFileLoader
-except ImportError:
-    import imp
-
-    def find_module(modname):
-        """Finds and returns a module in the local dist/checkout.
-        """
-        modpath = os.path.join(
-            os.path.dirname(os.path.dirname(__file__)), "Lib")
-        return imp.load_module(modname, *imp.find_module(modname, [modpath]))
-else:
-    def find_module(modname):
-        """Finds and returns a module in the local dist/checkout.
-        """
-        modpath = os.path.join(
-            os.path.dirname(os.path.dirname(__file__)), "Lib", modname + ".py")
-        return SourceFileLoader(modname, modpath).load_module()
+def find_module(modname):
+    """Finds and returns a module in the local dist/checkout.
+    """
+    modpath = os.path.join(
+        os.path.dirname(os.path.dirname(__file__)), "Lib", modname + ".py")
+    spec = importlib.util.spec_from_file_location(modname, modpath)
+    module = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(module)
+    return module
 
 
 def write_contents(f):