Import CPython 3.14.5+ stable branch (2026-05-19)

Summary:
Imported python/cpython `3.14.5+` from upstream rev [`8e13025`](https://www.github.com/python/cpython/commit/8e13025747e1ca72e86d1f35637123f9c306f0cb) (committed 2026-05-19 08:43:57+00:00).

# Commit Info

Base: (`3.14.5+`) - [`dc86a1b`](https://www.github.com/python/cpython/commit/dc86a1bdf3364a25f70452d2f7e52d9aae7d56e5) (commit date: 2026-05-17 10:35:27+00:00)
Imported: (`3.14.5+`) - [`8e13025`](https://www.github.com/python/cpython/commit/8e13025747e1ca72e86d1f35637123f9c306f0cb) (commit date: 2026-05-19 08:43:57+00:00)

# Noteworthy file changes

- Low-signal files (1 added) (NEWS.d, docs, .github)
- Other files (1 added)

Complete list of added/removed files: https://www.internalfb.com/intern/everpaste/?color=0&handle=GPuYySYT87fJMBIPAL7N-VCN9QNwbr0LAAAz

Reviewed By: itamaro

Differential Revision: D105707458

fbshipit-source-id: 7a74a98b7069b555c800a6ebaf80999c8782d209

Author: generatedunixname1734921407115435

.github/workflows/reusable-macos.yml

@@ -38,7 +38,8 @@ jobs:
       run: echo "IMAGE_OS_VERSION=${ImageOS}-${ImageVersion}" >> "$GITHUB_ENV"
     - name: Install Homebrew dependencies
       run: |
-        brew install pkg-config openssl@3.0 xz gdbm tcl-tk@8 make
+        brew bundle --file=Misc/Brewfile
+        brew install make
         # Because alternate versions are not symlinked into place by default:
         brew link --overwrite tcl-tk@8
     - name: Configure CPython

Doc/library/inspect.rst

@@ -407,24 +407,63 @@ attributes (see :ref:`import-mod-attrs` for module attributes):
 
    Return ``True`` if the object is a bound method written in Python.
 
+   .. note::
 
-.. function:: ispackage(object)
+      For example, given this class::
 
-   Return ``True`` if the object is a :term:`package`.
+          >>> class Greeter:
+          ...     def say_hello(self):
+          ...         print('hello!')
 
-   .. versionadded:: 3.14
+      A bound method (also known as an *instance method*) is created when
+      accessing ``say_hello`` (a :term:`function` defined in the
+      ``Greeter`` namespace) through an instance of the ``Greeter`` class::
+
+          >>> instance = Greeter()
+
+          >>> instance.say_hello
+          <bound method Greeter.say_hello of <__main__.Greeter object ...>>
+          >>> ismethod(instance.say_hello)
+          True
+          >>> isfunction(instance.say_hello)
+          False
+
+      Accessing ``say_hello`` through the ``Greeter`` class will return the
+      function itself. For this function, :func:`ismethod` will return
+      ``False``, but :func:`isfunction` will return ``True``::
+
+          >>> Greeter.say_hello
+          <function Greeter.say_hello at 0x7f7503854a90>
+          >>> ismethod(Greeter.say_hello)
+          False
+          >>> isfunction(Greeter.say_hello)
+          True
+
+      See :ref:`typesmethods` for details.
 
 
 .. function:: isfunction(object)
 
    Return ``True`` if the object is a Python function, which includes functions
    created by a :term:`lambda` expression.
 
+   See the note for :func:`~inspect.ismethod` for an example.
+
+
+.. function:: ispackage(object)
+
+   Return ``True`` if the object is a :term:`package`.
+
+   .. versionadded:: 3.14
+
 
 .. function:: isgeneratorfunction(object)
 
    Return ``True`` if the object is a Python generator function.
 
+   It also returns ``True`` for bound methods created from Python generator functions
+   (see :ref:`typesmethods` for more information).
+
    .. versionchanged:: 3.8
       Functions wrapped in :func:`functools.partial` now return ``True`` if the
       wrapped function is a Python generator function.

Doc/library/shutil.rst

@@ -745,8 +745,8 @@ provided.  They rely on the :mod:`zipfile` and :mod:`tarfile` modules.
 
       Never extract archives from untrusted sources without prior inspection.
       It is possible that files are created outside of the path specified in
-      the *extract_dir* argument, e.g. members that have absolute filenames
-      starting with "/" or filenames with two dots "..".
+      the *extract_dir* argument, for example, members that have absolute filenames
+      or filenames with ".." components.
 
       Since Python 3.14, the defaults for both built-in formats (zip and tar
       files) will prevent the most dangerous of such security issues,

Doc/library/ssl.rst

@@ -1950,7 +1950,7 @@ to speed up repeated connections from the same clients.
    :attr:`~SSLContext.minimum_version` and
    :attr:`SSLContext.options` all affect the supported SSL
    and TLS versions of the context. The implementation does not prevent
-   invalid combination. For example a context with
+   invalid combinations. For example a context with
    :attr:`OP_NO_TLSv1_2` in :attr:`~SSLContext.options` and
    :attr:`~SSLContext.maximum_version` set to :attr:`TLSVersion.TLSv1_2`
    will not be able to establish a TLS 1.2 connection.
@@ -2753,11 +2753,11 @@ disabled by default.
 ::
 
    >>> client_context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
-   >>> client_context.minimum_version = ssl.TLSVersion.TLSv1_3
+   >>> client_context.minimum_version = ssl.TLSVersion.TLSv1_2
    >>> client_context.maximum_version = ssl.TLSVersion.TLSv1_3
 
 
-The SSL context created above will only allow TLSv1.3 and later (if
+The SSL client context created above will only allow TLSv1.2 and TLSv1.3 (if
 supported by your system) connections to a server. :const:`PROTOCOL_TLS_CLIENT`
 implies certificate validation and hostname checks by default. You have to
 load certificates into the context.

Doc/library/zipfile.rst

@@ -414,9 +414,9 @@ ZipFile objects
    .. warning::
 
       Never extract archives from untrusted sources without prior inspection.
-      It is possible that files are created outside of *path*, e.g. members
-      that have absolute filenames starting with ``"/"`` or filenames with two
-      dots ``".."``.  This module attempts to prevent that.
+      It is possible that files are created outside of *path*, for example, members
+      that have absolute filenames or filenames with ".." components.
+      This module attempts to prevent that.
       See :meth:`extract` note.
 
    .. versionchanged:: 3.6
@@ -593,7 +593,7 @@ Path objects
       The :class:`Path` class does not sanitize filenames within the ZIP archive. Unlike
       the :meth:`ZipFile.extract` and :meth:`ZipFile.extractall` methods, it is the
       caller's responsibility to validate or sanitize filenames to prevent path traversal
-      vulnerabilities (e.g., filenames containing ".." or absolute paths). When handling
+      vulnerabilities (for example, absolute paths or paths with ".." components). When handling
       untrusted archives, consider resolving filenames using :func:`os.path.abspath`
       and checking against the target directory with :func:`os.path.commonpath`.
 

Misc/Brewfile

@@ -0,0 +1,15 @@
+brew "gdbm"
+brew "mpdecimal"
+brew "openssl@3.0"
+brew "pkg-config"
+brew "tcl-tk@8"
+brew "xz"
+brew "zstd"
+
+brew "bzip2" if OS.linux?
+brew "expat" if OS.linux?
+brew "libedit" if OS.linux?
+brew "libffi" if OS.linux?
+brew "ncurses" if OS.linux?
+brew "unzip" if OS.linux?
+brew "zlib-ng-compat" if OS.linux?

Misc/NEWS.d/next/Library/2026-05-14-15-55-28.gh-issue-149816.ZaXQ0q.rst

@@ -0,0 +1,2 @@
+Fix a race condition in ``_random.Random.__init__`` method in free-threading
+mode.

Modules/_randommodule.c

@@ -123,9 +123,9 @@ typedef struct {
 
 /*[clinic input]
 module _random
-class _random.Random "RandomObject *" "_randomstate_type(type)->Random_Type"
+class _random.Random "RandomObject *" "(PyTypeObject *)_randomstate_type(Py_TYPE(self))->Random_Type"
 [clinic start generated code]*/
-/*[clinic end generated code: output=da39a3ee5e6b4b0d input=70a2c99619474983]*/
+/*[clinic end generated code: output=da39a3ee5e6b4b0d input=f04bcbfba61a322e]*/
 
 /* Random methods */
 
@@ -549,27 +549,20 @@ _random_Random_getrandbits_impl(RandomObject *self, uint64_t k)
     return result;
 }
 
-static int
-random_init(PyObject *self, PyObject *args, PyObject *kwds)
-{
-    PyObject *arg = NULL;
-    _randomstate *state = _randomstate_type(Py_TYPE(self));
-
-    if ((Py_IS_TYPE(self, (PyTypeObject *)state->Random_Type) ||
-         Py_TYPE(self)->tp_init == ((PyTypeObject*)state->Random_Type)->tp_init) &&
-        !_PyArg_NoKeywords("Random", kwds)) {
-        return -1;
-    }
-
-    if (PyTuple_GET_SIZE(args) > 1) {
-        PyErr_SetString(PyExc_TypeError, "Random() requires 0 or 1 argument");
-        return -1;
-    }
+/*[clinic input]
+@critical_section
+@text_signature "($self, [seed])"
+_random.Random.__init__ as random_init
 
-    if (PyTuple_GET_SIZE(args) == 1)
-        arg = PyTuple_GET_ITEM(args, 0);
+    seed: object = NULL
+    /
+[clinic start generated code]*/
 
-    return random_seed(RandomObject_CAST(self), arg);
+static int
+random_init_impl(RandomObject *self, PyObject *seed)
+/*[clinic end generated code: output=260734a3739c394f input=e516bf32e8a05e28]*/
+{
+    return random_seed(self, seed);
 }