Merge branch 'main' into refleaks

Author: eendebakpt

.github/CODEOWNERS

@@ -260,33 +260,33 @@ Include/pyhash.h                 @gpshead @picnixz
 Python/pyhash.c                  @gpshead @picnixz
 
 # The import system (including importlib)
-**/*import*                   @brettcannon @ericsnowcurrently @ncoghlan @warsaw
-Python/import.c               @brettcannon @ericsnowcurrently @ncoghlan @warsaw @kumaraditya303
+**/*import*                   @brettcannon @ericsnowcurrently @ncoghlan @warsaw @FFY00
+Python/import.c               @brettcannon @ericsnowcurrently @ncoghlan @warsaw @FFY00 @kumaraditya303
 **/*freeze*                   @ericsnowcurrently
 **/*frozen*                   @ericsnowcurrently
 **/*modsupport*               @ericsnowcurrently
-**/*modulefinder*             @ericsnowcurrently
+**/*modulefinder*             @ericsnowcurrently @FFY00
 **/*moduleobject*             @ericsnowcurrently
 **/*multiphase*               @ericsnowcurrently
-**/*pkgutil*                  @ericsnowcurrently
+**/*pkgutil*                  @ericsnowcurrently @FFY00
 **/*pythonrun*                @ericsnowcurrently
-**/*runpy*                    @ericsnowcurrently
+**/*runpy*                    @ericsnowcurrently @FFY00
 **/*singlephase*              @ericsnowcurrently
 Doc/c-api/module.rst          @ericsnowcurrently
 Lib/test/test_module/         @ericsnowcurrently
-Python/dynload_*.c            @ericsnowcurrently
+Python/dynload_*.c            @ericsnowcurrently @FFY00
 
 # Initialisation
-**/*initconfig*               @ericsnowcurrently
-**/*pathconfig*               @ericsnowcurrently
-**/*preconfig*                @ericsnowcurrently
+**/*initconfig*               @ericsnowcurrently @FFY00
+**/*pathconfig*               @ericsnowcurrently @FFY00
+**/*preconfig*                @ericsnowcurrently @FFY00
 Doc/library/sys_path_init.rst @FFY00
 Doc/c-api/init_config.rst     @FFY00
 
 # Interpreter main program
-Modules/main.c                @ericsnowcurrently
-Programs/_bootstrap_python.c  @ericsnowcurrently
-Programs/python.c             @ericsnowcurrently
+Modules/main.c                @ericsnowcurrently @FFY00
+Programs/_bootstrap_python.c  @ericsnowcurrently @FFY00
+Programs/python.c             @ericsnowcurrently @FFY00
 
 # JIT
 .github/workflows/jit.yml     @savannahostrowski
@@ -316,8 +316,8 @@ Tools/peg_generator/          @pablogsal @lysnikolaou
 
 # Runtime state/lifecycle
 **/*gil*                      @ericsnowcurrently
-**/*pylifecycle*              @ericsnowcurrently @ZeroIntensity
-**/*pystate*                  @ericsnowcurrently @ZeroIntensity
+**/*pylifecycle*              @ericsnowcurrently @ZeroIntensity @FFY00
+**/*pystate*                  @ericsnowcurrently @ZeroIntensity @FFY00
 Include/internal/pycore_*_init.h          @ericsnowcurrently
 Include/internal/pycore_*_state.h         @ericsnowcurrently
 Include/internal/pycore_atexit.h          @ericsnowcurrently
@@ -505,13 +505,13 @@ Lib/idlelib/                  @terryjreedy
 Lib/turtledemo/               @terryjreedy
 
 # importlib.metadata
-Doc/library/importlib.metadata.rst  @jaraco @warsaw
-Lib/importlib/metadata/             @jaraco @warsaw
-Lib/test/test_importlib/metadata/   @jaraco @warsaw
+Doc/library/importlib.metadata.rst  @jaraco @warsaw @FFY00
+Lib/importlib/metadata/             @jaraco @warsaw @FFY00
+Lib/test/test_importlib/metadata/   @jaraco @warsaw @FFY00
 
 # importlib.resources
-Doc/library/importlib.resources.abc.rst   @jaraco @warsaw
-Doc/library/importlib.resources.rst       @jaraco @warsaw
+Doc/library/importlib.resources.abc.rst   @jaraco @warsaw @FFY00
+Doc/library/importlib.resources.rst       @jaraco @warsaw @FFY00
 Lib/importlib/resources/                  @jaraco @warsaw @FFY00
 Lib/test/test_importlib/resources/        @jaraco @warsaw @FFY00
 

.github/actionlint.yaml

@@ -1,7 +1,3 @@
-self-hosted-runner:
-  # Pending https://github.com/rhysd/actionlint/pull/615
-  labels: ["windows-2025-vs2026"]
-
 config-variables: null
 
 paths:

.github/workflows/new-bugs-announce-notifier.yml

@@ -44,7 +44,7 @@ jobs:
                 // We need to truncate the body size, because the max size for
                 // the whole payload is 16kb. We want to be safe and assume that
                 // body can take up to ~8kb of space.
-                body   : issue.data.body.substring(0, 8000)
+                body   : (issue.data.body || "").substring(0, 8000)
               };
 
               const data = {

.github/workflows/posix-deps-apt.sh

@@ -1,7 +1,7 @@
 #!/bin/sh
 apt-get update
 
-apt-get -yq install \
+apt-get -yq --no-install-recommends install \
     build-essential \
     pkg-config \
     cmake \
@@ -31,4 +31,4 @@ apt-get -yq install \
 # https://deb.sury.org/
 sudo add-apt-repository ppa:ondrej/php
 apt-get update
-apt-get -yq install libmpdec-dev
+apt-get -yq --no-install-recommends install libmpdec-dev

.github/workflows/regen-abidump.sh

@@ -2,7 +2,7 @@ set -ex
 
 export DEBIAN_FRONTEND=noninteractive
 ./.github/workflows/posix-deps-apt.sh
-apt-get install -yq abigail-tools python3
+apt-get install -yq --no-install-recommends abigail-tools python3
 export CFLAGS="-g3 -O0"
 ./configure --enable-shared && make
 make regen-abidump

.github/workflows/reusable-docs.yml

@@ -92,7 +92,7 @@ jobs:
         restore-keys: |
           ubuntu-doc-
     - name: 'Install Dependencies'
-      run: sudo ./.github/workflows/posix-deps-apt.sh && sudo apt-get install wamerican
+      run: sudo ./.github/workflows/posix-deps-apt.sh && sudo apt-get install --no-install-recommends wamerican
     - name: 'Configure CPython'
       run: ./configure --with-pydebug
     - name: 'Build CPython'

.github/workflows/reusable-ubuntu.yml

@@ -47,7 +47,7 @@ jobs:
       if: ${{ fromJSON(inputs.bolt-optimizations) }}
       run: |
         sudo bash -c "$(wget -O - https://apt.llvm.org/llvm.sh)" ./llvm.sh 19
-        sudo apt-get install bolt-19
+        sudo apt-get install --no-install-recommends bolt-19
         echo PATH="$(llvm-config-19 --bindir):$PATH" >> $GITHUB_ENV
     - name: Configure OpenSSL env vars
       run: |

.github/workflows/reusable-wasi.yml

@@ -13,8 +13,6 @@ jobs:
     timeout-minutes: 60
     env:
       WASMTIME_VERSION: 38.0.3
-      WASI_SDK_VERSION: 30
-      WASI_SDK_PATH: /opt/wasi-sdk
       CROSS_BUILD_PYTHON: cross-build/build
       CROSS_BUILD_WASI: cross-build/wasm32-wasip1
     steps:
@@ -26,18 +24,23 @@ jobs:
       uses: bytecodealliance/actions/wasmtime/setup@v1
       with:
         version: ${{ env.WASMTIME_VERSION }}
-    - name: "Restore WASI SDK"
-      id: cache-wasi-sdk
-      uses: actions/cache@v5
-      with:
-        path: ${{ env.WASI_SDK_PATH }}
-        key: ${{ runner.os }}-wasi-sdk-${{ env.WASI_SDK_VERSION }}
-    - name: "Install WASI SDK"  # Hard-coded to x64.
-      if: steps.cache-wasi-sdk.outputs.cache-hit != 'true'
+    - name: "Read WASI SDK version"
+      id: wasi-sdk-version
       run: |
-        mkdir "${WASI_SDK_PATH}" && \
-        curl -s -S --location "https://github.com/WebAssembly/wasi-sdk/releases/download/wasi-sdk-${WASI_SDK_VERSION}/wasi-sdk-${WASI_SDK_VERSION}.0-arm64-linux.tar.gz" | \
-        tar --strip-components 1 --directory "${WASI_SDK_PATH}" --extract --gunzip
+        import tomllib
+        from pathlib import Path
+        import os
+        config = tomllib.loads(Path("Platforms/WASI/config.toml").read_text())
+        version = config["targets"]["wasi-sdk"]
+        with open(os.environ["GITHUB_OUTPUT"], "a") as f:
+            f.write(f"version={version}\n")
+      shell: python
+    - name: "Install WASI SDK"
+      id: install-wasi-sdk
+      uses: bytecodealliance/setup-wasi-sdk-action@b2de090b44eb70013ee96b393727d473b35e1728
+      with:
+        version: ${{ steps.wasi-sdk-version.outputs.version }}
+        add-to-path: false
     - name: "Install Python"
       uses: actions/setup-python@v6
       with:
@@ -51,6 +54,8 @@ jobs:
     - name: "Configure host"
       # `--with-pydebug` inferred from configure-build-python
       run: python3 Platforms/WASI configure-host -- --config-cache
+      env:
+        WASI_SDK_PATH: ${{ steps.install-wasi-sdk.outputs.wasi-sdk-path }}
     - name: "Make host"
       run: python3 Platforms/WASI make-host
     - name: "Display build info"

.github/workflows/verify-expat.yml

@@ -0,0 +1,32 @@
+name: Verify bundled libexpat
+
+on:
+  workflow_dispatch:
+  push:
+    paths:
+      - 'Modules/expat/**'
+      - '.github/workflows/verify-expat.yml'
+  pull_request:
+    paths:
+      - 'Modules/expat/**'
+      - '.github/workflows/verify-expat.yml'
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  verify:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+      - name: Download and verify bundled libexpat files
+        run: |
+          ./Modules/expat/refresh.sh
+          git diff --exit-code Modules/expat/

.github/zizmor.yml

@@ -1,5 +1,5 @@
 # Configuration for the zizmor static analysis tool, run via prek in CI
-# https://woodruffw.github.io/zizmor/configuration/
+# https://docs.zizmor.sh/configuration/
 rules:
   dangerous-triggers:
     ignore: