[pull] main from python:main

.github/workflows/build.yml

@@ -278,14 +278,13 @@ jobs:
           # unsupported as it most resembles other 1.1.1-work-a-like ssl APIs
           # supported by important vendors such as AWS-LC.
           - { name: openssl, version: 1.1.1w }
-          - { name: openssl, version: 3.0.20 }
-          - { name: openssl, version: 3.3.7 }
-          - { name: openssl, version: 3.4.5 }
-          - { name: openssl, version: 3.5.6 }
-          - { name: openssl, version: 3.6.2 }
-          - { name: openssl, version: 4.0.0 }
+          - { name: openssl, version: 3.0.21 }
+          - { name: openssl, version: 3.4.6 }
+          - { name: openssl, version: 3.5.7 }
+          - { name: openssl, version: 3.6.3 }
+          - { name: openssl, version: 4.0.1 }
           ## AWS-LC
-          - { name: aws-lc, version: 1.72.1 }
+          - { name: aws-lc, version: 5.0.0 }
     env:
       SSLLIB_VER: ${{ matrix.ssllib.version }}
       MULTISSL_DIR: ${{ github.workspace }}/multissl
@@ -399,7 +398,7 @@ jobs:
     needs: build-context
     if: needs.build-context.outputs.run-ubuntu == 'true'
     env:
-      OPENSSL_VER: 3.5.6
+      OPENSSL_VER: 3.5.7
       PYTHONSTRICTEXTENSIONBUILD: 1
     steps:
     - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -507,7 +506,7 @@ jobs:
       matrix:
         os: [ubuntu-24.04]
     env:
-      OPENSSL_VER: 3.5.6
+      OPENSSL_VER: 3.5.7
       PYTHONSTRICTEXTENSIONBUILD: 1
       ASAN_OPTIONS: detect_leaks=0:allocator_may_return_null=1:handle_segv=0
     steps:

.github/workflows/reusable-ubuntu.yml

@@ -35,7 +35,7 @@ jobs:
     runs-on: ${{ inputs.os }}
     timeout-minutes: 60
     env:
-      OPENSSL_VER: 3.5.6
+      OPENSSL_VER: 3.5.7
       PYTHONSTRICTEXTENSIONBUILD: 1
       TERM: linux
     steps:

Lib/rlcompleter.py

@@ -40,6 +40,9 @@
 
 __all__ = ["Completer"]
 
+# Sentinel object to distinguish "missing" from "present but None"
+_SENTINEL = object()
+
 class Completer:
     def __init__(self, namespace = None):
         """Create a new completer for the command line.
@@ -194,14 +197,14 @@ def attr_matches(self, text):
                         and
                         isinstance(thisobject.__dict__.get(word),
                                    types.LazyImportType)
-                    ):
+                       ):
                         value = thisobject.__dict__.get(word)
                     else:
-                        value = getattr(thisobject, word, None)
+                        value = getattr(thisobject, word, _SENTINEL)
 
-                    if value is not None:
+                    if value is not _SENTINEL:
                         matches.append(self._callable_postfix(value, match))
-                    else:
+                    elif word in getattr(type(thisobject), '__slots__', ()):
                         matches.append(match)
             if matches or not noprefix:
                 break

Lib/test/test_listcomps.py

@@ -171,6 +171,17 @@ def test_references___class__(self):
         """
         self._check_in_scopes(code, raises=NameError)
 
+    def test_references___class___nested(self):
+        code = """
+            res = [(lambda: __class__)() for _ in [1]]
+        """
+        self._check_in_scopes(code, raises=NameError)
+
+    def test_references___class___nested_used(self):
+        class _C:
+            res = [lambda: __class__ for _ in [1]]
+        self.assertIs(_C.res[0](), _C)
+
     def test_references___class___defined(self):
         code = """
             __class__ = 2
@@ -180,18 +191,38 @@ def test_references___class___defined(self):
                 code, outputs={"res": [2]}, scopes=["module", "function"])
         self._check_in_scopes(code, raises=NameError, scopes=["class"])
 
+    def test_references___class___defined_nested(self):
+        code = """
+            __class__ = 2
+            res = [(lambda: __class__)() for x in [1]]
+        """
+        self._check_in_scopes(
+                code, outputs={"res": [2]}, scopes=["module", "function"])
+        self._check_in_scopes(code, raises=NameError, scopes=["class"])
+
     def test_references___classdict__(self):
         code = """
             class i: [__classdict__ for x in y]
         """
         self._check_in_scopes(code, raises=NameError)
 
+    def test_references___classdict___nested(self):
+        class _C:
+            res = [(lambda: __classdict__)() for _ in [1]]
+        self.assertIn("res", _C.res[0])
+
     def test_references___conditional_annotations__(self):
         code = """
             class i: [__conditional_annotations__ for x in y]
         """
         self._check_in_scopes(code, raises=NameError)
 
+    def test_references___conditional_annotations___nested(self):
+        code = """
+            class i: [lambda: __conditional_annotations__ for x in y]
+        """
+        self._check_in_scopes(code, raises=NameError)
+
     def test_references___class___enclosing(self):
         code = """
             __class__ = 2

Lib/test/test_rlcompleter.py

@@ -107,19 +107,35 @@ def test_excessive_getattr(self):
         # we use __dir__ and __getattr__ in class Foo to create a "magic"
         # class attribute 'bar'. This forces `getattr` to call __getattr__
         # (which is doesn't necessarily do).
-        class Foo:
+        # Test 1: Attribute returns None
+        class FooReturnsNone:
             calls = 0
-            bar = ''
+            bar = None
             def __getattribute__(self, name):
                 if name == 'bar':
                     self.calls += 1
                     return None
                 return super().__getattribute__(name)
 
-        f = Foo()
-        completer = rlcompleter.Completer(dict(f=f))
-        self.assertEqual(completer.complete('f.b', 0), 'f.bar')
-        self.assertEqual(f.calls, 1)
+        f1 = FooReturnsNone()
+        completer1 = rlcompleter.Completer(dict(f=f1))
+        self.assertEqual(completer1.complete('f.b', 0), 'f.bar')
+        self.assertEqual(f1.calls, 1)
+
+        # Test 2: Attribute returns non-None value
+        class FooReturnsValue:
+            calls = 0
+            bar = ''
+            def __getattribute__(self, name):
+                if name == 'bar':
+                    self.calls += 1
+                    return ''
+                return super().__getattribute__(name)
+
+        f2 = FooReturnsValue()
+        completer2 = rlcompleter.Completer(dict(f=f2))
+        self.assertEqual(completer2.complete('f.b', 0), 'f.bar')
+        self.assertEqual(f2.calls, 1)
 
     def test_property_method_not_called(self):
         class Foo:
@@ -196,6 +212,7 @@ class Foo:
         completer = rlcompleter.Completer(dict(f=Foo()))
         self.assertEqual(completer.complete('f.', 0), 'f.bar')
 
+
     @unittest.mock.patch('rlcompleter._readline_available', False)
     def test_complete(self):
         completer = rlcompleter.Completer()

Mac/BuildScript/build-installer.py

@@ -359,9 +359,9 @@ def library_recipes():
                   ),
           ),
           dict(
-              name="SQLite 3.53.1",
-              url="https://www.sqlite.org/2026/sqlite-autoconf-3530100.tar.gz",
-              checksum="83e6b2020a034e9a7ad4a72feea59e1ad52f162e09cbd26735a3ffb98359fc4f",
+              name="SQLite 3.53.2",
+              url="https://www.sqlite.org/2026/sqlite-autoconf-3530200.tar.gz",
+              checksum="588ad51949419a56ebe81fe56193d510c559eb94c9a57748387860b5d3069316",
               extra_cflags=('-Os '
                             '-DSQLITE_ENABLE_FTS5 '
                             '-DSQLITE_ENABLE_FTS4 '

Misc/NEWS.d/next/Build/2026-06-09-11-54-13.gh-issue-151163.vFAtjv.rst

@@ -0,0 +1 @@
+Updated Android build to include SQLite version 3.53.2.

Misc/NEWS.d/next/Core_and_Builtins/2026-06-01-19-00-00.gh-issue-150700.W8CzVR.rst

@@ -0,0 +1,3 @@
+Fix a :exc:`SystemError` when compiling a class-scope comprehension containing
+a ``lambda`` that references ``__class__``, ``__classdict__``, or
+``__conditional_annotations__``. Patch by Bartosz Sławecki.

Misc/NEWS.d/next/Core_and_Builtins/2026-06-09-12-24-35.gh-issue-151112.4RKCkD.rst

@@ -0,0 +1 @@
+Fix a crash in the compiler that could occur when running out of memory.

Misc/NEWS.d/next/Library/2025-10-09-12-13-29.gh-issue-139819.YxUDyH.rst

@@ -0,0 +1,3 @@
+:mod:`rlcompleter`: Avoid suggesting attributes that are not accessible on
+instances (e.g., Enum members showing ``__name__``). Patch by Peter
+(ttw225).

Misc/NEWS.d/next/Security/2026-06-09-10-23-57.gh-issue-151159.91GpWQ.rst

@@ -0,0 +1 @@
+Update Android and iOS installers to use OpenSSL 3.5.7.

Misc/NEWS.d/next/Windows/2026-06-09-11-55-41.gh-issue-151163.oizZYV.rst

@@ -0,0 +1 @@
+Updated Windows builds to include SQLite version 3.53.2.

Misc/NEWS.d/next/macOS/2026-06-09-11-52-35.gh-issue-151163.RlPXHq.rst

@@ -0,0 +1 @@
+Updated macOS installer to include SQLite version 3.53.2.

Misc/externals.spdx.json

@@ -91,21 +91,21 @@
       "checksums": [
         {
           "algorithm": "SHA256",
-          "checksumValue": "15e8fc7dc059f7b156e53629540951c2691acd71e027f6f8f66dacab5c66c884"
+          "checksumValue": "53f8711811090cc4d9ffc624c360f81e7b409763b145ab2e948998f1a0d6a612"
         }
       ],
-      "downloadLocation": "https://github.com/python/cpython-source-deps/archive/refs/tags/sqlite-3.53.1.0.tar.gz",
+      "downloadLocation": "https://github.com/python/cpython-source-deps/archive/refs/tags/sqlite-3.53.2.0.tar.gz",
       "externalRefs": [
         {
           "referenceCategory": "SECURITY",
-          "referenceLocator": "cpe:2.3:a:sqlite:sqlite:3.53.1.0:*:*:*:*:*:*:*",
+          "referenceLocator": "cpe:2.3:a:sqlite:sqlite:3.53.2.0:*:*:*:*:*:*:*",
           "referenceType": "cpe23Type"
         }
       ],
       "licenseConcluded": "NOASSERTION",
       "name": "sqlite",
       "primaryPackagePurpose": "SOURCE",
-      "versionInfo": "3.53.1.0"
+      "versionInfo": "3.53.2.0"
     },
     {
       "SPDXID": "SPDXRef-PACKAGE-tcl",

PCbuild/get_externals.bat

@@ -56,7 +56,7 @@ set libraries=%libraries%                                       bzip2-1.0.8
 if NOT "%IncludeLibffiSrc%"=="false" set libraries=%libraries%  libffi-3.4.4
 if NOT "%IncludeSSLSrc%"=="false" set libraries=%libraries%     openssl-3.5.7
 set libraries=%libraries%                                       mpdecimal-4.0.0
-set libraries=%libraries%                                       sqlite-3.53.1.0
+set libraries=%libraries%                                       sqlite-3.53.2.0
 if NOT "%IncludeTkinterSrc%"=="false" set libraries=%libraries% tcl-9.0.3.0
 if NOT "%IncludeTkinterSrc%"=="false" set libraries=%libraries% tk-9.0.3.1
 set libraries=%libraries%                                       xz-5.8.1.1

PCbuild/python.props

@@ -98,7 +98,7 @@
   <Import Project="$(ExternalProps)" Condition="$(ExternalProps) != '' and Exists('$(ExternalProps)')" />
 
   <PropertyGroup>
-    <sqlite3Dir Condition="$(sqlite3Dir) == ''">$(ExternalsDir)sqlite-3.53.1.0\</sqlite3Dir>
+    <sqlite3Dir Condition="$(sqlite3Dir) == ''">$(ExternalsDir)sqlite-3.53.2.0\</sqlite3Dir>
     <bz2Dir Condition="$(bz2Dir) == ''">$(ExternalsDir)bzip2-1.0.8\</bz2Dir>
     <lzmaDir Condition="$(lzmaDir) == ''">$(ExternalsDir)xz-5.8.1.1\</lzmaDir>
     <libffiDir Condition="$(libffiDir) == ''">$(ExternalsDir)libffi-3.4.4\</libffiDir>

PCbuild/readme.txt

@@ -242,7 +242,7 @@ _ssl
     again when building.
 
 _sqlite3
-    Wraps SQLite 3.53.1, which is itself built by sqlite3.vcxproj
+    Wraps SQLite 3.53.2, which is itself built by sqlite3.vcxproj
     Homepage:
         https://www.sqlite.org/
 

Platforms/Android/__main__.py

@@ -219,8 +219,8 @@ def unpack_deps(host, prefix_dir, cache_dir):
     for name_ver in [
         "bzip2-1.0.8-3",
         "libffi-3.4.4-3",
-        "openssl-3.5.6-0",
-        "sqlite-3.53.1-0",
+        "openssl-3.5.7-0",
+        "sqlite-3.53.2-0",
         "xz-5.4.6-1",
         "zstd-1.5.7-2"
     ]:

Platforms/Apple/__main__.py

@@ -319,7 +319,7 @@ def unpack_deps(
     for name_ver in [
         "BZip2-1.0.8-2",
         "libFFI-3.4.7-2",
-        "OpenSSL-3.5.6-1",
+        "OpenSSL-3.5.7-1",
         "XZ-5.6.4-2",
         "mpdecimal-4.0.0-2",
         "zstd-1.5.7-1",

Python/assemble.c

@@ -80,9 +80,9 @@ assemble_init(struct assembler *a, int firstlineno)
     }
     return SUCCESS;
 error:
-    Py_XDECREF(a->a_bytecode);
-    Py_XDECREF(a->a_linetable);
-    Py_XDECREF(a->a_except_table);
+    Py_CLEAR(a->a_bytecode);
+    Py_CLEAR(a->a_linetable);
+    Py_CLEAR(a->a_except_table);
     return ERROR;
 }
 

Python/symtable.c

@@ -834,17 +834,22 @@ inline_comprehension(PySTEntryObject *ste, PySTEntryObject *comp,
             return 0;
         }
         // __class__, __classdict__ and __conditional_annotations__ are
-        // never allowed to be free through a class scope (see
-        // drop_class_free)
+        // not allowed to be free through a class scope (see
+        // drop_class_free) unless children scopes need it
         if (scope == FREE && ste->ste_type == ClassBlock &&
                 (_PyUnicode_EqualToASCIIString(k, "__class__") ||
                  _PyUnicode_EqualToASCIIString(k, "__classdict__") ||
                  _PyUnicode_EqualToASCIIString(k, "__conditional_annotations__"))) {
             scope = GLOBAL_IMPLICIT;
-            if (PySet_Discard(comp_free, k) < 0) {
+            int child_needs_free = is_free_in_any_child(comp, k);
+            if (child_needs_free < 0) {
                 return 0;
             }
-
+            if (!child_needs_free) {
+                if (PySet_Discard(comp_free, k) < 0) {
+                    return 0;
+                }
+            }
             if (_PyUnicode_EqualToASCIIString(k, "__class__")) {
                 remove_dunder_class = 1;
             }

Tools/ssl/multissltests.py

@@ -46,15 +46,15 @@
     "1.1.1w",
     "3.1.8",
     "3.2.6",
+    "3.3.7",
 ]
 
 OPENSSL_RECENT_VERSIONS = [
-    "3.0.20",
-    "3.3.7",
-    "3.4.5",
-    "3.5.6",
-    "3.6.2",
-    "4.0.0",
+    "3.0.21",
+    "3.4.6",
+    "3.5.7",
+    "3.6.3",
+    "4.0.1",
     # See make_ssl_data.py for notes on adding a new version.
 ]
 
@@ -65,7 +65,7 @@
 ]
 
 AWSLC_RECENT_VERSIONS = [
-    "1.68.0",
+    "5.0.0",
 ]
 
 # store files in ../multissl