gh-157899: merged upstream/main into feature/gh-157899-fds-in-os-readlink and resolved merge conflicts.

Author: OOTS

.claude/CLAUDE.md

@@ -63,14 +63,14 @@
 .azure-pipelines/             @AA-Turner
 
 # GitHub & related scripts
-.github/                                    @ezio-melotti @hugovk @AA-Turner @webknjaz @itamaro @JacobCoffee
-Tools/build/compute-changes.py              @AA-Turner @hugovk @webknjaz
-Lib/test/test_tools/test_compute_changes.py @AA-Turner @hugovk @webknjaz
+.github/                                    @ezio-melotti @hugovk @AA-Turner @webknjaz @itamaro @JacobCoffee @StanFromIreland
+Tools/build/compute-changes.py              @AA-Turner @hugovk @webknjaz @StanFromIreland
+Lib/test/test_tools/test_compute_changes.py @AA-Turner @hugovk @webknjaz @StanFromIreland
 Tools/build/verify_ensurepip_wheels.py      @AA-Turner @pfmoore @pradyunsg
 
 # Pre-commit
-.pre-commit-config.yaml       @hugovk @JacobCoffee
-.ruff.toml                    @hugovk @AlexWaygood @AA-Turner @JacobCoffee
+.pre-commit-config.yaml       @hugovk @JacobCoffee @StanFromIreland
+.ruff.toml                    @hugovk @AlexWaygood @AA-Turner @JacobCoffee @StanFromIreland
 
 # Patchcheck
 Tools/patchcheck/             @AA-Turner @itamaro

.github/CODEOWNERS

@@ -16,7 +16,7 @@ body:
         Make sure to also search the [CPython issue tracker](https://github.com/python/cpython/issues?q=is%3Aissue+sort%3Acreated-desc) to check that the bug has not already been reported.
   - type: textarea
     attributes:
-      label: "Bug description:"
+      label: "Bug report"
       description: >
         Give a clear and concise description of what happened.
         Include a [minimal, reproducible example](https://stackoverflow.com/help/minimal-reproducible-example) if possible.

.github/ISSUE_TEMPLATE/bug.yml

@@ -10,8 +10,9 @@ body:
           The CPython interpreter is written in a different programming language, C. A "CPython crash" is when Python itself fails, leading to a traceback in the C stack.
   - type: textarea
     attributes:
-      label: What happened?
+      label: Crash report
       description: >
+        Give a clear and concise description of what happened.
         Include a [minimal, reproducible example](https://stackoverflow.com/help/minimal-reproducible-example) if possible.
         [Copy and paste code where possible rather than using screenshots](https://meta.stackoverflow.com/a/285557/13990016),
         and put any code blocks inside triple backticks.

.github/ISSUE_TEMPLATE/crash.yml

@@ -12,7 +12,7 @@ body:
         Major feature proposals should generally be discussed on [Discourse](https://discuss.python.org/c/ideas/6) before opening a GitHub issue. Wait until it's clear that most people support your idea before filling in this form.
   - type: textarea
     attributes:
-      label: "Proposal:"
+      label: "Feature or enhancement"
       description: >
         Explain your proposal, why it should be implemented, and how it would be used.
         Add examples, if applicable.

.github/ISSUE_TEMPLATE/feature.yml

@@ -0,0 +1,73 @@
+name: Vulnerability report
+description: Privately report a potential security vulnerability in CPython
+body:
+  - type: markdown
+    attributes:
+      value: |
+        **Not all bugs are vulnerabilities.** Before submitting, read the [Python security policy](https://devguide.python.org/security/policy/) to understand which issues are vulnerabilities and what versions of Python accept reports.
+
+        Keep the report short and in plain text: no headers, tables, PDFs, binaries, or severity and CVSS information.
+
+        Reports that do not contain a potential security vulnerability will be discarded without a reply.
+
+        To report vulnerabilities that affect other projects (such as pip or python.org), or if you are not sure where to send your report, email [security@python.org](mailto:security@python.org).
+  - type: textarea
+    id: summary
+    attributes:
+      label: Summary
+      description: A few sentences describing the vulnerability.
+    validations:
+      required: true
+  - type: textarea
+    id: threat_model
+    attributes:
+      label: Threat model
+      description: >
+        What does the attacker control, and what do they gain? Describe the code, configuration, or deployment that may exist in the real world and is exploitable. Where possible, cite the relevant part of the [security policy](https://devguide.python.org/security/policy/#what-types-of-bugs-are-vulnerabilities).
+    validations:
+      required: true
+  - type: textarea
+    id: proof_of_concept
+    attributes:
+      label: Proof of concept
+      description: >
+        A script that reproduces the issue and clearly indicates whether the vulnerability is present, such as exiting with `1` if vulnerable and `0` if not. If it depends on a specially constructed binary file, include a script to construct the file rather than the file itself.
+
+        Wrap scripts longer than a few lines in a [collapsed section](https://docs.github.com/en/get-started/writing-on-github/working-with-advanced-formatting/organizing-information-with-collapsed-sections) using `<details> ... </details>`.
+    validations:
+      required: true
+  - type: dropdown
+    id: versions
+    attributes:
+      label: "CPython versions tested on:"
+      description: >
+        If any tested version was not vulnerable, say which in the summary. Only [supported versions](https://devguide.python.org/versions/) accept reports.
+      multiple: true
+      options:
+        - "3.11"
+        - "3.12"
+        - "3.13"
+        - "3.14"
+        - "3.15"
+        - "3.16"
+        - "CPython main branch"
+    validations:
+      required: true
+  - type: textarea
+    id: patch
+    attributes:
+      label: Suggested fix
+      description: Ideally, a minimal patch with the mitigation.
+    validations:
+      required: false
+  - type: checkboxes
+    id: checklist
+    attributes:
+      label: Before submitting
+      options:
+        - label: I have read the security policy and evaluated this report against it.
+          required: true
+        - label: I have checked that this issue is not already resolved on the `main` branch.
+          required: true
+        - label: I have verified the factual validity of everything in this report, including any content produced by an LLM.
+          required: true

.github/VULNERABILITY_REPORT.yml

@@ -7,11 +7,6 @@ updates:
     labels:
       - "skip issue"
       - "skip news"
-    ignore:
-      - dependency-name: "*"
-        update-types:
-          - "version-update:semver-minor"
-          - "version-update:semver-patch"
     groups:
       actions:
         patterns:
@@ -21,12 +16,128 @@ updates:
       # Cooldowns protect against supply chain attacks by avoiding the
       # highest-risk window immediately after new releases.
       default-days: 14
+
   - package-ecosystem: "pip"
     directory: "/Tools/"
     schedule:
       interval: "quarterly"
-    labels:
-      - "skip issue"
-      - "skip news"
+    labels: ["skip issue", "skip news"]
+    groups:
+      pip:
+        patterns: ["*"]
+    cooldown:
+      default-days: 14
+
+  # Release branches: Dependabot only reads this file from the default
+  # branch, so each branch that should get its own actions bumps needs an
+  # entry here with `target-branch`. Add one when a new release branch is
+  # created, and remove when the branch reaches end-of-life.
+  - package-ecosystem: "github-actions"
+    target-branch: "3.15"
+    directory: "/"
+    schedule:
+      interval: "quarterly"
+    labels: ["skip issue", "skip news"]
+    groups:
+      actions:
+        patterns: ["*"]
+    cooldown:
+      default-days: 14
+
+  - package-ecosystem: "github-actions"
+    target-branch: "3.14"
+    directory: "/"
+    schedule:
+      interval: "quarterly"
+    labels: ["skip issue", "skip news"]
+    groups:
+      actions:
+        patterns: ["*"]
+    cooldown:
+      default-days: 14
+
+  - package-ecosystem: "github-actions"
+    target-branch: "3.13"
+    directory: "/"
+    schedule:
+      interval: "quarterly"
+    labels: ["skip issue", "skip news"]
+    groups:
+      actions:
+        patterns: ["*"]
+    cooldown:
+      default-days: 14
+
+  - package-ecosystem: "github-actions"
+    target-branch: "3.12"
+    directory: "/"
+    schedule:
+      interval: "quarterly"
+    labels: ["skip issue", "skip news"]
+    groups:
+      actions:
+        patterns: ["*"]
+    cooldown:
+      default-days: 14
+
+  - package-ecosystem: "github-actions"
+    target-branch: "3.11"
+    directory: "/"
+    schedule:
+      interval: "quarterly"
+    labels: ["skip issue", "skip news"]
+    groups:
+      actions:
+        patterns: ["*"]
+    cooldown:
+      default-days: 14
+
+  - package-ecosystem: "github-actions"
+    target-branch: "3.10"
+    directory: "/"
+    schedule:
+      interval: "quarterly"
+    labels: ["skip issue", "skip news"]
+    groups:
+      actions:
+        patterns: ["*"]
+    cooldown:
+      default-days: 14
+
+  # Only bump bugfix branches for pip. Remove
+  # the entry when branch goes security-only.
+  - package-ecosystem: "pip"
+    target-branch: "3.15"
+    directory: "/Tools/"
+    schedule:
+      interval: "quarterly"
+    labels: ["skip issue", "skip news"]
+    groups:
+      pip:
+        patterns: ["*"]
+    cooldown:
+      default-days: 14
+
+  - package-ecosystem: "pip"
+    target-branch: "3.14"
+    directory: "/Tools/"
+    schedule:
+      interval: "quarterly"
+    labels: ["skip issue", "skip news"]
+    groups:
+      pip:
+        patterns: ["*"]
+    cooldown:
+      default-days: 14
+
+  - package-ecosystem: "pip"
+    target-branch: "3.13"
+    directory: "/Tools/"
+    schedule:
+      interval: "quarterly"
+    labels: ["skip issue", "skip news"]
+    groups:
+      pip:
+        patterns: ["*"]
     cooldown:
       default-days: 14