Merge branch 'main' into whatsnew-2.4

Author: StanFromIreland

.github/actionlint.yaml

@@ -1,5 +1,12 @@
 config-variables: null
 
+# Pending release of actionlint > 1.7.12 for ubuntu-26.04* support:
+# https://github.com/rhysd/actionlint/pull/683
+self-hosted-runner:
+  labels:
+    - ubuntu-26.04
+    - ubuntu-26.04-arm
+
 paths:
   .github/workflows/**/*.yml:
      ignore:

.github/workflows/add-issue-header.yml

@@ -17,7 +17,7 @@ permissions:
 
 jobs:
   add-header:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-slim
     permissions:
       issues: write
     timeout-minutes: 5

.github/workflows/build.yml

@@ -53,7 +53,7 @@ jobs:
     name: 'Check if Autoconf files are up to date'
     # Don't use ubuntu-latest but a specific version to make the job
     # reproducible: to get the same tools versions (autoconf, aclocal, ...)
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     container:
       image: ghcr.io/python/autoconf:2025.01.02.12581854023
     timeout-minutes: 60
@@ -96,7 +96,7 @@ jobs:
     name: 'Check if generated files are up to date'
     # Don't use ubuntu-latest but a specific version to make the job
     # reproducible: to get the same tools versions (autoconf, aclocal, ...)
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 60
     needs: build-context
     if: needs.build-context.outputs.run-tests == 'true'
@@ -239,18 +239,18 @@ jobs:
         - false
         - true
         os:
-        - ubuntu-24.04
-        - ubuntu-24.04-arm
+        - ubuntu-26.04
+        - ubuntu-26.04-arm
         exclude:
         # Do not test BOLT with free-threading, to conserve resources
         - bolt: true
           free-threading: true
         # BOLT currently crashes during instrumentation on aarch64
-        - os: ubuntu-24.04-arm
+        - os: ubuntu-26.04-arm
           bolt: true
         include:
         # Enable CPU-intensive tests on ARM (default build only)
-        - os: ubuntu-24.04-arm
+        - os: ubuntu-26.04-arm
           bolt: false
           free-threading: false
           test-opts: '-u cpu'
@@ -270,7 +270,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-24.04]
+        os: [ubuntu-26.04]
         ssllib:
           # See Tools/ssl/make_ssl_data.py for notes on adding a new version
           ## OpenSSL
@@ -346,7 +346,7 @@ jobs:
           - arch: aarch64
             runs-on: macos-26
           - arch: x86_64
-            runs-on: ubuntu-24.04
+            runs-on: ubuntu-26.04
 
     runs-on: ${{ matrix.runs-on }}
     steps:
@@ -393,7 +393,7 @@ jobs:
 
   test-hypothesis:
     name: "Hypothesis tests on Ubuntu"
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 60
     needs: build-context
     if: needs.build-context.outputs.run-ubuntu == 'true'
@@ -504,7 +504,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-24.04]
+        os: [ubuntu-26.04]
     env:
       OPENSSL_VER: 3.5.7
       PYTHONSTRICTEXTENSIONBUILD: 1
@@ -568,7 +568,7 @@ jobs:
 
   cross-build-linux:
     name: Cross build Linux
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     timeout-minutes: 60
     needs: build-context
     if: needs.build-context.outputs.run-ubuntu == 'true'

.github/workflows/jit.yml

@@ -29,7 +29,7 @@ env:
 jobs:
   interpreter:
     name: Interpreter (Debug)
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 60
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
@@ -102,9 +102,9 @@ jobs:
           - false
         include:
           - target: x86_64-apple-darwin/clang
-            runner: macos-15-intel
+            runner: macos-26-intel
           - target: aarch64-apple-darwin/clang
-            runner: macos-15
+            runner: macos-26
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
@@ -145,9 +145,9 @@ jobs:
           - false
         include:
           - target: x86_64-unknown-linux-gnu/gcc
-            runner: ubuntu-24.04
+            runner: ubuntu-26.04
           - target: aarch64-unknown-linux-gnu/gcc
-            runner: ubuntu-24.04-arm
+            runner: ubuntu-26.04-arm
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
@@ -160,8 +160,7 @@ jobs:
           sudo ./.github/workflows/posix-deps-apt.sh
       - name: Build
         run: |
-          sudo bash -c "$(wget -O - https://apt.llvm.org/llvm.sh)" ./llvm.sh ${{ env.LLVM_VERSION }}
-          export PATH="$(llvm-config-${{ env.LLVM_VERSION }} --bindir):$PATH"
+          # On ubuntu-26.04 image, clang is clang-21 by default
           ./configure --enable-experimental-jit ${{ matrix.debug && '--with-pydebug' || '' }}
           make all --jobs 4
       - name: Test
@@ -171,7 +170,7 @@ jobs:
   linux-extras:
     name: ${{ matrix.name }}
 
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 60
     strategy:
       fail-fast: false
@@ -202,8 +201,7 @@ jobs:
           sudo ./.github/workflows/posix-deps-apt.sh
       - name: Build
         run: |
-          sudo bash -c "$(wget -O - https://apt.llvm.org/llvm.sh)" ./llvm.sh ${{ env.LLVM_VERSION }}
-          export PATH="$(llvm-config-${{ env.LLVM_VERSION }} --bindir):$PATH"
+          # On ubuntu-26.04 image, clang is clang-21 by default
           if [ "${{ matrix.use_clang }}" = "true" ]; then
             export CC=clang-${{ env.LLVM_VERSION }}
           fi

.github/workflows/new-bugs-announce-notifier.yml

@@ -10,7 +10,7 @@ permissions:
 
 jobs:
   notify-new-bugs-announce:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-slim
     permissions:
       issues: read
     timeout-minutes: 10

.github/workflows/posix-deps-apt.sh

@@ -5,37 +5,23 @@ apt-get -yq --no-install-recommends install \
     build-essential \
     pkg-config \
     cmake \
+    curl \
     gdb \
     lcov \
     libb2-dev \
     libbz2-dev \
     libffi-dev \
-    libgdbm-dev \
     libgdbm-compat-dev \
+    libgdbm-dev \
     liblzma-dev \
+    libmpdec-dev \
     libncurses5-dev \
     libreadline6-dev \
     libsqlite3-dev \
     libssl-dev \
     libzstd-dev \
-    lzma \
-    lzma-dev \
     strace \
     tk-dev \
     uuid-dev \
     xvfb \
     zlib1g-dev
-
-# Workaround missing libmpdec-dev on ubuntu 24.04 by building mpdecimal
-# from source. ppa:ondrej/php (launchpad.net) are unreliable
-# (https://status.canonical.com) so fetch the tarball directly
-# from the upstream host.
-# https://www.bytereef.org/mpdecimal/
-MPDECIMAL_VERSION=4.0.1
-curl -fsSL "https://www.bytereef.org/software/mpdecimal/releases/mpdecimal-${MPDECIMAL_VERSION}.tar.gz" \
-    | tar -xz -C /tmp
-(cd "/tmp/mpdecimal-${MPDECIMAL_VERSION}" \
-    && ./configure --prefix=/usr/local \
-    && make -j"$(nproc)" \
-    && make install)
-ldconfig

.github/workflows/require-pr-label.yml

@@ -11,7 +11,7 @@ jobs:
   label-dnm:
     name: DO-NOT-MERGE
     if: github.repository_owner == 'python'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-slim
     permissions:
       pull-requests: read
     timeout-minutes: 10
@@ -28,7 +28,7 @@ jobs:
   label-reviews:
     name: Unresolved review
     if: github.repository_owner == 'python'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-slim
     permissions:
       pull-requests: read
     timeout-minutes: 10

.github/workflows/reusable-docs.yml

@@ -3,6 +3,17 @@ name: Reusable Docs
 on:
   workflow_call:
   workflow_dispatch:
+  # Pushes to CPython branches seed the pip caches under the exact keys every
+  # docs PR restores from. Without a branch-scoped copy, each PR saves a
+  # duplicate into its own refs/pull/N/merge scope that nothing else can read.
+  push:
+    branches:
+      - main
+      - '3.*'
+    paths:
+      - 'Doc/pylock.toml'
+      - 'Doc/requirements.txt'
+      - '.github/workflows/reusable-docs.yml'
 
 permissions:
   contents: read
@@ -95,7 +106,7 @@ jobs:
   # Run "doctest" on HEAD as new syntax doesn't exist in the latest stable release
   doctest:
     name: 'Doctest'
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 60
     steps:
     - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

.github/workflows/reusable-emscripten.yml

@@ -12,7 +12,7 @@ env:
 jobs:
   build-emscripten-reusable:
     name: 'build and test'
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 40
     steps:
     - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

.github/workflows/reusable-san.yml

@@ -17,6 +17,7 @@ permissions:
 
 env:
   FORCE_COLOR: 1
+  OPENSSL_VER: 3.5.7
 
 jobs:
   build-san-reusable:
@@ -26,7 +27,7 @@ jobs:
         && ' (free-threading)'
         || ''
       }}
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 60
     steps:
     - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
@@ -37,36 +38,56 @@ jobs:
     - name: Install dependencies
       run: |
         sudo ./.github/workflows/posix-deps-apt.sh
-        # Install clang
-        wget https://apt.llvm.org/llvm.sh
-        chmod +x llvm.sh
-        sudo ./llvm.sh 21
-        sudo update-alternatives --install /usr/bin/clang clang /usr/bin/clang-21 100
-        sudo update-alternatives --set clang /usr/bin/clang-21
-        sudo update-alternatives --install /usr/bin/clang++ clang++ /usr/bin/clang++-21 100
-        sudo update-alternatives --set clang++ /usr/bin/clang++-21
-
-        if [ "${SANITIZER}" = "TSan" ]; then
-          # Reduce ASLR to avoid TSan crashing
-          sudo sysctl -w vm.mmap_rnd_bits=28
-        fi
-
-    - name: Sanitizer option setup
-      run: |
-        if [ "${SANITIZER}" = "TSan" ]; then
-          echo "TSAN_OPTIONS=${SAN_LOG_OPTION} suppressions=${GITHUB_WORKSPACE}/Tools/tsan/suppressions${{
-              fromJSON(inputs.free-threading)
-              && '_free_threading'
-              || ''
-            }}.txt handle_segv=0" >> "$GITHUB_ENV"
-        else
-          echo "UBSAN_OPTIONS=${SAN_LOG_OPTION} halt_on_error=1 suppressions=${GITHUB_WORKSPACE}/Tools/ubsan/suppressions.txt" >> "$GITHUB_ENV"
-        fi
+        # On ubuntu-26.04 image, clang is clang-21 by default
         echo "CC=clang" >> "$GITHUB_ENV"
         echo "CXX=clang++" >> "$GITHUB_ENV"
+    - name: TSan option setup
+      if: inputs.sanitizer == 'TSan'
+      run: |
+        sudo sysctl -w vm.mmap_rnd_bits=28  # Reduce ASLR to avoid TSan crashing
+
+        echo "MULTISSL_DIR=${GITHUB_WORKSPACE}/multissl" >> "$GITHUB_ENV"
+        echo "OPENSSL_DIR=${GITHUB_WORKSPACE}/multissl/openssl/${OPENSSL_VER}" >> "$GITHUB_ENV"
+        echo "TSAN_OPTIONS=${SAN_LOG_OPTION} suppressions=${GITHUB_WORKSPACE}/Tools/tsan/suppressions${SUPPRESSIONS_SUFFIX}.txt handle_segv=0" >> "$GITHUB_ENV"
       env:
-        SANITIZER: ${{ inputs.sanitizer }}
         SAN_LOG_OPTION: log_path=${{ github.workspace }}/san_log
+        SUPPRESSIONS_SUFFIX: >-
+          ${{
+            fromJSON(inputs.free-threading)
+            && '_free_threading'
+            || ''
+          }}
+    - name: UBSan option setup
+      if: inputs.sanitizer != 'TSan'
+      run: >-
+        echo
+        "UBSAN_OPTIONS=${SAN_LOG_OPTION}
+        halt_on_error=1
+        suppressions=${GITHUB_WORKSPACE}/Tools/ubsan/suppressions.txt"
+        >> "$GITHUB_ENV"
+      env:
+        SAN_LOG_OPTION: log_path=${{ github.workspace }}/san_log
+    - name: Add ccache to PATH
+      run: |
+        echo "PATH=/usr/lib/ccache:$PATH" >> "$GITHUB_ENV"
+    - name: 'Restore OpenSSL build (TSan)'
+      id: cache-openssl
+      if: inputs.sanitizer == 'TSan'
+      uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
+      with:
+        path: ./multissl/openssl/${{ env.OPENSSL_VER }}
+        key: ${{ env.IMAGE_OS_VERSION }}-multissl-openssl-tsan-${{ env.OPENSSL_VER }}
+    - name: Install OpenSSL (TSan)
+      if: >-
+        inputs.sanitizer == 'TSan'
+        && steps.cache-openssl.outputs.cache-hit != 'true'
+      run: >-
+        python3 Tools/ssl/multissltests.py
+        --steps=library
+        --base-directory="${MULTISSL_DIR}"
+        --openssl="${OPENSSL_VER}"
+        --system=Linux
+        --tsan
     - name: Configure CPython
       run: >-
         ./configure
@@ -77,6 +98,7 @@ jobs:
           || '--with-undefined-behavior-sanitizer --with-strict-overflow'
         }}
         --with-pydebug
+        ${{ inputs.sanitizer == 'TSan' && '--with-openssl="$OPENSSL_DIR" --with-openssl-rpath=auto' || '' }}
         ${{ fromJSON(inputs.free-threading) && '--disable-gil' || '' }}
     - name: Build CPython
       run: make -j4