Sync pre-release CPython main branch from GitHub (2026-09-30)

Summary:
Imported python/cpython `3.16.0a0` from upstream rev [`763b6ed`](https://www.github.com/python/cpython/commit/763b6edb0ec959bdfb78f098b76829365de36ca5) (committed 2026-09-30 22:48:34+00:00).

# Commit Info

- Base: (`3.16.0a0`) - [`70e6f3c`](https://www.github.com/python/cpython/commit/70e6f3cfe1da77859f1d497f6354b8a87048ed65) (commit date: 2026-09-30 03:31:36+00:00)
- Imported: (`3.16.0a0`) - [`763b6ed`](https://www.github.com/python/cpython/commit/763b6edb0ec959bdfb78f098b76829365de36ca5) (commit date: 2026-09-30 22:48:34+00:00)

# Noteworthy file changes

- Low-signal files (8 added) (NEWS.d, docs, .github)

Complete list of added/removed files: https://www.internalfb.com/intern/everpaste/?color=0&handle=GOzNCTEZhMTA7yoFACqhXBeoPs4Abr0LAAAz

Differential Revision: D122727602

fbshipit-source-id: 80bb12695d2f5c742dc5f40b838ee283f65e21a6

Author: generatedunixname1734921407115435

.github/workflows/reusable-san.yml

@@ -90,10 +90,14 @@ jobs:
         --openssl="${OPENSSL_VER}"
         --system=Linux
         --tsan
+    # gh-157958: -O2 instead of the pydebug default -Og to avoid a clang 21
+    # compile-time blowup on some interpreter files.
+    # (https://github.com/llvm/llvm-project/issues/179695)
     - name: Configure CPython
       run: >-
         ./configure
         --config-cache
+        OPT="-O2 -g"
         ${{
           inputs.sanitizer == 'TSan'
           && '--with-thread-sanitizer'

Doc/c-api/unicode.rst

@@ -425,6 +425,10 @@ APIs:
    the UCS1 range, it will be transformed into UCS1
    (:c:macro:`PyUnicode_1BYTE_KIND`).
 
+   All characters must be in range [U+0000; U+10ffff]. If *kind* is
+   :c:macro:`PyUnicode_4BYTE_KIND` and the string contains invalid characters,
+   the behavior is undefined.
+
    .. versionadded:: 3.3
 
 
@@ -1896,10 +1900,13 @@ object.
 
 .. c:function:: int PyUnicodeWriter_WriteUCS4(PyUnicodeWriter *writer, const Py_UCS4 *str, Py_ssize_t size)
 
-   Writer the UCS4 string *str* into *writer*.
+   Write the UCS4 string *str* into *writer*.
 
    *size* is a number of UCS4 characters.
 
+   All characters must be in range [U+0000; U+10ffff]. If the string contains
+   invalid characters, the behavior is undefined.
+
    On success, return ``0``.
    On error, set an exception, leave the writer unchanged, and return ``-1``.
 

Doc/library/asyncio-eventloop.rst

@@ -581,6 +581,10 @@ Opening network connections
    .. versionchanged:: 3.12
       *all_errors* was added.
 
+   .. versionchanged:: next
+      Raises a ``ValueError`` if ``ssl.check_hostname`` is ``True``
+      and ``server_hostname`` is not supplied.
+
    .. seealso::
 
       The :func:`open_connection` function is a high-level alternative

Doc/library/asyncio-stream.rst

@@ -425,6 +425,10 @@ StreamWriter
       .. versionchanged:: 3.12
          Added the *ssl_shutdown_timeout* parameter.
 
+      .. versionchanged:: next
+         Raises a ``ValueError`` if ``sslcontext.check_hostname`` is ``True``
+         and ``server_hostname`` is not supplied.
+
 
    .. method:: is_closing()
 

Doc/library/ssl.rst

@@ -1859,6 +1859,12 @@ to speed up repeated connections from the same clients.
    :class:`SSLContext` representing a certificate chain that matches the server
    name.
 
+   If the callback assigns a new context to :attr:`SSLSocket.context`, any
+   further ClientHello message on the same connection (for example after a
+   TLS 1.3 HelloRetryRequest) is dispatched to the new context's
+   *sni_callback*, if it has one; the original callback is not called again
+   for that connection.
+
    Due to the early negotiation phase of the TLS connection, only limited
    methods and attributes are usable like
    :meth:`SSLSocket.selected_alpn_protocol` and :attr:`SSLSocket.context`.
@@ -1883,6 +1889,11 @@ to speed up repeated connections from the same clients.
 
    .. versionadded:: 3.7
 
+   .. versionchanged:: next
+      After the callback assigns a new :attr:`SSLSocket.context`, later
+      ClientHello messages on the connection are dispatched to the new
+      context's *sni_callback*.
+
 .. method:: SSLContext.set_servername_callback(server_name_callback)
 
    This is a legacy API retained for backwards compatibility. When possible,
@@ -2004,7 +2015,11 @@ to speed up repeated connections from the same clients.
    outgoing BIO.
 
    The *server_side*, *server_hostname* and *session* parameters have the
-   same meaning as in :meth:`SSLContext.wrap_socket`.
+   same meaning as in :meth:`SSLContext.wrap_socket`, and are validated in
+   the same way: in particular a :exc:`ValueError` is raised when
+   :attr:`~SSLContext.check_hostname` is enabled but no *server_hostname* is
+   given, since there would be no name to match the peer's certificate
+   against.
 
    .. versionchanged:: 3.6
       *session* argument was added.
@@ -2013,6 +2028,13 @@ to speed up repeated connections from the same clients.
       The method returns an instance of :attr:`SSLContext.sslobject_class`
       instead of hard-coded :class:`SSLObject`.
 
+   .. versionchanged:: next
+      The *server_side*, *server_hostname* and *session* parameters are now
+      validated as :meth:`SSLContext.wrap_socket` validates them. Previously
+      a context with :attr:`~SSLContext.check_hostname` enabled and no
+      *server_hostname* was accepted, and verified the certificate chain but
+      never the peer's identity.
+
 .. attribute:: SSLContext.sslobject_class
 
    The return type of :meth:`SSLContext.wrap_bio`, defaults to

Doc/pylock.toml

@@ -220,9 +220,9 @@ wheels = [{ url = "https://files.pythonhosted.org/packages/71/46/17f022dd3e953bf
 
 [[packages]]
 name = "python-docs-theme"
-version = "2026.9"
-sdist = { url = "https://files.pythonhosted.org/packages/5a/5e/fee7dbfd6a5ebf27f4a91c8cdf204f35f0744fd1fbde7f50cd479d1d890c/python_docs_theme-2026.9.tar.gz", upload-time = 2026-09-19T08:41:45Z, size = 40572, hashes = { sha256 = "1a400cb5e6ac6c8b4788eb0a98067a8c35e8aea15e38941e90a7f764582702fc" } }
-wheels = [{ url = "https://files.pythonhosted.org/packages/68/e1/0d603158c9d9a59cd05dfa98a1682c2fffbc387f1e3a724794480f8acaab/python_docs_theme-2026.9-py3-none-any.whl", upload-time = 2026-09-19T08:41:43Z, size = 49214, hashes = { sha256 = "1a4bdc4f9c664c35a58714af0a98efee4ecb7c3bc4ee0752782c953164ac8fc3" } }]
+version = "2026.9.1"
+sdist = { url = "https://files.pythonhosted.org/packages/10/84/74b9dc8e57aad8e77e20e56b42db5ca101ef250272b178734c3e638e6c9c/python_docs_theme-2026.9.1.tar.gz", upload-time = 2026-09-30T16:17:50Z, size = 92406, hashes = { sha256 = "575743d4c38f39c8615c564269bb3eac5856c1e0191e5798168656cff828ec59" } }
+wheels = [{ url = "https://files.pythonhosted.org/packages/85/cd/1b313c9440012be2bca5aebac85f86990aa7deafb37a3cac816c21fd6c04/python_docs_theme-2026.9.1-py3-none-any.whl", upload-time = 2026-09-30T16:17:49Z, size = 99993, hashes = { sha256 = "3e4743ec90bdaf5d1144741b3b9c38cf9bf82c605d3c9a23ae178d9cea0f4429" } }]
 
 [[packages]]
 name = "requests"
@@ -316,6 +316,6 @@ wheels = [{ url = "https://files.pythonhosted.org/packages/87/55/ab40a0d1378ee5c
 
 [[packages]]
 name = "urllib3"
-version = "2.7.0"
-sdist = { url = "https://files.pythonhosted.org/packages/53/0c/06f8b233b8fd13b9e5ee11424ef85419ba0d8ba0b3138bf360be2ff56953/urllib3-2.7.0.tar.gz", upload-time = 2026-05-07T16:13:18Z, size = 433602, hashes = { sha256 = "231e0ec3b63ceb14667c67be60f2f2c40a518cb38b03af60abc813da26505f4c" } }
-wheels = [{ url = "https://files.pythonhosted.org/packages/7f/3e/5db95bcf282c52709639744ca2a8b149baccf648e39c8cc87553df9eae0c/urllib3-2.7.0-py3-none-any.whl", upload-time = 2026-05-07T16:13:17Z, size = 131087, hashes = { sha256 = "9fb4c81ebbb1ce9531cce37674bbc6f1360472bc18ca9a553ede278ef7276897" } }]
+version = "2.8.0"
+sdist = { url = "https://files.pythonhosted.org/packages/e3/05/b17359e1cefb4f909b5e40b1b90a496d987258916dbbf88e842c729f510e/urllib3-2.8.0.tar.gz", upload-time = 2026-09-15T19:29:36Z, size = 458972, hashes = { sha256 = "63bf2ead4c879426ebf22ef2a781eeb4aa3b4ae798a0435506f8687fd5bb9b63" } }
+wheels = [{ url = "https://files.pythonhosted.org/packages/92/9d/c4e665119135114480843e7ab388fa94d8480650450e6f8e26b70d323a4c/urllib3-2.8.0-py3-none-any.whl", upload-time = 2026-09-15T19:29:34Z, size = 135717, hashes = { sha256 = "0cf3cae568d36aa9576b28dfb35f11328f1cb974ca7647d9475ebb86c75ac6e3" } }]

Include/internal/pycore_call.h

@@ -12,6 +12,11 @@ extern "C" {
 #include "pycore_pystate.h"       // _PyThreadState_GET()
 #include "pycore_stats.h"
 
+/* Flags that determine the C calling convention. */
+#define _Py_METH_CALL_FLAGS \
+    (METH_VARARGS | METH_FASTCALL | METH_NOARGS | METH_O | \
+     METH_KEYWORDS | METH_METHOD)
+
 /* Suggested size (number of positional arguments) for arrays of PyObject*
    allocated on a C stack to avoid allocating memory on the heap memory. Such
    array is used to pass positional arguments to call functions of the

Include/internal/pycore_unicodeobject.h

@@ -189,7 +189,8 @@ _PyUnicodeWriter_WriteCharInline(_PyUnicodeWriter *writer, Py_UCS4 ch)
     return 0;
 }
 
-extern PyObject* _PyUnicodeWriter_FinishWithSize(
+// Export for '_testcapi' shared extension
+PyAPI_FUNC(PyObject*) _PyUnicodeWriter_FinishWithSize(
     _PyUnicodeWriter *writer,
     Py_ssize_t size);