Merge remote-tracking branch 'upstream/main' into gh-87512-subprocess-timeout

# Conflicts:
#	Modules/clinic/_winapi.c.h

Author: serhiy-storchaka

.claude/CLAUDE.md

@@ -0,0 +1 @@
+../AGENTS.md

.gitattributes

@@ -80,12 +80,12 @@ Include/internal/pycore_ast_state.h                 generated
 Include/internal/pycore_opcode.h                    generated
 Include/internal/pycore_opcode_metadata.h           generated
 Include/internal/pycore_*_generated.h               generated
+Include/internal/pycore_token.h                     generated
 Include/internal/pycore_uop_ids.h                   generated
 Include/internal/pycore_uop_metadata.h              generated
 Include/opcode.h                                    generated
 Include/opcode_ids.h                                generated
 Include/slots_generated.h                           generated
-Include/token.h                                     generated
 Lib/_opcode_metadata.py                             generated
 Lib/idlelib/help.html                               generated
 Lib/keyword.py                                      generated

.github/CODEOWNERS

@@ -223,7 +223,7 @@ Tools/cases_generator/        @markshannon
 Python/assemble.c             @markshannon @iritkatriel
 Python/codegen.c              @markshannon @iritkatriel
 Python/compile.c              @markshannon @iritkatriel
-Python/flowgraph.c            @markshannon @iritkatriel
+Python/flowgraph.c            @markshannon @iritkatriel @eclips4
 Python/instruction_sequence.c @iritkatriel
 Python/symtable.c             @JelleZijlstra @carljm
 
@@ -598,6 +598,12 @@ Doc/library/tomllib.rst       @encukou @hauntsaninja
 Lib/test/test_tomllib/        @encukou @hauntsaninja
 Lib/tomllib/                  @encukou @hauntsaninja
 
+# Turtle
+Doc/library/turtle.rst        @StanFromIreland
+Doc/library/turtle-star.png   @StanFromIreland
+Lib/test/test_turtle.py       @StanFromIreland
+Lib/turtle.py                 @StanFromIreland
+
 # Typing
 Doc/library/typing.rst        @JelleZijlstra @AlexWaygood
 Lib/test/test_typing.py       @JelleZijlstra @AlexWaygood
@@ -620,6 +626,12 @@ Lib/test/test_unittest/testmock/ @cjw296
 # Weakref
 **/*weakref*                  @kumaraditya303
 
+# Zlib
+Doc/library/zlib.rst          @StanFromIreland
+Lib/compression/zlib.py       @StanFromIreland
+Lib/test/test_zlib.py         @StanFromIreland
+Modules/zlibmodule.c          @StanFromIreland
+
 # Zipfile.Path
 Lib/test/test_zipfile/_path/  @jaraco
 Lib/zipfile/_path/            @jaraco

.github/workflows/build.yml

@@ -245,6 +245,12 @@ jobs:
       os: ${{ matrix.os }}
       test-opts: ${{ matrix.test-opts || '' }}
 
+  build-ubuntu-installed:
+    name: 'Ubuntu (installed)'
+    needs: build-context
+    if: needs.build-context.outputs.run-ubuntu == 'true'
+    uses: ./.github/workflows/reusable-install.yml
+
   build-ubuntu-ssltests:
     name: 'Ubuntu SSL tests'
     runs-on: ${{ matrix.os }}
@@ -262,13 +268,13 @@ jobs:
           # unsupported as it most resembles other 1.1.1-work-a-like ssl APIs
           # supported by important vendors such as AWS-LC.
           - { name: openssl, version: 1.1.1w }
-          - { name: openssl, version: 3.0.21 }
-          - { name: openssl, version: 3.4.6 }
-          - { name: openssl, version: 3.5.7 }
-          - { name: openssl, version: 3.6.3 }
-          - { name: openssl, version: 4.0.1 }
+          - { name: openssl, version: 3.0.22 }
+          - { name: openssl, version: 3.4.7 }
+          - { name: openssl, version: 3.5.8 }
+          - { name: openssl, version: 3.6.4 }
+          - { name: openssl, version: 4.0.2 }
           ## AWS-LC
-          - { name: aws-lc, version: 5.0.0 }
+          - { name: aws-lc, version: 5.5.0 }
     env:
       SSLLIB_VER: ${{ matrix.ssllib.version }}
       MULTISSL_DIR: ${{ github.workspace }}/multissl
@@ -373,7 +379,7 @@ jobs:
     needs: build-context
     if: needs.build-context.outputs.run-ubuntu == 'true'
     env:
-      OPENSSL_VER: 3.5.7
+      OPENSSL_VER: 3.5.8
       PYTHONSTRICTEXTENSIONBUILD: 1
     steps:
     - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
@@ -481,7 +487,7 @@ jobs:
       matrix:
         os: [ubuntu-26.04]
     env:
-      OPENSSL_VER: 3.5.7
+      OPENSSL_VER: 3.5.8
       PYTHONSTRICTEXTENSIONBUILD: 1
       ASAN_OPTIONS: detect_leaks=0:allocator_may_return_null=1:handle_segv=0
     steps:
@@ -636,6 +642,7 @@ jobs:
     - build-windows
     - build-macos
     - build-ubuntu
+    - build-ubuntu-installed
     - build-ubuntu-ssltests
     - build-ios
     - build-emscripten
@@ -685,6 +692,7 @@ jobs:
             !fromJSON(needs.build-context.outputs.run-ubuntu)
             && '
             build-ubuntu,
+            build-ubuntu-installed,
             build-ubuntu-ssltests,
             test-hypothesis,
             build-asan,

.github/workflows/reusable-docs.yml

@@ -86,6 +86,9 @@ jobs:
           --fail-if-regression \
           --fail-if-improved \
           --fail-if-new-news-nit
+    - name: 'Build list of changes'
+      run: |
+        make -C Doc/ PYTHON=../python changes
     - name: 'Collect HTML IDs'
       if: github.event_name == 'pull_request'
       run: python Doc/tools/check-html-ids.py collect Doc/build/html -o Doc/build/html-ids-head.json.gz

.github/workflows/reusable-install.yml

@@ -0,0 +1,44 @@
+name: Reusable Ubuntu (installed)
+
+on:
+  workflow_call:
+
+permissions:
+  contents: read
+
+env:
+  FORCE_COLOR: 1
+
+jobs:
+  build-install-test:
+    name: build, install and test
+    runs-on: ubuntu-26.04-arm
+    timeout-minutes: 60
+    env:
+      PYTHONSTRICTEXTENSIONBUILD: 1
+    steps:
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      with:
+        persist-credentials: false
+    - name: Register gcc problem matcher
+      run: echo "::add-matcher::.github/problem-matchers/gcc.json"
+    - name: Set install dir
+      run:
+        echo "INSTALL_DIR=$(realpath "${GITHUB_WORKSPACE}/../installed-python")" >> "$GITHUB_ENV"
+    - name: Install dependencies
+      run: sudo ./.github/workflows/posix-deps-apt.sh
+    - name: Configure CPython
+      run: ./configure --config-cache --prefix="$INSTALL_DIR"
+    - name: Build CPython
+      run: make -j
+    - name: Install CPython
+      run: make install
+    - name: Set installed interpreter
+      run: |
+        ldversion=$(./python -c 'import sysconfig; print(sysconfig.get_config_var("LDVERSION"))')
+        echo "INSTALLED_PYTHON=${INSTALL_DIR}/bin/python${ldversion}" >> "$GITHUB_ENV"
+    - name: Display build info
+      run: |
+        "$INSTALLED_PYTHON" -m test.pythoninfo
+    - name: Test the installed Python
+      run: xvfb-run "$INSTALLED_PYTHON" -m test --fast-ci --timeout=900

.github/workflows/reusable-san.yml

@@ -17,7 +17,7 @@ permissions:
 
 env:
   FORCE_COLOR: 1
-  OPENSSL_VER: 3.5.7
+  OPENSSL_VER: 3.5.8
 
 jobs:
   build-san-reusable:

.github/workflows/reusable-ubuntu.yml

@@ -35,7 +35,7 @@ jobs:
     runs-on: ${{ inputs.os }}
     timeout-minutes: 60
     env:
-      OPENSSL_VER: 3.5.7
+      OPENSSL_VER: 3.5.8
       PYTHONSTRICTEXTENSIONBUILD: 1
       TERM: linux
     steps:

.gitignore

@@ -178,8 +178,12 @@ Python/frozen_modules/MANIFEST
 /python
 !/Python/
 
-# People's custom https://docs.anthropic.com/en/docs/claude-code/memory configs.
-/.claude/
+# Local AI agent scratch state (per-PR and per-branch notebooks, sandbox
+# experiments) and personal agent overrides, none of which are committed.
+/.claude/pr-*
+/.claude/branch-*
+/.claude/sandbox/
+AGENTS.local.md
 CLAUDE.local.md
 
 #### main branch only stuff below this line, things to backport go above. ####

AGENTS.md

@@ -0,0 +1,16 @@
+# AI agent guidance
+
+CPython has a [policy on the use of AI tools](https://devguide.python.org/getting-started/ai-tools/).
+All use of AI tools and agents when working on or interacting with CPython
+must follow it.
+
+> [!important]
+> **Primary directive**: Read the policy before making or proposing any changes.
+
+When acting on this repository, apply the policy's core principles:
+
+- Consider whether the change is necessary.
+- Make minimal, focused changes.
+- Follow existing coding style and patterns.
+- Write tests that exercise the change.
+- Keep backwards compatibility with prior releases in mind.