diff --git a/.github/actionlint.yaml b/.github/actionlint.yaml
index eacfff24889021..61ee08db9919bb 100644
--- a/.github/actionlint.yaml
+++ b/.github/actionlint.yaml
@@ -1,5 +1,12 @@
 config-variables: null
 
+# Pending release of actionlint > 1.7.12 for ubuntu-26.04* support:
+# https://github.com/rhysd/actionlint/pull/683
+self-hosted-runner:
+  labels:
+    - ubuntu-26.04
+    - ubuntu-26.04-arm
+
 paths:
   .github/workflows/**/*.yml:
      ignore:
diff --git a/.github/workflows/add-issue-header.yml b/.github/workflows/add-issue-header.yml
index 09da61a470ff95..55095f17bb4cce 100644
--- a/.github/workflows/add-issue-header.yml
+++ b/.github/workflows/add-issue-header.yml
@@ -17,7 +17,7 @@ permissions:
 
 jobs:
   add-header:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-slim
     permissions:
       issues: write
     timeout-minutes: 5
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 9ef98f556cb205..b541dbd0c23d32 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -53,7 +53,7 @@ jobs:
     name: 'Check if Autoconf files are up to date'
     # Don't use ubuntu-latest but a specific version to make the job
     # reproducible: to get the same tools versions (autoconf, aclocal, ...)
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     container:
       image: ghcr.io/python/autoconf:2025.01.02.12581854023
     timeout-minutes: 60
@@ -96,7 +96,7 @@ jobs:
     name: 'Check if generated files are up to date'
     # Don't use ubuntu-latest but a specific version to make the job
     # reproducible: to get the same tools versions (autoconf, aclocal, ...)
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 60
     needs: build-context
     if: needs.build-context.outputs.run-tests == 'true'
@@ -239,18 +239,18 @@ jobs:
         - false
         - true
         os:
-        - ubuntu-24.04
-        - ubuntu-24.04-arm
+        - ubuntu-26.04
+        - ubuntu-26.04-arm
         exclude:
         # Do not test BOLT with free-threading, to conserve resources
         - bolt: true
           free-threading: true
         # BOLT currently crashes during instrumentation on aarch64
-        - os: ubuntu-24.04-arm
+        - os: ubuntu-26.04-arm
           bolt: true
         include:
         # Enable CPU-intensive tests on ARM (default build only)
-        - os: ubuntu-24.04-arm
+        - os: ubuntu-26.04-arm
           bolt: false
           free-threading: false
           test-opts: '-u cpu'
@@ -270,7 +270,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-24.04]
+        os: [ubuntu-26.04]
         ssllib:
           # See Tools/ssl/make_ssl_data.py for notes on adding a new version
           ## OpenSSL
@@ -346,7 +346,7 @@ jobs:
           - arch: aarch64
             runs-on: macos-26
           - arch: x86_64
-            runs-on: ubuntu-24.04
+            runs-on: ubuntu-26.04
 
     runs-on: ${{ matrix.runs-on }}
     steps:
@@ -393,7 +393,7 @@ jobs:
 
   test-hypothesis:
     name: "Hypothesis tests on Ubuntu"
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 60
     needs: build-context
     if: needs.build-context.outputs.run-ubuntu == 'true'
@@ -504,7 +504,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-24.04]
+        os: [ubuntu-26.04]
     env:
       OPENSSL_VER: 3.5.7
       PYTHONSTRICTEXTENSIONBUILD: 1
@@ -568,7 +568,7 @@ jobs:
 
   cross-build-linux:
     name: Cross build Linux
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     timeout-minutes: 60
     needs: build-context
     if: needs.build-context.outputs.run-ubuntu == 'true'
diff --git a/.github/workflows/jit.yml b/.github/workflows/jit.yml
index 846c90d2525d25..813589c2bc14c8 100644
--- a/.github/workflows/jit.yml
+++ b/.github/workflows/jit.yml
@@ -29,7 +29,7 @@ env:
 jobs:
   interpreter:
     name: Interpreter (Debug)
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 60
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
@@ -102,9 +102,9 @@ jobs:
           - false
         include:
           - target: x86_64-apple-darwin/clang
-            runner: macos-15-intel
+            runner: macos-26-intel
           - target: aarch64-apple-darwin/clang
-            runner: macos-15
+            runner: macos-26
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
@@ -145,9 +145,9 @@ jobs:
           - false
         include:
           - target: x86_64-unknown-linux-gnu/gcc
-            runner: ubuntu-24.04
+            runner: ubuntu-26.04
           - target: aarch64-unknown-linux-gnu/gcc
-            runner: ubuntu-24.04-arm
+            runner: ubuntu-26.04-arm
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
@@ -160,8 +160,7 @@ jobs:
           sudo ./.github/workflows/posix-deps-apt.sh
       - name: Build
         run: |
-          sudo bash -c "$(wget -O - https://apt.llvm.org/llvm.sh)" ./llvm.sh ${{ env.LLVM_VERSION }}
-          export PATH="$(llvm-config-${{ env.LLVM_VERSION }} --bindir):$PATH"
+          # On ubuntu-26.04 image, clang is clang-21 by default
           ./configure --enable-experimental-jit ${{ matrix.debug && '--with-pydebug' || '' }}
           make all --jobs 4
       - name: Test
@@ -171,7 +170,7 @@ jobs:
   linux-extras:
     name: ${{ matrix.name }}
 
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 60
     strategy:
       fail-fast: false
@@ -202,8 +201,7 @@ jobs:
           sudo ./.github/workflows/posix-deps-apt.sh
       - name: Build
         run: |
-          sudo bash -c "$(wget -O - https://apt.llvm.org/llvm.sh)" ./llvm.sh ${{ env.LLVM_VERSION }}
-          export PATH="$(llvm-config-${{ env.LLVM_VERSION }} --bindir):$PATH"
+          # On ubuntu-26.04 image, clang is clang-21 by default
           if [ "${{ matrix.use_clang }}" = "true" ]; then
             export CC=clang-${{ env.LLVM_VERSION }}
           fi
diff --git a/.github/workflows/new-bugs-announce-notifier.yml b/.github/workflows/new-bugs-announce-notifier.yml
index 9c19adb7ffda70..864d0f48904bcc 100644
--- a/.github/workflows/new-bugs-announce-notifier.yml
+++ b/.github/workflows/new-bugs-announce-notifier.yml
@@ -10,7 +10,7 @@ permissions:
 
 jobs:
   notify-new-bugs-announce:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-slim
     permissions:
       issues: read
     timeout-minutes: 10
diff --git a/.github/workflows/posix-deps-apt.sh b/.github/workflows/posix-deps-apt.sh
index f241fccdeb2a32..803204635abfe1 100755
--- a/.github/workflows/posix-deps-apt.sh
+++ b/.github/workflows/posix-deps-apt.sh
@@ -5,37 +5,23 @@ apt-get -yq --no-install-recommends install \
     build-essential \
     pkg-config \
     cmake \
+    curl \
     gdb \
     lcov \
     libb2-dev \
     libbz2-dev \
     libffi-dev \
-    libgdbm-dev \
     libgdbm-compat-dev \
+    libgdbm-dev \
     liblzma-dev \
+    libmpdec-dev \
     libncurses5-dev \
     libreadline6-dev \
     libsqlite3-dev \
     libssl-dev \
     libzstd-dev \
-    lzma \
-    lzma-dev \
     strace \
     tk-dev \
     uuid-dev \
     xvfb \
     zlib1g-dev
-
-# Workaround missing libmpdec-dev on ubuntu 24.04 by building mpdecimal
-# from source. ppa:ondrej/php (launchpad.net) are unreliable
-# (https://status.canonical.com) so fetch the tarball directly
-# from the upstream host.
-# https://www.bytereef.org/mpdecimal/
-MPDECIMAL_VERSION=4.0.1
-curl -fsSL "https://www.bytereef.org/software/mpdecimal/releases/mpdecimal-${MPDECIMAL_VERSION}.tar.gz" \
-    | tar -xz -C /tmp
-(cd "/tmp/mpdecimal-${MPDECIMAL_VERSION}" \
-    && ./configure --prefix=/usr/local \
-    && make -j"$(nproc)" \
-    && make install)
-ldconfig
diff --git a/.github/workflows/require-pr-label.yml b/.github/workflows/require-pr-label.yml
index f3e2666879530f..8af254c10786e1 100644
--- a/.github/workflows/require-pr-label.yml
+++ b/.github/workflows/require-pr-label.yml
@@ -11,7 +11,7 @@ jobs:
   label-dnm:
     name: DO-NOT-MERGE
     if: github.repository_owner == 'python'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-slim
     permissions:
       pull-requests: read
     timeout-minutes: 10
@@ -28,7 +28,7 @@ jobs:
   label-reviews:
     name: Unresolved review
     if: github.repository_owner == 'python'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-slim
     permissions:
       pull-requests: read
     timeout-minutes: 10
diff --git a/.github/workflows/reusable-docs.yml b/.github/workflows/reusable-docs.yml
index cac481d26a8d0c..a792553a63b8ba 100644
--- a/.github/workflows/reusable-docs.yml
+++ b/.github/workflows/reusable-docs.yml
@@ -95,7 +95,7 @@ jobs:
   # Run "doctest" on HEAD as new syntax doesn't exist in the latest stable release
   doctest:
     name: 'Doctest'
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 60
     steps:
     - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
diff --git a/.github/workflows/reusable-emscripten.yml b/.github/workflows/reusable-emscripten.yml
index 46664522aa6d79..0205203ef77a9f 100644
--- a/.github/workflows/reusable-emscripten.yml
+++ b/.github/workflows/reusable-emscripten.yml
@@ -12,7 +12,7 @@ env:
 jobs:
   build-emscripten-reusable:
     name: 'build and test'
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 40
     steps:
     - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
diff --git a/.github/workflows/reusable-san.yml b/.github/workflows/reusable-san.yml
index d29f4e83b48dac..405fa36454a62b 100644
--- a/.github/workflows/reusable-san.yml
+++ b/.github/workflows/reusable-san.yml
@@ -26,7 +26,7 @@ jobs:
         && ' (free-threading)'
         || ''
       }}
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 60
     steps:
     - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
@@ -37,14 +37,7 @@ jobs:
     - name: Install dependencies
       run: |
         sudo ./.github/workflows/posix-deps-apt.sh
-        # Install clang
-        wget https://apt.llvm.org/llvm.sh
-        chmod +x llvm.sh
-        sudo ./llvm.sh 21
-        sudo update-alternatives --install /usr/bin/clang clang /usr/bin/clang-21 100
-        sudo update-alternatives --set clang /usr/bin/clang-21
-        sudo update-alternatives --install /usr/bin/clang++ clang++ /usr/bin/clang++-21 100
-        sudo update-alternatives --set clang++ /usr/bin/clang++-21
+        # On ubuntu-26.04 image, clang is clang-21 by default
 
         if [ "${SANITIZER}" = "TSan" ]; then
           # Reduce ASLR to avoid TSan crashing
diff --git a/.github/workflows/reusable-ubuntu.yml b/.github/workflows/reusable-ubuntu.yml
index cd810babb7a9d6..4ecc541e6aa7d0 100644
--- a/.github/workflows/reusable-ubuntu.yml
+++ b/.github/workflows/reusable-ubuntu.yml
@@ -49,7 +49,7 @@ jobs:
     - name: Install Clang and BOLT
       if: ${{ fromJSON(inputs.bolt-optimizations) }}
       run: |
-        sudo bash -c "$(wget -O - https://apt.llvm.org/llvm.sh)" ./llvm.sh 21
+        # On ubuntu-26.04 image, LLVM is LLVM-21 by default
         sudo apt-get install --no-install-recommends bolt-21
         echo PATH="$(llvm-config-21 --bindir):$PATH" >> $GITHUB_ENV
     - name: Configure OpenSSL env vars
diff --git a/.github/workflows/reusable-wasi.yml b/.github/workflows/reusable-wasi.yml
index 9675c39b86a24c..b0dda62d0b291c 100644
--- a/.github/workflows/reusable-wasi.yml
+++ b/.github/workflows/reusable-wasi.yml
@@ -12,7 +12,7 @@ env:
 jobs:
   build-wasi-reusable:
     name: 'build and test'
-    runs-on: ubuntu-24.04-arm
+    runs-on: ubuntu-26.04-arm
     timeout-minutes: 60
     env:
       WASMTIME_VERSION: 38.0.3
diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml
index 37f78519dedc32..0283e9f621dcf0 100644
--- a/.github/workflows/stale.yml
+++ b/.github/workflows/stale.yml
@@ -10,7 +10,7 @@ permissions:
 jobs:
   stale:
     if: github.repository_owner == 'python'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-slim
     permissions:
       actions: write
       pull-requests: write
diff --git a/.github/workflows/tail-call.yml b/.github/workflows/tail-call.yml
index f5b174d87d8448..81e8235f236ea7 100644
--- a/.github/workflows/tail-call.yml
+++ b/.github/workflows/tail-call.yml
@@ -32,9 +32,9 @@ jobs:
       matrix:
         include:
           - target: x86_64-apple-darwin/clang
-            runner: macos-15-intel
+            runner: macos-26-intel
           - target: aarch64-apple-darwin/clang
-            runner: macos-15
+            runner: macos-26
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
@@ -66,13 +66,13 @@ jobs:
       matrix:
         include:
           - target: x86_64-unknown-linux-gnu/gcc
-            runner: ubuntu-24.04
+            runner: ubuntu-26.04
             configure_flags: --with-pydebug
           - target: x86_64-unknown-linux-gnu/gcc-free-threading
-            runner: ubuntu-24.04
+            runner: ubuntu-26.04
             configure_flags: --disable-gil
           - target: aarch64-unknown-linux-gnu/gcc
-            runner: ubuntu-24.04-arm
+            runner: ubuntu-26.04-arm
             configure_flags: --with-pydebug
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
@@ -83,8 +83,7 @@ jobs:
           python-version: '3.11'
       - name: Build
         run: |
-          sudo bash -c "$(wget -O - https://apt.llvm.org/llvm.sh)" ./llvm.sh ${{ env.LLVM_VERSION }}
-          export PATH="$(llvm-config-${{ env.LLVM_VERSION }} --bindir):$PATH"
+          # On ubuntu-26.04 image, clang is clang-21 by default
           CC=clang-${{ env.LLVM_VERSION }} ./configure --with-tail-call-interp ${{ matrix.configure_flags }}
           make all --jobs 4
       - name: Test
diff --git a/.github/workflows/verify-expat.yml b/.github/workflows/verify-expat.yml
index bae93a4d9ac0a2..b96e71b487dbe5 100644
--- a/.github/workflows/verify-expat.yml
+++ b/.github/workflows/verify-expat.yml
@@ -20,7 +20,7 @@ concurrency:
 
 jobs:
   verify:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-slim
     timeout-minutes: 5
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 6c7f1b93e66e87..615ba587c6a400 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -111,7 +111,7 @@ repos:
       - id: check-readthedocs
 
   - repo: https://github.com/rhysd/actionlint
-    rev: 393031adb9afb225ee52ae2ccd7a5af5525e03e8  # frozen: v1.7.11
+    rev: 914e7df21a07ef503a81201c76d2b11c789d3fca  # frozen: v1.7.12
     hooks:
       - id: actionlint
 
diff --git a/Doc/library/os.rst b/Doc/library/os.rst
index 7b043f257ca0b5..5858d9733c5779 100644
--- a/Doc/library/os.rst
+++ b/Doc/library/os.rst
@@ -2180,6 +2180,11 @@ features:
 
    .. audit-event:: os.chdir path os.chdir
 
+   .. seealso::
+
+      The :func:`contextlib.chdir` context manager, which changes the current
+      working directory on entering and restores the previous one on exit.
+
    .. versionchanged:: 3.3
       Added support for specifying *path* as a file descriptor
       on some platforms.
@@ -3032,10 +3037,16 @@ features:
 
    .. attribute:: path
 
-      The entry's full path name: equivalent to ``os.path.join(scandir_path,
-      entry.name)`` where *scandir_path* is the :func:`scandir` *path*
-      argument.  The path is only absolute if the :func:`scandir` *path*
-      argument was absolute.  If the :func:`scandir` *path*
+      The entry's path name: equivalent to ``os.path.join(scandir_path,
+      entry.name)`` where *scandir_path* is the original :func:`scandir`
+      *path* argument.  Apart from the filename, the path preserves the
+      original :func:`scandir` argument.  If the :func:`scandir` *path*
+      argument was relative, the :attr:`path` attribute is also relative.
+      Changing the current working directory after creating the
+      :func:`scandir` iterator may cause later uses of :attr:`path` to resolve
+      differently.  On some platforms, the constructed path may not be valid
+      if the original :func:`scandir` argument was usable for enumeration but
+      not for joining with the entry name.  If the :func:`scandir` *path*
       argument was a :ref:`file descriptor <path_fd>`, the :attr:`path`
       attribute is the same as the :attr:`name` attribute.
 
diff --git a/Lib/test/test_capi/test_bytes.py b/Lib/test/test_capi/test_bytes.py
index 410ebab729c2cf..c591e986bbce35 100644
--- a/Lib/test/test_capi/test_bytes.py
+++ b/Lib/test/test_capi/test_bytes.py
@@ -222,10 +222,10 @@ def test_decodeescape(self):
         self.assertEqual(decodeescape(br'x\xa\xy', 'replace'), b'x??y')
         self.assertEqual(decodeescape(br'x\xa\xy', 'ignore'), b'xy')
         self.assertRaises(ValueError, decodeescape, b'\\', 'spam')
-        self.assertEqual(decodeescape(NULL), b'')
         self.assertRaises(OverflowError, decodeescape, b'abc', NULL, PY_SSIZE_T_MAX)
         self.assertRaises(OverflowError, decodeescape, NULL, NULL, PY_SSIZE_T_MAX)
 
+        # INVALID decodeescape(NULL)
         # CRASHES decodeescape(b'abc', NULL, -1)
         # CRASHES decodeescape(NULL, NULL, 1)
 
diff --git a/Lib/test/test_fstring.py b/Lib/test/test_fstring.py
index 5cc02c30ec2ba3..9a8e56836fc671 100644
--- a/Lib/test/test_fstring.py
+++ b/Lib/test/test_fstring.py
@@ -1706,6 +1706,9 @@ def test_invalid_syntax_error_message(self):
         with self.assertRaisesRegex(SyntaxError,
                                     "f-string: expecting '=', or '!', or ':', or '}'"):
             compile("f'{a $ b}'", "?", "exec")
+        with self.assertRaisesRegex(SyntaxError,
+                                    "f-string: expecting '!', or ':', or '}'"):
+            compile("f'{a=b}'", "?", "exec")
 
     def test_with_two_commas_in_format_specifier(self):
         error_msg = re.escape("Cannot specify ',' with ','.")
diff --git a/Lib/test/test_syntax.py b/Lib/test/test_syntax.py
index 29278d928fbb40..a63042055210c5 100644
--- a/Lib/test/test_syntax.py
+++ b/Lib/test/test_syntax.py
@@ -2238,6 +2238,16 @@
 Traceback (most recent call last):
 SyntaxError: only single target (not list) can be annotated
 
+>>> 1: int
+Traceback (most recent call last):
+SyntaxError: illegal target for annotation
+>>> -x: int = 1
+Traceback (most recent call last):
+SyntaxError: illegal target for annotation
+>>> (x for x in y): int
+Traceback (most recent call last):
+SyntaxError: illegal target for annotation
+
 # 'not' after operators:
 
 >>> 3 + not 3
diff --git a/Lib/test/test_time.py b/Lib/test/test_time.py
index 1850f053aaffd6..985984b55123ce 100644
--- a/Lib/test/test_time.py
+++ b/Lib/test/test_time.py
@@ -1013,6 +1013,17 @@ def test_FromSecondsObject(self):
             with self.assertRaises(ValueError):
                 _PyTime_FromSecondsObject(float('nan'), time_rnd)
 
+    def test_FromSecondsObject_float_overflow_message(self):
+        # Float path must report a PyTime_t overflow, like the integer path.
+        from _testinternalcapi import _PyTime_FromSecondsObject
+        for value in (PyTime_MAX, PyTime_MIN):
+            for time_rnd, _ in ROUNDING_MODES:
+                with self.subTest(value=value, time_rnd=time_rnd):
+                    with self.assertRaisesRegex(
+                            OverflowError,
+                            "timestamp out of range for C PyTime_t"):
+                        _PyTime_FromSecondsObject(value, time_rnd)
+
     def test_AsSecondsDouble(self):
         from _testcapi import PyTime_AsSecondsDouble
 
diff --git a/Lib/test/test_unpack_ex.py b/Lib/test/test_unpack_ex.py
index 33c96b84964b59..4fe19765cacf11 100644
--- a/Lib/test/test_unpack_ex.py
+++ b/Lib/test/test_unpack_ex.py
@@ -355,6 +355,20 @@
         ^^^
     SyntaxError: cannot use dict unpacking in a dictionary value
 
+    >>> (**a)
+    Traceback (most recent call last):
+    ...
+    (**a)
+     ^^
+    SyntaxError: cannot use dict unpacking here
+
+    >>> {**a for a in {1: 2}.items(): b}
+    Traceback (most recent call last):
+    ...
+    {**a for a in {1: 2}.items(): b}
+     ^^
+    SyntaxError: cannot use dict unpacking here
+
 
 # Generator expression in function arguments
 
diff --git a/Misc/NEWS.d/next/Library/2026-07-02-13-30-00.gh-issue-152849.K9dRvP.rst b/Misc/NEWS.d/next/Library/2026-07-02-13-30-00.gh-issue-152849.K9dRvP.rst
new file mode 100644
index 00000000000000..053a5dfea3f3ff
--- /dev/null
+++ b/Misc/NEWS.d/next/Library/2026-07-02-13-30-00.gh-issue-152849.K9dRvP.rst
@@ -0,0 +1,2 @@
+Out-of-range float and integer timestamps now raise :exc:`OverflowError`
+with the same message. Patch by tonghuaroot.
diff --git a/Misc/NEWS.d/next/Windows/2026-07-01-16-38-24.gh-issue-152433.jvEiHh.rst b/Misc/NEWS.d/next/Windows/2026-07-01-16-38-24.gh-issue-152433.jvEiHh.rst
new file mode 100644
index 00000000000000..d5aead5fbe0b9e
--- /dev/null
+++ b/Misc/NEWS.d/next/Windows/2026-07-01-16-38-24.gh-issue-152433.jvEiHh.rst
@@ -0,0 +1 @@
+:mod:`ssl`: improve UWP build compatibility.
diff --git a/Modules/_ssl.c b/Modules/_ssl.c
index f451c0ce7364ab..20564e1ba4165a 100644
--- a/Modules/_ssl.c
+++ b/Modules/_ssl.c
@@ -4924,16 +4924,16 @@ static PyObject *
 _ssl__SSLContext_load_dh_params_impl(PySSLContext *self, PyObject *filepath)
 /*[clinic end generated code: output=dd74b3c524dd2723 input=832769a0734b8c4d]*/
 {
-    FILE *f;
-    DH *dh;
-
-#if defined(MS_WINDOWS) && defined(Py_DEBUG)
+#if defined(MS_WINDOWS_APP) && !defined(MS_WINDOWS_DESKTOP)
+    PyErr_SetString(PyExc_NotImplementedError, "load_dh_params: unavailable on UWP build");
+    return NULL;
+#elif defined(MS_WINDOWS) && defined(Py_DEBUG)
     PyErr_SetString(PyExc_NotImplementedError,
                     "load_dh_params: unavailable on Windows debug build");
     return NULL;
-#endif
-
-    f = Py_fopen(filepath, "rb");
+#else
+    FILE* f = Py_fopen(filepath, "rb");
+    DH* dh;
     if (f == NULL)
         return NULL;
 
@@ -4959,6 +4959,7 @@ _ssl__SSLContext_load_dh_params_impl(PySSLContext *self, PyObject *filepath)
     }
     DH_free(dh);
     Py_RETURN_NONE;
+#endif
 }
 
 /*[clinic input]
diff --git a/Modules/_ssl/debughelpers.c b/Modules/_ssl/debughelpers.c
index e0cb7ca9a09f91..fb9043994f08f9 100644
--- a/Modules/_ssl/debughelpers.c
+++ b/Modules/_ssl/debughelpers.c
@@ -182,14 +182,17 @@ static int
 _PySSLContext_set_keylog_filename(PyObject *op, PyObject *arg,
                                   void *Py_UNUSED(closure))
 {
-    PySSLContext *self = PySSLContext_CAST(op);
-    FILE *fp;
-
-#if defined(MS_WINDOWS) && defined(Py_DEBUG)
+#if defined(MS_WINDOWS_APP) && !defined(MS_WINDOWS_DESKTOP)
+    PyErr_SetString(PyExc_NotImplementedError,
+                    "set_keylog_filename: unavailable on UWP build");
+    return -1;
+#elif defined(MS_WINDOWS) && defined(Py_DEBUG)
     PyErr_SetString(PyExc_NotImplementedError,
                     "set_keylog_filename: unavailable on Windows debug build");
     return -1;
-#endif
+#else
+    PySSLContext* self = PySSLContext_CAST(op);
+    FILE* fp;
 
     /* Reset variables and callback first */
     SSL_CTX_set_keylog_callback(self->ctx, NULL);
@@ -231,4 +234,5 @@ _PySSLContext_set_keylog_filename(PyObject *op, PyObject *arg,
     PySSL_END_ALLOW_THREADS(self)
     SSL_CTX_set_keylog_callback(self->ctx, _PySSL_keylog_callback);
     return 0;
+#endif
 }
diff --git a/Python/pytime.c b/Python/pytime.c
index 399ff59ad01ab6..53c82736137a16 100644
--- a/Python/pytime.c
+++ b/Python/pytime.c
@@ -107,7 +107,7 @@ static void
 pytime_overflow(void)
 {
     PyErr_SetString(PyExc_OverflowError,
-                    "timestamp too large to convert to C PyTime_t");
+                    "timestamp out of range for C PyTime_t");
 }
 
 
@@ -636,7 +636,7 @@ pytime_from_double(PyTime_t *tp, double value, _PyTime_round_t round,
 
     /* See comments in pytime_double_to_denominator */
     if (!((double)PyTime_MIN <= d && d < -(double)PyTime_MIN)) {
-        pytime_time_t_overflow();
+        pytime_overflow();
         *tp = 0;
         return -1;
     }
diff --git a/Tools/ubsan/suppressions.txt b/Tools/ubsan/suppressions.txt
index a00e256b333618..e3679bc421f420 100644
--- a/Tools/ubsan/suppressions.txt
+++ b/Tools/ubsan/suppressions.txt
@@ -20,6 +20,3 @@ pointer-overflow:Modules/_zstd/decompressor.c
 
 # Modules/_io/stringio.c:350:24: runtime error: addition of unsigned offset to 0x7fd01ec25850 overflowed to 0x7fd01ec2584c
 pointer-overflow:Modules/_io/stringio.c
-
-# Objects/bytesobject.c:1190:25: runtime error: applying zero offset to null pointer
-pointer-overflow:Objects/bytesobject.c