Bump version: v4.0.0

Drops the GraalPy 3.11 / GraalPy 24.2 builds (gp311_242) as agreed in
pypa/cibuildwheel#2741: a ~6-month overlap after the GraalPy 25 (gp312)
release. GraalPy 3.12 (gp312_250) stays.

This also removes the GraalPy 24-only workarounds that were explicitly
marked "Remove when GraalPy 24.x is dropped":
- the Visual Studio compiler-discovery (vswhere) and build-isolation
  (graalpython#491) workarounds in the Windows backend
- the issue-491 Windows skip/filter hacks in test_pep518 and
  test_dependency_versions (added in the original GraalPy PR #1538 and
  unneeded since GraalPy 25 per #2597)

The uv-doesn't-support-graalpy skip (#2754), the `graalpy` enable group,
and the generated constraints pins apply to all GraalPy and are kept.

Assisted-by: ClaudeCode:claude-opus-4.8

.agents/skills/changelog-entry/SKILL.md

@@ -0,0 +1,122 @@
+---
+name: changelog-entry
+description: Generate a new changelog entry for cibuildwheel based on all changes since the last tag. Use when updating the changelog or preparing a release.
+---
+
+# Generate Changelog Entry
+
+Produce a new version section at the top of `docs/changelog.md` summarizing all changes since the last git tag.
+
+## Steps
+
+1. **Find the last tag** — run `git tag --sort=-version:refname | head -1` to get the most recent version tag.
+2. **Gather changes** — run `git log <last-tag>..HEAD --oneline` and `git log <last-tag>..HEAD --format="%H %s"` to see all commits since that tag.
+3. **Read each merge/commit** — for substantive commits, read the full message and any linked PRs to understand the change. Use `git log <last-tag>..HEAD --format="---%n%B"` for full messages. If a commit message is ambiguous, use `gh pr view <number>` to get richer context from GitHub.
+4. **Classify and draft entries** — assign each change an emoji and write a one-line description following the style rules below. Combine related small PRs of the same type (bot dependency updates, dependabot CI action bumps, pre-commit autoupdates) into a single entry listing all PR numbers. Skip meta-changelog PRs (e.g., "Add missing CHANGELOG entries") — they don't describe user-facing changes. If a bot/dependency PR contains a substantive fix mixed in (e.g., a pip revert inside a dependency update), split it: mention the fix separately under its own category.
+5. **Determine the new version number** — inspect commits for breaking changes or new features to decide patch/minor/major bump. Ask the user if unclear.
+6. **Determine the date** — use today's date.
+7. **Insert the new section** — add it at the top of `docs/changelog.md`, right after the `# Changelog` heading and a blank line, before any existing version sections.
+
+## Style Rules
+
+These are non-negotiable formatting conventions derived from the existing changelog.
+
+### Version heading
+
+```markdown
+### v3.4.2
+```
+
+`###` heading, `v` prefix, full semver.
+
+### Date line
+
+```markdown
+_14 May 2026_
+```
+
+Italic (underscore-wrapped), day without leading zero, full month name, 4-digit year. One blank line after the date.
+
+### Entry format
+
+```markdown
+- <emoji> <Description> (#<PR number>)
+```
+
+- Each entry is a single bullet starting with `- `.
+- Emoji immediately after the dash-space.
+- Space between emoji and description text.
+- PR number(s) in parens at end: `(#1234)` or `(#1234, #5678)`.
+- No trailing period for single-sentence entries.
+- Period at end of multi-sentence entries only.
+
+### Emoji categories
+
+Use exactly one emoji per entry, chosen by category:
+
+| Emoji | Category | Used for |
+|-------|----------|----------|
+| 🌟 | Major feature | New platforms, significant new capabilities |
+| ✨ | Feature | New features, additions, user-visible enhancements |
+| 🐛 | Bug fix | Bug fixes |
+| 🛠 | Maintenance | Dep updates, internal improvements, behavior tweaks |
+| ⚠️ | Warning | Deprecations, breaking changes, dropped support |
+| 📚 | Docs | Documentation changes |
+| 💼 | Internal | Non-user-facing infra/tooling changes |
+| 🧪 | Tests | Test changes |
+| 🔐 | Security | Security-related changes (used in past changelogs) |
+
+### Category disambiguation
+
+When a change could fit multiple categories, use these tiebreakers:
+
+- **CI/workflow fixes** → 💼 (not 🧪) — they fix infra, not test logic.
+- **Test suite changes** → 🧪 — only for changes to the test code itself.
+- **Diagnostic output changes** (e.g., printing more info during builds) → 🛠 (not 🐛) — they're improvements, not bug fixes.
+- **A bug fix that also changes test code** → 🐛 — the user-facing fix takes priority; test changes are implicit.
+
+### Writing style
+
+- **Present tense**: "Adds", "Fixes", "Updates", not "Added", "Fixed".
+- **Sentence case**: capitalize only the first word after the emoji.
+- **Link option names to docs**: `[`option-name`](https://cibuildwheel.pypa.io/en/stable/options/#option-name)`. Option anchors match the option name — verify in `docs/options.md` by searching for `{: #option-name }`.
+- Be specific about what changed and why, not just that something changed.
+
+### Ordering
+
+Within a version section, order entries by importance:
+
+1. 🌟 entries first
+2. ⚠️ entries next
+3. ✨ entries
+4. 🐛 entries
+5. 🛠 entries
+6. 📚 entries
+7. 💼 entries
+8. 🧪 entries last
+
+### Multi-line entries
+
+For complex features needing explanation, use an indented italic paragraph:
+
+```markdown
+- ✨ Short summary here. (#1234)
+
+    _Longer explanation with details and caveats._ (#1234)
+```
+
+Adding a new Python beta version always has a specific longer explanation, check for a previous addition (like 3.14) for the note to use.
+
+### Blank lines
+
+- One blank line between version sections.
+- No blank lines between bullets within a version.
+
+## Validation
+
+After inserting the new section:
+
+1. Check that the new section follows all style rules above.
+2. Verify PR numbers match actual PRs in the commit log.
+3. Ensure no duplicate entries — multiple commits to the same PR should produce one entry.
+4. Run a final review of the file to confirm formatting is consistent with surrounding entries.

.github/workflows/copilot-setup-steps.yml

@@ -0,0 +1,40 @@
+name: "Copilot Setup Steps"
+
+permissions: {}
+
+on:
+  workflow_dispatch:
+  push:
+    paths:
+      - .github/workflows/copilot-setup-steps.yml
+  pull_request:
+    paths:
+      - .github/workflows/copilot-setup-steps.yml
+
+jobs:
+  copilot-setup-steps:
+    name: Copilot Setup Steps
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        with:
+          python-version: "3.x"
+          allow-prereleases: true
+
+      - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+
+      - name: Install tooling
+        run: |
+          uv tool install nox
+          uv tool install prek
+
+      - name: Pre-install checks
+        run: |
+          prek prepare-hooks

.github/workflows/release.yml

@@ -17,7 +17,7 @@ jobs:
       with:
         persist-credentials: false
 
-    - uses: hynek/build-and-inspect-python-package@fe0a0fb1925ca263d076ca4f2c13e93a6e92a33e # v2.17.0
+    - uses: hynek/build-and-inspect-python-package@d44ca7d91762de7a7d5436ddae667c6da6d1c3df # v2.18.0
 
   publish:
     needs: [dist]

.github/workflows/test.yml

@@ -46,7 +46,7 @@ jobs:
       with:
         python-version: "3.x"
     - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
-    - uses: j178/prek-action@cbc2f23eb5539cf20d82d1aabd0d0ecbcc56f4e3 # v2.0.2
+    - uses: j178/prek-action@bdca6f102f98e2b4c7029491a53dfd366469e33d # v2.0.4
     - name: PyLint checks
       run: uvx nox -s pylint -- --output-format=github
 
@@ -85,7 +85,7 @@ jobs:
           python_version: '3.11'
         # Max Python
         - os: ubuntu-latest
-          python_version: '3.14'
+          python_version: '3.15'
         - os: ubuntu-latest
           python_version: '3.14'
           test_select: android
@@ -139,7 +139,7 @@ jobs:
     # for oci_container unit tests
     - name: Set up QEMU
       if: runner.os == 'Linux'
-      uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
+      uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
 
     - name: Set up Xcode
       if: ${{ startsWith(matrix.os, 'macos-15') }}
@@ -283,7 +283,7 @@ jobs:
       run: uv sync --no-dev --group test
 
     - name: Set up QEMU
-      uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
+      uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
 
     - name: Run the emulation tests
       env:
@@ -321,11 +321,13 @@ jobs:
         output-dir: wheelhouse
       env:
         CIBW_PLATFORM: pyodide
+        CIBW_ENABLE: pyodide-prerelease
 
     - name: Run tests with 'CIBW_PLATFORM' set to 'pyodide'
       run: uv run --no-sync ./bin/run_tests.py
       env:
         CIBW_PLATFORM: pyodide
+        CIBW_ENABLE: pyodide-prerelease
 
   test-uv-extras:
     name: Test uv extra on ${{ matrix.os }} ${{ matrix.test_select }}

.github/workflows/update-dependencies.yml

@@ -28,12 +28,14 @@ jobs:
 
     # we use this step to grab a Github App auth token, so that PRs generated by this workflow
     # run the GHA tests.
-    - uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
+    - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
       id: generate-token
       if: github.ref == 'refs/heads/main' && github.repository == 'pypa/cibuildwheel'
       with:
-        app-id: ${{ secrets.CIBUILDWHEEL_BOT_APP_ID }}
+        client-id: ${{ secrets.CIBUILDWHEEL_BOT_APP_ID }}
         private-key: ${{ secrets.CIBUILDWHEEL_BOT_APP_PRIVATE_KEY }}
+        permission-contents: write
+        permission-pull-requests: write
 
     - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       with:

.github/workflows/zizmor.yml

@@ -21,4 +21,4 @@ jobs:
           persist-credentials: false
 
       - name: Run zizmor 🌈
-        uses: zizmorcore/zizmor-action@b1d7e1fb5de872772f31590499237e7cce841e8e # v0.5.3
+        uses: zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d # v0.5.6

.gitignore

@@ -119,3 +119,6 @@ site/
 
 # OS files
 .DS_Store
+
+# This file should be a symlink or contain "See @AGENTS.md"
+CLAUDE.md

.gitlab-ci.yml

@@ -1,5 +1,5 @@
 linux:
-  image: python:3.12
+  image: python:3.13
   services:
     - name: docker:dind
       entrypoint: ["env", "-u", "DOCKER_HOST"]
@@ -14,7 +14,7 @@ linux:
     # (comment the below line in a PR to debug a Gitlab-specific issue)
     PYTEST_ADDOPTS: -k "unit_test or test_0_basic" --suppress-no-test-exit-code
   rules:
-    - if: '$CI_COMMIT_BRANCH == "main"'
+    - if: '$CI_COMMIT_BRANCH == "main" || $CI_COMMIT_BRANCH =~ /^gitlab/'
       variables:
         CIBW_ENABLE: "all"
   script:
@@ -25,28 +25,29 @@ linux:
     - python ./bin/run_tests.py
 
 windows:
-  image: mcr.microsoft.com/windows/servercore:1809
   variables:
     PYTEST_ADDOPTS: -k "unit_test or test_0_basic" --suppress-no-test-exit-code
-  before_script:
-    - choco install python -y --allow-downgrade --version 3.12.4
   rules:
-    - if: '$CI_COMMIT_BRANCH == "main"'
+    - if: '$CI_COMMIT_BRANCH == "main" || $CI_COMMIT_BRANCH =~ /^gitlab/'
       variables:
-        CIBW_ENABLE: "all"
+        # Everything except graalpy. GraalPy is JVM-based and very slow to
+        # start; on the small (2-core) GitLab SaaS Windows runners,
+        # virtualenv's interpreter query for graalpy.exe times out, failing
+        # the build. (Other platforms run the full "all" group.)
+        CIBW_ENABLE: "cpython-prerelease pypy pypy-eol pyodide-eol pyodide-prerelease"
   script:
-    - py -m pip install -U pip
+    - python -m pip install -U pip
-    - py -m pip install -e. pytest-custom-exit-code --group test
+    - python -m pip install -e. pytest-custom-exit-code --group test
-    - py bin\run_tests.py
+    - python bin\run_tests.py
   tags:
     - saas-windows-medium-amd64
 
 macos:
-  image: macos-14-xcode-15
+  image: macos-15-xcode-16
   variables:
     PYTEST_ADDOPTS: -k "unit_test or test_0_basic" --suppress-no-test-exit-code
   rules:
-    - if: '$CI_COMMIT_BRANCH == "main"'
+    - if: '$CI_COMMIT_BRANCH == "main" || $CI_COMMIT_BRANCH =~ /^gitlab/'
       variables:
         CIBW_ENABLE: "all"
   script:

.pre-commit-config.yaml

@@ -1,5 +1,6 @@
 ci:
   autoupdate_schedule: monthly
+exclude: "^cibuildwheel/resources/ios-support/(?!make_cross_venv\\.py)"
 
 repos:
 - repo: https://github.com/pre-commit/pre-commit-hooks
@@ -17,14 +18,14 @@ repos:
     exclude: ^cibuildwheel/resources/android/android.patch$
 
 - repo: https://github.com/astral-sh/ruff-pre-commit
-  rev: c60c980e561ed3e73101667fe8365c609d19a438  # frozen: v0.15.9
+  rev: 0671d8ab202c4ac093b78433ae5baf74f3fc7246  # frozen: v0.15.15
   hooks:
   - id: ruff-check
     args: ["--fix"]
   - id: ruff-format
 
 - repo: https://github.com/pre-commit/mirrors-mypy
-  rev: 8e5c80792e2ec0c87804d8ef915bf35e2caea6da  # frozen: v1.20.0
+  rev: d2823d321df3af8f878f7ee3414dc94d037145b9  # frozen: v2.1.0
   hooks:
   - id: mypy
     name: mypy 3.11 on cibuildwheel/
@@ -38,7 +39,6 @@ repos:
       - nox>=2025.2.9
       - orjson
       - packaging
-      - pyelftools
       - pygithub
       - pytest
       - rich
@@ -86,7 +86,7 @@ repos:
 
 
 - repo: https://github.com/python-jsonschema/check-jsonschema
-  rev: ed81924a8b1cecdaa570b072528fa80c9c4d6ccd  # frozen: 0.37.1
+  rev: 943377262562a12b57292fc98fabd7dbf81451fe  # frozen: 0.37.2
   hooks:
     - id: check-dependabot
     - id: check-github-actions

AGENTS.md

@@ -0,0 +1,57 @@
+# cibuildwheel — Agent Notes
+
+## Always run
+
+- `prek -a` should be run after changes to reformat, lint, and type check
+
+## Developer commands
+- `uv run pytest unit_test` — Quick run for unit tests
+- `nox -s tests` — run doctests + unit tests + integration tests (slow, >30 min, requires system Python installs on macOS).
+- `nox -s tests -- unit_test` — fast unit tests only.
+- `nox -s tests -- test -k before_build` — single integration test/file via pytest `-k`.
+- `nox -s lint` — run all linters (pre-commit/prek).
+- `nox -s pylint` — run pylint separately (not in pre-commit).
+- `nox -s docs` — mkdocs serve (interactive) or build (non-interactive).
+- Set up local dev env at `.venv`: `uv sync` (dependency groups used).
+
+## Project layout
+- `cibuildwheel/` — main package. Entry point: `cibuildwheel.__main__:main`.
+- `test/` — **integration tests** (expensive, run actual wheel builds).
+- `unit_test/` — **unit tests** (fast, no wheel builds).
+- `bin/` — maintainer scripts (update pins, generate README tables, schema, etc.).
+- `docs/` — mkdocs source.
+
+## Testing specifics
+- Three test suites exist, run in this order by `bin/run_tests.py`:
+  1. `pytest cibuildwheel` — doctests.
+  2. `pytest unit_test [...]` — unit tests.
+  3. `pytest test [...]` — integration tests (split into `serial` and `not serial` runs).
+- Serial integration tests **must not** run in parallel; non-serial use pytest-xdist by default.
+- Custom pytest options:
+  - `--run-docker` (unit_test + test): run OCI container tests. Linux only.
+  - `--run-podman`: run podman tests (Linux).
+  - `--run-emulation` (test): run QEMU emulation tests (e.g., `--run-emulation aarch64`).
+  - `--platform linux` (test): force integration tests to target Linux container builds even on macOS/Windows.
+  - `--enable` (test): sets `CIBW_ENABLE` env var (e.g., `pypy`, `graalpy`).
+- Integration tests auto-set a default `CIBW_ENABLE` if the env var is absent.
+- The `build_frontend_env` fixture parameterizes over `pip`, `build`, `build[uv]`, `uv` and skips unsupported combos per platform.
+- Some integration tests require system Python.org installs on macOS; missing them prints a download URL in the error.
+- iOS/Android/pyodide tests have dedicated pytest marks (`ios`, `android`, `pyodide`) and need platform-specific runners/simulators.
+
+## Lint / typecheck
+- Ruff (lint + format) and mypy run via pre-commit. Pylint runs separately via `nox -s pylint`.
+- Mypy is strict (`strict = true`) and targets Python 3.11 for the package, 3.14 for a second check in pre-commit.
+- Ruff config in `pyproject.toml` (`line-length = 100`).
+- Python 3.11 is the minimum supported version for the package itself.
+
+## Generated / maintained files
+- `README.md` contains two **cog-generated** tables (options table, changelog preview). Pre-commit runs `cog -c -P -r -I ./bin README.md`. Edit the source scripts (`bin/readme_*.py`) or the upstream files (`docs/options.md`, `docs/changelog.md`) — do not hand-edit the generated blocks. Note the identifier is _not_ cog generated, and can be edited.
+- `cibuildwheel/resources/cibuildwheel.schema.json` is generated by `bin/generate_schema.py` (run via `nox -s generate_schema`).
+- `cibuildwheel/resources/constraints-*.txt` are generated via `nox -s update_constraints`.
+- `cibuildwheel/resources/pinned_docker_images.cfg` and other resource files are updated via `nox -s update_pins`.
+
+## CI / release quirks
+- CI uses `uv sync --no-dev --group test` for test installs, then `uv run --no-sync` to execute.
+- The release workflow uses `hynek/build-and-inspect-python-package` for dist building.
+- `test.yml` skips unrelated paths to avoid burning CI time on docs-only changes.
+- A sample project artifact is built once and downloaded by downstream test jobs to avoid redundant work.

README.md

@@ -24,29 +24,29 @@ While cibuildwheel itself requires a recent Python version to run (we support th
 
 |                          | macOS Intel | macOS Apple Silicon | Windows 64bit | Windows 32bit | Windows Arm64  | manylinux<br/>musllinux x86_64 | manylinux<br/>musllinux i686 | manylinux<br/>musllinux aarch64 | manylinux<br/>musllinux ppc64le | manylinux<br/>musllinux s390x | manylinux<br/>musllinux armv7l | Android | iOS | Pyodide        |
 | ------------------------ | ----------- | ------------------- | ------------- | ------------- | -------------- | ------------------------------ | ---------------------------- | ------------------------------- | ------------------------------- | ----------------------------- | ------------------------------ | ------- | --- | -------------- |
-| CPython 3.8              | ✅          | ✅                  | ✅            | ✅            | N/A            | ✅                             | ✅                           | ✅                              | ✅                              | ✅                            | ✅<sup>5</sup>                 | N/A     | N/A | N/A            |
+| CPython 3.9              | ✅          | ✅                  | ✅            | ✅            | ✅<sup>2</sup> | ✅                             | ✅                           | ✅                              | ✅                              | ✅                            | ✅<sup>5</sup>                 | N/A     | N/A | N/A            |
-| CPython 3.9              | ✅          | ✅                  | ✅            | ✅            | ✅<sup>2</sup> | ✅                             | ✅                           | ✅                              | ✅                              | ✅                            | ✅<sup>5</sup>                 | N/A     | N/A | N/A            |
+| CPython 3.10             | ✅          | ✅                  | ✅            | ✅            | ✅<sup>2</sup> | ✅                             | ✅                           | ✅                              | ✅                              | ✅                            | ✅<sup>5</sup>                 | N/A     | N/A | N/A            |
-| CPython 3.10             | ✅          | ✅                  | ✅            | ✅            | ✅<sup>2</sup> | ✅                             | ✅                           | ✅                              | ✅                              | ✅                            | ✅<sup>5</sup>                 | N/A     | N/A | N/A            |
+| CPython 3.11             | ✅          | ✅                  | ✅            | ✅            | ✅<sup>2</sup> | ✅                             | ✅                           | ✅                              | ✅                              | ✅                            | ✅<sup>5</sup>                 | N/A     | N/A | N/A            |
-| CPython 3.11             | ✅          | ✅                  | ✅            | ✅            | ✅<sup>2</sup> | ✅                             | ✅                           | ✅                              | ✅                              | ✅                            | ✅<sup>5</sup>                 | N/A     | N/A | N/A            |
+| CPython 3.12             | ✅          | ✅                  | ✅            | ✅            | ✅<sup>2</sup> | ✅                             | ✅                           | ✅                              | ✅                              | ✅                            | ✅<sup>5</sup>                 | N/A     | N/A | ✅<sup>3</sup> |
-| CPython 3.12             | ✅          | ✅                  | ✅            | ✅            | ✅<sup>2</sup> | ✅                             | ✅                           | ✅                              | ✅                              | ✅                            | ✅<sup>5</sup>                 | N/A     | N/A | ✅<sup>4</sup> |
+| CPython 3.13             | ✅          | ✅                  | ✅            | ✅            | ✅<sup>2</sup> | ✅                             | ✅                           | ✅                              | ✅                              | ✅                            | ✅<sup>5</sup>                 | ✅      | ✅  | ✅             |
-| CPython 3.13<sup>3</sup> | ✅          | ✅                  | ✅            | ✅            | ✅<sup>2</sup> | ✅                             | ✅                           | ✅                              | ✅                              | ✅                            | ✅<sup>5</sup>                 | ✅      | ✅  | ✅<sup>4</sup> |
+| CPython 3.14             | ✅          | ✅                  | ✅            | ✅            | ✅<sup>2</sup> | ✅                             | ✅                           | ✅                              | ✅                              | ✅                            | ✅<sup>5</sup>                 | ✅      | ✅  | ✅<sup>4</sup> |
-| CPython 3.14             | ✅          | ✅                  | ✅            | ✅            | ✅<sup>2</sup> | ✅                             | ✅                           | ✅                              | ✅                              | ✅                            | ✅<sup>5</sup>                 | ✅      | ✅  | N/A            |
+| CPython 3.15<sup>6</sup> | ✅          | ✅                  | ✅            | ✅            | ✅<sup>2</sup> | ✅                             | ✅                           | ✅                              | ✅                              | ✅                            | ✅<sup>5</sup>                 | ✅      | ✅  | N/A            |
-| PyPy 3.8 v7.3            | ✅          | ✅                  | ✅            | N/A           | N/A            | ✅<sup>1</sup>                 | ✅<sup>1</sup>               | ✅<sup>1</sup>                  | N/A                             | N/A                           | N/A                            | N/A     | N/A | N/A            |
 | PyPy 3.9 v7.3            | ✅          | ✅                  | ✅            | N/A           | N/A            | ✅<sup>1</sup>                 | ✅<sup>1</sup>               | ✅<sup>1</sup>                  | N/A                             | N/A                           | N/A                            | N/A     | N/A | N/A            |
 | PyPy 3.10 v7.3           | ✅          | ✅                  | ✅            | N/A           | N/A            | ✅<sup>1</sup>                 | ✅<sup>1</sup>               | ✅<sup>1</sup>                  | N/A                             | N/A                           | N/A                            | N/A     | N/A | N/A            |
 | PyPy 3.11 v7.3           | ✅          | ✅                  | ✅            | N/A           | N/A            | ✅<sup>1</sup>                 | ✅<sup>1</sup>               | ✅<sup>1</sup>                  | N/A                             | N/A                           | N/A                            | N/A     | N/A | N/A            |
-| GraalPy 3.11 v24.2       | ✅          | ✅                  | ✅            | N/A           | N/A            | ✅<sup>1</sup>                 | N/A                          | ✅<sup>1</sup>                  | N/A                             | N/A                           | N/A                            | N/A     | N/A | N/A            |
 | GraalPy 3.12 v25.0       | ✅          | ✅                  | ✅            | N/A           | N/A            | ✅<sup>1</sup>                 | N/A                          | ✅<sup>1</sup>                  | N/A                             | N/A                           | N/A                            | N/A     | N/A | N/A            |
 
 <sup>**1** PyPy & GraalPy are only supported for manylinux wheels.</sup><br>
 <sup>**2** Windows arm64 support is experimental.</sup><br>
-<sup>**3** Free-threaded mode requires opt-in on 3.13 using [`enable`](https://cibuildwheel.pypa.io/en/stable/options/#enable).</sup><br>
+<sup>**3** Not supported on PyPI, uses old `pyodide` tag instead of `pyemscripten`. Requires `pyodide-eol` [`enable`](https://cibuildwheel.pypa.io/en/stable/options/#enable).</sup><br>
-<sup>**4** Experimental, not yet supported on PyPI, but can be used directly in web deployment. Use `--platform pyodide` to build.</sup><br>
+<sup>**4** Experimental alpha ABI, do not upload to PyPI yet.</sup><br>
 <sup>**5** manylinux armv7l support is experimental. As there are no RHEL based image for this architecture, it's using an Ubuntu based image instead.</sup><br>
+<sup>**6** Python 3.15 requires opt-in using [`enable`](https://cibuildwheel.pypa.io/en/stable/options/#enable).</sup><br>
 
-- Builds manylinux, musllinux, macOS, and Windows wheels for CPython, PyPy, and GraalPy
+- Builds manylinux, musllinux, macOS, Windows, pyemscripten, iOS, and Android wheels
+- Supports CPython, PyPy, and GraalPy
 - Works on GitHub Actions, Azure Pipelines, CircleCI, and GitLab CI
-- Bundles shared library dependencies on Linux and macOS through [auditwheel](https://github.com/pypa/auditwheel) and [delocate](https://github.com/matthew-brett/delocate)
+- Bundles shared library dependencies on Linux through [auditwheel](https://github.com/pypa/auditwheel), macOS through [delocate](https://github.com/matthew-brett/delocate), and Windows through [delvewheel](https://github.com/adang1345/delvewheel)
 - Runs your library's tests against the wheel-installed version of your library
 
 See the [cibuildwheel 1 documentation](https://cibuildwheel.pypa.io/en/1.x/) if you need to build unsupported versions of Python, such as Python 2.
@@ -99,7 +99,7 @@ jobs:
       - uses: actions/setup-python@v6
 
       - name: Install cibuildwheel
-        run: python -m pip install cibuildwheel==3.4.1
+        run: python -m pip install cibuildwheel==4.0.0
 
       - name: Build wheels
         run: python -m cibuildwheel --output-dir wheelhouse
@@ -151,11 +151,14 @@ The following diagram summarises the steps that cibuildwheel takes on each platf
 |  | [`before-all`](https://cibuildwheel.pypa.io/en/stable/options/#before-all) | Execute a shell command on the build system before any wheels are built. |
 |  | [`before-build`](https://cibuildwheel.pypa.io/en/stable/options/#before-build) | Execute a shell command preparing each wheel's build |
 |  | [`xbuild-tools`](https://cibuildwheel.pypa.io/en/stable/options/#xbuild-tools) | Binaries on the path that should be included in an isolated cross-build environment. |
+|  | [`xbuild-files`](https://cibuildwheel.pypa.io/en/stable/options/#xbuild-files) | Platform-specific files in the build environment |
 |  | [`repair-wheel-command`](https://cibuildwheel.pypa.io/en/stable/options/#repair-wheel-command) | Execute a shell command to repair each built wheel |
 |  | [`manylinux-*-image`<br>`musllinux-*-image`](https://cibuildwheel.pypa.io/en/stable/options/#linux-image) | Specify manylinux / musllinux container images |
 |  | [`container-engine`](https://cibuildwheel.pypa.io/en/stable/options/#container-engine) | Specify the container engine to use when building Linux wheels |
 |  | [`dependency-versions`](https://cibuildwheel.pypa.io/en/stable/options/#dependency-versions) | Control the versions of the tools cibuildwheel uses |
 |  | [`pyodide-version`](https://cibuildwheel.pypa.io/en/stable/options/#pyodide-version) | Specify the Pyodide version to use for `pyodide` platform builds |
+| **Auditing** | [`audit-requires`](https://cibuildwheel.pypa.io/en/stable/options/#audit-requires) | Install Python dependencies for the audit step |
+|  | [`audit-command`](https://cibuildwheel.pypa.io/en/stable/options/#audit-command) | Use a tool to check wheels before the end of the run |
 | **Testing** | [`test-command`](https://cibuildwheel.pypa.io/en/stable/options/#test-command) | The command to test each built wheel |
 |  | [`before-test`](https://cibuildwheel.pypa.io/en/stable/options/#before-test) | Execute a shell command before testing each wheel |
 |  | [`test-sources`](https://cibuildwheel.pypa.io/en/stable/options/#test-sources) | Paths that are copied into the working directory of the tests |
@@ -170,7 +173,7 @@ The following diagram summarises the steps that cibuildwheel takes on each platf
 |  | [`build-verbosity`](https://cibuildwheel.pypa.io/en/stable/options/#build-verbosity) | Increase/decrease the output of the build |
 
 
-<!--[[[end]]] (sum: dbfwOkj/k/) -->
+<!--[[[end]]] (sum: Of/28Z7Nut) -->
 
 These options can be specified in a pyproject.toml file, or as environment variables, see [configuration docs](https://cibuildwheel.pypa.io/en/latest/configuration/).
 
@@ -226,7 +229,7 @@ Here are some repos that use cibuildwheel.
 Legal note
 ----------
 
-Since `cibuildwheel` repairs the wheel with `delocate` or `auditwheel`, it might automatically bundle dynamically linked libraries from the build machine.
+Since `cibuildwheel` repairs the wheel with `delocate`, `auditwheel`, or `delvewheel`, it might automatically bundle dynamically linked libraries from the build machine.
 
 It helps ensure that the library can run without any dependencies outside of the pip toolchain.
 
@@ -237,6 +240,62 @@ Changelog
 
 <!-- [[[cog from readme_changelog import mini_changelog; print(mini_changelog()) ]]] -->
 
+### v4.0.0
+
+_7 June 2026_
+
+See @henryiii's [release post](https://iscinumpy.dev/post/cibuildwheel-4-0-0/) for more info on new features!
+
+- 🌟 Adds wheel auditing with `abi3audit` as a default after the repair step, with new [`audit-requires`](https://cibuildwheel.pypa.io/en/stable/options/#audit-requires) and [`audit-command`](https://cibuildwheel.pypa.io/en/stable/options/#audit-command) options (#2805)
+- 🌟 Adds `pyemscripten` platform tag support (PEP 783), updates Pyodide to 314.0.0a2, and adds a `pyodide-eol` [`enable`](https://cibuildwheel.pypa.io/en/stable/options/#enable) flag for building end-of-life Pyodide versions (#2812, #2848)
+- 🌟 Sets up `delvewheel` as the default [`repair-wheel-command`](https://cibuildwheel.pypa.io/en/stable/options/#repair-wheel-command) for Windows, so extension module DLLs are now bundled automatically. Skip by setting it to empty if not needed. (#2831)
+- ✨ Adds CPython 3.15 support, under the [`enable` option](https://cibuildwheel.pypa.io/en/stable/options/#enable) `cpython-prerelease`. This version of cibuildwheel uses 3.15.0b1. (#2833, #2850)
+
+    _While CPython is in beta, the ABI can change, so your wheels might not be compatible with the final release. For this reason, we don't recommend distributing wheels until RC1, at which point 3.15 will be available in cibuildwheel without the flag._
+- ✨ Adds CPython 3.15 support for iOS and Android (#2857, #2858)
+- ✨ Adds Android improvements for building NumPy and related packages, including auditwheel support, pkg-config and Fortran configuration, and the [`xbuild-files`](https://cibuildwheel.pypa.io/en/stable/options/#xbuild-files) option (#2695)
+- ✨ Adds `CIBUILDWHEEL_BUILD_IDENTIFIER` environment variable set to the current build identifier (e.g. `cp311-manylinux_x86_64`) during per-build steps (#2872)
+- ✨ Adds `{project}` and `{package}` placeholders to [`config-settings`](https://cibuildwheel.pypa.io/en/stable/options/#config-settings) (#2827)
+- ⚠️ Drops support for Python 3.8 (#2686)
+- ⚠️ Removes the experimental CPython 3.13 free-threading builds and the `cpython-freethreading` [`enable`](https://cibuildwheel.pypa.io/en/stable/options/#enable) option. CPython 3.14+ free-threading support remains available without the enable flag. (#2684)
+- ⚠️ Drops support for Cirrus CI, which is shutting down June 1, 2026 (#2817)
+- ⚠️ Drops GraalPy 3.11 (gp311) support, as agreed in #2741, and removes GraalPy 24-only workarounds (#2895)
+- 🔐 Adds SHA256 verification for direct downloads of Python interpreters, virtualenv, and python-build-standalone assets (#2873)
+- 🔐 Adds tarfile extraction filter for safe archive extraction (#2856)
+- 🐛 Fixes `UV_PYTHON` not being set for [`before-build`](https://cibuildwheel.pypa.io/en/stable/options/#before-build) on Linux when using `uv` as the [`build-frontend`](https://cibuildwheel.pypa.io/en/stable/options/#build-frontend) (#2830)
+- 🐛 Fixes detection of musl libc when downloading python-build-standalone, which previously always selected the gnu asset on musl hosts like Alpine (#2889)
+- 🐛 Fixes [`config-settings`](https://cibuildwheel.pypa.io/en/stable/options/#config-settings) expansion when `{project}` or `{package}` contains spaces or backslashes (#2886)
+- 🐛 Prevents deadlock when `linux32` fails and forwards platform args to the sanity check (#2880, #2888)
+- 🐛 Fixes container resource leaks on start failure and during teardown (#2879, #2887)
+- 🐛 Removes potential partial cache-population in case of error (#2892)
+- 🐛 Raises a clear error when `ANDROID_API_LEVEL` is not an integer (#2891)
+- 🐛 Replaces assert with proper exception in python-build-standalone (#2859)
+- 🐛 Uses ConfigurationError when `package_dir` is outside cwd instead of a generic Exception (#2898)
+- 🛠 Updates dependencies and container pins (#2893, #2882, #2874, #2868, #2862, #2884, #2845, #2837, #2818, #2810, #2838, #2813)
+- 🛠 Updates Android to Python 3.13.13 and 3.14.4 (#2821)
+- 🛠 Applies Pyodide-specific patches to the Emscripten toolchain installation (#2800)
+- 🛠 Uses `python -V -V` for Windows build diagnostics (#2832)
+- 🛠 Simplifies pinned container image lookup (#2897)
+- 🛠 Minor fixups across error messages, OCI container, and options (#2860)
+- 💼 Adds PEP 723 metadata for `bin/` scripts and drops the `bin` dependency group (#2819)
+- 💼 Improves Azure test reliability with retries and caching (#2890)
+- 💼 Fixes Windows GitLab CI test running (#2870)
+- 💼 Updates CI action pins and dev dependencies (#2902, #2867, #2851, #2843, #2826, #2823, #2820, #2807)
+- 💼 Adds agent and copilot setup files (#2861)
+- 💼 Uses `if TYPE_CHECKING:` blocks (#2866, #2864)
+- 🧪 Fixes Android tests using the `uv` frontend (#2809)
+- 🧪 Fixes the update-dependencies workflow to use `uv` to run `nox` (#2808)
+- 🧪 Adds unit tests for `OCIContainer._get_platform_args` (#2878)
+- 📚 Updates documentation for delvewheel as the default Windows [`repair-wheel-command`](https://cibuildwheel.pypa.io/en/stable/options/#repair-wheel-command), including the build diagram, schema defaults, and legal note (#2877, #2853, #2891)
+- 📚 Documents platform-specific [`before-build`](https://cibuildwheel.pypa.io/en/stable/options/#before-build) configuration (#2834)
+- 📚 Updates the "How it works" diagram with details of Android, iOS, and Pyodide builds (#2816)
+- 📚 Adds Pyodide icon and regenerates working examples data for Android, iOS, and Pyodide (#2815, #2811)
+- 📚 Adds intersphinx support for external documentation linking (#2871)
+- 📚 Adds instructions for building CUDA wheels and fixes manylinux container references in FAQ (#2896, #2900)
+- 📚 Links back to source in docs (#2806)
+- 📚 Removes outdated numpy info (#2855)
+
+
 ### v3.4.1
 
 _2 April 2026_
@@ -279,15 +338,7 @@ _12 November 2025_
 - 🛠 Improve the handling of `test-command` on Android, enabling more options to be passed (#2590)
 - 📚 Docs improvements (#2618)
 
-### v3.2.1
+<!-- [[[end]]] (sum: B1EtXSS7u7) -->
-
-_12 October 2025_
-
-- 🛠 Update to CPython 3.14.0 final (#2614)
-- 🐛 Fix the default MACOSX_DEPLOYMENT_TARGET on Python 3.14 (#2613)
-- 📚 Docs improvements (#2617)
-
-<!-- [[[end]]] (sum: h5X+wOmWfI) -->
 
 ---
 

azure-pipelines.yml

@@ -19,39 +19,54 @@ jobs:
 - job: tests
   strategy:
     matrix:
-      linux_311:
+      linux_313:
         imageName: "ubuntu-latest"
-        pythonVersion: "3.11"
+        pythonVersion: "3.13"
         testSelect: "native"
-      android_311:
+      android_313:
         imageName: "ubuntu-latest"
-        pythonVersion: "3.11"
+        pythonVersion: "3.13"
         testSelect: "android"
-      macos_311:
+      macos_313:
         imageName: "macos-latest"
-        pythonVersion: "3.11"
+        pythonVersion: "3.13"
         testSelect: "native"
-      ios_311:
+      ios_313:
         imageName: "macos-14"  # See https://github.com/actions/runner-images/issues/12777
-        pythonVersion: "3.11"
+        pythonVersion: "3.13"
         testSelect: "ios"
-      android_macos_311:
+      android_macos_313:
         imageName: "macos-latest"
-        pythonVersion: "3.11"
+        pythonVersion: "3.13"
         testSelect: "android"
-      windows_311:
+      windows_313:
         imageName: "windows-latest"
-        pythonVersion: "3.11"
+        pythonVersion: "3.13"
         testSelect: "native"
   timeoutInMinutes: 180
   pool:
     vmImage: $(imageName)
+  variables:
+    # Relocate cibuildwheel's download cache (interpreters) and the per-worker
+    # test pip caches (which live under it) to a stable, cacheable path.
+    CIBW_CACHE_PATH: $(Pipeline.Workspace)/.cibw-cache
 
   steps:
     - task: UsePythonVersion@0
       inputs:
         versionSpec: $(pythonVersion)
 
+    - task: Cache@2
+      displayName: 'Cache cibuildwheel downloads'
+      inputs:
+        # build-platforms.toml carries the interpreter pins; bump the version
+        # prefix to force a cold cache. restoreKeys lets a stale cache still seed
+        # a new run (cibuildwheel re-downloads only what's missing).
+        key: 'cibw-cache | v1 | "$(imageName)" | "$(testSelect)" | cibuildwheel/resources/build-platforms.toml'
+        restoreKeys: |
+          cibw-cache | v1 | "$(imageName)" | "$(testSelect)"
+        path: $(CIBW_CACHE_PATH)
+
     - task: JavaToolInstaller@0
       condition: and(eq(variables['testSelect'], 'android'), eq(variables['Agent.OS'], 'Linux'))
       inputs:

bin/generate_schema.py

@@ -15,6 +15,8 @@ parser = argparse.ArgumentParser(allow_abbrev=False)
 parser.add_argument("--schemastore", action="store_true", help="Generate schema_store version")
 args = parser.parse_args()
 
+# The defaults in the schema are used by external tools for validation and IDE support. They
+# should match the values in defaults.toml, which are used by cibuildwheel itself.
 starter = """
 $schema: http://json-schema.org/draft-07/schema#
 $id: https://github.com/pypa/cibuildwheel/blob/main/cibuildwheel/resources/cibuildwheel.schema.json
@@ -28,7 +30,6 @@ $defs:
     description: How to inherit the parent's value.
   enable:
     enum:
-      - cpython-freethreading
       - cpython-prerelease
       - graalpy
       - pyodide-prerelease
@@ -39,6 +40,12 @@ additionalProperties: false
 description: cibuildwheel's settings.
 type: object
 properties:
+  audit-command:
+    description: Execute a shell command to audit each wheel after it is repaired. Use {wheel} for each wheel path, or {abi3_wheel} to only audit abi3 wheels.
+    type: string_array
+  audit-requires:
+    description: Install Python dependencies for the audit step.
+    type: string_array
   archs:
     description: Change the architectures built on your machine by default.
     type: string_array
@@ -195,6 +202,9 @@ properties:
   xbuild-tools:
     description: Binaries on the path that should be included in an isolated cross-build environment
     type: string_array
+  xbuild-files:
+    description: Platform-specific files in the build environment
+    type: string_table_array
   pyodide-version:
     type: string
     description: Specify the version of Pyodide to use
@@ -309,9 +319,12 @@ items:
       type: object
       additionalProperties: false
       properties:
+        audit-command: {"$ref": "#/$defs/inherit"}
+        audit-requires: {"$ref": "#/$defs/inherit"}
         before-all: {"$ref": "#/$defs/inherit"}
         before-build: {"$ref": "#/$defs/inherit"}
         xbuild-tools: {"$ref": "#/$defs/inherit"}
+        xbuild-files: {"$ref": "#/$defs/inherit"}
         before-test: {"$ref": "#/$defs/inherit"}
         config-settings: {"$ref": "#/$defs/inherit"}
         container-engine: {"$ref": "#/$defs/inherit"}
@@ -367,14 +380,16 @@ oses = {
     "ios": as_object(not_linux),
 }
 
-oses["linux"]["properties"]["repair-wheel-command"] = {
+for os_name, command in [
-    **schema["properties"]["repair-wheel-command"],
+    ("linux", "auditwheel repair -w {dest_dir} {wheel}"),
-    "default": "auditwheel repair -w {dest_dir} {wheel}",
+    ("windows", "delvewheel repair -w {dest_dir} -v {wheel}"),
-}
+    ("macos", "delocate-wheel --require-archs {delocate_archs} -w {dest_dir} -v {wheel}"),
-oses["macos"]["properties"]["repair-wheel-command"] = {
+    ("android", "auditwheel repair --ldpaths {ldpaths} -w {dest_dir} {wheel}"),
-    **schema["properties"]["repair-wheel-command"],
+]:
-    "default": "delocate-wheel --require-archs {delocate_archs} -w {dest_dir} -v {wheel}",
+    oses[os_name]["properties"]["repair-wheel-command"] = {
-}
+        **schema["properties"]["repair-wheel-command"],
+        "default": command,
+    }
 
 del oses["linux"]["properties"]["dependency-versions"]
 

bin/inspect_all_known_projects.py

@@ -24,8 +24,9 @@ This will cache the results to all_known_setup.yaml; you can reprint
 the results without the `--online` setting.
 """
 
+from __future__ import annotations
+
 import ast
-from collections.abc import Iterable, Iterator
 from pathlib import Path
 
 import click
@@ -35,6 +36,10 @@ from rich import print
 
 from cibuildwheel.projectfiles import Analyzer
 
+TYPE_CHECKING = False
+if TYPE_CHECKING:
+    from collections.abc import Iterable, Iterator
+
 DIR = Path(__file__).parent.resolve()
 
 

bin/projects.py

@@ -17,13 +17,14 @@ Suggested usage:
     git diff
 """
 
+from __future__ import annotations
+
 import builtins
 import functools
 import textwrap
 import urllib.error
 import urllib.request
 import xml.dom.minidom
-from collections.abc import Iterable, Mapping, Sequence
 from datetime import UTC, datetime
 from io import StringIO
 from pathlib import Path
@@ -33,6 +34,10 @@ import click
 import yaml
 from github import Auth, Github, GithubException
 
+TYPE_CHECKING = False
+if TYPE_CHECKING:
+    from collections.abc import Iterable, Mapping, Sequence
+
 ICONS = (
     "github",
     "azurepipelines",

bin/run_example_ci_configs.py

@@ -3,6 +3,7 @@
 # /// script
 # dependencies = [
 #   "click",
+#   "jinja2",
 # ]
 # ///
 
@@ -39,13 +40,16 @@ def generate_project(path: Path, build_backend: BuildBackend) -> None:
     sys.path.insert(0, "")
     match build_backend:
         case "meson":
-            from test.test_projects.meson import new_meson_project as new_project  # noqa: PLC0415
+            from test.test_projects.meson import new_meson_project  # noqa: PLC0415
+
+            project = new_meson_project()
         case "setuptools":
-            from test.test_projects.setuptools import new_c_project as new_project  # noqa: PLC0415
+            from test.test_projects.setuptools import new_c_project  # noqa: PLC0415
+
+            project = new_c_project()
         case _:
             typing.assert_never(build_backend)
 
-    project = new_project()
     project.generate(path)
 
 

bin/update_python_build_standalone.py

@@ -3,6 +3,7 @@
 # /// script
 # dependencies = [
 #   "cibuildwheel",
+#   "requests",
 # ]
 #
 # [tool.uv.sources]
@@ -10,13 +11,23 @@
 # ///
 
 import json
+from pathlib import Path
+from typing import Final
+
+import requests
 
 from cibuildwheel.extra import github_api_request
 from cibuildwheel.util.python_build_standalone import (
     PythonBuildStandaloneAsset,
     PythonBuildStandaloneReleaseData,
 )
-from cibuildwheel.util.resources import PYTHON_BUILD_STANDALONE_RELEASES
+
+# Resolve path relative to this script so writes go to the source checkout,
+# not the uv-installed copy of the package.
+DIR: Final[Path] = Path(__file__).parent.parent.resolve()
+PYTHON_BUILD_STANDALONE_RELEASES: Final[Path] = (
+    DIR / "cibuildwheel/resources/python-build-standalone-releases.json"
+)
 
 
 def main() -> None:
@@ -34,8 +45,27 @@ def main() -> None:
         f"repos/astral-sh/python-build-standalone/releases/tags/{latest_tag}"
     )["assets"]
 
+    # Build a sha256 map from the SHA256SUMS file in the release
+    sha256_sums_urls = [
+        ga["browser_download_url"] for ga in github_assets if ga["name"] == "SHA256SUMS"
+    ]
+    name_to_sha256: dict[str, str] = {}
+    if sha256_sums_urls:
+        response = requests.get(sha256_sums_urls[0])
+        response.raise_for_status()
+        for line in response.text.splitlines():
+            parts = line.split()
+            if len(parts) == 2:
+                sha256_hex, filename = parts
+                # The filename may have a leading "./" or spaces - strip it
+                name_to_sha256[filename.lstrip("./")] = sha256_hex
+
     assets = [
-        PythonBuildStandaloneAsset(name=ga["name"], url=ga["browser_download_url"])
+        PythonBuildStandaloneAsset(
+            name=ga["name"],
+            url=ga["browser_download_url"],
+            sha256=name_to_sha256.get(ga["name"], ""),
+        )
         for ga in github_assets
         if ga["name"].endswith("install_only.tar.gz")
     ]

bin/update_pythons.py

@@ -12,16 +12,16 @@
 # [tool.uv.sources]
 # cibuildwheel = { path = ".." }
 # ///
-
+from __future__ import annotations
 
 import difflib
+import hashlib
 import logging
 import operator
 import re
 import tomllib
-from collections.abc import Mapping, MutableMapping
 from pathlib import Path
-from typing import Any, Final, Literal, TypedDict
+from typing import Any, Final, Literal, NotRequired, TypedDict
 from xml.etree import ElementTree as ET
 
 import click
@@ -35,6 +35,10 @@ from rich.syntax import Syntax
 from cibuildwheel.extra import dump_python_configurations, get_pyodide_xbuildenv_info
 from cibuildwheel.platforms.android import android_triplet
 
+TYPE_CHECKING = False
+if TYPE_CHECKING:
+    from collections.abc import Mapping, MutableMapping
+
 log = logging.getLogger("cibw")
 
 # Looking up the dir instead of using utils.resources_dir
@@ -53,11 +57,13 @@ class Config(TypedDict):
 
 class ConfigUrl(Config):
     url: str
+    sha256: NotRequired[str]
 
 
 class ConfigPyodide(Config):
     default_pyodide_version: str
     node_version: str
+    sha256: str
 
 
 # The following set of "Versions" classes allow the initial call to the APIs to
@@ -152,10 +158,6 @@ class GraalPyVersions:
             msg = f"GraalPy {arch} not found for {spec}!"
             raise RuntimeError(msg)
 
-        release = releases[-1]
-        version = release["python_version"]
-        gpversion = release["graalpy_version"]
-
         if "macosx" in identifier:
             arch = "x86_64" if "x86_64" in identifier else "arm64"
             platform = "macos"
@@ -168,19 +170,38 @@ class GraalPyVersions:
 
         arch = "amd64" if arch == "x86_64" else "aarch64"
         ext = "zip" if "win" in identifier else "tar.gz"
-        urls = [
+        for release in reversed(releases):
-            rf["browser_download_url"]
+            version = release["python_version"]
-            for rf in release["assets"]
+            gpversion = release["graalpy_version"]
-            if rf["name"].endswith(f"{platform}-{arch}.{ext}")
+            urls = [
-            and rf["name"].startswith(f"graalpy-{gpversion.major}")
+                rf["browser_download_url"]
-        ]
+                for rf in release["assets"]
-        if urls:
+                if rf["name"].endswith(f"{platform}-{arch}.{ext}")
+                and rf["name"].startswith(f"graalpy-{gpversion.major}")
+            ]
+            if not urls:
+                continue
+
             (url,) = urls
+            # Fetch sha256 from the ".sha256" sidecar asset in the same release.
+            sha256 = ""
+            sha256_asset_name = url.rsplit("/", 1)[-1] + ".sha256"
+            sha256_urls = [
+                rf["browser_download_url"]
+                for rf in release["assets"]
+                if rf["name"] == sha256_asset_name
+            ]
+            if sha256_urls:
+                sha256_response = requests.get(sha256_urls[0])
+                sha256_response.raise_for_status()
+                sha256 = sha256_response.text.strip().split()[0]
             return ConfigUrl(
                 identifier=identifier,
                 version=f"{version.major}.{version.minor}",
                 url=url,
+                sha256=sha256,
             )
+
         return None
 
 
@@ -295,12 +316,14 @@ class CPythonVersions:
             uri = self.versions_dict[new_version]
             files = [rf for rf in self.files_info if rf["release"] == uri]
 
-            urls = [rf["url"] for rf in files if file_ident in rf["url"]]
+            matching = [rf for rf in files if file_ident in rf["url"]]
-            if urls:
+            if matching:
+                rf = matching[0]
                 return ConfigUrl(
                     identifier=identifier,
                     version=f"{new_version.major}.{new_version.minor}",
-                    url=urls[0],
+                    url=rf["url"],
+                    sha256=rf.get("sha256_sum", ""),
                 )
 
         return None
@@ -417,6 +440,7 @@ class PyodideVersions:
             version=str(version),
             default_pyodide_version=release["version"],
             node_version=node_version,
+            sha256=release["sha256"],
         )
 
 
@@ -445,6 +469,16 @@ class AllVersions:
 
         self.pyodide = PyodideVersions()
 
+    def _stream_sha256(self, url: str) -> str:
+        """Download a file (streaming) and return its SHA256 hex digest."""
+        log.debug("Computing sha256 for %s by streaming download...", url)
+        response = requests.get(url, stream=True)
+        response.raise_for_status()
+        hasher = hashlib.sha256()
+        for chunk in response.iter_content(65536):
+            hasher.update(chunk)
+        return hasher.hexdigest()
+
     def update_config(self, config: MutableMapping[str, str]) -> None:
         identifier = config["identifier"]
         version = Version(config["version"])
@@ -462,8 +496,6 @@ class AllVersions:
                 elif "macosx_arm64" in identifier:
                     config_update = self.macos_pypy_arm64.update_version_macos(spec)
             elif identifier.startswith("gp"):
-                if "macosx_x86_64" in identifier:
-                    return
                 config_update = self.graalpy.update_version(identifier, spec)
         elif "t-win32" in identifier and identifier.startswith("cp"):
             config_update = self.windows_t_32.update_version_windows(spec)
@@ -488,13 +520,36 @@ class AllVersions:
             versions = self.maven if identifier.startswith("cp313") else self.cpython
             config_update = versions.update_version_android(identifier, spec)
         elif "ios" in identifier:
-            config_update = self.ios_cpython.update_version_ios(identifier, version)
+            # Python 3.13 and 3.14 are released by BeeWare on GitHub.
+            # Python 3.15 and newer have official releases on python.org.
+            if identifier.startswith(("cp313", "cp314")):
+                config_update = self.ios_cpython.update_version_ios(identifier, version)
+            else:
+                config_update = self.cpython.update_version(
+                    identifier, spec, "iOS-XCframework.tar.gz"
+                )
         elif "pyodide" in identifier:
             config_update = self.pyodide.update_version_pyodide(
                 identifier, version, spec, config["node_version"]
             )
 
         assert config_update is not None, f"{identifier} not found!"
+
+        # Fill in sha256 for URL-based configs if not already provided by the
+        # update_version_* method (e.g. PyPy, BeeWare iOS, Maven have no sidecar).
+        # Also fills in sha256 when the CPython API doesn't return a sha256_sum
+        # (e.g. for older releases).
+        # Widen the type to allow arbitrary key access on the underlying dict.
+        config_update_dict: dict[str, str] = config_update  # type: ignore[assignment]
+        if "url" in config_update_dict and not config_update_dict.get("sha256"):
+            url = config_update_dict["url"]
+            existing_sha256 = config.get("sha256", "")
+            if url == config.get("url") and existing_sha256:
+                # URL unchanged — preserve the existing sha256
+                config_update_dict["sha256"] = existing_sha256
+            else:
+                config_update_dict["sha256"] = self._stream_sha256(url)
+
         if config_update != config:
             log.info("  Updated %s to %s", config, config_update)
             config.clear()

bin/update_virtualenv.py

@@ -4,6 +4,7 @@
 # dependencies = [
 #   "click",
 #   "packaging",
+#   "requests",
 #   "rich",
 #   "cibuildwheel",
 # ]
@@ -15,12 +16,14 @@
 
 import dataclasses
 import difflib
+import hashlib
 import logging
 import tomllib
 from pathlib import Path
 from typing import Final
 
 import click
+import requests
 import rich
 from packaging.version import Version
 from rich.logging import RichHandler
@@ -92,16 +95,29 @@ def update_virtualenv(force: bool, level: str) -> None:
     if latest_release.version > Version(local_version):
         version = latest_release.name
         url = latest_release.download_url
+        sha256 = ""  # recomputed below
     else:
         version = local_version
         url = default["url"]
+        sha256 = default["sha256"]
+
+    # Compute sha256 if not already stored (new version or first-time population)
+    if not sha256:
+        log.info("Computing sha256 for %s...", url)
+        response = requests.get(url, stream=True)
+        response.raise_for_status()
+        hasher = hashlib.sha256()
+        for chunk in response.iter_content(65536):
+            hasher.update(chunk)
+        sha256 = hasher.hexdigest()
 
     configurations["default"] = {
         "version": version,
         "url": url,
+        "sha256": sha256,
     }
     result_toml = "".join(
-        f'{key} = {{ version = "{value["version"]}", url = "{value["url"]}" }}\n'
+        f'{key} = {{ version = "{value["version"]}", url = "{value["url"]}", sha256 = "{value["sha256"]}" }}\n'
         for key, value in configurations.items()
     )
 

cibuildwheel/__init__.py

@@ -1 +1 @@
-__version__ = "3.4.1"
+__version__ = "4.0.0"

cibuildwheel/__main__.py

@@ -1,3 +1,5 @@
+from __future__ import annotations
+
 import argparse
 import contextlib
 import dataclasses
@@ -5,17 +7,15 @@ import functools
 import os
 import shutil
 import sys
-import tarfile
 import textwrap
 import traceback
 import typing
-from collections.abc import Generator, Iterable, Sequence
 from pathlib import Path
 from tempfile import mkdtemp
-from typing import Any, Literal, TextIO
 
 import cibuildwheel
 from cibuildwheel import errors
+from cibuildwheel._compat.tarfile import TarFile, safe_extractall
 from cibuildwheel.architecture import Architecture, allowed_architectures_check
 from cibuildwheel.ci import CIProvider, detect_ci_provider, fix_ansi_codes_for_github_actions
 from cibuildwheel.logger import log
@@ -27,6 +27,11 @@ from cibuildwheel.util.file import CIBW_CACHE_PATH, ensure_cache_sentinel
 from cibuildwheel.util.helpers import strtobool
 from cibuildwheel.util.resources import read_all_configs
 
+TYPE_CHECKING = False
+if TYPE_CHECKING:
+    from collections.abc import Generator, Iterable, Sequence
+    from typing import Any, Literal, TextIO
+
 
 @dataclasses.dataclass
 class GlobalOptions:
@@ -262,8 +267,8 @@ def main_inner(global_options: GlobalOptions) -> None:
     # Tarfile builds require extraction and changing the directory
     temp_dir = Path(mkdtemp(prefix="cibw-sdist-")).resolve(strict=True)
     try:
-        with tarfile.open(args.package_dir) as tar:
+        with TarFile.open(args.package_dir) as tar:
-            tar.extractall(path=temp_dir)
+            safe_extractall(tar, temp_dir)
 
         # The extract directory is now the project dir
         try:
@@ -468,13 +473,6 @@ def detect_warnings(*, options: Options) -> Generator[str, None, None]:
     build_selector = options.globals.build_selector
     test_selector = options.globals.test_selector
 
-    if EnableGroup.CPythonFreeThreading in build_selector.enable:
-        yield (
-            "'cpython-freethreading' enable is deprecated and will be removed in a future version. "
-            "It should be removed from tool.cibuildwheel.enable in pyproject.toml "
-            "or CIBW_ENABLE environment variable."
-        )
-
     all_valid_identifiers = [
         config.identifier
         for module in ALL_PLATFORM_MODULES.values()
@@ -540,10 +538,16 @@ def check_for_invalid_selectors(
                 msg += "This selector matches a group that wasn't enabled. Enable it using the `enable` option or remove this selector. "
 
             if "p2" in selector_ or "p35" in selector_:
-                msg += f"cibuildwheel 3.x no longer supports Python < 3.8. Please use the 1.x series or update `{selector_name}`. "
+                msg += f"cibuildwheel 4.x no longer supports Python < 3.9. Please use the 1.x series or update `{selector_name}`. "
                 error_type = errors.DeprecationError
             if "p36" in selector_ or "p37" in selector_:
-                msg += f"cibuildwheel 3.x no longer supports Python < 3.8. Please use the 2.x series or update `{selector_name}`. "
+                msg += f"cibuildwheel 4.x no longer supports Python < 3.9. Please use the 2.x series or update `{selector_name}`. "
+                error_type = errors.DeprecationError
+            if "p38" in selector_:
+                msg += f"cibuildwheel 4.x no longer supports Python < 3.9. Please use the 3.x series or update `{selector_name}`. "
+                error_type = errors.DeprecationError
+            if "cp313t" in selector_:
+                msg += f"cibuildwheel 4.x no longer supports Python 3.13 free-threading. Please use the 3.x series or update `{selector_name}`. "
                 error_type = errors.DeprecationError
 
             if selector_name == "build":

cibuildwheel/_compat/tarfile.py

@@ -0,0 +1,71 @@
+# Based on https://github.com/pypa/build/blob/f4ebd495cc0c2c74155bd4fe48b76399fb7927ac/src/build/_compat/tarfile.py
+
+from __future__ import annotations
+
+import sys
+import tarfile
+
+TYPE_CHECKING = False
+if TYPE_CHECKING:
+    from pathlib import Path
+
+    TarFile = tarfile.TarFile
+
+# Per https://peps.python.org/pep-0706/, the "data" filter will become
+# the default in Python 3.14. The first series of releases with the filter
+# had a broken filter that could not process symlinks correctly.
+elif (3, 11, 5) <= sys.version_info < (3, 14):
+
+    class TarFile(tarfile.TarFile):  # pragma: no cover
+        extraction_filter = staticmethod(tarfile.data_filter)
+
+else:
+    TarFile = tarfile.TarFile  # pragma: no cover
+
+
+# Same availability matrix as the TarFile subclass above. On runtimes that
+# ship the stdlib ``data`` filter we delegate to it; the fallback branch is
+# only reached on 3.10.0-3.10.12 / 3.11.0-3.11.4 and validates each member
+# manually before extraction.
+if sys.version_info >= (3, 11, 5):
+
+    def safe_extractall(tar: tarfile.TarFile, path: Path) -> None:  # pragma: no cover
+        """Extract every member of ``tar`` into ``path`` via the PEP 706 ``data`` filter."""
+        tar.extractall(path, filter="data")
+
+else:
+
+    def safe_extractall(tar: tarfile.TarFile, path: Path) -> None:  # pragma: no cover
+        """Validate every member of ``tar``, then extract into ``path``.
+
+        Reached on 3.10.0-3.10.12 / 3.11.0-3.11.4 where the stdlib ``data`` filter is missing. Device or special files,
+        paths that escape ``path``, and symlinks/hardlinks whose targets resolve outside ``path`` are rejected before
+        any write hits the disk.
+
+        """
+        base = path.resolve()
+        for member in tar.getmembers():
+            _validate_safe_member(member, base)
+        tar.extractall(path)
+
+
+def _validate_safe_member(member: tarfile.TarInfo, base: Path) -> None:
+    if member.ischr() or member.isblk() or member.isfifo():
+        msg = f"refusing to extract special device file {member.name!r}"
+        raise tarfile.TarError(msg)
+    target = (base / member.name).resolve(strict=False)
+    if not target.is_relative_to(base):
+        msg = f"refusing to extract {member.name!r}: path escapes destination"
+        raise tarfile.TarError(msg)
+    if member.issym() or member.islnk():
+        link_base = target.parent if member.issym() else base
+        link_target = (link_base / member.linkname).resolve(strict=False)
+        if not link_target.is_relative_to(base):
+            msg = f"refusing to extract {member.name!r}: link target escapes destination"
+            raise tarfile.TarError(msg)
+
+
+__all__ = [
+    "TarFile",
+    "safe_extractall",
+]

cibuildwheel/architecture.py

@@ -1,15 +1,21 @@
+from __future__ import annotations
+
 import platform as platform_module
 import re
 import shutil
 import subprocess
 import sys
 import typing
-from collections.abc import Set
 from enum import StrEnum, auto
-from typing import Final, Literal, Self
 
 from cibuildwheel import errors
-from cibuildwheel.typing import PlatformName
+
+TYPE_CHECKING = False
+if TYPE_CHECKING:
+    from collections.abc import Set
+    from typing import Final, Literal, Self
+
+    from cibuildwheel.typing import PlatformName
 
 PRETTY_NAMES: Final[dict[PlatformName, str]] = {
     "linux": "Linux",

cibuildwheel/audit.py

@@ -0,0 +1,137 @@
+from __future__ import annotations
+
+import subprocess
+import sys
+from pathlib import Path
+
+from cibuildwheel import errors
+from cibuildwheel.logger import log
+from cibuildwheel.util.cmd import call, shell
+from cibuildwheel.util.helpers import prepare_command
+from cibuildwheel.util.packaging import is_abi3_wheel
+from cibuildwheel.venv import activate_virtualenv, find_uv, virtualenv
+
+TYPE_CHECKING = False
+if TYPE_CHECKING:
+    from cibuildwheel.options import BuildOptions
+
+
+def run_audit(
+    *,
+    tmp_dir: Path,
+    build_options: BuildOptions,
+    wheel: Path,
+) -> None:
+    """
+    Run the audit commands on a single wheel.
+
+    Creates a virtualenv (or reuses an existing one) and installs any
+    audit requirements, then runs each audit command template against
+    the wheel. Commands containing {abi3_wheel} are skipped for
+    non-abi3 wheels.
+    """
+
+    if not needs_audit(build_options.audit_command, wheel.name):
+        return
+
+    log.step("Auditing wheel...")
+
+    use_uv = build_options.build_frontend.name in {"build[uv]", "uv"}
+    version = f"{sys.version_info.major}.{sys.version_info.minor}.{sys.version_info.micro}"
+    dependency_constraint = build_options.dependency_constraints.get_for_python_version(
+        version=version, tmp_dir=tmp_dir
+    )
+
+    # Use the base interpreter, not the venv python, to avoid nested-venv
+    # issues where pip can't be found (seen on Windows + Python 3.13).
+    host_python = Path(getattr(sys, "_base_executable", sys.executable))
+
+    audit_venv_dir = tmp_dir / "audit_venv"
+    if not (audit_venv_dir / "pyvenv.cfg").exists():
+        env = virtualenv(
+            version,
+            host_python,
+            audit_venv_dir,
+            dependency_constraint=dependency_constraint,
+            use_uv=use_uv,
+        )
+    else:
+        env = activate_virtualenv(audit_venv_dir)
+
+    # install audit requirements. This is run every time in case the user has
+    # defined overrides.
+    audit_requires = build_options.audit_requires
+    if audit_requires:
+        print(f"Installing audit dependencies: {', '.join(audit_requires)}")
+
+        pip: list[str]
+        if use_uv:
+            uv_path = find_uv()
+            assert uv_path is not None
+            pip = [str(uv_path), "pip"]
+        else:
+            pip = ["pip"]
+        # we pin if the audit-requires is left as the default "abi3audit"
+        should_pin = audit_requires == ["abi3audit"] and dependency_constraint
+
+        call(
+            *pip,
+            "install",
+            *(["--constraint", str(dependency_constraint)] if should_pin else []),
+            *audit_requires,
+            env=env,
+        )
+
+    audit_command = build_options.audit_command
+
+    for command_template in audit_command:
+        if "{abi3_wheel}" in command_template and "{wheel}" in command_template:
+            msg = (
+                f"Invalid audit command {command_template!r}: cannot contain both {{abi3_wheel}} "
+                "and {{wheel}} placeholders"
+            )
+            raise errors.ConfigurationError(msg)
+
+        if "{abi3_wheel}" in command_template and not is_abi3_wheel(wheel.name):
+            continue
+
+        prepared_command = prepare_command(
+            command_template,
+            abi3_wheel=wheel,
+            wheel=wheel,
+            project=".",
+            package=build_options.package_dir,
+        )
+
+        print(f"Running audit command: {prepared_command}")
+        try:
+            shell(prepared_command, env=env)
+        except subprocess.CalledProcessError as e:
+            print(f"Audit command failed with exit code {e.returncode}")
+            msg = f"Audit command failed: {prepared_command}"
+            raise errors.AuditCommandFailedError(msg) from e
+
+
+def needs_audit(audit_commands: list[str], wheel_name: str) -> bool:
+    saw_abi3_placeholder = False
+    for audit_command in audit_commands:
+        if "{abi3_wheel}" not in audit_command and "{wheel}" not in audit_command:
+            msg = (
+                f"Invalid audit command {audit_command!r}: must contain either "
+                "{{abi3_wheel}} or {{wheel}} placeholder"
+            )
+            raise errors.ConfigurationError(msg)
+
+        if "{abi3_wheel}" in audit_command:
+            saw_abi3_placeholder = True
+            if is_abi3_wheel(wheel_name):
+                return True
+        elif "{wheel}" in audit_command:
+            return True
+
+    if saw_abi3_placeholder:
+        print("No audit required for this wheel, as it is not abi3")
+    else:
+        print("No audit configured")
+
+    return False

cibuildwheel/bashlex_eval.py

@@ -1,16 +1,21 @@
+from __future__ import annotations
+
 import dataclasses
 import subprocess
-from collections.abc import (
-    Callable,
-    Iterable,
-    Mapping,
-    Sequence,
-)
 
 import bashlex
 
-# a function that takes a command and the environment, and returns the result
+TYPE_CHECKING = False
-EnvironmentExecutor = Callable[[list[str], dict[str, str]], str]
+if TYPE_CHECKING:
+    from collections.abc import (
+        Callable,
+        Iterable,
+        Mapping,
+        Sequence,
+    )
+
+    # a function that takes a command and the environment, and returns the result
+    EnvironmentExecutor = Callable[[list[str], dict[str, str]], str]
 
 
 def local_environment_executor(command: Sequence[str], env: Mapping[str, str]) -> str:

cibuildwheel/environment.py

@@ -1,12 +1,18 @@
+from __future__ import annotations
+
 import dataclasses
-from collections.abc import Mapping, Sequence
+from typing import Protocol
-from typing import Any, Protocol
 
 import bashlex
 import bashlex.errors
 
 from cibuildwheel import bashlex_eval
 
+TYPE_CHECKING = False
+if TYPE_CHECKING:
+    from collections.abc import Mapping, Sequence
+    from typing import Any
+
 
 class EnvironmentParseError(Exception):
     pass

cibuildwheel/errors.py

@@ -76,7 +76,7 @@ class RepairStepProducedNoWheelError(FatalError):
             Build failed because the repair step completed successfully but
             did not produce a wheel.
 
-            Your `repair-wheel-command` is expected to place the repaired
+            Your `repair-wheel-command` must place the repaired
             wheel in the {dest_dir} directory. See the documentation for
             example configurations:
 
@@ -94,7 +94,7 @@ class RepairStepProducedMultipleWheelsError(FatalError):
             Build failed because the repair step completed successfully but
             produced multiple wheels: {wheels}
 
-            Your `repair-wheel-command` is expected to place one repaired
+            Your `repair-wheel-command` must place exactly one repaired
             wheel in the {{dest_dir}} directory. See the documentation for
             example configurations:
 
@@ -103,3 +103,9 @@ class RepairStepProducedMultipleWheelsError(FatalError):
         )
         super().__init__(message)
         self.return_code = 8
+
+
+class AuditCommandFailedError(FatalError):
+    def __init__(self, message: str) -> None:
+        super().__init__(message)
+        self.return_code = 9

cibuildwheel/extra.py

@@ -2,17 +2,24 @@
 These are utilities for the `/bin` scripts, not for the `cibuildwheel` program.
 """
 
+from __future__ import annotations
+
 import json
 import time
 import typing
 import urllib.error
 import urllib.request
-from collections.abc import Mapping, Sequence
 from io import StringIO
-from typing import Any, NotRequired, Protocol
+from typing import NotRequired, Protocol
 
 from cibuildwheel import __version__ as cibw_version
 
+TYPE_CHECKING = False
+if TYPE_CHECKING:
+    from collections.abc import Mapping, Sequence
+    from typing import Any
+
+
 __all__ = ("Printable", "dump_python_configurations")
 
 
@@ -83,6 +90,7 @@ def github_api_request(path: str, *, max_retries: int = 3) -> dict[str, Any]:
 
 class PyodideXBuildEnvRelease(typing.TypedDict):
     version: str
+    sha256: str
     python_version: str
     emscripten_version: str
     min_pyodide_build_version: NotRequired[str]

cibuildwheel/frontend.py

@@ -1,11 +1,18 @@
+from __future__ import annotations
+
 import dataclasses
 import shlex
 import typing
-from collections.abc import Sequence
+from typing import Literal, get_args
-from typing import Literal, Self, get_args
 
-from cibuildwheel.logger import log
+from cibuildwheel.util.helpers import parse_key_value_string, prepare_command
-from cibuildwheel.util.helpers import parse_key_value_string
+
+TYPE_CHECKING = False
+if TYPE_CHECKING:
+    from collections.abc import Sequence
+    from typing import Self
+
+    from cibuildwheel.typing import PathOrStr
 
 BuildFrontendName = Literal["pip", "build", "build[uv]", "uv"]
 
@@ -36,12 +43,8 @@ class BuildFrontendConfig:
             return {"name": self.name, "args": repr(self.args)}
 
 
-def _get_verbosity_flags(level: int, frontend: BuildFrontendName, *, py38: bool) -> list[str]:
+def _get_verbosity_flags(level: int, frontend: BuildFrontendName) -> list[str]:
     if level < 0:
-        if frontend.startswith("build") and py38:
-            msg = f"build_verbosity {level} is not supported for {frontend} frontend. Ignoring."
-            log.warning(msg)
-            return []
         return ["-" + -level * "q"]
 
     if level > 0:
@@ -58,6 +61,20 @@ def _split_config_settings(config_settings: str) -> list[str]:
     return [f"-C{setting}" for setting in config_settings_list]
 
 
+def prepare_config_settings(config_settings: str, *, project: PathOrStr, package: PathOrStr) -> str:
+    # Substitute the {project}/{package} placeholders on each already-split
+    # token rather than on the raw string. A substituted path may contain
+    # spaces or backslashes (e.g. a Windows `{package}` path), and the result
+    # is later re-parsed with shlex.split (in _split_config_settings /
+    # parse_config_settings) — substituting on the whole string would let
+    # those characters be reinterpreted, splitting one setting into several or
+    # eating backslashes. shlex.join re-quotes each token so the round-trip is
+    # lossless.
+    settings = shlex.split(config_settings)
+    prepared = [prepare_command(setting, project=project, package=package) for setting in settings]
+    return shlex.join(prepared)
+
+
 # Based on build.__main__.main.
 def parse_config_settings(config_settings_str: str) -> dict[str, str | list[str]]:
     config_settings: dict[str, str | list[str]] = {}
@@ -75,10 +92,10 @@ def parse_config_settings(config_settings_str: str) -> dict[str, str | list[str]
 
 
 def get_build_frontend_extra_flags(
-    build_frontend: BuildFrontendConfig, verbosity_level: int, config_settings: str, *, py38: bool
+    build_frontend: BuildFrontendConfig, verbosity_level: int, config_settings: str
 ) -> list[str]:
     return [
         *_split_config_settings(config_settings),
         *build_frontend.args,
-        *_get_verbosity_flags(verbosity_level, build_frontend.name, py38=py38),
+        *_get_verbosity_flags(verbosity_level, build_frontend.name),
     ]

cibuildwheel/logger.py

@@ -1,3 +1,5 @@
+from __future__ import annotations
+
 import codecs
 import contextlib
 import dataclasses
@@ -9,18 +11,21 @@ import re
 import sys
 import textwrap
 import time
-from collections.abc import Generator
 from pathlib import Path
-from typing import IO, TYPE_CHECKING, AnyStr, Final, Literal
 
 import humanize
 
 from cibuildwheel.ci import CIProvider, detect_ci_provider, filter_ansi_codes
 
+TYPE_CHECKING = False
 if TYPE_CHECKING:
+    from collections.abc import Generator
+    from typing import IO, AnyStr, Final, Literal
+
     from cibuildwheel.options import Options
 
-FoldPattern = tuple[str, str]
+    FoldPattern = tuple[str, str]
+
 DEFAULT_FOLD_PATTERN: Final[FoldPattern] = ("{name}", "")
 FOLD_PATTERNS: Final[dict[str, FoldPattern]] = {
     "azure": ("##[group]{name}", "##[endgroup]"),
@@ -234,7 +239,7 @@ class Logger:
             print(f"cibuildwheel: {c.bright_red}error{c.end}: {error}\n", file=sys.stderr)
 
     @contextlib.contextmanager
-    def print_summary(self, *, options: "Options") -> Generator[None, None, None]:
+    def print_summary(self, *, options: Options) -> Generator[None, None, None]:
         start = time.time()
         yield
         duration = time.time() - start
@@ -292,7 +297,7 @@ class Logger:
         # lowercase, shorten
         return identifier.lower()[:20]
 
-    def _github_step_summary(self, duration: float, options: "Options") -> str:
+    def _github_step_summary(self, duration: float, options: Options) -> str:
         """
         Returns the GitHub step summary, in markdown format.
         """

cibuildwheel/oci_container.py

@@ -1,3 +1,6 @@
+from __future__ import annotations
+
+import contextlib
 import dataclasses
 import io
 import json
@@ -10,19 +13,25 @@ import sys
 import textwrap
 import typing
 import uuid
-from collections.abc import Mapping, Sequence
 from enum import Enum
-from pathlib import Path, PurePath, PurePosixPath
+from pathlib import PurePosixPath
-from types import TracebackType
+from typing import Literal, assert_never
-from typing import IO, Literal, Self, assert_never
 
 from cibuildwheel.ci import CIProvider, detect_ci_provider
 from cibuildwheel.errors import OCIEngineTooOldError
 from cibuildwheel.logger import log
-from cibuildwheel.typing import PathOrStr
 from cibuildwheel.util.cmd import call
 from cibuildwheel.util.helpers import FlexibleVersion, parse_key_value_string, strtobool
 
+TYPE_CHECKING = False
+if TYPE_CHECKING:
+    from collections.abc import Mapping, Sequence
+    from pathlib import Path, PurePath
+    from types import TracebackType
+    from typing import IO, Self
+
+    from cibuildwheel.typing import PathOrStr
+
 ContainerEngineName = Literal["docker", "podman"]
 
 
@@ -198,7 +207,6 @@ class OCIContainer:
 
     UTILITY_PYTHON = "/opt/python/cp39-cp39/bin/python"
 
-    process: subprocess.Popen[bytes]
     bash_stdin: IO[bytes]
     bash_stdout: IO[bytes]
 
@@ -218,6 +226,7 @@ class OCIContainer:
         self.oci_platform = oci_platform
         self.cwd = cwd
         self.name: str | None = None
+        self.process: subprocess.Popen[bytes] | None = None
         self.engine = engine
         self.host_tar_format = ""
         if sys.platform.startswith("darwin"):
@@ -249,10 +258,12 @@ class OCIContainer:
                 # this allows to run local only images
                 pull = "never"
         except subprocess.CalledProcessError:
+            # silently fallback to "--pull=always"
             pass
         return f"--platform={oci_platform.value}", f"--pull={pull}"
 
     def __enter__(self) -> Self:
+        assert self.process is None
         self.name = f"cibuildwheel-{uuid.uuid4()}"
 
         _check_engine_version(self.engine)
@@ -288,7 +299,17 @@ class OCIContainer:
                     ).strip()
                 else:
                     raise
-            simulate_32_bit = container_machine not in {"i686", "armv7l", "armv8l"}
+            if container_machine not in {"i686", "armv7l", "armv8l"}:
+                simulate_32_bit = True
+                # sanity check to ensure no deadlock waiting for container to start
+                call(
+                    *run_cmd,
+                    *platform_args,
+                    self.image,
+                    "linux32",
+                    "/bin/true",
+                    capture_stdout=True,
+                )
 
         shell_args = ["linux32", "/bin/bash"] if simulate_32_bit else ["/bin/bash"]
 
@@ -310,32 +331,41 @@ class OCIContainer:
             check=True,
         )
 
-        self.process = subprocess.Popen(
+        try:
-            [
+            self.process = subprocess.Popen(
-                self.engine.name,
+                [
-                "start",
+                    self.engine.name,
-                "--attach",
+                    "start",
-                "--interactive",
+                    "--attach",
-                self.name,
+                    "--interactive",
-            ],
+                    self.name,
-            stdin=subprocess.PIPE,
+                ],
-            stdout=subprocess.PIPE,
+                stdin=subprocess.PIPE,
-        )
+                stdout=subprocess.PIPE,
+            )
 
-        assert self.process.stdin
+            assert self.process.stdin
-        assert self.process.stdout
+            assert self.process.stdout
-        self.bash_stdin = self.process.stdin
+            self.bash_stdin = self.process.stdin
-        self.bash_stdout = self.process.stdout
+            self.bash_stdout = self.process.stdout
 
-        # run a noop command to block until the container is responding
+            # run a noop command to block until the container is responding
-        self.call(["/bin/true"], cwd="/")
+            self.call(["/bin/true"], cwd="/")
-
-        if self.cwd:
-            # Although `docker create -w` does create the working dir if it
-            # does not exist, podman does not. There does not seem to be a way
-            # to setup a workdir for a container running in podman.
-            self.call(["mkdir", "-p", os.fspath(self.cwd)], cwd="/")
 
+            if self.cwd:
+                # Although `docker create -w` does create the working dir if it
+                # does not exist, podman does not. There does not seem to be a way
+                # to setup a workdir for a container running in podman.
+                self.call(["mkdir", "-p", os.fspath(self.cwd)], cwd="/")
+        except BaseException:
+            # clean-up
+            if self.process is not None:
+                if self.process.poll() is None:
+                    self.process.kill()
+                self.process.communicate()
+            self.process = None
+            self._remove_container()
+            raise
         return self
 
     def __exit__(
@@ -344,29 +374,52 @@ class OCIContainer:
         exc_val: BaseException | None,
         exc_tb: TracebackType | None,
     ) -> None:
-        self.bash_stdin.write(b"exit 0\n")
+        assert self.process is not None
-        self.bash_stdin.flush()
+        try:
-        self.process.wait(timeout=30)
+            # Ask bash to exit cleanly and wait for the `start` process to finish.
-        self.bash_stdin.close()
+            # If the container/bash has already died, the write raises
-        self.bash_stdout.close()
+            # BrokenPipeError; if bash refuses to exit, `wait` raises
+            # TimeoutExpired. Both are handled below so we always reach the
+            # cleanup in `finally` rather than leaking the process or container.
+            self.bash_stdin.write(b"exit 0\n")
+            self.bash_stdin.flush()
+            self.process.wait(timeout=30)
 
-        if self.engine.name == "podman":
+            if self.engine.name == "podman":
-            # This works around what seems to be a race condition in the podman
+                # This works around what seems to be a race condition in the
-            # backend. The full reason is not understood. See PR #966 for a
+                # podman backend. The full reason is not understood. See PR #966
-            # discussion on possible causes and attempts to remove this line.
+                # for a discussion on possible causes and attempts to remove this
-            # For now, this seems to work "well enough".
+                # line. For now, this seems to work "well enough".
-            self.process.wait()
+                self.process.wait()
+        except (OSError, subprocess.TimeoutExpired):
+            # bash didn't shut down cleanly; force the process down so it isn't
+            # leaked, then continue to cleanup.
+            if self.process.poll() is None:
+                self.process.kill()
+                self.process.wait()
+        finally:
+            with contextlib.suppress(OSError):
+                self.bash_stdin.close()
+            with contextlib.suppress(OSError):
+                self.bash_stdout.close()
+            self.process = None
 
-        assert isinstance(self.name, str)
+            keep_container = strtobool(os.environ.get("CIBW_DEBUG_KEEP_CONTAINER", ""))
+            if not keep_container:
+                self._remove_container()
 
-        keep_container = strtobool(os.environ.get("CIBW_DEBUG_KEEP_CONTAINER", ""))
+    def _remove_container(self) -> None:
-        if not keep_container:
+        assert self.name is not None
-            subprocess.run(
+        result = subprocess.run(
-                [self.engine.name, "rm", "--force", "-v", self.name],
+            [self.engine.name, "rm", "--force", "-v", self.name],
-                stdout=subprocess.DEVNULL,
+            stdout=subprocess.DEVNULL,
-                check=False,
+            check=False,
-            )
+        )
-            self.name = None
+        # only warn when not running in CI
+        if result.returncode != 0 and detect_ci_provider() is None:
+            msg = f"Failed to remove {self.name!r} container."
+            log.warning(msg)
+        self.name = None
 
     def copy_into(self, from_path: Path, to_path: PurePath) -> None:
         if from_path.is_dir():
@@ -525,13 +578,12 @@ class OCIContainer:
         return self.call(command, env=environment, capture_output=True)
 
     def debug_info(self) -> str:
+        command = [self.engine.name, "info"]
         if self.engine.name == "podman":
-            command = f"{self.engine.name} info --debug"
+            command.append("--debug")
-        else:
+
-            command = f"{self.engine.name} info"
         completed = subprocess.run(
             command,
-            shell=True,
             check=True,
             cwd=self.cwd,
             stdin=subprocess.PIPE,

cibuildwheel/options.py

@@ -1,3 +1,5 @@
+from __future__ import annotations
+
 import collections
 import configparser
 import contextlib
@@ -8,9 +10,9 @@ import functools
 import shlex
 import textwrap
 import tomllib
-from collections.abc import Callable, Generator, Iterable, Mapping, Sequence, Set
+from collections.abc import Mapping, Sequence
 from pathlib import Path
-from typing import Any, Final, Literal, Self, assert_never
+from typing import assert_never
 
 from packaging.specifiers import SpecifierSet
 
@@ -27,6 +29,11 @@ from cibuildwheel.util import resources
 from cibuildwheel.util.helpers import format_safe, parse_key_value_string, strtobool, unwrap
 from cibuildwheel.util.packaging import DependencyConstraints
 
+TYPE_CHECKING = False
+if TYPE_CHECKING:
+    from collections.abc import Callable, Generator, Iterable, Set
+    from typing import Any, Final, Literal, Self
+
 MANYLINUX_ARCHS: Final[tuple[str, ...]] = (
     "x86_64",
     "i686",
@@ -113,6 +120,7 @@ class BuildOptions:
     before_all: str
     before_build: str | None
     xbuild_tools: list[str] | None
+    xbuild_files: dict[str, list[str]]
     repair_command: str
     manylinux_images: dict[str, str] | None
     musllinux_images: dict[str, str] | None
@@ -125,6 +133,8 @@ class BuildOptions:
     test_groups: list[str]
     test_environment: ParsedEnvironment
     test_runtime: TestRuntimeConfig
+    audit_requires: list[str]
+    audit_command: list[str]
     build_verbosity: int
     build_frontend: BuildFrontendConfig
     config_settings: str
@@ -686,8 +696,6 @@ class Options:
             skip_config = ""
             architectures = Architecture.all_archs(self.platform)
             enable |= EnableGroup.all_groups()
-            if args.only.startswith("cp313t-"):
-                enable.add(EnableGroup.CPythonFreeThreading)
 
         build_selector = BuildSelector(
             build_config=build_config,
@@ -708,11 +716,12 @@ class Options:
 
     def _check_pinned_image(self, value: str, pinned_images: Mapping[str, str]) -> None:
         error_set = {"manylinux1", "manylinux2010", "manylinux_2_24", "musllinux_1_1"}
+        # Currently no warnings, next: https://github.com/pypa/manylinux/issues/1925
         warning_set: set[str] = set()
 
         if value in error_set:
             msg = (
-                f"cibuildwheel 3.x does not support the image {value!r}. Either upgrade to a "
+                f"cibuildwheel 4.x does not support the image {value!r}. Either upgrade to a "
                 "supported image or continue using the image by pinning it directly with"
                 " its full OCI registry '<name>{:<tag>|@<digest>}'."
             )
@@ -764,6 +773,14 @@ class Options:
             if xbuild_tools == ["\u0000"]:
                 xbuild_tools = None
 
+            xbuild_files = parse_key_value_string(
+                self.reader.get(
+                    "xbuild-files",
+                    option_format=ShlexTableFormat(sep="; ", pair_sep=":", allow_merge=False),
+                ),
+                kw_arg_names=["*"],
+            )
+
             test_sources = shlex.split(
                 self.reader.get(
                     "test-sources", option_format=ListFormat(sep=" ", quote=shlex.quote)
@@ -863,11 +880,7 @@ class Options:
                         f"manylinux-{build_platform}-image", ignore_empty=True
                     )
                     self._check_pinned_image(config_value, pinned_images)
-                    if config_value in pinned_images:
+                    manylinux_images[build_platform] = pinned_images.get(config_value, config_value)
-                        image = pinned_images[config_value]
-                    else:
-                        image = config_value
-                    manylinux_images[build_platform] = image
 
                 for build_platform in MUSLLINUX_ARCHS:
                     pinned_images = all_pinned_container_images[build_platform]
@@ -875,11 +888,7 @@ class Options:
                         f"musllinux-{build_platform}-image", ignore_empty=True
                     )
                     self._check_pinned_image(config_value, pinned_images)
-                    if config_value in pinned_images:
+                    musllinux_images[build_platform] = pinned_images.get(config_value, config_value)
-                        image = pinned_images[config_value]
-                    else:
-                        image = config_value
-                    musllinux_images[build_platform] = image
 
             container_engine_str = self.reader.get(
                 "container-engine",
@@ -894,6 +903,15 @@ class Options:
 
             pyodide_version = self.reader.get("pyodide-version", env_plat=False)
 
+            audit_command_str = self.reader.get(
+                "audit-command", option_format=ListFormat(sep=" && ")
+            )
+            audit_command = audit_command_str.split(" && ") if audit_command_str else []
+
+            audit_requires = self.reader.get(
+                "audit-requires", option_format=ListFormat(sep=" ")
+            ).split()
+
             return BuildOptions(
                 globals=self.globals,
                 test_command=test_command,
@@ -908,6 +926,7 @@ class Options:
                 before_all=before_all,
                 build_verbosity=build_verbosity,
                 xbuild_tools=xbuild_tools,
+                xbuild_files=xbuild_files,
                 repair_command=repair_command,
                 environment=environment,
                 dependency_constraints=dependency_constraints,
@@ -917,6 +936,8 @@ class Options:
                 config_settings=config_settings,
                 container_engine=container_engine,
                 pyodide_version=pyodide_version or None,
+                audit_command=audit_command,
+                audit_requires=audit_requires,
             )
 
     def check_for_invalid_configuration(self, identifiers: Iterable[str]) -> None:

cibuildwheel/platforms/__init__.py

@@ -1,14 +1,21 @@
+from __future__ import annotations
+
 import sys
-from collections.abc import Sequence
+from typing import Protocol
-from pathlib import Path
-from typing import Final, Protocol
 
 from cibuildwheel import errors
-from cibuildwheel.architecture import Architecture
-from cibuildwheel.options import Options
 from cibuildwheel.platforms import android, ios, linux, macos, pyodide, windows
-from cibuildwheel.selector import BuildSelector
+
-from cibuildwheel.typing import GenericPythonConfiguration, PlatformName
+TYPE_CHECKING = False
+if TYPE_CHECKING:
+    from collections.abc import Sequence
+    from pathlib import Path
+    from typing import Final
+
+    from cibuildwheel.architecture import Architecture
+    from cibuildwheel.options import Options
+    from cibuildwheel.selector import BuildSelector
+    from cibuildwheel.typing import GenericPythonConfiguration, PlatformName
 
 
 class PlatformModule(Protocol):

cibuildwheel/platforms/android.py

@@ -1,15 +1,13 @@
-import csv
+from __future__ import annotations
-import hashlib
+
 import os
 import platform
 import re
 import shlex
 import shutil
 import subprocess
-import sysconfig
+import sys
-from collections.abc import Iterable, Iterator, MutableMapping
 from dataclasses import dataclass
-from os.path import relpath
 from pathlib import Path
 from pprint import pprint
 from runpy import run_path
@@ -18,26 +16,39 @@ from typing import Any
 
 from build import ProjectBuilder
 from build.env import IsolatedEnv
-from elftools.common.exceptions import ELFError
-from elftools.elf.elffile import ELFFile
 from filelock import FileLock
+from packaging.utils import canonicalize_name
 
 from cibuildwheel import errors, platforms  # pylint: disable=cyclic-import
 from cibuildwheel.architecture import Architecture, arch_synonym
-from cibuildwheel.frontend import get_build_frontend_extra_flags, parse_config_settings
+from cibuildwheel.audit import run_audit
+from cibuildwheel.frontend import (
+    get_build_frontend_extra_flags,
+    parse_config_settings,
+    prepare_config_settings,
+)
 from cibuildwheel.logger import log
-from cibuildwheel.options import BuildOptions, Options
-from cibuildwheel.selector import BuildSelector
 from cibuildwheel.util import resources
 from cibuildwheel.util.cmd import call, shell
-from cibuildwheel.util.file import CIBW_CACHE_PATH, copy_test_sources, download, move_file
+from cibuildwheel.util.file import (
+    CIBW_CACHE_PATH,
+    copy_test_sources,
+    download,
+    move_file,
+    remove_on_error,
+)
 from cibuildwheel.util.helpers import prepare_command
 from cibuildwheel.util.packaging import find_compatible_wheel
 from cibuildwheel.util.python_build_standalone import create_python_build_standalone_environment
 from cibuildwheel.venv import constraint_flags, find_uv, virtualenv
 
-RESOURCES_ANDROID = resources.PATH / "android"
+TYPE_CHECKING = False
+if TYPE_CHECKING:
+    from cibuildwheel.options import BuildOptions, Options
+    from cibuildwheel.selector import BuildSelector
+    from cibuildwheel.typing import PathOrStr
 
+RESOURCES_ANDROID = resources.PATH / "android"
 ANDROID_TRIPLET = {
     "arm64_v8a": "aarch64-linux-android",
     "x86_64": "x86_64-linux-android",
@@ -62,6 +73,7 @@ class PythonConfiguration:
     version: str
     identifier: str
     url: str
+    sha256: str
 
     @property
     def arch(self) -> str:
@@ -135,9 +147,11 @@ def build(options: Options, tmp_path: Path) -> None:
             build_path.mkdir()
             python_dir = setup_target_python(config, build_path)
             build_env, android_env = setup_env(config, build_options, build_path, python_dir)
+
             state = BuildState(
                 config, build_options, build_path, python_dir, build_env, android_env
             )
+            setup_xbuild_files(state)
 
             compatible_wheel = find_compatible_wheel(built_wheels, config.identifier)
             if compatible_wheel:
@@ -150,8 +164,9 @@ def build(options: Options, tmp_path: Path) -> None:
                 before_build(state)
                 built_wheel = build_wheel(state)
                 repaired_wheel = repair_wheel(state, built_wheel)
+                run_audit(tmp_dir=tmp_path, build_options=build_options, wheel=repaired_wheel)
 
-            test_wheel(state, repaired_wheel, build_frontend=build_options.build_frontend.name)
+            test_wheel(state, repaired_wheel)
 
             output_wheel: Path | None = None
             if compatible_wheel is None:
@@ -173,7 +188,8 @@ def setup_target_python(config: PythonConfiguration, build_path: Path) -> Path:
     python_tgz = CIBW_CACHE_PATH / config.url.rpartition("/")[-1]
     with FileLock(f"{python_tgz}.lock"):
         if not python_tgz.exists():
-            download(config.url, python_tgz)
+            with remove_on_error(python_tgz):
+                download(config.url, python_tgz, sha256=config.sha256)
 
     python_dir = build_path / "python"
     python_dir.mkdir()
@@ -183,6 +199,11 @@ def setup_target_python(config: PythonConfiguration, build_path: Path) -> Path:
     # updated to Python versions that include the fix.
     call("patch", "-p1", "-i", RESOURCES_ANDROID / "android.patch", cwd=python_dir)
 
+    # Work around https://github.com/python/cpython/issues/138800. This can be removed
+    # once we've updated to Python versions that include the fix.
+    pc_path = python_dir / f"prefix/lib/pkgconfig/python-{config.version}.pc"
+    pc_path.write_text(pc_path.read_text().replace("$(BLDLIBRARY)", f"-lpython{config.version}"))
+
     return python_dir
 
 
@@ -196,13 +217,7 @@ def setup_env(
     * android_env, which uses the environment while simulating running on Android.
     """
     log.step("Setting up build environment...")
-    build_frontend = build_options.build_frontend.name
+    use_uv, pip = find_pip(build_options)
-    use_uv = build_frontend in {"build[uv]", "uv"}
-    uv_path = find_uv()
-    if use_uv and uv_path is None:
-        msg = "uv not found"
-        raise AssertionError(msg)
-    pip = ["pip"] if not use_uv else [str(uv_path), "pip"]
 
     # Create virtual environment
     python_exe = create_python_build_standalone_environment(
@@ -217,8 +232,12 @@ def setup_env(
     )
     create_cmake_toolchain(config, build_path, python_dir, build_env)
 
+    # See platforms.md for the reason why we use this default API level.
+    build_env.setdefault("ANDROID_API_LEVEL", "24")
+
     # Apply custom environment variables, and check environment is still valid
     build_env = build_options.environment.as_dictionary(build_env)
+    build_env["CIBUILDWHEEL_BUILD_IDENTIFIER"] = config.identifier
     build_env["PIP_DISABLE_PIP_VERSION_CHECK"] = "1"
     for command in ["python"] if use_uv else ["python", "pip"]:
         command_path = call("which", command, env=build_env, capture_stdout=True).strip()
@@ -234,14 +253,14 @@ def setup_env(
         else:
             call(command, "--version", env=build_env)
 
-    # Construct an altered environment which simulates running on Android.
-    android_env = setup_android_env(config, python_dir, venv_dir, build_env)
-
     # Install build tools
-    if build_frontend not in {"build", "build[uv]", "uv"}:
+    tools = ["auditwheel", "patchelf", "pkgconf"]
-        msg = "Android requires the build frontend to be 'build' or 'uv'"
+    if build_options.build_frontend.name in {"build", "build[uv]"}:
-        raise errors.FatalError(msg)
+        tools.append("build")
-    call(*pip, "install", "build", *constraint_flags(dependency_constraint), env=build_env)
+    call(*pip, "install", *tools, *constraint_flags(dependency_constraint), env=build_env)
+
+    # Construct an altered environment which simulates running on Android.
+    android_env = setup_android_env(config, python_dir, build_env)
 
     # Build-time requirements must be queried within android_env, because
     # `get_requires_for_build` can run arbitrary code in setup.py scripts, which may be
@@ -264,7 +283,12 @@ def setup_env(
         call(*pip, "install", *pb.build_system_requires, env=build_env)
 
     requires_for_build = pb.get_requires_for_build(
-        "wheel", parse_config_settings(build_options.config_settings)
+        "wheel",
+        parse_config_settings(
+            prepare_config_settings(
+                build_options.config_settings, project=".", package=build_options.package_dir
+            )
+        ),
     )
     if requires_for_build:
         call(*pip, "install", *requires_for_build, env=build_env)
@@ -332,8 +356,11 @@ def localized_vars(
             final = final.replace(orig_prefix, str(prefix))
 
         if key == "ANDROID_API_LEVEL":
-            if api_level := build_env.get(key):
+            try:
-                final = int(api_level)
+                final = int(build_env[key])
+            except ValueError as e:
+                msg = f"ANDROID_API_LEVEL: {e}. This variable must be an integer."
+                raise errors.FatalError(msg) from e
 
         # Build systems vary in whether FLAGS variables are read from sysconfig, and if so,
         # whether they're replaced by environment variables or combined with them. Even
@@ -356,15 +383,15 @@ def localized_vars(
 
 
 def setup_android_env(
-    config: PythonConfiguration, python_dir: Path, venv_dir: Path, build_env: dict[str, str]
+    config: PythonConfiguration, python_dir: Path, build_env: dict[str, str]
 ) -> dict[str, str]:
-    site_packages = next(venv_dir.glob("lib/python*/site-packages"))
+    site_packages = find_site_packages(build_env)
     for suffix in ["pth", "py"]:
         shutil.copy(RESOURCES_ANDROID / f"_cross_venv.{suffix}", site_packages)
 
     sysconfigdata_path = Path(
         shutil.copy(
-            next(python_dir.glob("prefix/lib/python*/_sysconfigdata_*.py")),
+            glob1(python_dir, "prefix/lib/python*/_sysconfigdata_*.py"),
             site_packages,
         )
     )
@@ -403,6 +430,17 @@ def setup_android_env(
     # Cargo target linker needs to be specified after CC is set
     setup_rust(config, python_dir, android_env)
 
+    # Create shims which install additional build tools on first use.
+    setup_fortran(android_env)
+
+    # `android.py env` returns PKG_CONFIG="pkg-config --define-prefix", but some build
+    # systems can't handle arguments in that variable. Since we have a known version
+    # of pkgconf, it's safe to use PKG_CONFIG_RELOCATE_PATHS instead.
+    android_env["PKG_CONFIG"] = call(
+        "which", "pkgconf-pypi", env=build_env, capture_stdout=True
+    ).strip()
+    android_env["PKG_CONFIG_RELOCATE_PATHS"] = "1"
+
     # Format the environment so it can be pasted into a shell when debugging.
     for key, value in sorted(android_env.items()):
         if os.environ.get(key) != value:
@@ -411,11 +449,7 @@ def setup_android_env(
     return android_env
 
 
-def setup_rust(
+def setup_rust(config: PythonConfiguration, python_dir: Path, env: dict[str, str]) -> None:
-    config: PythonConfiguration,
-    python_dir: Path,
-    env: MutableMapping[str, str],
-) -> None:
     cargo_target = android_triplet(config.identifier)
 
     # CARGO_BUILD_TARGET is the variable used by Cargo and setuptools_rust
@@ -439,13 +473,83 @@ def setup_rust(
         shim_path.chmod(0o755)
 
 
+def setup_fortran(env: dict[str, str]) -> None:
+    # In case there's any autodetection based on the executable name, use the same name
+    # as the real executable (see fortran_shim.run_flang)
+    shim_in = RESOURCES_ANDROID / "fortran_shim.py"
+    shim_out = Path(env["VIRTUAL_ENV"]) / "bin/flang-new"
+
+    # The hashbang line runs the shim in cibuildwheel's own virtual environment, so it
+    # has access to utility functions for downloading and caching files.
+    shim_out.write_text(f"#!{sys.executable}\n\n" + shim_in.read_text())
+    shim_out.chmod(0o755)
+    env["FC"] = str(shim_out)
+
+
+def setup_xbuild_files(state: BuildState) -> None:
+    _, pip = find_pip(state.options)
+    xbf_dir = state.build_path / "xbuild_files"
+    xbf_dir.mkdir()
+
+    for requirement in call(*pip, "freeze", env=state.build_env, capture_stdout=True).splitlines():
+        name, _, _ = requirement.strip().partition("==")
+        xbuild_files = state.options.xbuild_files.get(canonicalize_name(name), [])
+        if xbuild_files:
+            log.step(f"Installing xbuild-files for {name}...")
+            pip_install_android(state, xbf_dir, "--no-deps", requirement)
+            for xbf in xbuild_files:
+                if (xbf_dir / xbf).exists():
+                    shutil.copy(
+                        xbf_dir / xbf,
+                        find_site_packages(state.build_env) / xbf,
+                    )
+                else:
+                    log.warning(f"{xbf_dir / xbf} does not exist")
+
+
+def pip_install_android(state: BuildState, target: Path, *args: PathOrStr) -> None:
+    use_uv, pip = find_pip(state.options)
+    call(
+        *pip,
+        "install",
+        "--only-binary=:all:",
+        *(["--python-platform", android_triplet(state.config.identifier)] if use_uv else []),
+        "--target",
+        target,
+        *args,
+        env=state.android_env,
+    )
+
+
+def find_site_packages(env: dict[str, str]) -> Path:
+    return glob1(Path(env["VIRTUAL_ENV"]), "lib/python*/site-packages")
+
+
+def glob1(base: Path, pattern: str) -> Path:
+    results = list(base.glob(pattern))
+    if len(results) != 1:
+        msg = f"{base} contains {len(results)} paths matching '{pattern}'; expected 1"
+        raise errors.FatalError(msg)
+    return results[0]
+
+
+def find_pip(build_options: BuildOptions) -> tuple[bool, list[str]]:
+    use_uv = build_options.build_frontend.name in {"build[uv]", "uv"}
+    uv_path = find_uv()
+    if use_uv and uv_path is None:
+        msg = "uv not found"
+        raise AssertionError(msg)
+    pip = ["pip"] if not use_uv else [str(uv_path), "pip"]
+    return use_uv, pip
+
+
 def before_build(state: BuildState) -> None:
     if state.options.before_build:
         log.step("Running before_build...")
         shell_prepared(
             state.options.before_build,
             build_options=state.options,
-            env=state.build_env,
+            env=state.android_env,
         )
 
 
@@ -466,8 +570,11 @@ def build_wheel(state: BuildState) -> Path:
                 *get_build_frontend_extra_flags(
                     state.options.build_frontend,
                     state.options.build_verbosity,
-                    state.options.config_settings,
+                    prepare_config_settings(
-                    py38=False,
+                        state.options.config_settings,
+                        project=".",
+                        package=state.options.package_dir,
+                    ),
                 ),
                 env=state.android_env,
             )
@@ -484,21 +591,19 @@ def build_wheel(state: BuildState) -> Path:
                 *get_build_frontend_extra_flags(
                     state.options.build_frontend,
                     state.options.build_verbosity,
-                    state.options.config_settings,
+                    prepare_config_settings(
-                    py38=False,
+                        state.options.config_settings,
+                        project=".",
+                        package=state.options.package_dir,
+                    ),
                 ),
                 env=state.android_env,
             )
         case x:
-            msg = f"Invalid build backend {x!r}"
+            msg = f"Android requires the build frontend to be 'build' or 'uv', not {x!r}"
-            raise AssertionError(msg)
+            raise errors.FatalError(msg)
-
-    built_wheels = list(built_wheel_dir.glob("*.whl"))
-    if len(built_wheels) != 1:
-        msg = f"{built_wheel_dir} contains {len(built_wheels)} wheels; expected 1"
-        raise errors.FatalError(msg)
-    built_wheel = built_wheels[0]
 
+    built_wheel = glob1(built_wheel_dir, "*.whl")
     if built_wheel.name.endswith("none-any.whl"):
         raise errors.NonPlatformWheelError()
     return built_wheel
@@ -510,9 +615,20 @@ def repair_wheel(state: BuildState, built_wheel: Path) -> Path:
     repaired_wheel_dir.mkdir()
 
     if state.options.repair_command:
+        # Tell auditwheel the locations of compiler libraries.
+        toolchain = Path(state.android_env["CC"]).parent.parent
+        triplet = android_triplet(state.config.identifier)
+        ldpaths = ":".join(
+            str(glob1(toolchain, pattern))
+            for pattern in [
+                f"lib/clang/*/lib/linux/{triplet.split('-')[0]}",  # libomp
+                f"sysroot/usr/lib/{triplet}",  # libc++_shared
+            ]
+        )
         shell(
             prepare_command(
                 state.options.repair_command,
+                ldpaths=ldpaths,
                 wheel=built_wheel,
                 dest_dir=repaired_wheel_dir,
                 package=state.options.package_dir,
@@ -521,14 +637,15 @@ def repair_wheel(state: BuildState, built_wheel: Path) -> Path:
             env=state.build_env,
         )
     else:
-        repair_default(state.android_env, built_wheel, repaired_wheel_dir)
+        shutil.move(built_wheel, repaired_wheel_dir)
 
     repaired_wheels = list(repaired_wheel_dir.glob("*.whl"))
     if len(repaired_wheels) == 0:
         raise errors.RepairStepProducedNoWheelError()
     if len(repaired_wheels) != 1:
-        msg = f"{repaired_wheel_dir} contains {len(repaired_wheels)} wheels; expected 1"
+        raise errors.RepairStepProducedMultipleWheelsError(
-        raise errors.FatalError(msg)
+            [rw.name for rw in repaired_wheels],
+        )
     repaired_wheel = repaired_wheels[0]
 
     if repaired_wheel.name.endswith("none-any.whl"):
@@ -536,119 +653,12 @@ def repair_wheel(state: BuildState, built_wheel: Path) -> Path:
     return repaired_wheel
 
 
-def repair_default(
+def test_wheel(state: BuildState, wheel: Path) -> None:
-    android_env: dict[str, str], built_wheel: Path, repaired_wheel_dir: Path
-) -> None:
-    """
-    Adds libc++ to the wheel if anything links against it. In the future this should be
-    moved to auditwheel and generalized to support more libraries.
-    """
-    if (match := re.search(r"^(.+?)-", built_wheel.name)) is None:
-        msg = f"Failed to parse wheel filename: {built_wheel.name}"
-        raise errors.FatalError(msg)
-    wheel_name = match[1]
-
-    unpacked_dir = repaired_wheel_dir / "unpacked"
-    unpacked_dir.mkdir()
-    shutil.unpack_archive(built_wheel, unpacked_dir, format="zip")
-
-    # Some build systems are inconsistent about name normalization, so don't assume the
-    # dist-info name is identical to the wheel name.
-    record_paths = list(unpacked_dir.glob("*.dist-info/RECORD"))
-    if len(record_paths) != 1:
-        msg = f"{built_wheel.name} contains {len(record_paths)} dist-info/RECORD files; expected 1"
-        raise errors.FatalError(msg)
-
-    old_soname = "libc++_shared.so"
-    paths_to_patch = []
-    for path, elffile in elf_file_filter(
-        unpacked_dir / filename
-        for filename, *_ in csv.reader(record_paths[0].read_text().splitlines())
-    ):
-        if (dynamic := elffile.get_section_by_name(".dynamic")) and any(  # type: ignore[no-untyped-call]
-            tag.entry.d_tag == "DT_NEEDED" and tag.needed == old_soname
-            for tag in dynamic.iter_tags()
-        ):
-            paths_to_patch.append(path)
-
-    if not paths_to_patch:
-        shutil.copyfile(built_wheel, repaired_wheel_dir / built_wheel.name)
-    else:
-        # Android doesn't support DT_RPATH, but supports DT_RUNPATH since API level 24
-        # (https://github.com/aosp-mirror/platform_bionic/blob/master/android-changes-for-ndk-developers.md).
-        if int(sysconfig_print('get_config_vars()["ANDROID_API_LEVEL"]', android_env)) < 24:
-            msg = f"Adding {old_soname} requires ANDROID_API_LEVEL to be at least 24"
-            raise errors.FatalError(msg)
-
-        toolchain = Path(android_env["CC"]).parent.parent
-        src_path = toolchain / f"sysroot/usr/lib/{android_env['CIBW_HOST_TRIPLET']}/{old_soname}"
-
-        # Use the same library location as auditwheel would.
-        libs_dir = unpacked_dir / (wheel_name + ".libs")
-        libs_dir.mkdir()
-        new_soname = soname_with_hash(src_path)
-        dst_path = libs_dir / new_soname
-        shutil.copyfile(src_path, dst_path)
-        call(which("patchelf"), "--set-soname", new_soname, dst_path)
-
-        for path in paths_to_patch:
-            call(which("patchelf"), "--replace-needed", old_soname, new_soname, path)
-            call(
-                which("patchelf"),
-                "--set-rpath",
-                f"${{ORIGIN}}/{relpath(libs_dir, path.parent)}",
-                path,
-            )
-        call(which("wheel"), "pack", unpacked_dir, "-d", repaired_wheel_dir)
-
-
-# If cibuildwheel was called without activating its environment, its scripts directory
-# will not be on the PATH.
-def which(cmd: str) -> str:
-    scripts_dir = sysconfig.get_path("scripts")
-    result = shutil.which(cmd, path=scripts_dir + os.pathsep + os.environ["PATH"])
-    if result is None:
-        msg = f"Couldn't find {cmd!r} in {scripts_dir} or on the PATH"
-        raise errors.FatalError(msg)
-    return result
-
-
-def elf_file_filter(paths: Iterable[Path]) -> Iterator[tuple[Path, ELFFile]]:
-    """Filter through an iterator of filenames and load up only ELF files"""
-    for path in paths:
-        if not path.name.endswith(".py"):
-            try:
-                with open(path, "rb") as f:
-                    candidate = ELFFile(f)  # type: ignore[no-untyped-call]
-                    yield path, candidate
-            except ELFError:
-                pass  # Not an ELF file
-
-
-def soname_with_hash(src_path: Path) -> str:
-    """Return the same library filename as auditwheel would"""
-    shorthash = hashlib.sha256(src_path.read_bytes()).hexdigest()[:8]
-    src_name = src_path.name
-    base, ext = src_name.split(".", 1)
-    if not base.endswith(f"-{shorthash}"):
-        return f"{base}-{shorthash}.{ext}"
-    else:
-        return src_name
-
-
-def test_wheel(state: BuildState, wheel: Path, *, build_frontend: str) -> None:
     test_command = state.options.test_command
     if not (test_command and state.options.test_selector(state.config.identifier)):
         return
 
     log.step("Testing wheel...")
-    use_uv = build_frontend in {"build[uv]", "uv"}
-    uv_path = find_uv()
-    if use_uv and uv_path is None:
-        msg = "uv not found"
-        raise AssertionError(msg)
-    pip = ["pip"] if not use_uv else [str(uv_path), "pip"]
-
     native_arch = arch_synonym(platform.machine(), platforms.native_platform(), "android")
     if state.config.arch != native_arch:
         log.warning(
@@ -661,31 +671,17 @@ def test_wheel(state: BuildState, wheel: Path, *, build_frontend: str) -> None:
         shell_prepared(
             state.options.before_test,
             build_options=state.options,
-            env=state.build_env,
+            env=state.android_env,
         )
 
-    platform_args = (
-        ["--python-platform", android_triplet(state.config.identifier)]
-        if use_uv
-        else [
-            "--platform",
-            sysconfig_print("get_platform()", state.android_env).replace("-", "_"),
-        ]
-    )
-
     # Install the wheel and test-requires.
     site_packages_dir = state.build_path / "site-packages"
     site_packages_dir.mkdir()
-    call(
+    pip_install_android(
-        *pip,
+        state,
-        "install",
-        "--only-binary=:all:",
-        *platform_args,
-        "--target",
         site_packages_dir,
         f"{wheel}{state.options.test_extras}",
         *state.options.test_requires,
-        env=state.android_env,
     )
 
     # Copy test-sources.
@@ -755,13 +751,3 @@ def test_wheel(state: BuildState, wheel: Path, *, build_frontend: str) -> None:
         *test_args,
         env=state.build_env,
     )
-
-
-def sysconfig_print(method_call: str, env: dict[str, str]) -> str:
-    return call(
-        "python",
-        "-c",
-        f'import sysconfig; print(sysconfig.{method_call}, end="")',
-        env=env,
-        capture_stdout=True,
-    )

cibuildwheel/platforms/ios.py

@@ -1,3 +1,5 @@
+from __future__ import annotations
+
 import dataclasses
 import os
 import platform
@@ -6,27 +8,43 @@ import shutil
 import subprocess
 import sys
 import textwrap
-from collections.abc import Sequence, Set
 from pathlib import Path
 from typing import assert_never
 
 from filelock import FileLock
+from packaging.version import Version
 
 from cibuildwheel import errors
-from cibuildwheel.architecture import Architecture
+from cibuildwheel.audit import run_audit
-from cibuildwheel.environment import ParsedEnvironment
+from cibuildwheel.frontend import (
-from cibuildwheel.frontend import BuildFrontendName, get_build_frontend_extra_flags
+    BuildFrontendName,
+    get_build_frontend_extra_flags,
+    prepare_config_settings,
+)
 from cibuildwheel.logger import log
-from cibuildwheel.options import Options
 from cibuildwheel.platforms.macos import install_cpython as install_build_cpython
-from cibuildwheel.selector import BuildSelector
 from cibuildwheel.util import resources
 from cibuildwheel.util.cmd import call, shell, split_command
-from cibuildwheel.util.file import CIBW_CACHE_PATH, copy_test_sources, download, move_file
+from cibuildwheel.util.file import (
+    CIBW_CACHE_PATH,
+    copy_test_sources,
+    download,
+    move_file,
+    remove_on_error,
+)
 from cibuildwheel.util.helpers import prepare_command, unwrap_preserving_paragraphs
 from cibuildwheel.util.packaging import find_compatible_wheel
 from cibuildwheel.venv import constraint_flags, virtualenv
 
+TYPE_CHECKING = False
+if TYPE_CHECKING:
+    from collections.abc import Sequence, Set
+
+    from cibuildwheel.architecture import Architecture
+    from cibuildwheel.environment import ParsedEnvironment
+    from cibuildwheel.options import Options
+    from cibuildwheel.selector import BuildSelector
+
 
 @dataclasses.dataclass(frozen=True, kw_only=True)
 class PythonConfiguration:
@@ -34,6 +52,8 @@ class PythonConfiguration:
     identifier: str
     url: str
     build_url: str
+    build_sha256: str
+    sha256: str
 
     @property
     def sdk(self) -> str:
@@ -66,7 +86,7 @@ def all_python_configurations() -> list[PythonConfiguration]:
     # configuration.
     macos_python_configs = resources.read_python_configs("macos")
 
-    def build_url(config_dict: dict[str, str]) -> str:
+    def build_python_config(config_dict: dict[str, str]) -> dict[str, str]:
         # The iOS identifier will be something like cp313-ios_arm64_iphoneos.
         # Drop the iphoneos suffix, then replace ios with macosx to yield
         # cp313-macosx_arm64, which will be a macOS build identifier.
@@ -75,18 +95,22 @@ def all_python_configurations() -> list[PythonConfiguration]:
         matching = [
             config for config in macos_python_configs if config["identifier"] == macos_identifier
         ]
-        return matching[0]["url"]
+        return matching[0]
 
     # Load the platform configuration
     full_python_configs = resources.read_python_configs("ios")
     # Build the configurations, annotating with macOS URL details.
-    return [
+    python_configurations = []
-        PythonConfiguration(
+    for item in full_python_configs:
-            **item,
+        build_config = build_python_config(item)
-            build_url=build_url(item),
+        python_configurations.append(
+            PythonConfiguration(
+                **item,
+                build_url=build_config["url"],
+                build_sha256=build_config["sha256"],
+            )
         )
-        for item in full_python_configs
+    return python_configurations
-    ]
 
 
 def get_python_configurations(
@@ -121,9 +145,10 @@ def install_target_cpython(tmp: Path, config: PythonConfiguration, free_threadin
     with FileLock(str(installation_path) + ".lock"):
         if not installation_path.exists():
             downloaded_tar_gz = tmp / ios_python_tar_gz
-            download(config.url, downloaded_tar_gz)
+            download(config.url, downloaded_tar_gz, sha256=config.sha256)
-            installation_path.mkdir(parents=True, exist_ok=True)
+            with remove_on_error(installation_path):
-            call("tar", "-C", installation_path, "-xf", downloaded_tar_gz)
+                installation_path.mkdir(parents=True)
+                call("tar", "-C", installation_path, "-xf", downloaded_tar_gz)
             downloaded_tar_gz.unlink()
 
     return installation_path
@@ -178,18 +203,37 @@ def cross_virtualenv(
     )
 
     # Convert the macOS virtual environment into an iOS virtual environment
-    # using the cross-platform conversion script in the iOS distribution.
+    # using make_cross_venv.py.
 
     # target_python is the path to the Python binary;
     # determine the root of the XCframework slice that is being used.
     slice_path = target_python.parent.parent
-    call(
+    if Version(py_version) >= Version("3.15"):
-        "python",
+        # python.org 3.15+ distributions: sysconfig data lives in the
-        str(slice_path / f"platform-config/{multiarch}/make_cross_venv.py"),
+        # stdlib directory (lib-<arch>/python<version>); cross-venv scripts
-        str(venv_path),
+        # come from cibuildwheel resources.
-        env=env,
+        arch = multiarch.split("-", maxsplit=1)[0]
-        cwd=venv_path,
+        stdlib_path = slice_path / f"lib-{arch}" / f"python{py_version}"
-    )
+        call(
+            "python",
+            str(resources.IOS_SUPPORT_FILES / "make_cross_venv.py"),
+            str(venv_path),
+            str(stdlib_path),
+            str(resources.IOS_SUPPORT_FILES),
+            env=env,
+            cwd=venv_path,
+        )
+    else:
+        # BeeWare distributions: platform-config already contains both
+        # sysconfig data and the make_cross_venv.py script.
+        platform_config_path = slice_path / f"platform-config/{multiarch}"
+        call(
+            "python",
+            str(platform_config_path / "make_cross_venv.py"),
+            str(venv_path),
+            env=env,
+            cwd=venv_path,
+        )
 
     # When running on macOS, it's easy for the build environment to leak into
     # the target environment, especially when building for ARM64 (because the
@@ -288,6 +332,7 @@ def setup_python(
             python_configuration.version,
             python_configuration.build_url,
             free_threading,
+            python_configuration.build_sha256,
         )
     else:
         msg = f"Unknown Python implementation: {implementation_id}"
@@ -307,8 +352,8 @@ def setup_python(
         / f"python{python_configuration.version}"
     )
 
-    assert target_python.exists(), (
+    assert target_python.parent.exists(), (
-        f"{target_python.name} not found, has {list(target_install_path.iterdir())}"
+        f"{target_python.parent} not found, has {list(target_install_path.iterdir())}"
     )
 
     log.step("Creating cross build environment...")
@@ -451,6 +496,7 @@ def build(options: Options, tmp_path: Path) -> None:
                 build_frontend=build_frontend.name,
                 xbuild_tools=build_options.xbuild_tools,
             )
+            env["CIBUILDWHEEL_BUILD_IDENTIFIER"] = config.identifier
 
             compatible_wheel = find_compatible_wheel(built_wheels, config.identifier)
             if compatible_wheel:
@@ -477,8 +523,11 @@ def build(options: Options, tmp_path: Path) -> None:
                 extra_flags = get_build_frontend_extra_flags(
                     build_frontend,
                     build_options.build_verbosity,
-                    build_options.config_settings,
+                    prepare_config_settings(
-                    py38=False,
+                        build_options.config_settings,
+                        project=".",
+                        package=build_options.package_dir,
+                    ),
                 )
 
                 match build_frontend.name:
@@ -539,10 +588,12 @@ def build(options: Options, tmp_path: Path) -> None:
                 if repaired_wheel.name in {wheel.name for wheel in built_wheels}:
                     raise errors.AlreadyBuiltWheelError(repaired_wheel.name)
 
-                test_wheel = repaired_wheel
-
                 log.step_end()
 
+                run_audit(tmp_dir=tmp_path, build_options=build_options, wheel=repaired_wheel)
+
+                test_wheel = repaired_wheel
+
             if build_options.test_command and build_options.test_selector(config.identifier):
                 if not config.is_simulator:
                     log.step("Skipping tests on non-simulator SDK")

cibuildwheel/platforms/linux.py

@@ -1,26 +1,32 @@
+from __future__ import annotations
+
 import contextlib
 import dataclasses
+import shutil
 import subprocess
 import sys
 import textwrap
 from collections import OrderedDict
-from collections.abc import Iterable, Iterator, Sequence, Set
 from pathlib import Path, PurePath, PurePosixPath
-from typing import TYPE_CHECKING, assert_never
+from typing import assert_never
 
 from cibuildwheel import errors
 from cibuildwheel.architecture import Architecture
-from cibuildwheel.frontend import get_build_frontend_extra_flags
+from cibuildwheel.audit import needs_audit, run_audit
+from cibuildwheel.frontend import get_build_frontend_extra_flags, prepare_config_settings
 from cibuildwheel.logger import log
 from cibuildwheel.oci_container import OCIContainer, OCIContainerEngineConfig, OCIPlatform
-from cibuildwheel.options import BuildOptions, Options
-from cibuildwheel.selector import BuildSelector
 from cibuildwheel.util import resources
 from cibuildwheel.util.file import copy_test_sources
 from cibuildwheel.util.helpers import prepare_command, unwrap
 from cibuildwheel.util.packaging import find_compatible_wheel
 
+TYPE_CHECKING = False
 if TYPE_CHECKING:
+    from collections.abc import Iterable, Iterator, Sequence, Set
+
+    from cibuildwheel.options import BuildOptions, Options
+    from cibuildwheel.selector import BuildSelector
     from cibuildwheel.typing import PathOrStr
 
 ARCHITECTURE_OCI_PLATFORM_MAP = {
@@ -231,6 +237,7 @@ def build_in_container(
         env["PATH"] = f"{python_bin}:{env['PATH']}"
 
         env = build_options.environment.as_dictionary(env, executor=container.environment_executor)
+        env["CIBUILDWHEEL_BUILD_IDENTIFIER"] = config.identifier
 
         # check config python is still on PATH
         which_python = container.call(["which", "python"], env=env, capture_output=True).strip()
@@ -265,7 +272,16 @@ def build_in_container(
                     project=container_project_path,
                     package=container_package_dir,
                 )
-                container.call(["sh", "-c", before_build_prepared], env=env)
+                before_build_env = env.copy()
+                if use_uv:
+                    # On Linux, no virtualenv is created for the build environment
+                    # (unlike macOS/Windows, where one is set up before before_build
+                    # runs). uv requires either an active venv or an explicit Python
+                    # target to install packages. Pin UV_PYTHON to the exact interpreter
+                    # for this build so that `uv pip install` works in before_build
+                    # without requiring users to pass --system.
+                    before_build_env["UV_PYTHON"] = str(python_bin / "python")
+                container.call(["sh", "-c", before_build_prepared], env=before_build_env)
 
             log.step("Building wheel...")
 
@@ -277,8 +293,11 @@ def build_in_container(
             extra_flags = get_build_frontend_extra_flags(
                 build_frontend,
                 build_options.build_verbosity,
-                build_options.config_settings,
+                prepare_config_settings(
-                py38=config.identifier[1:].startswith("p38"),
+                    build_options.config_settings,
+                    project=container_project_path,
+                    package=container_package_dir,
+                ),
             )
 
             match build_frontend.name:
@@ -360,6 +379,18 @@ def build_in_container(
             if repaired_wheel.name in {wheel.name for wheel in built_wheels}:
                 raise errors.AlreadyBuiltWheelError(repaired_wheel.name)
 
+            log.step_end()
+
+            if needs_audit(build_options.audit_command, repaired_wheel.name):
+                local_abi3audit_dir = local_identifier_tmp_dir / "audit"
+                local_abi3audit_dir.mkdir(parents=True, exist_ok=True)
+                try:
+                    container.copy_out(repaired_wheel_dir, local_abi3audit_dir)
+                    local_wheel = local_abi3audit_dir / repaired_wheel.name
+                    run_audit(tmp_dir=local_tmp_dir, build_options=build_options, wheel=local_wheel)
+                finally:
+                    shutil.rmtree(local_abi3audit_dir, ignore_errors=True)
+
         if build_options.test_command and build_options.test_selector(config.identifier):
             log.step("Testing wheel...")
 
@@ -462,7 +493,7 @@ def build(options: Options, tmp_path: Path) -> None:
     abs_package_dir = options.globals.package_dir.resolve()
     if cwd != abs_package_dir and cwd not in abs_package_dir.parents:
         msg = "package_dir must be inside the working directory"
-        raise Exception(msg)
+        raise errors.ConfigurationError(msg)
 
     container_project_path = PurePosixPath("/project")
     container_package_dir = container_project_path / abs_package_dir.relative_to(cwd)

cibuildwheel/platforms/macos.py

@@ -1,3 +1,5 @@
+from __future__ import annotations
+
 import dataclasses
 import functools
 import inspect
@@ -8,27 +10,43 @@ import shutil
 import subprocess
 import sys
 import typing
-from collections.abc import Set
 from pathlib import Path
-from typing import Literal, assert_never
+from typing import assert_never
 
 from filelock import FileLock
 from packaging.version import Version
 
 from cibuildwheel import errors
-from cibuildwheel.architecture import Architecture
+from cibuildwheel.audit import run_audit
 from cibuildwheel.ci import detect_ci_provider
-from cibuildwheel.environment import ParsedEnvironment
+from cibuildwheel.frontend import (
-from cibuildwheel.frontend import BuildFrontendName, get_build_frontend_extra_flags
+    BuildFrontendName,
+    get_build_frontend_extra_flags,
+    prepare_config_settings,
+)
 from cibuildwheel.logger import log
-from cibuildwheel.options import Options
-from cibuildwheel.selector import BuildSelector
 from cibuildwheel.util import resources
 from cibuildwheel.util.cmd import call, shell
-from cibuildwheel.util.file import CIBW_CACHE_PATH, copy_test_sources, download, move_file
+from cibuildwheel.util.file import (
+    CIBW_CACHE_PATH,
+    copy_test_sources,
+    download,
+    move_file,
+    remove_on_error,
+)
 from cibuildwheel.util.helpers import prepare_command, unwrap
 from cibuildwheel.util.packaging import find_compatible_wheel, get_pip_version
-from cibuildwheel.venv import constraint_flags, find_uv, virtualenv
+from cibuildwheel.venv import constraint_flags, find_uv, target_marker_env, virtualenv
+
+TYPE_CHECKING = False
+if TYPE_CHECKING:
+    from collections.abc import Set
+    from typing import Literal
+
+    from cibuildwheel.architecture import Architecture
+    from cibuildwheel.environment import ParsedEnvironment
+    from cibuildwheel.options import Options
+    from cibuildwheel.selector import BuildSelector
 
 
 @functools.cache
@@ -76,6 +94,7 @@ class PythonConfiguration:
     version: str
     identifier: str
     url: str
+    sha256: str
 
 
 def all_python_configurations() -> list[PythonConfiguration]:
@@ -123,7 +142,7 @@ def get_python_configurations(
     return python_configurations
 
 
-def install_cpython(_tmp: Path, version: str, url: str, free_threading: bool) -> Path:
+def install_cpython(_tmp: Path, version: str, url: str, free_threading: bool, sha256: str) -> Path:
     ft = "T" if free_threading else ""
     installation_path = Path(f"/Library/Frameworks/Python{ft}.framework/Versions/{version}")
     with FileLock(CIBW_CACHE_PATH / f"cpython{version}.lock"):
@@ -149,13 +168,12 @@ def install_cpython(_tmp: Path, version: str, url: str, free_threading: bool) ->
             python_filename = url.rsplit("/", maxsplit=1)[-1]
             pkg_path = CIBW_CACHE_PATH / "cpython-installer" / python_filename
             if not pkg_path.exists():
-                download(url, pkg_path)
+                download(url, pkg_path, sha256=sha256)
             args = []
-            if version.startswith("3.13"):
+            if version.startswith("3.14"):
-                # Python 3.13 is the first version to have a free-threading option
-                args += ["-applyChoiceChangesXML", str(resources.FREE_THREAD_ENABLE_313.resolve())]
-            elif version.startswith("3.14"):
                 args += ["-applyChoiceChangesXML", str(resources.FREE_THREAD_ENABLE_314.resolve())]
+            elif version.startswith("3.15"):
+                args += ["-applyChoiceChangesXML", str(resources.FREE_THREAD_ENABLE_315.resolve())]
             call("sudo", "installer", "-pkg", pkg_path, *args, "-target", "/")
             pkg_path.unlink()
             env = os.environ.copy()
@@ -174,7 +192,7 @@ def install_cpython(_tmp: Path, version: str, url: str, free_threading: bool) ->
     return installation_path / "bin" / (f"python{version}t" if free_threading else "python3")
 
 
-def install_pypy(tmp: Path, url: str) -> Path:
+def install_pypy(tmp: Path, url: str, sha256: str) -> Path:
     pypy_tar_bz2 = url.rsplit("/", 1)[-1]
     extension = ".tar.bz2"
     assert pypy_tar_bz2.endswith(extension)
@@ -182,14 +200,15 @@ def install_pypy(tmp: Path, url: str) -> Path:
     with FileLock(str(installation_path) + ".lock"):
         if not installation_path.exists():
             downloaded_tar_bz2 = tmp / pypy_tar_bz2
-            download(url, downloaded_tar_bz2)
+            download(url, downloaded_tar_bz2, sha256=sha256)
             installation_path.parent.mkdir(parents=True, exist_ok=True)
-            call("tar", "-C", installation_path.parent, "-xf", downloaded_tar_bz2)
+            with remove_on_error(installation_path):
+                call("tar", "-C", installation_path.parent, "-xf", downloaded_tar_bz2)
             downloaded_tar_bz2.unlink()
     return installation_path / "bin" / "pypy3"
 
 
-def install_graalpy(tmp: Path, url: str) -> Path:
+def install_graalpy(tmp: Path, url: str, sha256: str) -> Path:
     graalpy_archive = url.rsplit("/", 1)[-1]
     extension = ".tar.gz"
     assert graalpy_archive.endswith(extension)
@@ -197,10 +216,18 @@ def install_graalpy(tmp: Path, url: str) -> Path:
     with FileLock(str(installation_path) + ".lock"):
         if not installation_path.exists():
             downloaded_archive = tmp / graalpy_archive
-            download(url, downloaded_archive)
+            download(url, downloaded_archive, sha256=sha256)
-            installation_path.mkdir(parents=True)
+            with remove_on_error(installation_path):
-            # GraalPy top-folder name is inconsistent with archive name
+                installation_path.mkdir(parents=True)
-            call("tar", "-C", installation_path, "--strip-components=1", "-xzf", downloaded_archive)
+                # GraalPy top-folder name is inconsistent with archive name
+                call(
+                    "tar",
+                    "-C",
+                    installation_path,
+                    "--strip-components=1",
+                    "-xzf",
+                    downloaded_archive,
+                )
             downloaded_archive.unlink()
     return installation_path / "bin" / "graalpy"
 
@@ -221,13 +248,17 @@ def setup_python(
     if implementation_id.startswith("cp"):
         free_threading = "t-macos" in python_configuration.identifier
         base_python = install_cpython(
-            tmp, python_configuration.version, python_configuration.url, free_threading
+            tmp,
+            python_configuration.version,
+            python_configuration.url,
+            free_threading,
+            python_configuration.sha256,
         )
 
     elif implementation_id.startswith("pp"):
-        base_python = install_pypy(tmp, python_configuration.url)
+        base_python = install_pypy(tmp, python_configuration.url, python_configuration.sha256)
     elif implementation_id.startswith("gp"):
-        base_python = install_graalpy(tmp, python_configuration.url)
+        base_python = install_graalpy(tmp, python_configuration.url, python_configuration.sha256)
     else:
         msg = "Unknown Python implementation"
         raise ValueError(msg)
@@ -243,6 +274,7 @@ def setup_python(
         venv_path,
         dependency_constraint,
         use_uv=use_uv,
+        marker_env=target_marker_env(implementation_id=implementation_id),
     )
     venv_bin_path = venv_path / "bin"
     assert venv_bin_path.exists()
@@ -454,6 +486,7 @@ def build(options: Options, tmp_path: Path) -> None:
                 build_options.environment,
                 build_frontend.name,
             )
+            env["CIBUILDWHEEL_BUILD_IDENTIFIER"] = config.identifier
             pip_version = None if use_uv else get_pip_version(env)
 
             compatible_wheel = find_compatible_wheel(built_wheels, config.identifier)
@@ -477,8 +510,11 @@ def build(options: Options, tmp_path: Path) -> None:
                 extra_flags = get_build_frontend_extra_flags(
                     build_frontend,
                     build_options.build_verbosity,
-                    build_options.config_settings,
+                    prepare_config_settings(
-                    py38=config.identifier[1:].startswith("p38"),
+                        build_options.config_settings,
+                        project=".",
+                        package=build_options.package_dir,
+                    ),
                 )
 
                 build_env = env.copy()
@@ -569,15 +605,10 @@ def build(options: Options, tmp_path: Path) -> None:
 
                 log.step_end()
 
+                run_audit(tmp_dir=tmp_path, build_options=build_options, wheel=repaired_wheel)
+
             if build_options.test_command and build_options.test_selector(config.identifier):
                 machine_arch = platform.machine()
-                python_arch = call(
-                    "python",
-                    "-sSc",
-                    "import platform; print(platform.machine())",
-                    env=env,
-                    capture_stdout=True,
-                ).strip()
                 testing_archs: list[Literal["x86_64", "arm64"]]
 
                 if config_is_arm64:
@@ -625,24 +656,6 @@ def build(options: Options, tmp_path: Path) -> None:
                         # skip this test
                         continue
 
-                    is_cp38 = config.identifier.startswith("cp38-")
-                    if testing_arch == "arm64" and is_cp38 and python_arch != "arm64":
-                        log.warning(
-                            unwrap(
-                                """
-                                While cibuildwheel can build CPython 3.8 universal2/arm64 wheels, we
-                                cannot test the arm64 part of them, even when running on an Apple
-                                Silicon machine. This is because we use the x86_64 installer of
-                                CPython 3.8. See the discussion in
-                                https://github.com/pypa/cibuildwheel/pull/1169 for the details. To
-                                silence this warning, set `CIBW_TEST_SKIP: "cp38-macosx_*:arm64"`.
-                                """
-                            )
-                        )
-
-                        # skip this test
-                        continue
-
                     log.step(
                         "Testing wheel..."
                         if testing_arch == machine_arch
@@ -699,33 +712,16 @@ def build(options: Options, tmp_path: Path) -> None:
                         shell_with_arch(before_test_prepared, env=virtualenv_env)
 
                     # install the wheel
-                    if is_cp38 and python_arch == "x86_64":
-                        virtualenv_env_install_wheel = virtualenv_env.copy()
-                        virtualenv_env_install_wheel["SYSTEM_VERSION_COMPAT"] = "0"
-                        log.notice(
-                            unwrap(
-                                """
-                                Setting SYSTEM_VERSION_COMPAT=0 to ensure CPython 3.8 can get
-                                correct macOS version and allow installation of wheels with
-                                MACOSX_DEPLOYMENT_TARGET >= 11.0.
-                                See https://github.com/pypa/cibuildwheel/issues/1767 for the
-                                details.
-                                """
-                            )
-                        )
-                    else:
-                        virtualenv_env_install_wheel = virtualenv_env
-
                     pip_install(
                         f"{repaired_wheel}{build_options.test_extras}",
-                        env=virtualenv_env_install_wheel,
+                        env=virtualenv_env,
                     )
 
                     # test the wheel
                     if build_options.test_requires:
                         pip_install(
                             *build_options.test_requires,
-                            env=virtualenv_env_install_wheel,
+                            env=virtualenv_env,
                         )
 
                     # run the tests from a temp dir, with an absolute path in the command

cibuildwheel/platforms/pyodide.py

@@ -1,3 +1,5 @@
+from __future__ import annotations
+
 import dataclasses
 import functools
 import json
@@ -7,7 +9,6 @@ import subprocess
 import sys
 import tomllib
 import typing
-from collections.abc import Set
 from pathlib import Path
 from tempfile import TemporaryDirectory
 from typing import Final, TypedDict
@@ -16,11 +17,9 @@ from filelock import FileLock
 
 from cibuildwheel import errors
 from cibuildwheel.architecture import Architecture
-from cibuildwheel.environment import ParsedEnvironment
+from cibuildwheel.audit import run_audit
-from cibuildwheel.frontend import get_build_frontend_extra_flags
+from cibuildwheel.frontend import get_build_frontend_extra_flags, prepare_config_settings
 from cibuildwheel.logger import log
-from cibuildwheel.options import Options
-from cibuildwheel.selector import BuildSelector
 from cibuildwheel.util import resources
 from cibuildwheel.util.cmd import call, shell
 from cibuildwheel.util.file import (
@@ -30,6 +29,7 @@ from cibuildwheel.util.file import (
     extract_tar,
     extract_zip,
     move_file,
+    remove_on_error,
 )
 from cibuildwheel.util.helpers import prepare_command, unwrap, unwrap_preserving_paragraphs
 from cibuildwheel.util.packaging import find_compatible_wheel, get_pip_version
@@ -39,6 +39,14 @@ from cibuildwheel.util.python_build_standalone import (
 )
 from cibuildwheel.venv import constraint_flags, virtualenv
 
+TYPE_CHECKING = False
+if TYPE_CHECKING:
+    from collections.abc import Set
+
+    from cibuildwheel.environment import ParsedEnvironment
+    from cibuildwheel.options import Options
+    from cibuildwheel.selector import BuildSelector
+
 IS_WIN: Final[bool] = sys.platform.startswith("win")
 
 
@@ -48,6 +56,7 @@ class PythonConfiguration:
     identifier: str
     default_pyodide_version: str
     node_version: str
+    sha256: str = ""
 
 
 class PyodideXBuildEnvInfoVersionRange(TypedDict):
@@ -84,39 +93,40 @@ def ensure_node(major_version: str) -> Path:
             with TemporaryDirectory() as tmp_path:
                 archive = Path(tmp_path) / f"{name}.{ext}"
                 download(url, archive)
-                if ext == "zip":
+                with remove_on_error(path):
-                    extract_zip(archive, path.parent)
+                    if ext == "zip":
-                else:
+                        extract_zip(archive, path.parent)
-                    extract_tar(archive, path.parent)
+                    else:
+                        extract_tar(archive, path.parent)
     assert path.exists()
     if not IS_WIN:
         return path / "bin"
     return path
 
 
-def install_emscripten(
+def install_emscripten(env: dict[str, str], version: str, xbuildenv_cache_path: Path) -> Path:
-    env: dict[str, str], version: str, xbuildenv_cache_path: Path, pyodide_version: str
-) -> Path:
     """Install Emscripten via pyodide-build, which also applies Pyodide-specific patches."""
-    emcc_path = (
+    emscripten_dir = Path(
-        xbuildenv_cache_path / pyodide_version / "emsdk" / "upstream" / "emscripten" / "emcc"
+        call("pyodide", "config", "get", "emscripten_dir", env=env, capture_stdout=True).strip()
     )
     with FileLock(CIBW_CACHE_PATH / "emscripten.lock"):
-        if emcc_path.exists():
+        if emscripten_dir.exists():
-            return emcc_path
+            return emscripten_dir
-        call(
+        with remove_on_error(emscripten_dir):
-            "pyodide",
+            call(
-            "xbuildenv",
+                "pyodide",
-            "install-emscripten",
+                "xbuildenv",
-            "--version",
+                "install-emscripten",
-            version,
+                "--force",
-            "--path",
+                "--version",
-            str(xbuildenv_cache_path),
+                version,
-            env=env,
+                "--path",
-            cwd=CIBW_CACHE_PATH,
+                str(xbuildenv_cache_path),
-        )
+                env=env,
-    assert emcc_path.exists()
+                cwd=CIBW_CACHE_PATH,
-    return emcc_path
+            )
+    assert emscripten_dir.exists()
+    return emscripten_dir
 
 
 def get_all_xbuildenv_version_info(env: dict[str, str]) -> list[PyodideXBuildEnvInfo]:
@@ -201,17 +211,18 @@ def install_xbuildenv(env: dict[str, str], xbuildenv_cache_path: Path, pyodide_v
         env.pop("PYODIDE_ROOT", None)
 
         # Install the xbuildenv
-        call(
+        with remove_on_error(xbuildenv_cache_path / pyodide_version):
-            "pyodide",
+            call(
-            "xbuildenv",
+                "pyodide",
-            "install",
+                "xbuildenv",
-            "--path",
+                "install",
-            str(xbuildenv_cache_path),
+                "--path",
-            pyodide_version,
+                str(xbuildenv_cache_path),
-            env=env,
+                pyodide_version,
-            cwd=CIBW_CACHE_PATH,
+                env=env,
-        )
+                cwd=CIBW_CACHE_PATH,
-        assert pyodide_root.exists()
+            )
+            assert pyodide_root.exists()
 
     return str(pyodide_root)
 
@@ -315,9 +326,9 @@ def setup_python(
     log.step(
         f"Installing Emscripten {emscripten_version} and applying Pyodide-specific patches ..."
     )
-    emcc_path = install_emscripten(env, emscripten_version, xbuildenv_cache_path, pyodide_version)
+    emscripten_dir = install_emscripten(env, emscripten_version, xbuildenv_cache_path)
 
-    env["PATH"] = os.pathsep.join([str(emcc_path.parent), env["PATH"]])
+    env["PATH"] = os.pathsep.join([str(emscripten_dir), env["PATH"]])
 
     return env
 
@@ -385,6 +396,7 @@ def build(options: Options, tmp_path: Path) -> None:
                 environment=build_options.environment,
                 user_pyodide_version=build_options.pyodide_version,
             )
+            env["CIBUILDWHEEL_BUILD_IDENTIFIER"] = config.identifier
             pip_version = get_pip_version(env)
             # The Pyodide command line runner mounts all directories in the host
             # filesystem into the Pyodide file system, except for the custom
@@ -424,8 +436,11 @@ def build(options: Options, tmp_path: Path) -> None:
                 extra_flags = get_build_frontend_extra_flags(
                     build_frontend,
                     build_options.build_verbosity,
-                    build_options.config_settings,
+                    prepare_config_settings(
-                    py38=False,
+                        build_options.config_settings,
+                        project=".",
+                        package=build_options.package_dir,
+                    ),
                 )
 
                 call(
@@ -461,6 +476,8 @@ def build(options: Options, tmp_path: Path) -> None:
                 if repaired_wheel.name in {wheel.name for wheel in built_wheels}:
                     raise errors.AlreadyBuiltWheelError(repaired_wheel.name)
 
+                run_audit(tmp_dir=tmp_path, build_options=build_options, wheel=repaired_wheel)
+
             if build_options.test_command and build_options.test_selector(config.identifier):
                 log.step("Testing wheel...")
 

cibuildwheel/platforms/windows.py

@@ -1,11 +1,11 @@
+from __future__ import annotations
+
 import dataclasses
-import json
 import os
 import platform as platform_module
 import shutil
 import subprocess
 import textwrap
-from collections.abc import MutableMapping, Sequence, Set
 from functools import cache
 from pathlib import Path
 from typing import assert_never
@@ -14,11 +14,13 @@ from filelock import FileLock
 
 from cibuildwheel import errors
 from cibuildwheel.architecture import Architecture
-from cibuildwheel.environment import ParsedEnvironment
+from cibuildwheel.audit import run_audit
-from cibuildwheel.frontend import BuildFrontendName, get_build_frontend_extra_flags
+from cibuildwheel.frontend import (
+    BuildFrontendName,
+    get_build_frontend_extra_flags,
+    prepare_config_settings,
+)
 from cibuildwheel.logger import log
-from cibuildwheel.options import Options
-from cibuildwheel.selector import BuildSelector
 from cibuildwheel.util import resources
 from cibuildwheel.util.cmd import call, shell
 from cibuildwheel.util.file import (
@@ -27,10 +29,19 @@ from cibuildwheel.util.file import (
     download,
     extract_zip,
     move_file,
+    remove_on_error,
 )
 from cibuildwheel.util.helpers import prepare_command, unwrap
 from cibuildwheel.util.packaging import find_compatible_wheel, get_pip_version
-from cibuildwheel.venv import constraint_flags, find_uv, virtualenv
+from cibuildwheel.venv import constraint_flags, find_uv, target_marker_env, virtualenv
+
+TYPE_CHECKING = False
+if TYPE_CHECKING:
+    from collections.abc import MutableMapping, Sequence, Set
+
+    from cibuildwheel.environment import ParsedEnvironment
+    from cibuildwheel.options import Options
+    from cibuildwheel.selector import BuildSelector
 
 
 def get_nuget_args(
@@ -62,6 +73,7 @@ class PythonConfiguration:
     version: str
     identifier: str
     url: str | None = None
+    sha256: str = ""
 
     @property
     def arch(self) -> str:
@@ -100,7 +112,8 @@ def _ensure_nuget() -> Path:
     nuget = CIBW_CACHE_PATH / "nuget.exe"
     with FileLock(str(nuget) + ".lock"):
         if not nuget.exists():
-            download("https://dist.nuget.org/win-x86-commandline/latest/nuget.exe", nuget)
+            with remove_on_error(nuget):
+                download("https://dist.nuget.org/win-x86-commandline/latest/nuget.exe", nuget)
     return nuget
 
 
@@ -116,11 +129,12 @@ def install_cpython(configuration: PythonConfiguration, arch: str | None = None)
     with FileLock(str(base_output_dir) + f"-{version}{free_threaded_str}-{arch}.lock"):
         if not installation_path.exists():
             nuget = _ensure_nuget()
-            call(nuget, "install", *nuget_args)
+            with remove_on_error(installation_path.parent):
+                call(nuget, "install", *nuget_args)
     return installation_path / "python.exe"
 
 
-def install_pypy(tmp: Path, arch: str, url: str) -> Path:
+def install_pypy(tmp: Path, arch: str, url: str, sha256: str) -> Path:
     assert arch == "64"
     assert "win64" in url
     # Inside the PyPy zip file is a directory with the same name
@@ -131,13 +145,14 @@ def install_pypy(tmp: Path, arch: str, url: str) -> Path:
     with FileLock(str(installation_path) + ".lock"):
         if not installation_path.exists():
             pypy_zip = tmp / zip_filename
-            download(url, pypy_zip)
+            download(url, pypy_zip, sha256=sha256)
-            # Extract to the parent directory because the zip file still contains a directory
+            with remove_on_error(installation_path):
-            extract_zip(pypy_zip, installation_path.parent)
+                # Extract to the parent directory because the zip file still contains a directory
+                extract_zip(pypy_zip, installation_path.parent)
     return installation_path / "python.exe"
 
 
-def install_graalpy(tmp: Path, url: str) -> Path:
+def install_graalpy(tmp: Path, url: str, sha256: str) -> Path:
     zip_filename = url.rsplit("/", 1)[-1]
     extension = ".zip"
     assert zip_filename.endswith(extension)
@@ -145,9 +160,10 @@ def install_graalpy(tmp: Path, url: str) -> Path:
     with FileLock(str(installation_path) + ".lock"):
         if not installation_path.exists():
             graalpy_zip = tmp / zip_filename
-            download(url, graalpy_zip)
+            download(url, graalpy_zip, sha256=sha256)
-            # Extract to the parent directory because the zip file still contains a directory
+            with remove_on_error(installation_path):
-            extract_zip(graalpy_zip, installation_path.parent)
+                # Extract to the parent directory because the zip file still contains a directory
+                extract_zip(graalpy_zip, installation_path.parent)
     return installation_path / "bin" / "graalpy.exe"
 
 
@@ -238,11 +254,6 @@ def setup_rust_cross_compile(
         )
 
 
-def can_use_uv(python_configuration: PythonConfiguration) -> bool:
-    conditions = (not python_configuration.identifier.startswith("pp38-"),)
-    return all(conditions)
-
-
 def setup_python(
     tmp: Path,
     python_configuration: PythonConfiguration,
@@ -266,17 +277,19 @@ def setup_python(
             base_python = install_cpython(python_configuration, arch=native_arch)
     elif implementation_id.startswith("pp"):
         assert python_configuration.url is not None
-        base_python = install_pypy(tmp, python_configuration.arch, python_configuration.url)
+        assert python_configuration.sha256
+        base_python = install_pypy(
+            tmp, python_configuration.arch, python_configuration.url, python_configuration.sha256
+        )
     elif implementation_id.startswith("gp"):
-        base_python = install_graalpy(tmp, python_configuration.url or "")
+        assert python_configuration.url is not None
+        assert python_configuration.sha256
+        base_python = install_graalpy(tmp, python_configuration.url, python_configuration.sha256)
     else:
         msg = "Unknown Python implementation"
         raise ValueError(msg)
     assert base_python.exists()
 
-    if build_frontend == "build[uv]" and not can_use_uv(python_configuration):
-        build_frontend = "build"
-
     use_uv = build_frontend in {"build[uv]", "uv"}
     uv_path = find_uv()
 
@@ -288,6 +301,7 @@ def setup_python(
         venv_path,
         dependency_constraint,
         use_uv=use_uv,
+        marker_env=target_marker_env(implementation_id=implementation_id),
     )
 
     # set up environment variables for run_with_env
@@ -321,12 +335,22 @@ def setup_python(
 
     log.step("Installing build tools...")
     match build_frontend:
+        case "pip":
+            call(
+                "pip",
+                "install",
+                "--upgrade",
+                "delvewheel",
+                *constraint_flags(dependency_constraint),
+                env=env,
+            )
         case "build":
             call(
                 "pip",
                 "install",
                 "--upgrade",
                 "build[virtualenv]",
+                "delvewheel",
                 *constraint_flags(dependency_constraint),
                 env=env,
             )
@@ -340,51 +364,31 @@ def setup_python(
                 where_python,
                 "--upgrade",
                 "build[virtualenv]",
+                "delvewheel",
                 *constraint_flags(dependency_constraint),
                 env=env,
             )
+        case "uv":
+            assert uv_path is not None
+            call(
+                uv_path,
+                "pip",
+                "install",
+                "--python",
+                where_python,
+                "--upgrade",
+                "delvewheel",
+                *constraint_flags(dependency_constraint),
+                env=env,
+            )
+        case _:
+            assert_never(build_frontend)
 
     if python_libs_base:
         # Set up the environment for various backends to enable cross-compilation
         setup_setuptools_cross_compile(tmp, python_configuration, python_libs_base, env)
         setup_rust_cross_compile(tmp, python_configuration, python_libs_base, env)
 
-    if implementation_id.startswith("gp311"):
-        # GraalPy 24 fails to discover compilers, setup the relevant environment
-        # variables. Adapted from
-        # https://github.com/microsoft/vswhere/wiki/Start-Developer-Command-Prompt
-        # Remove when GraalPy 24.x is dropped.
-        vcpath = call(
-            Path(os.environ["PROGRAMFILES(X86)"])
-            / "Microsoft Visual Studio"
-            / "Installer"
-            / "vswhere.exe",
-            "-products",
-            "*",
-            "-latest",
-            "-property",
-            "installationPath",
-            capture_stdout=True,
-        ).strip()
-        log.notice(f"Discovering Visual Studio for GraalPy at {vcpath}")
-        vcvars_file = tmp / "vcvars.json"
-        call(
-            f"{vcpath}\\Common7\\Tools\\vsdevcmd.bat",
-            "-no_logo",
-            "-arch=amd64",
-            "-host_arch=amd64",
-            "&&",
-            "python",
-            "-c",
-            # this command needs to be one line for Windows reasons
-            "import sys, json, pathlib, os; pathlib.Path(sys.argv[1]).write_text(json.dumps(dict(os.environ)))",
-            vcvars_file,
-            env=env,
-        )
-        with open(vcvars_file, encoding="utf-8") as f:
-            vcvars = json.load(f)
-        env.update(vcvars)
-
     return base_python, env
 
 
@@ -415,7 +419,7 @@ def build(options: Options, tmp_path: Path) -> None:
         for config in python_configurations:
             build_options = options.build_options(config.identifier)
             build_frontend = build_options.build_frontend
-            use_uv = build_frontend.name in {"build[uv]", "uv"} and can_use_uv(config)
+            use_uv = build_frontend.name in {"build[uv]", "uv"}
             log.build_start(config.identifier)
 
             identifier_tmp_dir = tmp_path / config.identifier
@@ -436,6 +440,7 @@ def build(options: Options, tmp_path: Path) -> None:
                 build_options.environment,
                 build_frontend.name,
             )
+            env["CIBUILDWHEEL_BUILD_IDENTIFIER"] = config.identifier
             pip_version = None if use_uv else get_pip_version(env)
 
             compatible_wheel = find_compatible_wheel(built_wheels, config.identifier)
@@ -462,26 +467,13 @@ def build(options: Options, tmp_path: Path) -> None:
                 extra_flags = get_build_frontend_extra_flags(
                     build_frontend,
                     build_options.build_verbosity,
-                    build_options.config_settings,
+                    prepare_config_settings(
-                    py38=config.identifier[1:].startswith("p38"),
+                        build_options.config_settings,
+                        project=".",
+                        package=options.globals.package_dir,
+                    ),
                 )
 
-                if (
-                    config.identifier.startswith("gp311")
-                    and build_frontend.name == "build"
-                    and "--no-isolation" not in extra_flags
-                    and "-n" not in extra_flags
-                ):
-                    # GraalPy 24 fails to discover its standard library when a venv is created
-                    # from a virtualenv seeded executable. See
-                    # https://github.com/oracle/graalpython/issues/491 and remove this once
-                    # GraalPy 24 is dropped.
-                    log.notice(
-                        "Disabling build isolation to workaround GraalPy bug. If the build fails, consider using pip or build[uv] as build frontend."
-                    )
-                    shell("graalpy -m pip install setuptools wheel", env=env)
-                    extra_flags = [*extra_flags, "-n"]
-
                 match build_frontend.name:
                     case "pip":
                         # Path.resolve() is needed. Without it pip wheel may try to fetch package from pypi.org
@@ -559,6 +551,8 @@ def build(options: Options, tmp_path: Path) -> None:
                 if repaired_wheel.name in {wheel.name for wheel in built_wheels}:
                     raise errors.AlreadyBuiltWheelError(repaired_wheel.name)
 
+                run_audit(tmp_dir=tmp_path, build_options=build_options, wheel=repaired_wheel)
+
             test_selected = options.globals.test_selector(config.identifier)
             if test_selected and config.arch == "ARM64" != platform_module.machine():
                 log.warning(

cibuildwheel/projectfiles.py

@@ -1,11 +1,16 @@
+from __future__ import annotations
+
 import ast
 import configparser
 import contextlib
-from pathlib import Path
-from typing import Any
 
 import dependency_groups
 
+TYPE_CHECKING = False
+if TYPE_CHECKING:
+    from pathlib import Path
+    from typing import Any
+
 
 def get_parent(node: ast.AST | None, depth: int = 1) -> ast.AST | None:
     for _ in range(depth):

cibuildwheel/resources/android/_cross_venv.py

@@ -14,6 +14,9 @@ def initialize() -> None:
     if not (host_triplet := os.environ.get("CIBW_HOST_TRIPLET")):
         return
 
+    # Pre-import any modules which would fail to import after the monkey-patching.
+    import ctypes  # noqa: F401, PLC0415 - uses get_config_var("LDLIBRARY")
+
     # os ######################################################################
     def cross_os_uname() -> os.uname_result:
         return os.uname_result(

cibuildwheel/resources/android/fortran_shim.py

@@ -0,0 +1,121 @@
+# This file intentionally has no hashbang line in the source: cibuildwheel will add it
+# above this comment when the file is deployed.
+
+import os
+import re
+import shutil
+import sys
+from pathlib import Path
+from tempfile import gettempdir
+
+from filelock import FileLock
+
+from cibuildwheel.util.file import CIBW_CACHE_PATH, download
+
+# In the future we might pick a different Flang release depending on the NDK version,
+# but so far all Python versions use the same NDK version, so there's no need.
+RELEASE_URL = "https://github.com/termux/ndk-toolchain-clang-with-flang/releases/download"
+RELEASE_VERSION = "r27c"
+ARCHS = ["aarch64", "x86_64"]
+
+# The compiler is built for Linux x86_64, so we use Docker on macOS.
+DOCKER_IMAGE = "debian:trixie-slim"
+
+
+def main() -> None:
+    cache_dir = CIBW_CACHE_PATH / f"flang-android-{RELEASE_VERSION}"
+    with FileLock(f"{cache_dir}.lock"):
+        if not cache_dir.exists():
+            download_flang(cache_dir)
+
+    run_flang(cache_dir)
+
+
+def download_flang(cache_dir: Path) -> None:
+    tmp_dir = Path(f"{cache_dir}.tmp")
+    if tmp_dir.exists():
+        shutil.rmtree(tmp_dir)
+    tmp_dir.mkdir(parents=True)
+
+    for archive_name in [f"package-flang-{arch}.tar.bz2" for arch in ARCHS] + [
+        "package-flang-host.tar.bz2",
+        "package-install.tar.bz2",
+    ]:
+        archive_path = tmp_dir / archive_name
+        download(f"{RELEASE_URL}/{RELEASE_VERSION}/{archive_name}", archive_path)
+        shutil.unpack_archive(archive_path, tmp_dir)
+        archive_path.unlink()
+
+    # Merge the extracted trees together, along with the necessary parts of the NDK. Based on
+    # https://github.com/kivy/python-for-android/blob/develop/pythonforandroid/recipes/fortran/__init__.py.
+    flang_toolchain = tmp_dir / "toolchain"
+    (tmp_dir / "out/install/linux-x86/clang-dev").rename(flang_toolchain)
+
+    ndk_toolchain = Path(os.environ["CC"]).parents[1]
+    if (clang_ver_flang := clang_ver(flang_toolchain)) != (
+        clang_ver_ndk := clang_ver(ndk_toolchain)
+    ):
+        msg = f"Flang uses Clang {clang_ver_flang}, but NDK uses Clang {clang_ver_ndk}"
+        raise ValueError(msg)
+
+    clang_lib_path = f"lib/clang/{clang_ver_ndk}/lib"
+    shutil.rmtree(flang_toolchain / clang_lib_path)
+
+    for src, dst in [
+        (f"{tmp_dir}/build-{arch}-install", f"sysroot/usr/lib/{arch}-linux-android")
+        for arch in ARCHS
+    ] + [
+        (f"{tmp_dir}/build-host-install", ""),
+        (f"{ndk_toolchain}/{clang_lib_path}", clang_lib_path),
+        (f"{ndk_toolchain}/sysroot", "sysroot"),
+    ]:
+        shutil.copytree(src, flang_toolchain / dst, symlinks=True, dirs_exist_ok=True)
+
+    flang_toolchain.rename(cache_dir)
+    shutil.rmtree(tmp_dir)
+
+
+def clang_ver(toolchain: Path) -> str:
+    versions = [p.name for p in (toolchain / "lib/clang").iterdir()]
+    assert len(versions) == 1
+    return versions[0]
+
+
+def run_flang(cache_dir: Path) -> None:
+    match = re.fullmatch(r".+/(.+)-clang", os.environ["CC"])
+    assert match is not None
+    target = match[1]
+
+    # In a future Flang version the executable name will change to "flang"
+    # (https://blog.llvm.org/posts/2025-03-11-flang-new/).
+    flang_args = [f"{cache_dir}/bin/flang-new", f"--target={target}", *sys.argv[1:]]
+
+    if sys.platform == "linux":
+        args = flang_args
+    elif sys.platform == "darwin":
+        args = ["docker", "run", "--rm", "--platform", "linux/amd64"]
+        # Docker on macOS only allows certain directories to be mounted as volumes
+        # by default, but they include all the locations we're likely to need.
+        for path in [
+            # Location of CIBW_CACHE_PATH (containing the Fortran compiler), and
+            # probably the project directory.
+            Path.home(),
+            # Temporary directories created by build backends and cibuildwheel itself.
+            # This is controlled by the TMPDIR environment variable, which is set to
+            # an unpredictable subdirectory of /var/folders. /var is itself a symlink
+            # to /private/var.
+            Path(gettempdir()),
+            Path(gettempdir()).resolve(),
+        ]:
+            args += ["-v", f"{path}:{path}"]
+        args += ["--workdir", str(Path.cwd())]
+        args += ["--entrypoint", flang_args[0], DOCKER_IMAGE, *flang_args[1:]]
+    else:
+        msg = f"unknown platform: {sys.platform}"
+        raise ValueError(msg)
+
+    os.execvp(args[0], args)
+
+
+if __name__ == "__main__":
+    main()

cibuildwheel/resources/build-platforms.toml

@@ -1,196 +1,185 @@
 [linux]
 python_configurations = [
-  { identifier = "cp38-manylinux_x86_64", version = "3.8", path_str = "/opt/python/cp38-cp38" },
   { identifier = "cp39-manylinux_x86_64", version = "3.9", path_str = "/opt/python/cp39-cp39" },
   { identifier = "cp310-manylinux_x86_64", version = "3.10", path_str = "/opt/python/cp310-cp310" },
   { identifier = "cp311-manylinux_x86_64", version = "3.11", path_str = "/opt/python/cp311-cp311" },
   { identifier = "cp312-manylinux_x86_64", version = "3.12", path_str = "/opt/python/cp312-cp312" },
   { identifier = "cp313-manylinux_x86_64", version = "3.13", path_str = "/opt/python/cp313-cp313" },
-  { identifier = "cp313t-manylinux_x86_64", version = "3.13", path_str = "/opt/python/cp313-cp313t" },
   { identifier = "cp314-manylinux_x86_64", version = "3.14", path_str = "/opt/python/cp314-cp314" },
   { identifier = "cp314t-manylinux_x86_64", version = "3.14", path_str = "/opt/python/cp314-cp314t" },
-  { identifier = "cp38-manylinux_i686", version = "3.8", path_str = "/opt/python/cp38-cp38" },
+  { identifier = "cp315-manylinux_x86_64", version = "3.15", path_str = "/opt/python/cp315-cp315" },
+  { identifier = "cp315t-manylinux_x86_64", version = "3.15", path_str = "/opt/python/cp315-cp315t" },
   { identifier = "cp39-manylinux_i686", version = "3.9", path_str = "/opt/python/cp39-cp39" },
   { identifier = "cp310-manylinux_i686", version = "3.10", path_str = "/opt/python/cp310-cp310" },
   { identifier = "cp311-manylinux_i686", version = "3.11", path_str = "/opt/python/cp311-cp311" },
   { identifier = "cp312-manylinux_i686", version = "3.12", path_str = "/opt/python/cp312-cp312" },
   { identifier = "cp313-manylinux_i686", version = "3.13", path_str = "/opt/python/cp313-cp313" },
-  { identifier = "cp313t-manylinux_i686", version = "3.13", path_str = "/opt/python/cp313-cp313t" },
   { identifier = "cp314-manylinux_i686", version = "3.14", path_str = "/opt/python/cp314-cp314" },
   { identifier = "cp314t-manylinux_i686", version = "3.14", path_str = "/opt/python/cp314-cp314t" },
-  { identifier = "pp38-manylinux_x86_64", version = "3.8", path_str = "/opt/python/pp38-pypy38_pp73" },
+  { identifier = "cp315-manylinux_i686", version = "3.15", path_str = "/opt/python/cp315-cp315" },
+  { identifier = "cp315t-manylinux_i686", version = "3.15", path_str = "/opt/python/cp315-cp315t" },
   { identifier = "pp39-manylinux_x86_64", version = "3.9", path_str = "/opt/python/pp39-pypy39_pp73" },
   { identifier = "pp310-manylinux_x86_64", version = "3.10", path_str = "/opt/python/pp310-pypy310_pp73" },
   { identifier = "pp311-manylinux_x86_64", version = "3.11", path_str = "/opt/python/pp311-pypy311_pp73" },
-  { identifier = "gp311_242-manylinux_x86_64", version = "3.11", path_str = "/opt/python/graalpy311-graalpy242_311_native" },
   { identifier = "gp312_250-manylinux_x86_64", version = "3.12", path_str = "/opt/python/graalpy312-graalpy250_312_native" },
-  { identifier = "cp38-manylinux_aarch64", version = "3.8", path_str = "/opt/python/cp38-cp38" },
   { identifier = "cp39-manylinux_aarch64", version = "3.9", path_str = "/opt/python/cp39-cp39" },
   { identifier = "cp310-manylinux_aarch64", version = "3.10", path_str = "/opt/python/cp310-cp310" },
   { identifier = "cp311-manylinux_aarch64", version = "3.11", path_str = "/opt/python/cp311-cp311" },
   { identifier = "cp312-manylinux_aarch64", version = "3.12", path_str = "/opt/python/cp312-cp312" },
   { identifier = "cp313-manylinux_aarch64", version = "3.13", path_str = "/opt/python/cp313-cp313" },
-  { identifier = "cp313t-manylinux_aarch64", version = "3.13", path_str = "/opt/python/cp313-cp313t" },
   { identifier = "cp314-manylinux_aarch64", version = "3.14", path_str = "/opt/python/cp314-cp314" },
   { identifier = "cp314t-manylinux_aarch64", version = "3.14", path_str = "/opt/python/cp314-cp314t" },
-  { identifier = "cp38-manylinux_ppc64le", version = "3.8", path_str = "/opt/python/cp38-cp38" },
+  { identifier = "cp315-manylinux_aarch64", version = "3.15", path_str = "/opt/python/cp315-cp315" },
+  { identifier = "cp315t-manylinux_aarch64", version = "3.15", path_str = "/opt/python/cp315-cp315t" },
   { identifier = "cp39-manylinux_ppc64le", version = "3.9", path_str = "/opt/python/cp39-cp39" },
   { identifier = "cp310-manylinux_ppc64le", version = "3.10", path_str = "/opt/python/cp310-cp310" },
   { identifier = "cp311-manylinux_ppc64le", version = "3.11", path_str = "/opt/python/cp311-cp311" },
   { identifier = "cp312-manylinux_ppc64le", version = "3.12", path_str = "/opt/python/cp312-cp312" },
   { identifier = "cp313-manylinux_ppc64le", version = "3.13", path_str = "/opt/python/cp313-cp313" },
-  { identifier = "cp313t-manylinux_ppc64le", version = "3.13", path_str = "/opt/python/cp313-cp313t" },
   { identifier = "cp314-manylinux_ppc64le", version = "3.14", path_str = "/opt/python/cp314-cp314" },
   { identifier = "cp314t-manylinux_ppc64le", version = "3.14", path_str = "/opt/python/cp314-cp314t" },
-  { identifier = "cp38-manylinux_s390x", version = "3.8", path_str = "/opt/python/cp38-cp38" },
+  { identifier = "cp315-manylinux_ppc64le", version = "3.15", path_str = "/opt/python/cp315-cp315" },
+  { identifier = "cp315t-manylinux_ppc64le", version = "3.15", path_str = "/opt/python/cp315-cp315t" },
   { identifier = "cp39-manylinux_s390x", version = "3.9", path_str = "/opt/python/cp39-cp39" },
   { identifier = "cp310-manylinux_s390x", version = "3.10", path_str = "/opt/python/cp310-cp310" },
   { identifier = "cp311-manylinux_s390x", version = "3.11", path_str = "/opt/python/cp311-cp311" },
   { identifier = "cp312-manylinux_s390x", version = "3.12", path_str = "/opt/python/cp312-cp312" },
   { identifier = "cp313-manylinux_s390x", version = "3.13", path_str = "/opt/python/cp313-cp313" },
-  { identifier = "cp313t-manylinux_s390x", version = "3.13", path_str = "/opt/python/cp313-cp313t" },
   { identifier = "cp314-manylinux_s390x", version = "3.14", path_str = "/opt/python/cp314-cp314" },
   { identifier = "cp314t-manylinux_s390x", version = "3.14", path_str = "/opt/python/cp314-cp314t" },
-  { identifier = "cp38-manylinux_armv7l", version = "3.8", path_str = "/opt/python/cp38-cp38" },
+  { identifier = "cp315-manylinux_s390x", version = "3.15", path_str = "/opt/python/cp315-cp315" },
+  { identifier = "cp315t-manylinux_s390x", version = "3.15", path_str = "/opt/python/cp315-cp315t" },
   { identifier = "cp39-manylinux_armv7l", version = "3.9", path_str = "/opt/python/cp39-cp39" },
   { identifier = "cp310-manylinux_armv7l", version = "3.10", path_str = "/opt/python/cp310-cp310" },
   { identifier = "cp311-manylinux_armv7l", version = "3.11", path_str = "/opt/python/cp311-cp311" },
   { identifier = "cp312-manylinux_armv7l", version = "3.12", path_str = "/opt/python/cp312-cp312" },
   { identifier = "cp313-manylinux_armv7l", version = "3.13", path_str = "/opt/python/cp313-cp313" },
-  { identifier = "cp313t-manylinux_armv7l", version = "3.13", path_str = "/opt/python/cp313-cp313t" },
   { identifier = "cp314-manylinux_armv7l", version = "3.14", path_str = "/opt/python/cp314-cp314" },
   { identifier = "cp314t-manylinux_armv7l", version = "3.14", path_str = "/opt/python/cp314-cp314t" },
-  { identifier = "cp38-manylinux_riscv64", version = "3.8", path_str = "/opt/python/cp38-cp38" },
+  { identifier = "cp315-manylinux_armv7l", version = "3.15", path_str = "/opt/python/cp315-cp315" },
+  { identifier = "cp315t-manylinux_armv7l", version = "3.15", path_str = "/opt/python/cp315-cp315t" },
   { identifier = "cp39-manylinux_riscv64", version = "3.9", path_str = "/opt/python/cp39-cp39" },
   { identifier = "cp310-manylinux_riscv64", version = "3.10", path_str = "/opt/python/cp310-cp310" },
   { identifier = "cp311-manylinux_riscv64", version = "3.11", path_str = "/opt/python/cp311-cp311" },
   { identifier = "cp312-manylinux_riscv64", version = "3.12", path_str = "/opt/python/cp312-cp312" },
   { identifier = "cp313-manylinux_riscv64", version = "3.13", path_str = "/opt/python/cp313-cp313" },
-  { identifier = "cp313t-manylinux_riscv64", version = "3.13", path_str = "/opt/python/cp313-cp313t" },
   { identifier = "cp314-manylinux_riscv64", version = "3.14", path_str = "/opt/python/cp314-cp314" },
   { identifier = "cp314t-manylinux_riscv64", version = "3.14", path_str = "/opt/python/cp314-cp314t" },
-  { identifier = "pp38-manylinux_aarch64", version = "3.8", path_str = "/opt/python/pp38-pypy38_pp73" },
+  { identifier = "cp315-manylinux_riscv64", version = "3.15", path_str = "/opt/python/cp315-cp315" },
+  { identifier = "cp315t-manylinux_riscv64", version = "3.15", path_str = "/opt/python/cp315-cp315t" },
   { identifier = "pp39-manylinux_aarch64", version = "3.9", path_str = "/opt/python/pp39-pypy39_pp73" },
   { identifier = "pp310-manylinux_aarch64", version = "3.10", path_str = "/opt/python/pp310-pypy310_pp73" },
   { identifier = "pp311-manylinux_aarch64", version = "3.11", path_str = "/opt/python/pp311-pypy311_pp73" },
-  { identifier = "gp311_242-manylinux_aarch64", version = "3.11", path_str = "/opt/python/graalpy311-graalpy242_311_native" },
   { identifier = "gp312_250-manylinux_aarch64", version = "3.12", path_str = "/opt/python/graalpy312-graalpy250_312_native" },
-  { identifier = "pp38-manylinux_i686", version = "3.8", path_str = "/opt/python/pp38-pypy38_pp73" },
   { identifier = "pp39-manylinux_i686", version = "3.9", path_str = "/opt/python/pp39-pypy39_pp73" },
   { identifier = "pp310-manylinux_i686", version = "3.10", path_str = "/opt/python/pp310-pypy310_pp73" },
   { identifier = "pp311-manylinux_i686", version = "3.11", path_str = "/opt/python/pp311-pypy311_pp73" },
-  { identifier = "cp38-musllinux_x86_64", version = "3.8", path_str = "/opt/python/cp38-cp38" },
   { identifier = "cp39-musllinux_x86_64", version = "3.9", path_str = "/opt/python/cp39-cp39" },
   { identifier = "cp310-musllinux_x86_64", version = "3.10", path_str = "/opt/python/cp310-cp310" },
   { identifier = "cp311-musllinux_x86_64", version = "3.11", path_str = "/opt/python/cp311-cp311" },
   { identifier = "cp312-musllinux_x86_64", version = "3.12", path_str = "/opt/python/cp312-cp312" },
   { identifier = "cp313-musllinux_x86_64", version = "3.13", path_str = "/opt/python/cp313-cp313" },
-  { identifier = "cp313t-musllinux_x86_64", version = "3.13", path_str = "/opt/python/cp313-cp313t" },
   { identifier = "cp314-musllinux_x86_64", version = "3.14", path_str = "/opt/python/cp314-cp314" },
   { identifier = "cp314t-musllinux_x86_64", version = "3.14", path_str = "/opt/python/cp314-cp314t" },
-  { identifier = "cp38-musllinux_i686", version = "3.8", path_str = "/opt/python/cp38-cp38" },
+  { identifier = "cp315-musllinux_x86_64", version = "3.15", path_str = "/opt/python/cp315-cp315" },
+  { identifier = "cp315t-musllinux_x86_64", version = "3.15", path_str = "/opt/python/cp315-cp315t" },
   { identifier = "cp39-musllinux_i686", version = "3.9", path_str = "/opt/python/cp39-cp39" },
   { identifier = "cp310-musllinux_i686", version = "3.10", path_str = "/opt/python/cp310-cp310" },
   { identifier = "cp311-musllinux_i686", version = "3.11", path_str = "/opt/python/cp311-cp311" },
   { identifier = "cp312-musllinux_i686", version = "3.12", path_str = "/opt/python/cp312-cp312" },
   { identifier = "cp313-musllinux_i686", version = "3.13", path_str = "/opt/python/cp313-cp313" },
-  { identifier = "cp313t-musllinux_i686", version = "3.13", path_str = "/opt/python/cp313-cp313t" },
   { identifier = "cp314-musllinux_i686", version = "3.14", path_str = "/opt/python/cp314-cp314" },
   { identifier = "cp314t-musllinux_i686", version = "3.14", path_str = "/opt/python/cp314-cp314t" },
-  { identifier = "cp38-musllinux_aarch64", version = "3.8", path_str = "/opt/python/cp38-cp38" },
+  { identifier = "cp315-musllinux_i686", version = "3.15", path_str = "/opt/python/cp315-cp315" },
+  { identifier = "cp315t-musllinux_i686", version = "3.15", path_str = "/opt/python/cp315-cp315t" },
   { identifier = "cp39-musllinux_aarch64", version = "3.9", path_str = "/opt/python/cp39-cp39" },
   { identifier = "cp310-musllinux_aarch64", version = "3.10", path_str = "/opt/python/cp310-cp310" },
   { identifier = "cp311-musllinux_aarch64", version = "3.11", path_str = "/opt/python/cp311-cp311" },
   { identifier = "cp312-musllinux_aarch64", version = "3.12", path_str = "/opt/python/cp312-cp312" },
   { identifier = "cp313-musllinux_aarch64", version = "3.13", path_str = "/opt/python/cp313-cp313" },
-  { identifier = "cp313t-musllinux_aarch64", version = "3.13", path_str = "/opt/python/cp313-cp313t" },
   { identifier = "cp314-musllinux_aarch64", version = "3.14", path_str = "/opt/python/cp314-cp314" },
   { identifier = "cp314t-musllinux_aarch64", version = "3.14", path_str = "/opt/python/cp314-cp314t" },
-  { identifier = "cp38-musllinux_ppc64le", version = "3.8", path_str = "/opt/python/cp38-cp38" },
+  { identifier = "cp315-musllinux_aarch64", version = "3.15", path_str = "/opt/python/cp315-cp315" },
+  { identifier = "cp315t-musllinux_aarch64", version = "3.15", path_str = "/opt/python/cp315-cp315t" },
   { identifier = "cp39-musllinux_ppc64le", version = "3.9", path_str = "/opt/python/cp39-cp39" },
   { identifier = "cp310-musllinux_ppc64le", version = "3.10", path_str = "/opt/python/cp310-cp310" },
   { identifier = "cp311-musllinux_ppc64le", version = "3.11", path_str = "/opt/python/cp311-cp311" },
   { identifier = "cp312-musllinux_ppc64le", version = "3.12", path_str = "/opt/python/cp312-cp312" },
   { identifier = "cp313-musllinux_ppc64le", version = "3.13", path_str = "/opt/python/cp313-cp313" },
-  { identifier = "cp313t-musllinux_ppc64le", version = "3.13", path_str = "/opt/python/cp313-cp313t" },
   { identifier = "cp314-musllinux_ppc64le", version = "3.14", path_str = "/opt/python/cp314-cp314" },
   { identifier = "cp314t-musllinux_ppc64le", version = "3.14", path_str = "/opt/python/cp314-cp314t" },
-  { identifier = "cp38-musllinux_s390x", version = "3.8", path_str = "/opt/python/cp38-cp38" },
+  { identifier = "cp315-musllinux_ppc64le", version = "3.15", path_str = "/opt/python/cp315-cp315" },
+  { identifier = "cp315t-musllinux_ppc64le", version = "3.15", path_str = "/opt/python/cp315-cp315t" },
   { identifier = "cp39-musllinux_s390x", version = "3.9", path_str = "/opt/python/cp39-cp39" },
   { identifier = "cp310-musllinux_s390x", version = "3.10", path_str = "/opt/python/cp310-cp310" },
   { identifier = "cp311-musllinux_s390x", version = "3.11", path_str = "/opt/python/cp311-cp311" },
   { identifier = "cp312-musllinux_s390x", version = "3.12", path_str = "/opt/python/cp312-cp312" },
   { identifier = "cp313-musllinux_s390x", version = "3.13", path_str = "/opt/python/cp313-cp313" },
-  { identifier = "cp313t-musllinux_s390x", version = "3.13", path_str = "/opt/python/cp313-cp313t" },
   { identifier = "cp314-musllinux_s390x", version = "3.14", path_str = "/opt/python/cp314-cp314" },
   { identifier = "cp314t-musllinux_s390x", version = "3.14", path_str = "/opt/python/cp314-cp314t" },
-  { identifier = "cp38-musllinux_armv7l", version = "3.8", path_str = "/opt/python/cp38-cp38" },
+  { identifier = "cp315-musllinux_s390x", version = "3.15", path_str = "/opt/python/cp315-cp315" },
+  { identifier = "cp315t-musllinux_s390x", version = "3.15", path_str = "/opt/python/cp315-cp315t" },
   { identifier = "cp39-musllinux_armv7l", version = "3.9", path_str = "/opt/python/cp39-cp39" },
   { identifier = "cp310-musllinux_armv7l", version = "3.10", path_str = "/opt/python/cp310-cp310" },
   { identifier = "cp311-musllinux_armv7l", version = "3.11", path_str = "/opt/python/cp311-cp311" },
   { identifier = "cp312-musllinux_armv7l", version = "3.12", path_str = "/opt/python/cp312-cp312" },
   { identifier = "cp313-musllinux_armv7l", version = "3.13", path_str = "/opt/python/cp313-cp313" },
-  { identifier = "cp313t-musllinux_armv7l", version = "3.13", path_str = "/opt/python/cp313-cp313t" },
   { identifier = "cp314-musllinux_armv7l", version = "3.14", path_str = "/opt/python/cp314-cp314" },
   { identifier = "cp314t-musllinux_armv7l", version = "3.14", path_str = "/opt/python/cp314-cp314t" },
-  { identifier = "cp38-musllinux_riscv64", version = "3.8", path_str = "/opt/python/cp38-cp38" },
+  { identifier = "cp315-musllinux_armv7l", version = "3.15", path_str = "/opt/python/cp315-cp315" },
+  { identifier = "cp315t-musllinux_armv7l", version = "3.15", path_str = "/opt/python/cp315-cp315t" },
   { identifier = "cp39-musllinux_riscv64", version = "3.9", path_str = "/opt/python/cp39-cp39" },
   { identifier = "cp310-musllinux_riscv64", version = "3.10", path_str = "/opt/python/cp310-cp310" },
   { identifier = "cp311-musllinux_riscv64", version = "3.11", path_str = "/opt/python/cp311-cp311" },
   { identifier = "cp312-musllinux_riscv64", version = "3.12", path_str = "/opt/python/cp312-cp312" },
   { identifier = "cp313-musllinux_riscv64", version = "3.13", path_str = "/opt/python/cp313-cp313" },
-  { identifier = "cp313t-musllinux_riscv64", version = "3.13", path_str = "/opt/python/cp313-cp313t" },
   { identifier = "cp314-musllinux_riscv64", version = "3.14", path_str = "/opt/python/cp314-cp314" },
   { identifier = "cp314t-musllinux_riscv64", version = "3.14", path_str = "/opt/python/cp314-cp314t" },
+  { identifier = "cp315-musllinux_riscv64", version = "3.15", path_str = "/opt/python/cp315-cp315" },
+  { identifier = "cp315t-musllinux_riscv64", version = "3.15", path_str = "/opt/python/cp315-cp315t" },
 ]
 
 [macos]
 python_configurations = [
-  { identifier = "cp38-macosx_x86_64", version = "3.8", url = "https://www.python.org/ftp/python/3.8.10/python-3.8.10-macosx10.9.pkg" },
+  { identifier = "cp39-macosx_x86_64", version = "3.9", url = "https://www.python.org/ftp/python/3.9.13/python-3.9.13-macos11.pkg", sha256 = "351fe18f4fb03be7afac5e4012fc0a51345f43202af43ef620cf1eee5ee36578" },
-  { identifier = "cp38-macosx_arm64", version = "3.8", url = "https://www.python.org/ftp/python/3.8.10/python-3.8.10-macosx10.9.pkg" },
+  { identifier = "cp39-macosx_arm64", version = "3.9", url = "https://www.python.org/ftp/python/3.9.13/python-3.9.13-macos11.pkg", sha256 = "351fe18f4fb03be7afac5e4012fc0a51345f43202af43ef620cf1eee5ee36578" },
-  { identifier = "cp38-macosx_universal2", version = "3.8", url = "https://www.python.org/ftp/python/3.8.10/python-3.8.10-macosx10.9.pkg" },
+  { identifier = "cp39-macosx_universal2", version = "3.9", url = "https://www.python.org/ftp/python/3.9.13/python-3.9.13-macos11.pkg", sha256 = "351fe18f4fb03be7afac5e4012fc0a51345f43202af43ef620cf1eee5ee36578" },
-  { identifier = "cp39-macosx_x86_64", version = "3.9", url = "https://www.python.org/ftp/python/3.9.13/python-3.9.13-macos11.pkg" },
+  { identifier = "cp310-macosx_x86_64", version = "3.10", url = "https://www.python.org/ftp/python/3.10.11/python-3.10.11-macos11.pkg", sha256 = "767ed35ad688d28ea4494081ae96408a0318d0d5bb9ca0139d74d6247b231cfc" },
-  { identifier = "cp39-macosx_arm64", version = "3.9", url = "https://www.python.org/ftp/python/3.9.13/python-3.9.13-macos11.pkg" },
+  { identifier = "cp310-macosx_arm64", version = "3.10", url = "https://www.python.org/ftp/python/3.10.11/python-3.10.11-macos11.pkg", sha256 = "767ed35ad688d28ea4494081ae96408a0318d0d5bb9ca0139d74d6247b231cfc" },
-  { identifier = "cp39-macosx_universal2", version = "3.9", url = "https://www.python.org/ftp/python/3.9.13/python-3.9.13-macos11.pkg" },
+  { identifier = "cp310-macosx_universal2", version = "3.10", url = "https://www.python.org/ftp/python/3.10.11/python-3.10.11-macos11.pkg", sha256 = "767ed35ad688d28ea4494081ae96408a0318d0d5bb9ca0139d74d6247b231cfc" },
-  { identifier = "cp310-macosx_x86_64", version = "3.10", url = "https://www.python.org/ftp/python/3.10.11/python-3.10.11-macos11.pkg" },
+  { identifier = "cp311-macosx_x86_64", version = "3.11", url = "https://www.python.org/ftp/python/3.11.9/python-3.11.9-macos11.pkg", sha256 = "b6cfdee2571ca56ee895043ca1e7110fb78a878cee3eb0c21accb2de34d24b55" },
-  { identifier = "cp310-macosx_arm64", version = "3.10", url = "https://www.python.org/ftp/python/3.10.11/python-3.10.11-macos11.pkg" },
+  { identifier = "cp311-macosx_arm64", version = "3.11", url = "https://www.python.org/ftp/python/3.11.9/python-3.11.9-macos11.pkg", sha256 = "b6cfdee2571ca56ee895043ca1e7110fb78a878cee3eb0c21accb2de34d24b55" },
-  { identifier = "cp310-macosx_universal2", version = "3.10", url = "https://www.python.org/ftp/python/3.10.11/python-3.10.11-macos11.pkg" },
+  { identifier = "cp311-macosx_universal2", version = "3.11", url = "https://www.python.org/ftp/python/3.11.9/python-3.11.9-macos11.pkg", sha256 = "b6cfdee2571ca56ee895043ca1e7110fb78a878cee3eb0c21accb2de34d24b55" },
-  { identifier = "cp311-macosx_x86_64", version = "3.11", url = "https://www.python.org/ftp/python/3.11.9/python-3.11.9-macos11.pkg" },
+  { identifier = "cp312-macosx_x86_64", version = "3.12", url = "https://www.python.org/ftp/python/3.12.10/python-3.12.10-macos11.pkg", sha256 = "8373e58da4ea146b3eb1c1f9834f19a319440b6b679b06050b1f9ee3237aa8e4" },
-  { identifier = "cp311-macosx_arm64", version = "3.11", url = "https://www.python.org/ftp/python/3.11.9/python-3.11.9-macos11.pkg" },
+  { identifier = "cp312-macosx_arm64", version = "3.12", url = "https://www.python.org/ftp/python/3.12.10/python-3.12.10-macos11.pkg", sha256 = "8373e58da4ea146b3eb1c1f9834f19a319440b6b679b06050b1f9ee3237aa8e4" },
-  { identifier = "cp311-macosx_universal2", version = "3.11", url = "https://www.python.org/ftp/python/3.11.9/python-3.11.9-macos11.pkg" },
+  { identifier = "cp312-macosx_universal2", version = "3.12", url = "https://www.python.org/ftp/python/3.12.10/python-3.12.10-macos11.pkg", sha256 = "8373e58da4ea146b3eb1c1f9834f19a319440b6b679b06050b1f9ee3237aa8e4" },
-  { identifier = "cp312-macosx_x86_64", version = "3.12", url = "https://www.python.org/ftp/python/3.12.10/python-3.12.10-macos11.pkg" },
+  { identifier = "cp313-macosx_x86_64", version = "3.13", url = "https://www.python.org/ftp/python/3.13.13/python-3.13.13-macos11.pkg", sha256 = "a909cb655af5db67d5a90b3603437a1d58bec3446d624e4034e278ac62023cc9" },
-  { identifier = "cp312-macosx_arm64", version = "3.12", url = "https://www.python.org/ftp/python/3.12.10/python-3.12.10-macos11.pkg" },
+  { identifier = "cp313-macosx_arm64", version = "3.13", url = "https://www.python.org/ftp/python/3.13.13/python-3.13.13-macos11.pkg", sha256 = "a909cb655af5db67d5a90b3603437a1d58bec3446d624e4034e278ac62023cc9" },
-  { identifier = "cp312-macosx_universal2", version = "3.12", url = "https://www.python.org/ftp/python/3.12.10/python-3.12.10-macos11.pkg" },
+  { identifier = "cp313-macosx_universal2", version = "3.13", url = "https://www.python.org/ftp/python/3.13.13/python-3.13.13-macos11.pkg", sha256 = "a909cb655af5db67d5a90b3603437a1d58bec3446d624e4034e278ac62023cc9" },
-  { identifier = "cp313-macosx_x86_64", version = "3.13", url = "https://www.python.org/ftp/python/3.13.13/python-3.13.13-macos11.pkg" },
+  { identifier = "cp314-macosx_x86_64", version = "3.14", url = "https://www.python.org/ftp/python/3.14.5/python-3.14.5-macos11.pkg", sha256 = "b28a8dc33c456dd06c97024697d63ca916cfb494594c06fa3e4ef4d41fa82335" },
-  { identifier = "cp313-macosx_arm64", version = "3.13", url = "https://www.python.org/ftp/python/3.13.13/python-3.13.13-macos11.pkg" },
+  { identifier = "cp314-macosx_arm64", version = "3.14", url = "https://www.python.org/ftp/python/3.14.5/python-3.14.5-macos11.pkg", sha256 = "b28a8dc33c456dd06c97024697d63ca916cfb494594c06fa3e4ef4d41fa82335" },
-  { identifier = "cp313-macosx_universal2", version = "3.13", url = "https://www.python.org/ftp/python/3.13.13/python-3.13.13-macos11.pkg" },
+  { identifier = "cp314-macosx_universal2", version = "3.14", url = "https://www.python.org/ftp/python/3.14.5/python-3.14.5-macos11.pkg", sha256 = "b28a8dc33c456dd06c97024697d63ca916cfb494594c06fa3e4ef4d41fa82335" },
-  { identifier = "cp313t-macosx_x86_64", version = "3.13", url = "https://www.python.org/ftp/python/3.13.13/python-3.13.13-macos11.pkg" },
+  { identifier = "cp314t-macosx_x86_64", version = "3.14", url = "https://www.python.org/ftp/python/3.14.5/python-3.14.5-macos11.pkg", sha256 = "b28a8dc33c456dd06c97024697d63ca916cfb494594c06fa3e4ef4d41fa82335" },
-  { identifier = "cp313t-macosx_arm64", version = "3.13", url = "https://www.python.org/ftp/python/3.13.13/python-3.13.13-macos11.pkg" },
+  { identifier = "cp314t-macosx_arm64", version = "3.14", url = "https://www.python.org/ftp/python/3.14.5/python-3.14.5-macos11.pkg", sha256 = "b28a8dc33c456dd06c97024697d63ca916cfb494594c06fa3e4ef4d41fa82335" },
-  { identifier = "cp313t-macosx_universal2", version = "3.13", url = "https://www.python.org/ftp/python/3.13.13/python-3.13.13-macos11.pkg" },
+  { identifier = "cp314t-macosx_universal2", version = "3.14", url = "https://www.python.org/ftp/python/3.14.5/python-3.14.5-macos11.pkg", sha256 = "b28a8dc33c456dd06c97024697d63ca916cfb494594c06fa3e4ef4d41fa82335" },
-  { identifier = "cp314-macosx_x86_64", version = "3.14", url = "https://www.python.org/ftp/python/3.14.4/python-3.14.4-macos11.pkg" },
+  { identifier = "cp315-macosx_x86_64", version = "3.15", url = "https://www.python.org/ftp/python/3.15.0/python-3.15.0b2-macos11.pkg", sha256 = "29b5c95f255f846f77e1c119146836445f929de1392a3ae9ef24f559e1345418" },
-  { identifier = "cp314-macosx_arm64", version = "3.14", url = "https://www.python.org/ftp/python/3.14.4/python-3.14.4-macos11.pkg" },
+  { identifier = "cp315-macosx_arm64", version = "3.15", url = "https://www.python.org/ftp/python/3.15.0/python-3.15.0b2-macos11.pkg", sha256 = "29b5c95f255f846f77e1c119146836445f929de1392a3ae9ef24f559e1345418" },
-  { identifier = "cp314-macosx_universal2", version = "3.14", url = "https://www.python.org/ftp/python/3.14.4/python-3.14.4-macos11.pkg" },
+  { identifier = "cp315-macosx_universal2", version = "3.15", url = "https://www.python.org/ftp/python/3.15.0/python-3.15.0b2-macos11.pkg", sha256 = "29b5c95f255f846f77e1c119146836445f929de1392a3ae9ef24f559e1345418" },
-  { identifier = "cp314t-macosx_x86_64", version = "3.14", url = "https://www.python.org/ftp/python/3.14.4/python-3.14.4-macos11.pkg" },
+  { identifier = "cp315t-macosx_x86_64", version = "3.15", url = "https://www.python.org/ftp/python/3.15.0/python-3.15.0b2-macos11.pkg", sha256 = "29b5c95f255f846f77e1c119146836445f929de1392a3ae9ef24f559e1345418" },
-  { identifier = "cp314t-macosx_arm64", version = "3.14", url = "https://www.python.org/ftp/python/3.14.4/python-3.14.4-macos11.pkg" },
+  { identifier = "cp315t-macosx_arm64", version = "3.15", url = "https://www.python.org/ftp/python/3.15.0/python-3.15.0b2-macos11.pkg", sha256 = "29b5c95f255f846f77e1c119146836445f929de1392a3ae9ef24f559e1345418" },
-  { identifier = "cp314t-macosx_universal2", version = "3.14", url = "https://www.python.org/ftp/python/3.14.4/python-3.14.4-macos11.pkg" },
+  { identifier = "cp315t-macosx_universal2", version = "3.15", url = "https://www.python.org/ftp/python/3.15.0/python-3.15.0b2-macos11.pkg", sha256 = "29b5c95f255f846f77e1c119146836445f929de1392a3ae9ef24f559e1345418" },
-  { identifier = "pp38-macosx_x86_64", version = "3.8", url = "https://downloads.python.org/pypy/pypy3.8-v7.3.11-macos_x86_64.tar.bz2" },
+  { identifier = "pp39-macosx_x86_64", version = "3.9", url = "https://downloads.python.org/pypy/pypy3.9-v7.3.16-macos_x86_64.tar.bz2", sha256 = "fda015431621e7e5aa16359d114f2c45a77ed936992c1efff86302e768a6b21c" },
-  { identifier = "pp38-macosx_arm64", version = "3.8", url = "https://downloads.python.org/pypy/pypy3.8-v7.3.11-macos_arm64.tar.bz2" },
+  { identifier = "pp39-macosx_arm64", version = "3.9", url = "https://downloads.python.org/pypy/pypy3.9-v7.3.16-macos_arm64.tar.bz2", sha256 = "88f824e7a2d676440d09bc90fc959ae0fd3557d7e2f14bfbbe53d41d159a47fe" },
-  { identifier = "pp39-macosx_x86_64", version = "3.9", url = "https://downloads.python.org/pypy/pypy3.9-v7.3.16-macos_x86_64.tar.bz2" },
+  { identifier = "pp310-macosx_x86_64", version = "3.10", url = "https://downloads.python.org/pypy/pypy3.10-v7.3.19-macos_x86_64.tar.bz2", sha256 = "2c5e5c2a33ac882551d7f28b98d19d486b8995aa50824a73b4edcc6aeec35c63" },
-  { identifier = "pp39-macosx_arm64", version = "3.9", url = "https://downloads.python.org/pypy/pypy3.9-v7.3.16-macos_arm64.tar.bz2" },
+  { identifier = "pp310-macosx_arm64", version = "3.10", url = "https://downloads.python.org/pypy/pypy3.10-v7.3.19-macos_arm64.tar.bz2", sha256 = "3db8a03fc496164801646844d7f3b12baa0adb3ad9a0b7cb124521bc2e168a36" },
-  { identifier = "pp310-macosx_x86_64", version = "3.10", url = "https://downloads.python.org/pypy/pypy3.10-v7.3.19-macos_x86_64.tar.bz2" },
+  { identifier = "pp311-macosx_x86_64", version = "3.11", url = "https://downloads.python.org/pypy/pypy3.11-v7.3.23-macos_x86_64.tar.bz2", sha256 = "c95363c4e87235d11a6cec8128239c291b1eb67a752778fbcfe029a71da82b5e" },
-  { identifier = "pp310-macosx_arm64", version = "3.10", url = "https://downloads.python.org/pypy/pypy3.10-v7.3.19-macos_arm64.tar.bz2" },
+  { identifier = "pp311-macosx_arm64", version = "3.11", url = "https://downloads.python.org/pypy/pypy3.11-v7.3.23-macos_arm64.tar.bz2", sha256 = "4747b3aceba4c1c6104cddc0fe5ea302101d32955f0957347b9ecc4fbd7aed05" },
-  { identifier = "pp311-macosx_x86_64", version = "3.11", url = "https://downloads.python.org/pypy/pypy3.11-v7.3.21-macos_x86_64.tar.bz2" },
+  { identifier = "gp312_250-macosx_x86_64", version = "3.12", url = "https://github.com/oracle/graalpython/releases/download/graal-25.0.1/graalpy-25.0.1-macos-amd64.tar.gz", sha256 = "10b0721d52397f0cc85f038900318da2203711cbcfae7899e3faed49d3dc6221" },
-  { identifier = "pp311-macosx_arm64", version = "3.11", url = "https://downloads.python.org/pypy/pypy3.11-v7.3.21-macos_arm64.tar.bz2" },
+  { identifier = "gp312_250-macosx_arm64", version = "3.12", url = "https://github.com/oracle/graalpython/releases/download/graal-25.0.3/graalpy-25.0.3-macos-aarch64.tar.gz", sha256 = "387d9f5b376860842bea4d55aae5820974f3f3b68fc36c77ae863a061a888857" },
-  { identifier = "gp311_242-macosx_x86_64", version = "3.11", url = "https://github.com/oracle/graalpython/releases/download/graal-24.2.2/graalpy-24.2.2-macos-amd64.tar.gz" },
-  { identifier = "gp311_242-macosx_arm64", version = "3.11", url = "https://github.com/oracle/graalpython/releases/download/graal-24.2.2/graalpy-24.2.2-macos-aarch64.tar.gz" },
-  { identifier = "gp312_250-macosx_x86_64", version = "3.12", url = "https://github.com/oracle/graalpython/releases/download/graal-25.0.1/graalpy-25.0.1-macos-amd64.tar.gz" },
-  { identifier = "gp312_250-macosx_arm64", version = "3.12", url = "https://github.com/oracle/graalpython/releases/download/graal-25.0.2/graalpy-25.0.2-macos-aarch64.tar.gz" },
 ]
 
 [windows]
 python_configurations = [
-  { identifier = "cp38-win32", version = "3.8.10" },
-  { identifier = "cp38-win_amd64", version = "3.8.10" },
   { identifier = "cp39-win32", version = "3.9.13" },
   { identifier = "cp39-win_amd64", version = "3.9.13" },
   { identifier = "cp310-win32", version = "3.10.11" },
@@ -200,49 +189,56 @@ python_configurations = [
   { identifier = "cp312-win32", version = "3.12.10" },
   { identifier = "cp312-win_amd64", version = "3.12.10" },
   { identifier = "cp313-win32", version = "3.13.13" },
-  { identifier = "cp313t-win32", version = "3.13.13" },
   { identifier = "cp313-win_amd64", version = "3.13.13" },
-  { identifier = "cp313t-win_amd64", version = "3.13.13" },
+  { identifier = "cp314-win32", version = "3.14.5" },
-  { identifier = "cp314-win32", version = "3.14.4" },
+  { identifier = "cp314t-win32", version = "3.14.5" },
-  { identifier = "cp314t-win32", version = "3.14.4" },
+  { identifier = "cp314-win_amd64", version = "3.14.5" },
-  { identifier = "cp314-win_amd64", version = "3.14.4" },
+  { identifier = "cp314t-win_amd64", version = "3.14.5" },
-  { identifier = "cp314t-win_amd64", version = "3.14.4" },
+  { identifier = "cp315-win32", version = "3.15.0-b2" },
+  { identifier = "cp315t-win32", version = "3.15.0-b2" },
+  { identifier = "cp315-win_amd64", version = "3.15.0-b2" },
+  { identifier = "cp315t-win_amd64", version = "3.15.0-b2" },
   { identifier = "cp39-win_arm64", version = "3.9.10" },
   { identifier = "cp310-win_arm64", version = "3.10.11" },
   { identifier = "cp311-win_arm64", version = "3.11.9" },
   { identifier = "cp312-win_arm64", version = "3.12.10" },
   { identifier = "cp313-win_arm64", version = "3.13.13" },
-  { identifier = "cp313t-win_arm64", version = "3.13.13" },
+  { identifier = "cp314-win_arm64", version = "3.14.5" },
-  { identifier = "cp314-win_arm64", version = "3.14.4" },
+  { identifier = "cp314t-win_arm64", version = "3.14.5" },
-  { identifier = "cp314t-win_arm64", version = "3.14.4" },
+  { identifier = "cp315-win_arm64", version = "3.15.0-b2" },
-  { identifier = "pp38-win_amd64", version = "3.8", url = "https://downloads.python.org/pypy/pypy3.8-v7.3.11-win64.zip" },
+  { identifier = "cp315t-win_arm64", version = "3.15.0-b2" },
-  { identifier = "pp39-win_amd64", version = "3.9", url = "https://downloads.python.org/pypy/pypy3.9-v7.3.16-win64.zip" },
+  { identifier = "pp39-win_amd64", version = "3.9", url = "https://downloads.python.org/pypy/pypy3.9-v7.3.16-win64.zip", sha256 = "06ec12a5e964dc0ad33e6f380185a4d295178dce6d6df512f508e7aee00a1323" },
-  { identifier = "pp310-win_amd64", version = "3.10", url = "https://downloads.python.org/pypy/pypy3.10-v7.3.19-win64.zip" },
+  { identifier = "pp310-win_amd64", version = "3.10", url = "https://downloads.python.org/pypy/pypy3.10-v7.3.19-win64.zip", sha256 = "c0d07bba6c8fb4e5804f4a8b3f8ef07cc3d89f6ad1db42a45ffb9be60bbb7cc2" },
-  { identifier = "pp311-win_amd64", version = "3.11", url = "https://downloads.python.org/pypy/pypy3.11-v7.3.21-win64.zip" },
+  { identifier = "pp311-win_amd64", version = "3.11", url = "https://downloads.python.org/pypy/pypy3.11-v7.3.23-win64.zip", sha256 = "948b8ea58dea5b9917210fe4afd242c788fbfaba1c3f1a25e696a404f703389a" },
-  { identifier = "gp311_242-win_amd64", version = "3.11", url = "https://github.com/oracle/graalpython/releases/download/graal-24.2.2/graalpy-24.2.2-windows-amd64.zip" },
+  { identifier = "gp312_250-win_amd64", version = "3.12", url = "https://github.com/oracle/graalpython/releases/download/graal-25.0.3/graalpy-25.0.3-windows-amd64.zip", sha256 = "2ae5c42b93e08d9e106a017634a3442b272ccae6d08ace157244de0449e937d4" },
-  { identifier = "gp312_250-win_amd64", version = "3.12", url = "https://github.com/oracle/graalpython/releases/download/graal-25.0.2/graalpy-25.0.2-windows-amd64.zip" },
 ]
 
 [pyodide]
 python_configurations = [
-  { identifier = "cp312-pyodide_wasm32", version = "3.12", default_pyodide_version = "0.27.7", node_version = "v22" },
+  { identifier = "cp312-pyodide_wasm32", version = "3.12", default_pyodide_version = "0.27.7", node_version = "v22", sha256 = "0c2e7db42efa5d1dac38b50f8b3d659a1e3885d0a233494831b8206281307d52" },
-  { identifier = "cp313-pyodide_wasm32", version = "3.13", default_pyodide_version = "0.29.3", node_version = "v22" },
+  { identifier = "cp313-pyodide_wasm32", version = "3.13", default_pyodide_version = "0.29.4", node_version = "v22", sha256 = "a29fc4a076408a18fc29eb4b280f80c6dddc95c19514c874c29e590d0931c02a" },
+  { identifier = "cp314-pyodide_wasm32", version = "3.14", default_pyodide_version = "314.0.0a2", node_version = "v24", sha256 = "ac7bbcdf289ab3ae25621c436b1d013099ef6bec644ad0538dae5d65552c5c95" },
 ]
 
 [android]
 python_configurations = [
-  { identifier = "cp313-android_arm64_v8a", version = "3.13", url = "https://repo.maven.apache.org/maven2/com/chaquo/python/python/3.13.13/python-3.13.13-aarch64-linux-android.tar.gz" },
+  { identifier = "cp313-android_arm64_v8a", version = "3.13", url = "https://repo.maven.apache.org/maven2/com/chaquo/python/python/3.13.13/python-3.13.13-aarch64-linux-android.tar.gz", sha256 = "a21250c246b36eb704be096be51e40ab24cafa3ae1d7ca4c396e6bf780cf87cf" },
-  { identifier = "cp313-android_x86_64", version = "3.13", url = "https://repo.maven.apache.org/maven2/com/chaquo/python/python/3.13.13/python-3.13.13-x86_64-linux-android.tar.gz" },
+  { identifier = "cp313-android_x86_64", version = "3.13", url = "https://repo.maven.apache.org/maven2/com/chaquo/python/python/3.13.13/python-3.13.13-x86_64-linux-android.tar.gz", sha256 = "b021b76df2c8d64e41c76d18a2d91f27652356bd932c06f9076bac1b664c0e37" },
-  { identifier = "cp314-android_arm64_v8a", version = "3.14", url = "https://www.python.org/ftp/python/3.14.4/python-3.14.4-aarch64-linux-android.tar.gz" },
+  { identifier = "cp314-android_arm64_v8a", version = "3.14", url = "https://www.python.org/ftp/python/3.14.5/python-3.14.5-aarch64-linux-android.tar.gz", sha256 = "f008321abf837fcaec569df143283ece0e764b18d8c75763200160553f906af1" },
-  { identifier = "cp314-android_x86_64", version = "3.14", url = "https://www.python.org/ftp/python/3.14.4/python-3.14.4-x86_64-linux-android.tar.gz" },
+  { identifier = "cp314-android_x86_64", version = "3.14", url = "https://www.python.org/ftp/python/3.14.5/python-3.14.5-x86_64-linux-android.tar.gz", sha256 = "36184e31464b2b959d92c81ded8d025834342cc080623bced282a2a9a57bd47c" },
+  { identifier = "cp315-android_arm64_v8a", version = "3.15", url = "https://www.python.org/ftp/python/3.15.0/python-3.15.0b2-aarch64-linux-android.tar.gz", sha256 = "de5e36ffc3c33b63a1ed53fe83db4dee16b003a3180ac35e5c4c203d3750e076" },
+  { identifier = "cp315-android_x86_64", version = "3.15", url = "https://www.python.org/ftp/python/3.15.0/python-3.15.0b2-x86_64-linux-android.tar.gz", sha256 = "e05ef9c142ea83b41b194b16014ffe2249d27783313c3b00b97f6c93d9a56b92" },
 ]
 
 [ios]
 python_configurations = [
-  { identifier = "cp313-ios_arm64_iphoneos", version = "3.13", url = "https://github.com/beeware/Python-Apple-support/releases/download/3.13-b13/Python-3.13-iOS-support.b13.tar.gz" },
+  { identifier = "cp313-ios_arm64_iphoneos", version = "3.13", url = "https://github.com/beeware/Python-Apple-support/releases/download/3.13-b13/Python-3.13-iOS-support.b13.tar.gz", sha256 = "d1f95f95137a4b91dc0cbe9b99ddfc0a78918dde883c7fbe7147074a5e715274" },
-  { identifier = "cp313-ios_x86_64_iphonesimulator", version = "3.13", url = "https://github.com/beeware/Python-Apple-support/releases/download/3.13-b13/Python-3.13-iOS-support.b13.tar.gz" },
+  { identifier = "cp313-ios_x86_64_iphonesimulator", version = "3.13", url = "https://github.com/beeware/Python-Apple-support/releases/download/3.13-b13/Python-3.13-iOS-support.b13.tar.gz", sha256 = "d1f95f95137a4b91dc0cbe9b99ddfc0a78918dde883c7fbe7147074a5e715274" },
-  { identifier = "cp313-ios_arm64_iphonesimulator", version = "3.13", url = "https://github.com/beeware/Python-Apple-support/releases/download/3.13-b13/Python-3.13-iOS-support.b13.tar.gz" },
+  { identifier = "cp313-ios_arm64_iphonesimulator", version = "3.13", url = "https://github.com/beeware/Python-Apple-support/releases/download/3.13-b13/Python-3.13-iOS-support.b13.tar.gz", sha256 = "d1f95f95137a4b91dc0cbe9b99ddfc0a78918dde883c7fbe7147074a5e715274" },
-  { identifier = "cp314-ios_arm64_iphoneos", version = "3.14", url = "https://github.com/beeware/Python-Apple-support/releases/download/3.14-b9/Python-3.14-iOS-support.b9.tar.gz" },
+  { identifier = "cp314-ios_arm64_iphoneos", version = "3.14", url = "https://github.com/beeware/Python-Apple-support/releases/download/3.14-b9/Python-3.14-iOS-support.b9.tar.gz", sha256 = "8e4123b543bf17fdae2e2c6c033434487752438431014eb12e6d833aa35927a8" },
-  { identifier = "cp314-ios_x86_64_iphonesimulator", version = "3.14", url = "https://github.com/beeware/Python-Apple-support/releases/download/3.14-b9/Python-3.14-iOS-support.b9.tar.gz" },
+  { identifier = "cp314-ios_x86_64_iphonesimulator", version = "3.14", url = "https://github.com/beeware/Python-Apple-support/releases/download/3.14-b9/Python-3.14-iOS-support.b9.tar.gz", sha256 = "8e4123b543bf17fdae2e2c6c033434487752438431014eb12e6d833aa35927a8" },
-  { identifier = "cp314-ios_arm64_iphonesimulator", version = "3.14", url = "https://github.com/beeware/Python-Apple-support/releases/download/3.14-b9/Python-3.14-iOS-support.b9.tar.gz" },
+  { identifier = "cp314-ios_arm64_iphonesimulator", version = "3.14", url = "https://github.com/beeware/Python-Apple-support/releases/download/3.14-b9/Python-3.14-iOS-support.b9.tar.gz", sha256 = "8e4123b543bf17fdae2e2c6c033434487752438431014eb12e6d833aa35927a8" },
+  { identifier = "cp315-ios_arm64_iphoneos", version = "3.15", url = "https://www.python.org/ftp/python/3.15.0/python-3.15.0b2-iOS-XCframework.tar.gz", sha256 = "fd6b6fb8f82cf44622d28ea53b8197c89fb06505557d29d4d7a47f9386c1c896" },
+  { identifier = "cp315-ios_x86_64_iphonesimulator", version = "3.15", url = "https://www.python.org/ftp/python/3.15.0/python-3.15.0b2-iOS-XCframework.tar.gz", sha256 = "fd6b6fb8f82cf44622d28ea53b8197c89fb06505557d29d4d7a47f9386c1c896" },
+  { identifier = "cp315-ios_arm64_iphonesimulator", version = "3.15", url = "https://www.python.org/ftp/python/3.15.0/python-3.15.0b2-iOS-XCframework.tar.gz", sha256 = "fd6b6fb8f82cf44622d28ea53b8197c89fb06505557d29d4d7a47f9386c1c896" },
 ]

cibuildwheel/resources/cibuildwheel.schema.json

@@ -13,7 +13,6 @@
     },
     "enable": {
       "enum": [
-        "cpython-freethreading",
         "cpython-prerelease",
         "graalpy",
         "pyodide-prerelease",
@@ -27,6 +26,36 @@
   "description": "cibuildwheel's settings.",
   "type": "object",
   "properties": {
+    "audit-command": {
+      "description": "Execute a shell command to audit each wheel after it is repaired. Use {wheel} for each wheel path, or {abi3_wheel} to only audit abi3 wheels.",
+      "oneOf": [
+        {
+          "type": "string"
+        },
+        {
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        }
+      ],
+      "title": "CIBW_AUDIT_COMMAND"
+    },
+    "audit-requires": {
+      "description": "Install Python dependencies for the audit step.",
+      "oneOf": [
+        {
+          "type": "string"
+        },
+        {
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        }
+      ],
+      "title": "CIBW_AUDIT_REQUIRES"
+    },
     "archs": {
       "description": "Change the architectures built on your machine by default.",
       "oneOf": [
@@ -431,6 +460,34 @@
       ],
       "title": "CIBW_XBUILD_TOOLS"
     },
+    "xbuild-files": {
+      "description": "Platform-specific files in the build environment",
+      "oneOf": [
+        {
+          "type": "string"
+        },
+        {
+          "type": "object",
+          "additionalProperties": false,
+          "patternProperties": {
+            ".+": {
+              "oneOf": [
+                {
+                  "type": "string"
+                },
+                {
+                  "type": "array",
+                  "items": {
+                    "type": "string"
+                  }
+                }
+              ]
+            }
+          }
+        }
+      ],
+      "title": "CIBW_XBUILD_FILES"
+    },
     "pyodide-version": {
       "type": "string",
       "description": "Specify the version of Pyodide to use",
@@ -635,6 +692,12 @@
             "type": "object",
             "additionalProperties": false,
             "properties": {
+              "audit-command": {
+                "$ref": "#/$defs/inherit"
+              },
+              "audit-requires": {
+                "$ref": "#/$defs/inherit"
+              },
               "before-all": {
                 "$ref": "#/$defs/inherit"
               },
@@ -644,6 +707,9 @@
               "xbuild-tools": {
                 "$ref": "#/$defs/inherit"
               },
+              "xbuild-files": {
+                "$ref": "#/$defs/inherit"
+              },
               "before-test": {
                 "$ref": "#/$defs/inherit"
               },
@@ -682,6 +748,12 @@
               }
             }
           },
+          "audit-command": {
+            "$ref": "#/properties/audit-command"
+          },
+          "audit-requires": {
+            "$ref": "#/properties/audit-requires"
+          },
           "before-all": {
             "$ref": "#/properties/before-all"
           },
@@ -766,6 +838,9 @@
           "xbuild-tools": {
             "$ref": "#/properties/xbuild-tools"
           },
+          "xbuild-files": {
+            "$ref": "#/properties/xbuild-files"
+          },
           "pyodide-version": {
             "$ref": "#/properties/pyodide-version"
           },
@@ -800,6 +875,12 @@
       "type": "object",
       "additionalProperties": false,
       "properties": {
+        "audit-command": {
+          "$ref": "#/properties/audit-command"
+        },
+        "audit-requires": {
+          "$ref": "#/properties/audit-requires"
+        },
         "archs": {
           "$ref": "#/properties/archs"
         },
@@ -884,6 +965,9 @@
         "xbuild-tools": {
           "$ref": "#/properties/xbuild-tools"
         },
+        "xbuild-files": {
+          "$ref": "#/properties/xbuild-files"
+        },
         "pyodide-version": {
           "$ref": "#/properties/pyodide-version"
         },
@@ -930,6 +1014,12 @@
       "type": "object",
       "additionalProperties": false,
       "properties": {
+        "audit-command": {
+          "$ref": "#/properties/audit-command"
+        },
+        "audit-requires": {
+          "$ref": "#/properties/audit-requires"
+        },
         "archs": {
           "$ref": "#/properties/archs"
         },
@@ -960,11 +1050,27 @@
         "xbuild-tools": {
           "$ref": "#/properties/xbuild-tools"
         },
+        "xbuild-files": {
+          "$ref": "#/properties/xbuild-files"
+        },
         "pyodide-version": {
           "$ref": "#/properties/pyodide-version"
         },
         "repair-wheel-command": {
-          "$ref": "#/properties/repair-wheel-command"
+          "description": "Execute a shell command to repair each built wheel.",
+          "oneOf": [
+            {
+              "type": "string"
+            },
+            {
+              "type": "array",
+              "items": {
+                "type": "string"
+              }
+            }
+          ],
+          "title": "CIBW_REPAIR_WHEEL_COMMAND",
+          "default": "delvewheel repair -w {dest_dir} -v {wheel}"
         },
         "test-command": {
           "$ref": "#/properties/test-command"
@@ -993,6 +1099,12 @@
       "type": "object",
       "additionalProperties": false,
       "properties": {
+        "audit-command": {
+          "$ref": "#/properties/audit-command"
+        },
+        "audit-requires": {
+          "$ref": "#/properties/audit-requires"
+        },
         "archs": {
           "$ref": "#/properties/archs"
         },
@@ -1023,6 +1135,9 @@
         "xbuild-tools": {
           "$ref": "#/properties/xbuild-tools"
         },
+        "xbuild-files": {
+          "$ref": "#/properties/xbuild-files"
+        },
         "pyodide-version": {
           "$ref": "#/properties/pyodide-version"
         },
@@ -1069,6 +1184,12 @@
       "type": "object",
       "additionalProperties": false,
       "properties": {
+        "audit-command": {
+          "$ref": "#/properties/audit-command"
+        },
+        "audit-requires": {
+          "$ref": "#/properties/audit-requires"
+        },
         "archs": {
           "$ref": "#/properties/archs"
         },
@@ -1099,6 +1220,9 @@
         "xbuild-tools": {
           "$ref": "#/properties/xbuild-tools"
         },
+        "xbuild-files": {
+          "$ref": "#/properties/xbuild-files"
+        },
         "pyodide-version": {
           "$ref": "#/properties/pyodide-version"
         },
@@ -1132,6 +1256,12 @@
       "type": "object",
       "additionalProperties": false,
       "properties": {
+        "audit-command": {
+          "$ref": "#/properties/audit-command"
+        },
+        "audit-requires": {
+          "$ref": "#/properties/audit-requires"
+        },
         "archs": {
           "$ref": "#/properties/archs"
         },
@@ -1162,11 +1292,27 @@
         "xbuild-tools": {
           "$ref": "#/properties/xbuild-tools"
         },
+        "xbuild-files": {
+          "$ref": "#/properties/xbuild-files"
+        },
         "pyodide-version": {
           "$ref": "#/properties/pyodide-version"
         },
         "repair-wheel-command": {
-          "$ref": "#/properties/repair-wheel-command"
+          "description": "Execute a shell command to repair each built wheel.",
+          "oneOf": [
+            {
+              "type": "string"
+            },
+            {
+              "type": "array",
+              "items": {
+                "type": "string"
+              }
+            }
+          ],
+          "title": "CIBW_REPAIR_WHEEL_COMMAND",
+          "default": "auditwheel repair --ldpaths {ldpaths} -w {dest_dir} {wheel}"
         },
         "test-command": {
           "$ref": "#/properties/test-command"
@@ -1195,6 +1341,12 @@
       "type": "object",
       "additionalProperties": false,
       "properties": {
+        "audit-command": {
+          "$ref": "#/properties/audit-command"
+        },
+        "audit-requires": {
+          "$ref": "#/properties/audit-requires"
+        },
         "archs": {
           "$ref": "#/properties/archs"
         },
@@ -1225,6 +1377,9 @@
         "xbuild-tools": {
           "$ref": "#/properties/xbuild-tools"
         },
+        "xbuild-files": {
+          "$ref": "#/properties/xbuild-files"
+        },
         "pyodide-version": {
           "$ref": "#/properties/pyodide-version"
         },

cibuildwheel/resources/constraints-pyodide312.txt

@@ -2,71 +2,71 @@
 #    nox -s update_constraints
 annotated-types==0.7.0
     # via pydantic
-auditwheel-emscripten==0.2.3
+auditwheel-emscripten==0.2.5
     # via pyodide-build
-build==1.2.2.post1
+build==1.5.0
     # via
     #   -r .nox/update_constraints/tmp/constraints-pyodide.in
     #   pyodide-build
-certifi==2026.2.25
+certifi==2026.5.20
     # via requests
-charset-normalizer==3.4.6
+charset-normalizer==3.4.7
     # via requests
 click==8.1.8
     # via
     #   -r .nox/update_constraints/tmp/constraints-pyodide.in
     #   pyodide-build
     #   pyodide-cli
-distlib==0.4.0
+distlib==0.4.1
     # via virtualenv
-filelock==3.25.2
+filelock==3.29.1
     # via
     #   python-discovery
     #   virtualenv
-idna==3.11
+idna==3.18
     # via requests
 leb128==1.0.9
     # via auditwheel-emscripten
-markdown-it-py==4.0.0
+markdown-it-py==4.2.0
     # via rich
 mdurl==0.1.2
     # via markdown-it-py
-packaging==26.0
+packaging==26.2
     # via
     #   auditwheel-emscripten
     #   build
     #   pyodide-build
     #   wheel
-pip==26.0.1
+pip==26.1.2
     # via -r .nox/update_constraints/tmp/constraints-pyodide.in
-platformdirs==4.9.4
+platformdirs==4.10.0
     # via
     #   pyodide-build
     #   python-discovery
     #   virtualenv
-pydantic==2.12.5
+pydantic==2.13.4
     # via
     #   pyodide-build
     #   pyodide-lock
-pydantic-core==2.41.5
+pydantic-core==2.46.4
     # via pydantic
-pygments==2.19.2
+pygments==2.20.0
     # via rich
-pyodide-build==0.33.0
+pyodide-build==0.34.4
     # via -r .nox/update_constraints/tmp/constraints-pyodide.in
 pyodide-cli==0.5.0
     # via
     #   auditwheel-emscripten
     #   pyodide-build
-pyodide-lock==0.1.2
+pyodide-lock==0.1.3
     # via pyodide-build
 pyproject-hooks==1.2.0
     # via build
-python-discovery==1.2.0
+python-discovery==1.4.0
     # via virtualenv
-requests==2.32.5
+requests==2.34.2
     # via pyodide-build
-rich==14.3.3
+rich==15.0.0
     # via
     #   pyodide-build
     #   pyodide-cli
@@ -79,13 +79,13 @@ typing-extensions==4.15.0
     #   typing-inspection
 typing-inspection==0.4.2
     # via pydantic
-urllib3==2.6.3
+urllib3==2.7.0
     # via requests
-virtualenv==21.2.0
+virtualenv==21.4.2
     # via
     #   build
     #   pyodide-build
-wheel==0.46.3
+wheel==0.47.0
     # via
     #   auditwheel-emscripten
     #   pyodide-build

cibuildwheel/resources/constraints-pyodide313.txt

@@ -2,71 +2,71 @@
 #    nox -s update_constraints
 annotated-types==0.7.0
     # via pydantic
-auditwheel-emscripten==0.2.3
+auditwheel-emscripten==0.2.5
     # via pyodide-build
-build==1.2.2.post1
+build==1.5.0
     # via
     #   -r .nox/update_constraints/tmp/constraints-pyodide.in
     #   pyodide-build
-certifi==2026.2.25
+certifi==2026.5.20
     # via requests
-charset-normalizer==3.4.6
+charset-normalizer==3.4.7
     # via requests
 click==8.1.8
     # via
     #   -r .nox/update_constraints/tmp/constraints-pyodide.in
     #   pyodide-build
     #   pyodide-cli
-distlib==0.4.0
+distlib==0.4.1
     # via virtualenv
-filelock==3.25.2
+filelock==3.29.1
     # via
     #   python-discovery
     #   virtualenv
-idna==3.11
+idna==3.18
     # via requests
 leb128==1.0.9
     # via auditwheel-emscripten
-markdown-it-py==4.0.0
+markdown-it-py==4.2.0
     # via rich
 mdurl==0.1.2
     # via markdown-it-py
-packaging==26.0
+packaging==26.2
     # via
     #   auditwheel-emscripten
     #   build
     #   pyodide-build
     #   wheel
-pip==26.0.1
+pip==26.1.2
     # via -r .nox/update_constraints/tmp/constraints-pyodide.in
-platformdirs==4.9.4
+platformdirs==4.10.0
     # via
     #   pyodide-build
     #   python-discovery
     #   virtualenv
-pydantic==2.12.5
+pydantic==2.13.4
     # via
     #   pyodide-build
     #   pyodide-lock
-pydantic-core==2.41.5
+pydantic-core==2.46.4
     # via pydantic
-pygments==2.19.2
+pygments==2.20.0
     # via rich
-pyodide-build==0.33.0
+pyodide-build==0.34.4
     # via -r .nox/update_constraints/tmp/constraints-pyodide.in
 pyodide-cli==0.5.0
     # via
     #   auditwheel-emscripten
     #   pyodide-build
-pyodide-lock==0.1.2
+pyodide-lock==0.1.3
     # via pyodide-build
 pyproject-hooks==1.2.0
     # via build
-python-discovery==1.2.0
+python-discovery==1.4.0
     # via virtualenv
-requests==2.32.5
+requests==2.34.2
     # via pyodide-build
-rich==14.3.3
+rich==15.0.0
     # via
     #   pyodide-build
     #   pyodide-cli
@@ -79,13 +79,13 @@ typing-extensions==4.15.0
     #   typing-inspection
 typing-inspection==0.4.2
     # via pydantic
-urllib3==2.6.3
+urllib3==2.7.0
     # via requests
-virtualenv==21.2.0
+virtualenv==21.4.2
     # via
     #   build
     #   pyodide-build
-wheel==0.46.3
+wheel==0.47.0
     # via
     #   auditwheel-emscripten
     #   pyodide-build

cibuildwheel/resources/constraints-pyodide314.txt

@@ -0,0 +1,91 @@
+# This file was autogenerated by uv via the following command:
+#    nox -s update_constraints
+annotated-types==0.7.0
+    # via pydantic
+auditwheel-emscripten==0.2.5
+    # via pyodide-build
+build==1.5.0
+    # via
+    #   -r .nox/update_constraints/tmp/constraints-pyodide.in
+    #   pyodide-build
+certifi==2026.5.20
+    # via requests
+charset-normalizer==3.4.7
+    # via requests
+click==8.1.8
+    # via
+    #   -r .nox/update_constraints/tmp/constraints-pyodide.in
+    #   pyodide-build
+    #   pyodide-cli
+distlib==0.4.1
+    # via virtualenv
+filelock==3.29.1
+    # via
+    #   python-discovery
+    #   virtualenv
+idna==3.18
+    # via requests
+leb128==1.0.9
+    # via auditwheel-emscripten
+markdown-it-py==4.2.0
+    # via rich
+mdurl==0.1.2
+    # via markdown-it-py
+packaging==26.2
+    # via
+    #   auditwheel-emscripten
+    #   build
+    #   pyodide-build
+    #   wheel
+pip==26.1.2
+    # via -r .nox/update_constraints/tmp/constraints-pyodide.in
+platformdirs==4.10.0
+    # via
+    #   pyodide-build
+    #   python-discovery
+    #   virtualenv
+pydantic==2.13.4
+    # via
+    #   pyodide-build
+    #   pyodide-lock
+pydantic-core==2.46.4
+    # via pydantic
+pygments==2.20.0
+    # via rich
+pyodide-build==0.34.4
+    # via -r .nox/update_constraints/tmp/constraints-pyodide.in
+pyodide-cli==0.5.0
+    # via
+    #   auditwheel-emscripten
+    #   pyodide-build
+pyodide-lock==0.1.3
+    # via pyodide-build
+pyproject-hooks==1.2.0
+    # via build
+python-discovery==1.4.0
+    # via virtualenv
+requests==2.34.2
+    # via pyodide-build
+rich==15.0.0
+    # via
+    #   pyodide-build
+    #   pyodide-cli
+ruamel-yaml==0.19.1
+    # via pyodide-build
+typing-extensions==4.15.0
+    # via
+    #   pydantic
+    #   pydantic-core
+    #   typing-inspection
+typing-inspection==0.4.2
+    # via pydantic
+urllib3==2.7.0
+    # via requests
+virtualenv==21.4.2
+    # via
+    #   build
+    #   pyodide-build
+wheel==0.47.0
+    # via
+    #   auditwheel-emscripten
+    #   pyodide-build

cibuildwheel/resources/constraints-python310.txt

@@ -1,42 +1,105 @@
 # This file was autogenerated by uv via the following command:
 #    nox -s update_constraints
+abi3audit==0.0.26
+    # via -r cibuildwheel/resources/constraints.in
+abi3info==2025.11.29
+    # via abi3audit
 altgraph==0.17.5
     # via macholib
-build==1.4.3
+attrs==26.1.0
+    # via
+    #   cattrs
+    #   requests-cache
+auditwheel==6.7.0
     # via -r cibuildwheel/resources/constraints.in
+build==1.5.0
+    # via -r cibuildwheel/resources/constraints.in
+cattrs==26.1.0
+    # via requests-cache
+certifi==2026.5.20
+    # via requests
+charset-normalizer==3.4.7
+    # via requests
 delocate==0.13.0
     # via -r cibuildwheel/resources/constraints.in
-distlib==0.4.0
+delvewheel==1.13.0
+    # via -r cibuildwheel/resources/constraints.in
+distlib==0.4.1
     # via virtualenv
-filelock==3.25.2
+exceptiongroup==1.3.1
+    # via cattrs
+filelock==3.29.1
     # via
     #   python-discovery
     #   virtualenv
+idna==3.18
+    # via
+    #   requests
+    #   url-normalize
 importlib-metadata==9.0.0
     # via build
+kaitaistruct==0.11
+    # via abi3audit
 macholib==1.16.4
     # via delocate
-packaging==26.0
+markdown-it-py==4.2.0
+    # via rich
+mdurl==0.1.2
+    # via markdown-it-py
+packaging==26.2
     # via
+    #   abi3audit
+    #   auditwheel
     #   build
     #   delocate
-pip==26.0.1
+patchelf==0.17.2.4
     # via -r cibuildwheel/resources/constraints.in
-platformdirs==4.9.6
+pefile==2024.8.26
+    # via
+    #   abi3audit
+    #   delvewheel
+pip==26.1.2
+    # via -r cibuildwheel/resources/constraints.in
+pkgconf==2.5.1.post2
+    # via -r cibuildwheel/resources/constraints.in
+platformdirs==4.10.0
     # via
     #   python-discovery
+    #   requests-cache
     #   virtualenv
+pyelftools==0.33
+    # via
+    #   abi3audit
+    #   auditwheel
+pygments==2.20.0
+    # via rich
 pyproject-hooks==1.2.0
     # via build
-python-discovery==1.2.2
+python-discovery==1.4.0
     # via virtualenv
+requests==2.34.2
+    # via
+    #   abi3audit
+    #   requests-cache
+requests-cache==1.3.2
+    # via abi3audit
+rich==15.0.0
+    # via abi3audit
 tomli==2.4.1
     # via build
 typing-extensions==4.15.0
     # via
+    #   cattrs
     #   delocate
+    #   exceptiongroup
     #   virtualenv
-virtualenv==21.2.1
+url-normalize==3.0.0
+    # via requests-cache
+urllib3==2.7.0
+    # via
+    #   requests
+    #   requests-cache
+virtualenv==21.4.2
     # via -r cibuildwheel/resources/constraints.in
-zipp==3.23.0
+zipp==4.1.0
     # via importlib-metadata

cibuildwheel/resources/constraints-python311.txt

@@ -1,34 +1,96 @@
 # This file was autogenerated by uv via the following command:
 #    nox -s update_constraints
+abi3audit==0.0.26
+    # via -r cibuildwheel/resources/constraints.in
+abi3info==2025.11.29
+    # via abi3audit
 altgraph==0.17.5
     # via macholib
-build==1.4.3
+attrs==26.1.0
+    # via
+    #   cattrs
+    #   requests-cache
+auditwheel==6.7.0
     # via -r cibuildwheel/resources/constraints.in
+build==1.5.0
+    # via -r cibuildwheel/resources/constraints.in
+cattrs==26.1.0
+    # via requests-cache
+certifi==2026.5.20
+    # via requests
+charset-normalizer==3.4.7
+    # via requests
 delocate==0.13.0
     # via -r cibuildwheel/resources/constraints.in
-distlib==0.4.0
+delvewheel==1.13.0
+    # via -r cibuildwheel/resources/constraints.in
+distlib==0.4.1
     # via virtualenv
-filelock==3.25.2
+filelock==3.29.1
     # via
     #   python-discovery
     #   virtualenv
+idna==3.18
+    # via
+    #   requests
+    #   url-normalize
+kaitaistruct==0.11
+    # via abi3audit
 macholib==1.16.4
     # via delocate
-packaging==26.0
+markdown-it-py==4.2.0
+    # via rich
+mdurl==0.1.2
+    # via markdown-it-py
+packaging==26.2
     # via
+    #   abi3audit
+    #   auditwheel
     #   build
     #   delocate
-pip==26.0.1
+patchelf==0.17.2.4
     # via -r cibuildwheel/resources/constraints.in
-platformdirs==4.9.6
+pefile==2024.8.26
+    # via
+    #   abi3audit
+    #   delvewheel
+pip==26.1.2; implementation_name != "graalpy" or platform_system != "Windows"
+pip==26.0.1; implementation_name == "graalpy" and platform_system == "Windows"
+    # via -r cibuildwheel/resources/constraints.in
+pkgconf==2.5.1.post2
+    # via -r cibuildwheel/resources/constraints.in
+platformdirs==4.10.0
     # via
     #   python-discovery
+    #   requests-cache
     #   virtualenv
+pyelftools==0.33
+    # via
+    #   abi3audit
+    #   auditwheel
+pygments==2.20.0
+    # via rich
 pyproject-hooks==1.2.0
     # via build
-python-discovery==1.2.2
+python-discovery==1.4.0
     # via virtualenv
+requests==2.34.2
+    # via
+    #   abi3audit
+    #   requests-cache
+requests-cache==1.3.2
+    # via abi3audit
+rich==15.0.0
+    # via abi3audit
 typing-extensions==4.15.0
-    # via delocate
+    # via
-virtualenv==21.2.1
+    #   cattrs
+    #   delocate
+url-normalize==3.0.0
+    # via requests-cache
+urllib3==2.7.0
+    # via
+    #   requests
+    #   requests-cache
+virtualenv==21.4.2
     # via -r cibuildwheel/resources/constraints.in

cibuildwheel/resources/constraints-python312.txt

@@ -1,34 +1,96 @@
 # This file was autogenerated by uv via the following command:
 #    nox -s update_constraints
+abi3audit==0.0.26
+    # via -r cibuildwheel/resources/constraints.in
+abi3info==2025.11.29
+    # via abi3audit
 altgraph==0.17.5
     # via macholib
-build==1.4.3
+attrs==26.1.0
+    # via
+    #   cattrs
+    #   requests-cache
+auditwheel==6.7.0
     # via -r cibuildwheel/resources/constraints.in
+build==1.5.0
+    # via -r cibuildwheel/resources/constraints.in
+cattrs==26.1.0
+    # via requests-cache
+certifi==2026.5.20
+    # via requests
+charset-normalizer==3.4.7
+    # via requests
 delocate==0.13.0
     # via -r cibuildwheel/resources/constraints.in
-distlib==0.4.0
+delvewheel==1.13.0
+    # via -r cibuildwheel/resources/constraints.in
+distlib==0.4.1
     # via virtualenv
-filelock==3.25.2
+filelock==3.29.1
     # via
     #   python-discovery
     #   virtualenv
+idna==3.18
+    # via
+    #   requests
+    #   url-normalize
+kaitaistruct==0.11
+    # via abi3audit
 macholib==1.16.4
     # via delocate
-packaging==26.0
+markdown-it-py==4.2.0
+    # via rich
+mdurl==0.1.2
+    # via markdown-it-py
+packaging==26.2
     # via
+    #   abi3audit
+    #   auditwheel
     #   build
     #   delocate
-pip==26.0.1
+patchelf==0.17.2.4
     # via -r cibuildwheel/resources/constraints.in
-platformdirs==4.9.6
+pefile==2024.8.26
+    # via
+    #   abi3audit
+    #   delvewheel
+pip==26.1.2; implementation_name != "graalpy" or platform_system != "Windows"
+pip==26.0.1; implementation_name == "graalpy" and platform_system == "Windows"
+    # via -r cibuildwheel/resources/constraints.in
+pkgconf==2.5.1.post2
+    # via -r cibuildwheel/resources/constraints.in
+platformdirs==4.10.0
     # via
     #   python-discovery
+    #   requests-cache
     #   virtualenv
+pyelftools==0.33
+    # via
+    #   abi3audit
+    #   auditwheel
+pygments==2.20.0
+    # via rich
 pyproject-hooks==1.2.0
     # via build
-python-discovery==1.2.2
+python-discovery==1.4.0
     # via virtualenv
+requests==2.34.2
+    # via
+    #   abi3audit
+    #   requests-cache
+requests-cache==1.3.2
+    # via abi3audit
+rich==15.0.0
+    # via abi3audit
 typing-extensions==4.15.0
-    # via delocate
+    # via
-virtualenv==21.2.1
+    #   cattrs
+    #   delocate
+url-normalize==3.0.0
+    # via requests-cache
+urllib3==2.7.0
+    # via
+    #   requests
+    #   requests-cache
+virtualenv==21.4.2
     # via -r cibuildwheel/resources/constraints.in

cibuildwheel/resources/constraints-python313.txt

@@ -1,34 +1,95 @@
 # This file was autogenerated by uv via the following command:
 #    nox -s update_constraints
+abi3audit==0.0.26
+    # via -r cibuildwheel/resources/constraints.in
+abi3info==2025.11.29
+    # via abi3audit
 altgraph==0.17.5
     # via macholib
-build==1.4.3
+attrs==26.1.0
+    # via
+    #   cattrs
+    #   requests-cache
+auditwheel==6.7.0
     # via -r cibuildwheel/resources/constraints.in
+build==1.5.0
+    # via -r cibuildwheel/resources/constraints.in
+cattrs==26.1.0
+    # via requests-cache
+certifi==2026.5.20
+    # via requests
+charset-normalizer==3.4.7
+    # via requests
 delocate==0.13.0
     # via -r cibuildwheel/resources/constraints.in
-distlib==0.4.0
+delvewheel==1.13.0
+    # via -r cibuildwheel/resources/constraints.in
+distlib==0.4.1
     # via virtualenv
-filelock==3.25.2
+filelock==3.29.1
     # via
     #   python-discovery
     #   virtualenv
+idna==3.18
+    # via
+    #   requests
+    #   url-normalize
+kaitaistruct==0.11
+    # via abi3audit
 macholib==1.16.4
     # via delocate
-packaging==26.0
+markdown-it-py==4.2.0
+    # via rich
+mdurl==0.1.2
+    # via markdown-it-py
+packaging==26.2
     # via
+    #   abi3audit
+    #   auditwheel
     #   build
     #   delocate
-pip==26.0.1
+patchelf==0.17.2.4
     # via -r cibuildwheel/resources/constraints.in
-platformdirs==4.9.6
+pefile==2024.8.26
+    # via
+    #   abi3audit
+    #   delvewheel
+pip==26.1.2
+    # via -r cibuildwheel/resources/constraints.in
+pkgconf==2.5.1.post2
+    # via -r cibuildwheel/resources/constraints.in
+platformdirs==4.10.0
     # via
     #   python-discovery
+    #   requests-cache
     #   virtualenv
+pyelftools==0.33
+    # via
+    #   abi3audit
+    #   auditwheel
+pygments==2.20.0
+    # via rich
 pyproject-hooks==1.2.0
     # via build
-python-discovery==1.2.2
+python-discovery==1.4.0
     # via virtualenv
+requests==2.34.2
+    # via
+    #   abi3audit
+    #   requests-cache
+requests-cache==1.3.2
+    # via abi3audit
+rich==15.0.0
+    # via abi3audit
 typing-extensions==4.15.0
-    # via delocate
+    # via
-virtualenv==21.2.1
+    #   cattrs
+    #   delocate
+url-normalize==3.0.0
+    # via requests-cache
+urllib3==2.7.0
+    # via
+    #   requests
+    #   requests-cache
+virtualenv==21.4.2
     # via -r cibuildwheel/resources/constraints.in

cibuildwheel/resources/constraints-python314.txt

@@ -1,34 +1,95 @@
 # This file was autogenerated by uv via the following command:
 #    nox -s update_constraints
+abi3audit==0.0.26
+    # via -r cibuildwheel/resources/constraints.in
+abi3info==2025.11.29
+    # via abi3audit
 altgraph==0.17.5
     # via macholib
-build==1.4.3
+attrs==26.1.0
+    # via
+    #   cattrs
+    #   requests-cache
+auditwheel==6.7.0
     # via -r cibuildwheel/resources/constraints.in
+build==1.5.0
+    # via -r cibuildwheel/resources/constraints.in
+cattrs==26.1.0
+    # via requests-cache
+certifi==2026.5.20
+    # via requests
+charset-normalizer==3.4.7
+    # via requests
 delocate==0.13.0
     # via -r cibuildwheel/resources/constraints.in
-distlib==0.4.0
+delvewheel==1.13.0
+    # via -r cibuildwheel/resources/constraints.in
+distlib==0.4.1
     # via virtualenv
-filelock==3.25.2
+filelock==3.29.1
     # via
     #   python-discovery
     #   virtualenv
+idna==3.18
+    # via
+    #   requests
+    #   url-normalize
+kaitaistruct==0.11
+    # via abi3audit
 macholib==1.16.4
     # via delocate
-packaging==26.0
+markdown-it-py==4.2.0
+    # via rich
+mdurl==0.1.2
+    # via markdown-it-py
+packaging==26.2
     # via
+    #   abi3audit
+    #   auditwheel
     #   build
     #   delocate
-pip==26.0.1
+patchelf==0.17.2.4
     # via -r cibuildwheel/resources/constraints.in
-platformdirs==4.9.6
+pefile==2024.8.26
+    # via
+    #   abi3audit
+    #   delvewheel
+pip==26.1.2
+    # via -r cibuildwheel/resources/constraints.in
+pkgconf==2.5.1.post2
+    # via -r cibuildwheel/resources/constraints.in
+platformdirs==4.10.0
     # via
     #   python-discovery
+    #   requests-cache
     #   virtualenv
+pyelftools==0.33
+    # via
+    #   abi3audit
+    #   auditwheel
+pygments==2.20.0
+    # via rich
 pyproject-hooks==1.2.0
     # via build
-python-discovery==1.2.2
+python-discovery==1.4.0
     # via virtualenv
+requests==2.34.2
+    # via
+    #   abi3audit
+    #   requests-cache
+requests-cache==1.3.2
+    # via abi3audit
+rich==15.0.0
+    # via abi3audit
 typing-extensions==4.15.0
-    # via delocate
+    # via
-virtualenv==21.2.1
+    #   cattrs
+    #   delocate
+url-normalize==3.0.0
+    # via requests-cache
+urllib3==2.7.0
+    # via
+    #   requests
+    #   requests-cache
+virtualenv==21.4.2
     # via -r cibuildwheel/resources/constraints.in

cibuildwheel/resources/constraints-python315.txt

@@ -0,0 +1,95 @@
+# This file was autogenerated by uv via the following command:
+#    nox -s update_constraints
+abi3audit==0.0.26
+    # via -r cibuildwheel/resources/constraints.in
+abi3info==2025.11.29
+    # via abi3audit
+altgraph==0.17.5
+    # via macholib
+attrs==26.1.0
+    # via
+    #   cattrs
+    #   requests-cache
+auditwheel==6.7.0
+    # via -r cibuildwheel/resources/constraints.in
+build==1.5.0
+    # via -r cibuildwheel/resources/constraints.in
+cattrs==26.1.0
+    # via requests-cache
+certifi==2026.5.20
+    # via requests
+charset-normalizer==3.4.7
+    # via requests
+delocate==0.13.0
+    # via -r cibuildwheel/resources/constraints.in
+delvewheel==1.13.0
+    # via -r cibuildwheel/resources/constraints.in
+distlib==0.4.1
+    # via virtualenv
+filelock==3.29.1
+    # via
+    #   python-discovery
+    #   virtualenv
+idna==3.18
+    # via
+    #   requests
+    #   url-normalize
+kaitaistruct==0.11
+    # via abi3audit
+macholib==1.16.4
+    # via delocate
+markdown-it-py==4.2.0
+    # via rich
+mdurl==0.1.2
+    # via markdown-it-py
+packaging==26.2
+    # via
+    #   abi3audit
+    #   auditwheel
+    #   build
+    #   delocate
+patchelf==0.17.2.4
+    # via -r cibuildwheel/resources/constraints.in
+pefile==2024.8.26
+    # via
+    #   abi3audit
+    #   delvewheel
+pip==26.1.2
+    # via -r cibuildwheel/resources/constraints.in
+pkgconf==2.5.1.post2
+    # via -r cibuildwheel/resources/constraints.in
+platformdirs==4.10.0
+    # via
+    #   python-discovery
+    #   requests-cache
+    #   virtualenv
+pyelftools==0.33
+    # via
+    #   abi3audit
+    #   auditwheel
+pygments==2.20.0
+    # via rich
+pyproject-hooks==1.2.0
+    # via build
+python-discovery==1.4.0
+    # via virtualenv
+requests==2.34.2
+    # via
+    #   abi3audit
+    #   requests-cache
+requests-cache==1.3.2
+    # via abi3audit
+rich==15.0.0
+    # via abi3audit
+typing-extensions==4.15.0
+    # via
+    #   cattrs
+    #   delocate
+url-normalize==3.0.0
+    # via requests-cache
+urllib3==2.7.0
+    # via
+    #   requests
+    #   requests-cache
+virtualenv==21.4.2
+    # via -r cibuildwheel/resources/constraints.in

cibuildwheel/resources/constraints-python38.txt

@@ -1,42 +0,0 @@
-# This file was autogenerated by uv via the following command:
-#    nox -s update_constraints
-altgraph==0.17.5
-    # via macholib
-build==1.2.2.post1
-    # via -r cibuildwheel/resources/constraints.in
-delocate==0.12.0
-    # via -r cibuildwheel/resources/constraints.in
-distlib==0.4.0
-    # via virtualenv
-filelock==3.16.1
-    # via
-    #   python-discovery
-    #   virtualenv
-importlib-metadata==8.5.0
-    # via build
-macholib==1.16.4
-    # via delocate
-packaging==26.0
-    # via
-    #   build
-    #   delocate
-pip==25.0.1
-    # via -r cibuildwheel/resources/constraints.in
-platformdirs==4.3.6
-    # via
-    #   python-discovery
-    #   virtualenv
-pyproject-hooks==1.2.0
-    # via build
-python-discovery==1.2.2
-    # via virtualenv
-tomli==2.4.1
-    # via build
-typing-extensions==4.13.2
-    # via
-    #   delocate
-    #   virtualenv
-virtualenv==21.2.1
-    # via -r cibuildwheel/resources/constraints.in
-zipp==3.20.2
-    # via importlib-metadata

cibuildwheel/resources/constraints-python39.txt

@@ -1,42 +1,107 @@
 # This file was autogenerated by uv via the following command:
 #    nox -s update_constraints
+abi3audit==0.0.25
+    # via -r cibuildwheel/resources/constraints.in
+abi3info==2025.4.29
+    # via abi3audit
 altgraph==0.17.5
     # via macholib
-build==1.4.3
+attrs==26.1.0
+    # via
+    #   cattrs
+    #   requests-cache
+auditwheel==6.4.2
     # via -r cibuildwheel/resources/constraints.in
+build==1.4.4
+    # via -r cibuildwheel/resources/constraints.in
+cattrs==25.3.0
+    # via requests-cache
+certifi==2026.5.20
+    # via requests
+charset-normalizer==3.4.7
+    # via requests
 delocate==0.13.0
     # via -r cibuildwheel/resources/constraints.in
-distlib==0.4.0
+delvewheel==1.13.0
+    # via -r cibuildwheel/resources/constraints.in
+distlib==0.4.1
     # via virtualenv
+exceptiongroup==1.3.1
+    # via cattrs
 filelock==3.19.1
     # via
     #   python-discovery
     #   virtualenv
+idna==3.18
+    # via
+    #   requests
+    #   url-normalize
 importlib-metadata==8.7.1
-    # via build
-macholib==1.16.4
-    # via delocate
-packaging==26.0
     # via
     #   build
+    #   pkgconf
+kaitaistruct==0.11
+    # via abi3audit
+macholib==1.16.4
+    # via delocate
+markdown-it-py==3.0.0
+    # via rich
+mdurl==0.1.2
+    # via markdown-it-py
+packaging==25.0
+    # via
+    #   abi3audit
+    #   auditwheel
+    #   build
     #   delocate
+patchelf==0.17.2.4
+    # via -r cibuildwheel/resources/constraints.in
+pefile==2024.8.26
+    # via
+    #   abi3audit
+    #   delvewheel
 pip==26.0.1
     # via -r cibuildwheel/resources/constraints.in
+pkgconf==2.4.3.post2
+    # via -r cibuildwheel/resources/constraints.in
 platformdirs==4.4.0
     # via
     #   python-discovery
+    #   requests-cache
     #   virtualenv
+pyelftools==0.32
+    # via
+    #   abi3audit
+    #   auditwheel
+pygments==2.20.0
+    # via rich
 pyproject-hooks==1.2.0
     # via build
-python-discovery==1.2.2
+python-discovery==1.4.0
     # via virtualenv
+requests==2.32.5
+    # via
+    #   abi3audit
+    #   requests-cache
+requests-cache==1.2.1
+    # via abi3audit
+rich==14.2.0
+    # via abi3audit
 tomli==2.4.1
     # via build
 typing-extensions==4.15.0
     # via
+    #   cattrs
     #   delocate
+    #   exceptiongroup
     #   virtualenv
-virtualenv==21.2.1
+url-normalize==2.2.1
+    # via requests-cache
+urllib3==2.6.3
+    # via
+    #   requests
+    #   requests-cache
+virtualenv==21.4.2
     # via -r cibuildwheel/resources/constraints.in
-zipp==3.23.0
+zipp==3.23.1
     # via importlib-metadata

cibuildwheel/resources/constraints.in

@@ -1,4 +1,11 @@
 pip
 build
 delocate
+delvewheel
 virtualenv
+abi3audit
+
+# Android
+auditwheel
+patchelf
+pkgconf

cibuildwheel/resources/constraints.txt

@@ -1,34 +1,95 @@
 # This file was autogenerated by uv via the following command:
 #    nox -s update_constraints
+abi3audit==0.0.26
+    # via -r cibuildwheel/resources/constraints.in
+abi3info==2025.11.29
+    # via abi3audit
 altgraph==0.17.5
     # via macholib
-build==1.4.3
+attrs==26.1.0
+    # via
+    #   cattrs
+    #   requests-cache
+auditwheel==6.7.0
     # via -r cibuildwheel/resources/constraints.in
+build==1.5.0
+    # via -r cibuildwheel/resources/constraints.in
+cattrs==26.1.0
+    # via requests-cache
+certifi==2026.5.20
+    # via requests
+charset-normalizer==3.4.7
+    # via requests
 delocate==0.13.0
     # via -r cibuildwheel/resources/constraints.in
-distlib==0.4.0
+delvewheel==1.13.0
+    # via -r cibuildwheel/resources/constraints.in
+distlib==0.4.1
     # via virtualenv
-filelock==3.25.2
+filelock==3.29.1
     # via
     #   python-discovery
     #   virtualenv
+idna==3.18
+    # via
+    #   requests
+    #   url-normalize
+kaitaistruct==0.11
+    # via abi3audit
 macholib==1.16.4
     # via delocate
-packaging==26.0
+markdown-it-py==4.2.0
+    # via rich
+mdurl==0.1.2
+    # via markdown-it-py
+packaging==26.2
     # via
+    #   abi3audit
+    #   auditwheel
     #   build
     #   delocate
-pip==26.0.1
+patchelf==0.17.2.4
     # via -r cibuildwheel/resources/constraints.in
-platformdirs==4.9.6
+pefile==2024.8.26
+    # via
+    #   abi3audit
+    #   delvewheel
+pip==26.1.2
+    # via -r cibuildwheel/resources/constraints.in
+pkgconf==2.5.1.post2
+    # via -r cibuildwheel/resources/constraints.in
+platformdirs==4.10.0
     # via
     #   python-discovery
+    #   requests-cache
     #   virtualenv
+pyelftools==0.33
+    # via
+    #   abi3audit
+    #   auditwheel
+pygments==2.20.0
+    # via rich
 pyproject-hooks==1.2.0
     # via build
-python-discovery==1.2.2
+python-discovery==1.4.0
     # via virtualenv
+requests==2.34.2
+    # via
+    #   abi3audit
+    #   requests-cache
+requests-cache==1.3.2
+    # via abi3audit
+rich==15.0.0
+    # via abi3audit
 typing-extensions==4.15.0
-    # via delocate
+    # via
-virtualenv==21.2.1
+    #   cattrs
+    #   delocate
+url-normalize==3.0.0
+    # via requests-cache
+urllib3==2.7.0
+    # via
+    #   requests
+    #   requests-cache
+virtualenv==21.4.2
     # via -r cibuildwheel/resources/constraints.in

cibuildwheel/resources/defaults.toml

@@ -1,3 +1,6 @@
+# These are the defaults used by cibuildwheel itself. They should match the values in
+# generate_schema.py, which are used by external tools for validation and IDE support.
+
 [tool.cibuildwheel]
 build = "*"
 skip = ""
@@ -5,6 +8,8 @@ test-skip = ""
 enable = []
 
 archs = ["auto"]
+audit-requires = ["abi3audit"]
+audit-command = "abi3audit --strict --report {abi3_wheel}"
 build-frontend = "default"
 config-settings = {}
 dependency-versions = "pinned"
@@ -50,6 +55,13 @@ musllinux-s390x-image = "musllinux_1_2"
 musllinux-armv7l-image = "musllinux_1_2"
 musllinux-riscv64-image = "musllinux_1_2"
 
+[tool.cibuildwheel.xbuild-files]
+numpy = [
+    "numpy/_core/include/numpy/_numpyconfig.h",
+    "numpy/_core/include/numpy/numpyconfig.h",
+    "numpy/_core/lib/libnpymath.a",
+    "numpy/random/lib/libnpyrandom.a",
+]
 
 [tool.cibuildwheel.linux]
 repair-wheel-command = "auditwheel repair -w {dest_dir} {wheel}"
@@ -58,9 +70,12 @@ repair-wheel-command = "auditwheel repair -w {dest_dir} {wheel}"
 repair-wheel-command = "delocate-wheel --require-archs {delocate_archs} -w {dest_dir} -v {wheel}"
 
 [tool.cibuildwheel.windows]
+repair-wheel-command = "delvewheel repair -w {dest_dir} -v {wheel}"
 
 [tool.cibuildwheel.android]
+repair-wheel-command = "auditwheel repair --ldpaths {ldpaths} -w {dest_dir} {wheel}"
 
 [tool.cibuildwheel.ios]
 
 [tool.cibuildwheel.pyodide]
+audit-command = ""

cibuildwheel/resources/free-threaded-enable-315.xml

@@ -8,7 +8,7 @@
                 <key>choiceAttribute</key>
                 <string>selected</string>
                 <key>choiceIdentifier</key>
-                <string>org.python.Python.PythonTFramework-3.13</string>
+                <string>org.python.Python.PythonTFramework-3.15</string>
         </dict>
 </array>
 </plist>

cibuildwheel/resources/ios-support/_cross_venv.py

@@ -0,0 +1,103 @@
+import shutil
+import sys
+import sysconfig
+from pathlib import Path
+
+SITE_PACKAGE_PATH = Path(__file__).parent
+
+###########################################################################
+# importlib module patches
+###########################################################################
+
+
+def patch_env_create(env):
+    """
+    Patch the process of creating virtual environments to ensure that the cross
+    environment modification files are also copied as part of environment
+    creation.
+    """
+    old_pip_env_create = env._PipBackend.create
+
+    def pip_env_create(self, path, *args, **kwargs):
+        result = old_pip_env_create(self, path, *args, **kwargs)
+        # Copy any _cross_*.pth or _cross_*.py file, plus the cross-platform
+        # sysconfigdata module and sysconfig_vars JSON to the new environment.
+        data_name = sysconfig._get_sysconfigdata_name()
+        json_name = data_name.replace("_sysconfigdata", "_sysconfig_vars")
+        for filename in [
+            "_cross_venv.pth",
+            "_cross_venv.py",
+            f"_cross_{sys.implementation._multiarch.replace('-', '_')}.py",
+            f"{data_name}.py",
+            f"{json_name}.json",
+        ]:
+            src = SITE_PACKAGE_PATH / filename
+            target = Path(path) / src.relative_to(SITE_PACKAGE_PATH.parent.parent.parent)
+            if not target.exists():
+                shutil.copy(src, target)
+        return result
+
+    env._PipBackend.create = pip_env_create
+
+
+# Import hook that patches the creation of virtual environments by `build`
+#
+# The approach used here is the same as the one used by virtualenv to patch
+# distutils (but without support for the older load_module API).
+# https://docs.python.org/3/library/importlib.html#setting-up-an-importer
+_BUILD_PATCH = ("build.env",)
+
+
+class _Finder:
+    """A meta path finder that allows patching the imported build modules."""
+
+    fullname = None
+
+    # lock[0] is threading.Lock(), but initialized lazily to avoid importing
+    # threading very early at startup, because there are gevent-based
+    # applications that need to be first to import threading by themselves.
+    # See https://github.com/pypa/virtualenv/issues/1895 for details.
+    lock = []  # noqa: RUF012
+
+    def find_spec(self, fullname, path, target=None):
+        if fullname in _BUILD_PATCH and self.fullname is None:
+            # initialize lock[0] lazily
+            if len(self.lock) == 0:
+                import threading
+
+                lock = threading.Lock()
+                # there is possibility that two threads T1 and T2 are
+                # simultaneously running into find_spec, observing .lock as
+                # empty, and further going into hereby initialization. However
+                # due to the GIL, list.append() operation is atomic and this
+                # way only one of the threads will "win" to put the lock
+                # - that every thread will use - into .lock[0].
+                # https://docs.python.org/3/faq/library.html#what-kinds-of-global-value-mutation-are-thread-safe
+                self.lock.append(lock)
+
+            from functools import partial
+            from importlib.util import find_spec
+
+            with self.lock[0]:
+                self.fullname = fullname
+                try:
+                    spec = find_spec(fullname, path)
+                    if spec is not None:
+                        # https://www.python.org/dev/peps/pep-0451/#how-loading-will-work
+                        old = spec.loader.exec_module
+                        func = self.exec_module
+                        if old is not func:
+                            spec.loader.exec_module = partial(func, old)
+                        return spec
+                finally:
+                    self.fullname = None
+        return None
+
+    @staticmethod
+    def exec_module(old, module):
+        old(module)
+        if module.__name__ in _BUILD_PATCH:
+            patch_env_create(module)
+
+
+sys.meta_path.insert(0, _Finder())

cibuildwheel/resources/ios-support/arm64-iphoneos/_cross_arm64_iphoneos.py

@@ -0,0 +1,79 @@
+# A site package that turns a macOS virtual environment
+# into an arm64 iphoneos cross-platform virtual environment
+import platform
+import subprocess
+import sys
+import sysconfig
+
+###########################################################################
+# sys module patches
+###########################################################################
+sys.cross_compiling = True
+sys.platform = "ios"
+sys.implementation._multiarch = "arm64-iphoneos"
+sys.base_prefix = sysconfig._get_sysconfigdata()["prefix"]
+sys.base_exec_prefix = sysconfig._get_sysconfigdata()["prefix"]
+
+###########################################################################
+# subprocess module patches
+###########################################################################
+subprocess._can_fork_exec = True
+
+
+###########################################################################
+# platform module patches
+###########################################################################
+
+
+def cross_system():
+    return "iOS"
+
+
+def cross_uname():
+    return platform.uname_result(
+        system="iOS",
+        node="build",
+        release="13.0",
+        version="",
+        machine="arm64",
+    )
+
+
+def cross_ios_ver(system="", release="", model="", is_simulator=False):
+    if system == "":
+        system = "iOS"
+    if release == "":
+        release = "13.0"
+    if model == "":
+        model = "iphoneos"
+
+    return platform.IOSVersionInfo(system, release, model, False)
+
+
+platform.system = cross_system
+platform.uname = cross_uname
+platform.ios_ver = cross_ios_ver
+
+
+###########################################################################
+# sysconfig module patches
+###########################################################################
+
+
+def cross_get_platform():
+    return "ios-13.0-arm64-iphoneos"
+
+
+def cross_get_sysconfigdata_name():
+    return "_sysconfigdata__ios_arm64-iphoneos"
+
+
+sysconfig.get_platform = cross_get_platform
+sysconfig._get_sysconfigdata_name = cross_get_sysconfigdata_name
+
+# Ensure module-level values cached at time of import are updated.
+sysconfig._BASE_PREFIX = sys.base_prefix
+sysconfig._BASE_EXEC_PREFIX = sys.base_exec_prefix
+
+# Force sysconfig data to be loaded (and cached).
+sysconfig._init_config_vars()

cibuildwheel/resources/ios-support/arm64-iphoneos/sitecustomize.py

@@ -0,0 +1,22 @@
+# A site customization that can be used to trick pip into installing packages
+# cross-platform. If the folder containing this file is on your PYTHONPATH when
+# you invoke python, the interpreter will behave as if it were running on
+# arm64 iphoneos.
+import sys
+import os
+
+# Apply the cross-platform patch
+import _cross_arm64_iphoneos
+import _cross_venv
+
+
+# Call the next sitecustomize script if there is one
+# (https://nedbatchelder.com/blog/201001/running_code_at_python_startup.html).
+del sys.modules["sitecustomize"]
+this_dir = os.path.dirname(__file__)
+path_index = sys.path.index(this_dir)
+del sys.path[path_index]
+try:
+    import sitecustomize  # noqa: F401
+finally:
+    sys.path.insert(path_index, this_dir)

cibuildwheel/resources/ios-support/arm64-iphonesimulator/_cross_arm64_iphonesimulator.py

@@ -0,0 +1,79 @@
+# A site package that turns a macOS virtual environment
+# into an arm64 iphonesimulator cross-platform virtual environment
+import platform
+import subprocess
+import sys
+import sysconfig
+
+###########################################################################
+# sys module patches
+###########################################################################
+sys.cross_compiling = True
+sys.platform = "ios"
+sys.implementation._multiarch = "arm64-iphonesimulator"
+sys.base_prefix = sysconfig._get_sysconfigdata()["prefix"]
+sys.base_exec_prefix = sysconfig._get_sysconfigdata()["prefix"]
+
+###########################################################################
+# subprocess module patches
+###########################################################################
+subprocess._can_fork_exec = True
+
+
+###########################################################################
+# platform module patches
+###########################################################################
+
+
+def cross_system():
+    return "iOS"
+
+
+def cross_uname():
+    return platform.uname_result(
+        system="iOS",
+        node="build",
+        release="13.0",
+        version="",
+        machine="arm64",
+    )
+
+
+def cross_ios_ver(system="", release="", model="", is_simulator=False):
+    if system == "":
+        system = "iOS"
+    if release == "":
+        release = "13.0"
+    if model == "":
+        model = "iphonesimulator"
+
+    return platform.IOSVersionInfo(system, release, model, True)
+
+
+platform.system = cross_system
+platform.uname = cross_uname
+platform.ios_ver = cross_ios_ver
+
+
+###########################################################################
+# sysconfig module patches
+###########################################################################
+
+
+def cross_get_platform():
+    return "ios-13.0-arm64-iphonesimulator"
+
+
+def cross_get_sysconfigdata_name():
+    return "_sysconfigdata__ios_arm64-iphonesimulator"
+
+
+sysconfig.get_platform = cross_get_platform
+sysconfig._get_sysconfigdata_name = cross_get_sysconfigdata_name
+
+# Ensure module-level values cached at time of import are updated.
+sysconfig._BASE_PREFIX = sys.base_prefix
+sysconfig._BASE_EXEC_PREFIX = sys.base_exec_prefix
+
+# Force sysconfig data to be loaded (and cached).
+sysconfig._init_config_vars()

cibuildwheel/resources/ios-support/arm64-iphonesimulator/sitecustomize.py

@@ -0,0 +1,22 @@
+# A site customization that can be used to trick pip into installing packages
+# cross-platform. If the folder containing this file is on your PYTHONPATH when
+# you invoke python, the interpreter will behave as if it were running on
+# arm64 iphonesimulator.
+import sys
+import os
+
+# Apply the cross-platform patch
+import _cross_arm64_iphonesimulator
+import _cross_venv
+
+
+# Call the next sitecustomize script if there is one
+# (https://nedbatchelder.com/blog/201001/running_code_at_python_startup.html).
+del sys.modules["sitecustomize"]
+this_dir = os.path.dirname(__file__)
+path_index = sys.path.index(this_dir)
+del sys.path[path_index]
+try:
+    import sitecustomize  # noqa: F401
+finally:
+    sys.path.insert(path_index, this_dir)

cibuildwheel/resources/ios-support/make_cross_venv.py

@@ -0,0 +1,175 @@
+from __future__ import annotations
+
+import json
+import pprint
+import shutil
+import sys
+from importlib import util as importlib_util
+from pathlib import Path
+from typing import Any
+
+
+def localized_vars(orig_vars: dict[str, Any], slice_path: Path) -> dict[str, Any]:
+    """Update (where possible) any references to build-time variables with the
+    best guess of the installed location.
+    """
+    # The host's sysconfigdata will include references to build-time variables.
+    # Update these to refer to the current known install location.
+    orig_prefix = orig_vars["prefix"]
+    localized_vars = {}
+    for key, value in orig_vars.items():
+        final = value
+        if isinstance(value, str):
+            # Replace any reference to the build installation prefix
+            final = final.replace(orig_prefix, str(slice_path))
+            # Replace any reference to the build-time Framework location
+            final = final.replace("-F .", f"-F {slice_path}")
+        localized_vars[key] = final
+
+    return localized_vars
+
+
+def localize_sysconfigdata(sysconfig_path: Path, venv_site_packages: Path) -> None:
+    """Localize a sysconfigdata python module.
+
+    :param sysconfig_path: The platform config that contains the
+        sysconfigdata module to localize.
+    :param venv_site_packages: The site packages folder where the localized
+        sysconfigdata module should be output.
+    """
+    # Find the "_sysconfigdata_*.py" file in the platform config
+    sysconfigdata_path = next(sysconfig_path.glob("_sysconfigdata_*.py"))
+
+    # Import the sysconfigdata module
+    spec = importlib_util.spec_from_file_location(sysconfigdata_path.stem, sysconfigdata_path)
+    if spec is None:
+        msg = f"Unable to load spec for {sysconfigdata_path}"
+        raise ValueError(msg)
+    if spec.loader is None:
+        msg = f"Spec for {sysconfigdata_path} does not define a loader"
+        raise ValueError(msg)
+    sysconfigdata = importlib_util.module_from_spec(spec)
+    spec.loader.exec_module(sysconfigdata)
+
+    # Write the updated sysconfigdata module into the cross-platform site.
+    slice_path = sysconfigdata_path.parent.parent.parent
+    with (venv_site_packages / sysconfigdata_path.name).open("w") as f:
+        f.write(f"# Generated from {sysconfigdata_path}\n")
+        f.write("build_time_vars = ")
+        pprint.pprint(
+            localized_vars(sysconfigdata.build_time_vars, slice_path), stream=f, compact=True
+        )
+
+
+def localize_sysconfig_vars(sysconfig_path: Path, venv_site_packages: Path) -> None:
+    """Localize a sysconfig_vars.json file.
+
+    :param sysconfig_path: The platform config that contains the
+        sysconfigdata module to localize.
+    :param venv_site_packages: The site-packages folder where the localized
+        sysconfig_vars.json file should be output.
+    """
+    # Find the "_sysconfig_vars_*.json" file in the platform config
+    sysconfig_vars_path = next(sysconfig_path.glob("_sysconfig_vars_*.json"))
+
+    with sysconfig_vars_path.open("rb") as f:
+        build_time_vars = json.load(f)
+
+    slice_path = sysconfig_vars_path.parent.parent.parent
+    with (venv_site_packages / sysconfig_vars_path.name).open("w") as f:
+        json.dump(localized_vars(build_time_vars, slice_path), f, indent=2)
+
+
+def make_cross_venv(
+    venv_path: Path,
+    sysconfig_path: Path,
+    platform_config_path: Path,
+) -> None:
+    """Convert a virtual environment into a cross-platform environment.
+
+    :param venv_path: The path to the root of the venv.
+    :param sysconfig_path: The path containing sysconfigdata files for the
+        target platform.
+    :param platform_config_path: The path containing the cross-venv support
+        scripts (_cross_venv.py and the multiarch-specific _cross_*.py).
+    """
+    if not venv_path.exists():
+        msg = f"Virtual environment {venv_path} does not exist."
+        raise ValueError(msg)
+    if not (venv_path / "bin/python3").exists():
+        msg = f"{venv_path} does not appear to be a virtual environment."
+        raise ValueError(msg)
+
+    LIB_PATH = f"lib/python{sys.version_info[0]}.{sys.version_info[1]}"
+
+    # Derive the multiarch tag from the sysconfigdata filename if available;
+    # otherwise fall back to the directory name (BeeWare convention).
+    sysconfigdata_files = list(sysconfig_path.glob("_sysconfigdata_*.py"))
+    if sysconfigdata_files:
+        multiarch_tag = sysconfigdata_files[0].stem.split("_ios_")[1]
+        cross_multiarch = f"_cross_{multiarch_tag.replace('-', '_')}"
+    else:
+        multiarch_tag = sysconfig_path.name
+        cross_multiarch = f"_cross_{multiarch_tag.replace('-', '_')}"
+
+    print(
+        f"Converting {venv_path} into a {multiarch_tag} environment... ",
+        end="",
+    )
+
+    # Update path references in the sysconfigdata to reflect local conditions.
+    venv_site_packages = venv_path / LIB_PATH / "site-packages"
+    localize_sysconfigdata(sysconfig_path, venv_site_packages)
+    localize_sysconfig_vars(sysconfig_path, venv_site_packages)
+    # The multiarch-specific script may be directly in platform_config_path (BeeWare
+    # convention, where all files are co-located) or in a named subdirectory
+    # (cibuildwheel resource layout, where each multiarch has its own subdir).
+    multiarch_script = platform_config_path / f"{cross_multiarch}.py"
+    if not multiarch_script.exists():
+        multiarch_script = platform_config_path / multiarch_tag / f"{cross_multiarch}.py"
+    shutil.copy(
+        multiarch_script,
+        venv_site_packages / f"{cross_multiarch}.py",
+    )
+    shutil.copy(
+        platform_config_path / "_cross_venv.py",
+        venv_site_packages / "_cross_venv.py",
+    )
+    # Write the .pth file that will enable the cross-env modifications
+    (venv_site_packages / "_cross_venv.pth").write_text(
+        f"import {cross_multiarch}; import _cross_venv\n"
+    )
+
+    print("done.")
+
+
+if __name__ == "__main__":
+    try:
+        sysconfig_path = Path(sys.argv[2]).resolve()
+    except IndexError:
+        sysconfig_path = Path(__file__).parent
+
+    try:
+        platform_config_path = Path(sys.argv[3]).resolve()
+    except IndexError:
+        platform_config_path = sysconfig_path
+
+    try:
+        venv_path = Path(sys.argv[1]).resolve()
+        make_cross_venv(venv_path, sysconfig_path, platform_config_path)
+    except IndexError:
+        print("""
+Convert a virtual environment into a cross-platform environment.
+
+Usage:
+    make_cross_venv <venv> (<sysconfig path>) (<platform config path>)
+
+The sysconfig path is the path that contains the `_sysconfigdata-*.py` file
+for the platform being targeted. If an explicit sysconfig path isn't
+provided, it is assumed the directory containing the make_cross_venv script
+also contains the sysconfig data for the interpreter.
+
+The platform config path is the path that contains the cross-venv support
+scripts. If an explicit platform config path isn't provided, it is assumed
+that the sysconfig path also contains the platform configuration files.
+""")

cibuildwheel/resources/ios-support/x86_64-iphonesimulator/_cross_x86_64_iphonesimulator.py

@@ -0,0 +1,79 @@
+# A site package that turns a macOS virtual environment
+# into an x86_64 iphonesimulator cross-platform virtual environment
+import platform
+import subprocess
+import sys
+import sysconfig
+
+###########################################################################
+# sys module patches
+###########################################################################
+sys.cross_compiling = True
+sys.platform = "ios"
+sys.implementation._multiarch = "x86_64-iphonesimulator"
+sys.base_prefix = sysconfig._get_sysconfigdata()["prefix"]
+sys.base_exec_prefix = sysconfig._get_sysconfigdata()["prefix"]
+
+###########################################################################
+# subprocess module patches
+###########################################################################
+subprocess._can_fork_exec = True
+
+
+###########################################################################
+# platform module patches
+###########################################################################
+
+
+def cross_system():
+    return "iOS"
+
+
+def cross_uname():
+    return platform.uname_result(
+        system="iOS",
+        node="build",
+        release="13.0",
+        version="",
+        machine="x86_64",
+    )
+
+
+def cross_ios_ver(system="", release="", model="", is_simulator=False):
+    if system == "":
+        system = "iOS"
+    if release == "":
+        release = "13.0"
+    if model == "":
+        model = "iphonesimulator"
+
+    return platform.IOSVersionInfo(system, release, model, True)
+
+
+platform.system = cross_system
+platform.uname = cross_uname
+platform.ios_ver = cross_ios_ver
+
+
+###########################################################################
+# sysconfig module patches
+###########################################################################
+
+
+def cross_get_platform():
+    return "ios-13.0-x86_64-iphonesimulator"
+
+
+def cross_get_sysconfigdata_name():
+    return "_sysconfigdata__ios_x86_64-iphonesimulator"
+
+
+sysconfig.get_platform = cross_get_platform
+sysconfig._get_sysconfigdata_name = cross_get_sysconfigdata_name
+
+# Ensure module-level values cached at time of import are updated.
+sysconfig._BASE_PREFIX = sys.base_prefix
+sysconfig._BASE_EXEC_PREFIX = sys.base_exec_prefix
+
+# Force sysconfig data to be loaded (and cached).
+sysconfig._init_config_vars()

cibuildwheel/resources/ios-support/x86_64-iphonesimulator/sitecustomize.py

@@ -0,0 +1,22 @@
+# A site customization that can be used to trick pip into installing packages
+# cross-platform. If the folder containing this file is on your PYTHONPATH when
+# you invoke python, the interpreter will behave as if it were running on
+# x86_64 iphonesimulator.
+import sys
+import os
+
+# Apply the cross-platform patch
+import _cross_x86_64_iphonesimulator
+import _cross_venv
+
+
+# Call the next sitecustomize script if there is one
+# (https://nedbatchelder.com/blog/201001/running_code_at_python_startup.html).
+del sys.modules["sitecustomize"]
+this_dir = os.path.dirname(__file__)
+path_index = sys.path.index(this_dir)
+del sys.path[path_index]
+try:
+    import sitecustomize  # noqa: F401
+finally:
+    sys.path.insert(path_index, this_dir)

cibuildwheel/resources/nodejs.toml

@@ -1,4 +1,4 @@
 url = "https://nodejs.org/dist/"
-v24 = "v24.14.1"
+v24 = "v24.16.0"
-v22 = "v22.22.2"
+v22 = "v22.22.3"
 v20 = "v20.20.2"

cibuildwheel/resources/pinned_docker_images.cfg

@@ -1,54 +1,54 @@
 [x86_64]
-manylinux2014 = quay.io/pypa/manylinux2014_x86_64:2026.04.08-5
+manylinux2014 = quay.io/pypa/manylinux2014_x86_64:2026.06.04-1
-manylinux_2_28 = quay.io/pypa/manylinux_2_28_x86_64:2026.04.08-5
+manylinux_2_28 = quay.io/pypa/manylinux_2_28_x86_64:2026.06.04-1
-manylinux_2_34 = quay.io/pypa/manylinux_2_34_x86_64:2026.04.08-5
+manylinux_2_34 = quay.io/pypa/manylinux_2_34_x86_64:2026.06.04-1
-musllinux_1_2 = quay.io/pypa/musllinux_1_2_x86_64:2026.04.08-5
+musllinux_1_2 = quay.io/pypa/musllinux_1_2_x86_64:2026.06.04-1
 
 [i686]
-manylinux2014 = quay.io/pypa/manylinux2014_i686:2026.04.08-5
+manylinux2014 = quay.io/pypa/manylinux2014_i686:2026.06.04-1
-manylinux_2_28 = quay.io/pypa/manylinux_2_28_i686:2026.04.08-5
+manylinux_2_28 = quay.io/pypa/manylinux_2_28_i686:2026.06.04-1
-manylinux_2_34 = quay.io/pypa/manylinux_2_34_i686:2026.04.08-5
+manylinux_2_34 = quay.io/pypa/manylinux_2_34_i686:2026.06.04-1
-musllinux_1_2 = quay.io/pypa/musllinux_1_2_i686:2026.04.08-5
+musllinux_1_2 = quay.io/pypa/musllinux_1_2_i686:2026.06.04-1
 
 [aarch64]
-manylinux2014 = quay.io/pypa/manylinux2014_aarch64:2026.04.08-5
+manylinux2014 = quay.io/pypa/manylinux2014_aarch64:2026.06.04-1
-manylinux_2_28 = quay.io/pypa/manylinux_2_28_aarch64:2026.04.08-5
+manylinux_2_28 = quay.io/pypa/manylinux_2_28_aarch64:2026.06.04-1
-manylinux_2_34 = quay.io/pypa/manylinux_2_34_aarch64:2026.04.08-5
+manylinux_2_34 = quay.io/pypa/manylinux_2_34_aarch64:2026.06.04-1
-musllinux_1_2 = quay.io/pypa/musllinux_1_2_aarch64:2026.04.08-5
+musllinux_1_2 = quay.io/pypa/musllinux_1_2_aarch64:2026.06.04-1
 
 [ppc64le]
-manylinux2014 = quay.io/pypa/manylinux2014_ppc64le:2026.04.08-5
+manylinux2014 = quay.io/pypa/manylinux2014_ppc64le:2026.06.04-1
-manylinux_2_28 = quay.io/pypa/manylinux_2_28_ppc64le:2026.04.08-5
+manylinux_2_28 = quay.io/pypa/manylinux_2_28_ppc64le:2026.06.04-1
-manylinux_2_34 = quay.io/pypa/manylinux_2_34_ppc64le:2026.04.08-5
+manylinux_2_34 = quay.io/pypa/manylinux_2_34_ppc64le:2026.06.04-1
-musllinux_1_2 = quay.io/pypa/musllinux_1_2_ppc64le:2026.04.08-5
+musllinux_1_2 = quay.io/pypa/musllinux_1_2_ppc64le:2026.06.04-1
 
 [s390x]
-manylinux2014 = quay.io/pypa/manylinux2014_s390x:2026.04.08-5
+manylinux2014 = quay.io/pypa/manylinux2014_s390x:2026.06.04-1
-manylinux_2_28 = quay.io/pypa/manylinux_2_28_s390x:2026.04.08-5
+manylinux_2_28 = quay.io/pypa/manylinux_2_28_s390x:2026.06.04-1
-manylinux_2_34 = quay.io/pypa/manylinux_2_34_s390x:2026.04.08-5
+manylinux_2_34 = quay.io/pypa/manylinux_2_34_s390x:2026.06.04-1
-musllinux_1_2 = quay.io/pypa/musllinux_1_2_s390x:2026.04.08-5
+musllinux_1_2 = quay.io/pypa/musllinux_1_2_s390x:2026.06.04-1
 
 [pypy_x86_64]
-manylinux2014 = quay.io/pypa/manylinux2014_x86_64:2026.04.08-5
+manylinux2014 = quay.io/pypa/manylinux2014_x86_64:2026.06.04-1
-manylinux_2_28 = quay.io/pypa/manylinux_2_28_x86_64:2026.04.08-5
+manylinux_2_28 = quay.io/pypa/manylinux_2_28_x86_64:2026.06.04-1
-manylinux_2_34 = quay.io/pypa/manylinux_2_34_x86_64:2026.04.08-5
+manylinux_2_34 = quay.io/pypa/manylinux_2_34_x86_64:2026.06.04-1
 
 [pypy_i686]
-manylinux2014 = quay.io/pypa/manylinux2014_i686:2026.04.08-5
+manylinux2014 = quay.io/pypa/manylinux2014_i686:2026.06.04-1
-manylinux_2_28 = quay.io/pypa/manylinux_2_28_i686:2026.04.08-5
+manylinux_2_28 = quay.io/pypa/manylinux_2_28_i686:2026.06.04-1
-manylinux_2_34 = quay.io/pypa/manylinux_2_34_i686:2026.04.08-5
+manylinux_2_34 = quay.io/pypa/manylinux_2_34_i686:2026.06.04-1
 
 [pypy_aarch64]
-manylinux2014 = quay.io/pypa/manylinux2014_aarch64:2026.04.08-5
+manylinux2014 = quay.io/pypa/manylinux2014_aarch64:2026.06.04-1
-manylinux_2_28 = quay.io/pypa/manylinux_2_28_aarch64:2026.04.08-5
+manylinux_2_28 = quay.io/pypa/manylinux_2_28_aarch64:2026.06.04-1
-manylinux_2_34 = quay.io/pypa/manylinux_2_34_aarch64:2026.04.08-5
+manylinux_2_34 = quay.io/pypa/manylinux_2_34_aarch64:2026.06.04-1
 
 [armv7l]
-manylinux_2_31 = quay.io/pypa/manylinux_2_31_armv7l:2026.04.08-5
+manylinux_2_31 = quay.io/pypa/manylinux_2_31_armv7l:2026.06.04-1
-manylinux_2_35 = quay.io/pypa/manylinux_2_35_armv7l:2026.04.08-5
+manylinux_2_35 = quay.io/pypa/manylinux_2_35_armv7l:2026.06.04-1
-musllinux_1_2 = quay.io/pypa/musllinux_1_2_armv7l:2026.04.08-5
+musllinux_1_2 = quay.io/pypa/musllinux_1_2_armv7l:2026.06.04-1
 
 [riscv64]
-manylinux_2_39 = quay.io/pypa/manylinux_2_39_riscv64:2026.04.08-5
+manylinux_2_39 = quay.io/pypa/manylinux_2_39_riscv64:2026.06.04-1
-musllinux_1_2 = quay.io/pypa/musllinux_1_2_riscv64:2026.04.08-5
+musllinux_1_2 = quay.io/pypa/musllinux_1_2_riscv64:2026.06.04-1
 

cibuildwheel/resources/virtualenv.toml

@@ -1 +1 @@
-default = { version = "21.2.1", url = "https://github.com/pypa/get-virtualenv/releases/download/21.2.1/virtualenv.pyz" }
+default = { version = "21.4.2", url = "https://github.com/pypa/get-virtualenv/releases/download/21.4.2/virtualenv.pyz", sha256 = "b54c48b9c81468403626762747c5ee5939616f18f46c3c4bbebdbe0aa3a8ba1d" }

cibuildwheel/schema.py

@@ -1,8 +1,13 @@
+from __future__ import annotations
+
 import json
-from typing import Any
 
 from cibuildwheel.util import resources
 
+TYPE_CHECKING = False
+if TYPE_CHECKING:
+    from typing import Any
+
 
 def get_schema(tool_name: str = "cibuildwheel") -> dict[str, Any]:
     "Get the stored complete schema for cibuildwheel settings."

cibuildwheel/selector.py

@@ -1,13 +1,19 @@
+from __future__ import annotations
+
 import dataclasses
 import itertools
 from enum import StrEnum
 from fnmatch import fnmatch
-from typing import Self
 
 import bracex
-from packaging.specifiers import SpecifierSet
 from packaging.version import Version
 
+TYPE_CHECKING = False
+if TYPE_CHECKING:
+    from typing import Self
+
+    from packaging.specifiers import SpecifierSet
+
 
 def selector_matches(patterns: str, string: str) -> bool:
     """
@@ -29,16 +35,16 @@ class EnableGroup(StrEnum):
     Groups of build selectors that are not enabled by default.
     """
 
-    CPythonFreeThreading = "cpython-freethreading"
     CPythonPrerelease = "cpython-prerelease"
     GraalPy = "graalpy"
     PyPy = "pypy"
     PyPyEoL = "pypy-eol"
+    PyodideEoL = "pyodide-eol"
     PyodidePrerelease = "pyodide-prerelease"
 
     @classmethod
     def all_groups(cls) -> frozenset[Self]:
-        return frozenset(set(cls) - {cls.CPythonFreeThreading})
+        return frozenset(cls)
 
     @classmethod
     def parse_option_value(cls, value: str) -> frozenset[Self]:
@@ -84,8 +90,6 @@ class BuildSelector:
                 return False
 
         # filter out groups that are not enabled
-        if EnableGroup.CPythonFreeThreading not in self.enable and fnmatch(build_id, "cp313t-*"):
-            return False
         if EnableGroup.CPythonPrerelease not in self.enable and fnmatch(build_id, "cp315*"):
             return False
         is_pypy_eol = fnmatch(build_id, "pp3?-*") or fnmatch(build_id, "pp310-*")
@@ -96,17 +100,21 @@ class BuildSelector:
             return False
         if EnableGroup.GraalPy not in self.enable and fnmatch(build_id, "gp*"):
             return False
-        # TODO: Re-enable this when we have Pyodide prereleases again (e.g., 0.29.0a1+)
+        if EnableGroup.PyodideEoL not in self.enable and fnmatch(build_id, "cp312-pyodide_*"):
-        # Python 3.13 support became stable in Pyodide 0.28.0, so it no longer needs a prerelease
+            return False
-        # flag.
+        # NOTE: Disable this when we don't have any Pyodide prereleases (e.g., 314.0.0a1+)
-        # Also update Pyodide tests in unit_test/build_selector_test.py accordingly.
+        # When doing this, also:
-        # When re-enabling, update the pattern to match the experimental Python version in case
+        #   1. update Pyodide tests in unit_test/build_selector_test.py and unit_test/options_test.py accordingly.
-        # it is bumped to Python 3.14 (likely cp314-pyodide_* but could remain as 3.13 as well).
+        #   2. update Python versions for Pyodide identifiers in cibuildwheel/selector.py.
+        #   3. update constraints as necessary via bin/generate_pyodide_constraints.py and add/delete
+        #      Pyodide constraints files in cibuildwheel/resources/constraints/ as necessary.
+        # When disabling, update the pattern to match the experimental Python version in case
+        # it is bumped to Python 3.15 (likely cp315-pyodide_* but could remain as 3.14 as well).
         # This depends on the CPython version being used in the Pyodide runtime at the time.
-        # if EnableGroup.PyodidePrerelease not in self.enable and fnmatch(
+        if EnableGroup.PyodidePrerelease not in self.enable and fnmatch(
-        #     build_id, "cp313-pyodide_*"
+            build_id, "cp314-pyodide_*"
-        # ):
+        ):
-        #     return False
+            return False
 
         should_build = selector_matches(self.build_config, build_id)
         should_skip = selector_matches(self.skip_config, build_id)

cibuildwheel/util/cmd.py

@@ -1,14 +1,20 @@
+from __future__ import annotations
+
 import os
 import shlex
 import shutil
 import subprocess
 import sys
 import typing
-from collections.abc import Iterator, Mapping
-from typing import Final, Literal
 
 from cibuildwheel.errors import FatalError
-from cibuildwheel.typing import PathOrStr
+
+TYPE_CHECKING = False
+if TYPE_CHECKING:
+    from collections.abc import Iterator, Mapping
+    from typing import Final, Literal
+
+    from cibuildwheel.typing import PathOrStr
 
 _IS_WIN: Final[bool] = sys.platform.startswith("win")
 

cibuildwheel/util/file.py

@@ -1,10 +1,13 @@
+from __future__ import annotations
+
+import hashlib
 import os
 import shutil
 import ssl
 import tarfile
 import time
 import urllib.request
-from collections.abc import Callable
+from contextlib import contextmanager
 from pathlib import Path, PurePath
 from typing import Final
 from zipfile import ZipFile
@@ -14,12 +17,32 @@ from platformdirs import user_cache_path
 
 from cibuildwheel.errors import FatalError
 
+TYPE_CHECKING = False
+if TYPE_CHECKING:
+    from collections.abc import Callable, Generator
+
 DEFAULT_CIBW_CACHE_PATH: Final[Path] = user_cache_path(appname="cibuildwheel", appauthor="pypa")
 CIBW_CACHE_PATH: Final[Path] = Path(
     os.environ.get("CIBW_CACHE_PATH", DEFAULT_CIBW_CACHE_PATH)
 ).resolve()
 
 
+@contextmanager
+def remove_on_error(path: Path) -> Generator[None, None, None]:
+    try:
+        yield
+    except BaseException as original_exception:
+        try:
+            if path.is_dir() and not path.is_symlink():
+                shutil.rmtree(path)
+            elif path.exists() or path.is_symlink():
+                path.unlink()
+        except BaseException as cleanup_exception:
+            msg = f"Failed to remove {path}. Please remove it manually."
+            raise BaseExceptionGroup(msg, [original_exception, cleanup_exception]) from None
+        raise
+
+
 def ensure_cache_sentinel(cache_path: Path) -> None:
     """Create a sentinel file to mark a cibuildwheel cache directory.
 
@@ -40,7 +63,7 @@ def ensure_cache_sentinel(cache_path: Path) -> None:
             )
 
 
-def download(url: str, dest: Path) -> None:
+def download(url: str, dest: Path, *, sha256: str | None = None) -> None:
     print(f"+ Download {url} to {dest}")
     dest_dir = dest.parent
     dest_dir.mkdir(parents=True, exist_ok=True)
@@ -54,13 +77,20 @@ def download(url: str, dest: Path) -> None:
         try:
             with urllib.request.urlopen(url, context=context) as response:
                 dest.write_bytes(response.read())
-                return
+                break
 
         except OSError:
             if i == repeat_num - 1:
                 raise
             time.sleep(3)
 
+    if sha256:
+        computed = hashlib.sha256(dest.read_bytes()).hexdigest()
+        if computed != sha256:
+            dest.unlink(missing_ok=True)
+            msg = f"SHA256 mismatch for {url}: expected {sha256!r}, got {computed!r}"
+            raise FatalError(msg)
+
 
 def extract_zip(zip_src: Path, dest: Path) -> None:
     """Extracts a zip and correctly sets permissions on extracted files.

cibuildwheel/util/helpers.py

@@ -1,13 +1,18 @@
+from __future__ import annotations
+
 import dataclasses
 import itertools
-import os
 import re
 import shlex
 import textwrap
 from collections import defaultdict
-from collections.abc import Sequence
 
-from cibuildwheel.typing import PathOrStr
+TYPE_CHECKING = False
+if TYPE_CHECKING:
+    import os
+    from collections.abc import Sequence
+
+    from cibuildwheel.typing import PathOrStr
 
 
 def format_safe(template: str, **kwargs: str | os.PathLike[str]) -> str:
@@ -104,7 +109,7 @@ def parse_key_value_string(
     if kw_arg_names is None:
         kw_arg_names = []
 
-    all_field_names = [*positional_arg_names, *kw_arg_names]
+    all_field_names = None if ("*" in kw_arg_names) else [*positional_arg_names, *kw_arg_names]
 
     shlexer = shlex.shlex(key_value_string, posix=True, punctuation_chars=";")
     shlexer.commenters = ""
@@ -121,7 +126,7 @@ def parse_key_value_string(
         # check to see if the option name is specified
         field_name, sep, first_value = field[0].partition(":")
         if sep:
-            if field_name not in all_field_names:
+            if (all_field_names is not None) and (field_name not in all_field_names):
                 msg = f"Failed to parse {key_value_string!r}. Unknown field name {field_name!r}"
                 raise ValueError(msg)
 

cibuildwheel/util/packaging.py

@@ -1,8 +1,9 @@
+from __future__ import annotations
+
 import shlex
-from collections.abc import Mapping, Sequence
 from dataclasses import dataclass, field
 from pathlib import Path, PurePath
-from typing import Literal, Self, TypeVar
+from typing import TypeVar
 
 from packaging.utils import parse_wheel_filename
 
@@ -10,6 +11,11 @@ from cibuildwheel.util import resources
 from cibuildwheel.util.cmd import call
 from cibuildwheel.util.helpers import parse_key_value_string, unwrap
 
+TYPE_CHECKING = False
+if TYPE_CHECKING:
+    from collections.abc import Mapping, Sequence
+    from typing import Literal, Self
+
 
 @dataclass(kw_only=True)
 class DependencyConstraints:
@@ -177,3 +183,9 @@ def find_compatible_wheel(wheels: Sequence[T], identifier: str) -> T | None:
             return wheel
 
     return None
+
+
+def is_abi3_wheel(wheel_name: str) -> bool:
+    """Check if a wheel uses the abi3 stable ABI based on its filename."""
+    _, _, _, tags = parse_wheel_filename(wheel_name)
+    return any(tag.abi == "abi3" for tag in tags)

cibuildwheel/util/python_build_standalone.py

@@ -1,19 +1,27 @@
+from __future__ import annotations
+
 import fnmatch
 import functools
+import hashlib
 import json
 import platform
+import subprocess
 import typing
-from pathlib import Path
 
 from filelock import FileLock
 
-from cibuildwheel.util.file import download, extract_tar
+from cibuildwheel.util.file import download, extract_tar, remove_on_error
 from cibuildwheel.util.resources import PYTHON_BUILD_STANDALONE_RELEASES
 
+TYPE_CHECKING = False
+if TYPE_CHECKING:
+    from pathlib import Path
+
 
 class PythonBuildStandaloneAsset(typing.TypedDict):
     name: str
     url: str
+    sha256: str
 
 
 class PythonBuildStandaloneRelease(typing.TypedDict):
@@ -35,6 +43,26 @@ class PythonBuildStandaloneError(Exception):
     """Errors related to python-build-standalone."""
 
 
+def _is_musl_libc() -> bool:
+    """
+    Detect whether the host uses musl libc (e.g. Alpine Linux).
+
+    ``platform.libc_ver()`` only ever reports glibc, so we shell out to ``ldd``,
+    which prints "musl libc" on musl-based systems (and "GNU libc"/"GLIBC" on
+    glibc systems). If ``ldd`` is unavailable, we fall back to assuming glibc.
+    """
+    try:
+        ldd = subprocess.run(
+            ["ldd", "--version"],
+            capture_output=True,
+            text=True,
+            check=False,
+        )
+    except OSError:
+        return False
+    return "musl" in (ldd.stdout + ldd.stderr).lower()
+
+
 def _get_platform_identifiers() -> tuple[str, str, str | None]:
     """
     Detects the current platform and returns architecture, platform, and libc
@@ -60,7 +88,7 @@ def _get_platform_identifiers() -> tuple[str, str, str | None]:
     # Map OS + Libc
     if system == "Linux":
         platform_identifier = "unknown-linux"
-        libc_identifier = "musl" if "musl" in (platform.libc_ver() or ("", "")) else "gnu"
+        libc_identifier = "musl" if _is_musl_libc() else "gnu"
     elif system == "Darwin":
         platform_identifier = "apple-darwin"
     elif system == "Windows":
@@ -81,8 +109,8 @@ def _get_pbs_asset(
     arch_identifier: str,
     platform_identifier: str,
     libc_identifier: str | None,
-) -> tuple[str, str, str]:
+) -> tuple[str, str, str, str]:
-    """Finds the asset, returning (tag, filename, url)."""
+    """Finds the asset, returning (tag, url, filename, sha256)."""
     release_data = get_python_build_standalone_release_data()
 
     expected_suffix = f"{arch_identifier}-{platform_identifier}"
@@ -100,22 +128,37 @@ def _get_pbs_asset(
                 continue
 
             asset_url = asset["url"]
-            return release["tag"], asset_url, asset_name
+            asset_sha256 = asset.get("sha256", "")
+            return release["tag"], asset_url, asset_name, asset_sha256
 
     # If loop completes without finding a match
     msg = f"Could not find python-build-standalone release asset matching {asset_pattern!r}."
     raise PythonBuildStandaloneError(msg)
 
 
-def _download_or_get_from_cache(asset_url: str, asset_filename: str, cache_dir: Path) -> Path:
+def _download_or_get_from_cache(
+    asset_url: str, asset_filename: str, cache_dir: Path, sha256: str = ""
+) -> Path:
     with FileLock(cache_dir / (asset_filename + ".lock")):
         asset_cache_path = cache_dir / asset_filename
         if asset_cache_path.is_file():
-            print(f"Using cached python_build_standalone: {asset_cache_path}")
+            if sha256:
-            return asset_cache_path
+                computed = hashlib.sha256(asset_cache_path.read_bytes()).hexdigest()
+                if computed != sha256:
+                    print(
+                        f"Cached python_build_standalone SHA256 mismatch for {asset_cache_path}; redownloading."
+                    )
+                    asset_cache_path.unlink(missing_ok=True)
+                else:
+                    print(f"Using cached python_build_standalone: {asset_cache_path}")
+                    return asset_cache_path
+            else:
+                print(f"Using cached python_build_standalone: {asset_cache_path}")
+                return asset_cache_path
 
         print(f"Downloading python_build_standalone: {asset_url} to {asset_cache_path}")
-        download(asset_url, asset_cache_path)
+        with remove_on_error(asset_cache_path):
+            download(asset_url, asset_cache_path, sha256=sha256 or None)
         return asset_cache_path
 
 
@@ -161,7 +204,7 @@ def create_python_build_standalone_environment(
 
     arch_id, platform_id, libc_id = _get_platform_identifiers()
 
-    pbs_tag, asset_url, asset_filename = _get_pbs_asset(
+    pbs_tag, asset_url, asset_filename, asset_sha256 = _get_pbs_asset(
         python_version=python_version,
         arch_identifier=arch_id,
         platform_identifier=platform_id,
@@ -171,11 +214,13 @@ def create_python_build_standalone_environment(
     print(f"Using python-build-standalone release: {pbs_tag}")
 
     archive_path = _download_or_get_from_cache(
-        asset_url=asset_url, asset_filename=asset_filename, cache_dir=cache_dir
+        asset_url=asset_url, asset_filename=asset_filename, cache_dir=cache_dir, sha256=asset_sha256
     )
 
     python_base_dir = temp_dir / "pbs"
-    assert not python_base_dir.exists()
+    if python_base_dir.exists():
+        msg = f"python-build-standalone directory already exists: {python_base_dir}"
+        raise PythonBuildStandaloneError(msg)
     extract_tar(archive_path, python_base_dir)
 
     return _find_python_executable(python_base_dir)

cibuildwheel/util/resources.py

@@ -1,14 +1,19 @@
+from __future__ import annotations
+
 import functools
 import tomllib
 from pathlib import Path
-from typing import Final
 
-from cibuildwheel.typing import PlatformName
+TYPE_CHECKING = False
+if TYPE_CHECKING:
+    from typing import Final
+
+    from cibuildwheel.typing import PlatformName
 
 PATH: Final[Path] = Path(__file__).parent.parent / "resources"
 INSTALL_CERTIFI_SCRIPT: Final[Path] = PATH / "install_certifi.py"
-FREE_THREAD_ENABLE_313: Final[Path] = PATH / "free-threaded-enable-313.xml"
 FREE_THREAD_ENABLE_314: Final[Path] = PATH / "free-threaded-enable-314.xml"
+FREE_THREAD_ENABLE_315: Final[Path] = PATH / "free-threaded-enable-315.xml"
 NODEJS: Final[Path] = PATH / "nodejs.toml"
 DEFAULTS: Final[Path] = PATH / "defaults.toml"
 PINNED_DOCKER_IMAGES: Final[Path] = PATH / "pinned_docker_images.cfg"
@@ -18,6 +23,7 @@ VIRTUALENV: Final[Path] = PATH / "virtualenv.toml"
 CIBUILDWHEEL_SCHEMA: Final[Path] = PATH / "cibuildwheel.schema.json"
 PYTHON_BUILD_STANDALONE_RELEASES: Final[Path] = PATH / "python-build-standalone-releases.json"
 TEST_FAIL_CWD_FILE: Final[Path] = PATH / "testing_temp_dir_file.py"
+IOS_SUPPORT_FILES: Final[Path] = PATH / "ios-support"
 
 
 # this value is cached because it's used a lot in unit tests
@@ -25,7 +31,14 @@ TEST_FAIL_CWD_FILE: Final[Path] = PATH / "testing_temp_dir_file.py"
 def read_all_configs() -> dict[str, list[dict[str, str]]]:
     with BUILD_PLATFORMS.open("rb") as f:
         loaded_file = tomllib.load(f)
-    return {k: list[dict[str, str]](v["python_configurations"]) for k, v in loaded_file.items()}
+    configs = {k: list[dict[str, str]](v["python_configurations"]) for k, v in loaded_file.items()}
+    for platform, python_configs in configs.items():
+        for config in python_configs:
+            if "url" in config and not config.get("sha256"):
+                identifier = config["identifier"]
+                msg = f"{platform} Python configuration {identifier!r} is missing a sha256"
+                raise ValueError(msg)
+    return configs
 
 
 def read_python_configs(config: PlatformName) -> list[dict[str, str]]:

cibuildwheel/venv.py

@@ -1,24 +1,49 @@
+from __future__ import annotations
+
 import contextlib
 import functools
 import os
 import shutil
 import sys
 import tomllib
-from collections.abc import Sequence
 from pathlib import Path
-from typing import Final
+from typing import cast
 
 from filelock import FileLock
+from packaging.markers import default_environment
 from packaging.requirements import InvalidRequirement, Requirement
 from packaging.version import Version
 
 from cibuildwheel.util import resources
 from cibuildwheel.util.cmd import call
-from cibuildwheel.util.file import CIBW_CACHE_PATH, download
+from cibuildwheel.util.file import CIBW_CACHE_PATH, download, remove_on_error
+
+TYPE_CHECKING = False
+if TYPE_CHECKING:
+    from collections.abc import Sequence
+    from typing import Final
 
 _IS_WIN: Final[bool] = sys.platform.startswith("win")
 
 
+def target_marker_env(
+    *,
+    implementation_id: str,
+) -> dict[str, str]:
+    """
+    Build a PEP 508 marker environment dict for the target Python,
+    overriding the host's values with the target implementation info.
+    """
+    env = cast("dict[str, str]", default_environment())
+    if implementation_id.startswith("gp"):
+        env["implementation_name"] = "graalpy"
+        env["platform_python_implementation"] = "GraalPy"
+    elif implementation_id.startswith("pp"):
+        env["implementation_name"] = "pypy"
+        env["platform_python_implementation"] = "PyPy"
+    return env
+
+
 @functools.cache
 def _ensure_virtualenv(version: str) -> tuple[Path, Version]:
     version_parts = version.split(".")
@@ -28,10 +53,12 @@ def _ensure_virtualenv(version: str) -> tuple[Path, Version]:
     configuration = loaded_file.get(key, loaded_file["default"])
     version = str(configuration["version"])
     url = str(configuration["url"])
+    sha256 = str(configuration["sha256"])
     path = CIBW_CACHE_PATH / f"virtualenv-{version}.pyz"
     with FileLock(str(path) + ".lock"):
         if not path.exists():
-            download(url, path)
+            with remove_on_error(path):
+                download(url, path, sha256=sha256)
     return (path, Version(version))
 
 
@@ -47,6 +74,7 @@ def constraint_flags(
 
 def _parse_pip_constraint_for_virtualenv(
     constraint_path: Path | None,
+    marker_env: dict[str, str] | None = None,
 ) -> str:
     """
     Parses the constraints file referenced by `dependency_constraint_flags` and returns a dict where
@@ -56,7 +84,12 @@ def _parse_pip_constraint_for_virtualenv(
     The function does not try to be too smart and just handles basic constraints.
     If it can't get an exact version, the real constraint will be handled by the
     {macos|windows}.setup_python function.
+    If marker_env is provided, marker-bearing constraints are evaluated against it;
+    otherwise, they are evaluated against the host's default environment.
     """
+    env: dict[str, str] = (
+        marker_env if marker_env is not None else cast("dict[str, str]", default_environment())
+    )
     if constraint_path:
         assert constraint_path.exists()
         with constraint_path.open(encoding="utf-8") as constraint_file:
@@ -72,11 +105,12 @@ def _parse_pip_constraint_for_virtualenv(
                     if (
                         package != "pip"
                         or requirement.url is not None
-                        or requirement.marker is not None
                         or len(requirement.extras) != 0
                         or len(requirement.specifier) != 1
                     ):
                         continue
+                    if requirement.marker is not None and not requirement.marker.evaluate(env):
+                        continue
                     specifier = next(iter(requirement.specifier))
                     if specifier.operator != "==":
                         continue
@@ -95,6 +129,7 @@ def virtualenv(
     use_uv: bool,
     env: dict[str, str] | None = None,
     pip_version: str | None = None,
+    marker_env: dict[str, str] | None = None,
 ) -> dict[str, str]:
     """
     Create a virtual environment. If `use_uv` is True,
@@ -114,7 +149,7 @@ def virtualenv(
     else:
         virtualenv_app, virtualenv_version = _ensure_virtualenv(version)
         if pip_version is None:
-            pip_version = _parse_pip_constraint_for_virtualenv(dependency_constraint)
+            pip_version = _parse_pip_constraint_for_virtualenv(dependency_constraint, marker_env)
         additional_flags = [f"--pip={pip_version}", "--no-setuptools"]
         if virtualenv_version < Version("20.31") or Version(version) < Version("3.9"):
             additional_flags.append("--no-wheel")
@@ -139,10 +174,7 @@ def virtualenv(
             python,
             venv_path,
         )
-    paths = [str(venv_path), str(venv_path / "Scripts")] if _IS_WIN else [str(venv_path / "bin")]
+    venv_env = activate_virtualenv(venv_path, env=env)
-    venv_env = os.environ.copy() if env is None else env.copy()
-    venv_env["PATH"] = os.pathsep.join([*paths, venv_env["PATH"]])
-    venv_env["VIRTUAL_ENV"] = str(venv_path)
     if not use_uv and pip_version == "embed":
         call(
             "python",
@@ -158,6 +190,20 @@ def virtualenv(
     return venv_env
 
 
+def activate_virtualenv(
+    venv_path: Path,
+    env: dict[str, str] | None = None,
+) -> dict[str, str]:
+    """
+    Return a copy of the environment with the virtualenv at `venv_path` activated.
+    """
+    paths = [str(venv_path), str(venv_path / "Scripts")] if _IS_WIN else [str(venv_path / "bin")]
+    venv_env = os.environ.copy() if env is None else env.copy()
+    venv_env["PATH"] = os.pathsep.join([*paths, venv_env["PATH"]])
+    venv_env["VIRTUAL_ENV"] = str(venv_path)
+    return venv_env
+
+
 def find_uv() -> Path | None:
     # Prefer uv in our environment
     with contextlib.suppress(ImportError, FileNotFoundError):

docs/_internal/pyodide-maintenance.md

@@ -0,0 +1,113 @@
+# Maintaining Pyodide support
+
+Last updated: May 2026
+
+This page describes how to update cibuildwheel's Pyodide platform code when either:
+
+- a new Pyodide alpha release arrives with support for a new [PyEmscripten Platform](https://pyodide.org/en/latest/development/abi.html) (which is tied to updates in Emscripten and CPython versions, compiler/linker flags, and so on), or
+- when that alpha release graduates to a stable one.
+
+## Background
+
+Pyodide has three types of releases that matter to cibuildwheel:
+
+- **Stable** – the most recent full Pyodide release (e.g., `0.29.x` / cp313). This is enabled by default with no special `CIBW_ENABLE` flag needed.
+- **Prerelease** – an alpha/beta/rc Pyodide release that uses the _next_ CPython version (e.g., `314.0.0a1` / cp314). Users must opt in with `CIBW_ENABLE: pyodide-prerelease` to build against this version. This may or may not be available at any given time, depending on the Pyodide release cycle.
+- **End-of-life (EoL)** – older Pyodide stable releases that are no longer the current stable. These are kept available behind `CIBW_ENABLE: pyodide-eol` so that users who still need to build for older Pyodide versions can do so.
+
+The guards in `cibuildwheel/selector.py` enforce this distinction. The constraints files under `cibuildwheel/resources/` pin the exact tool versions that go with each build.
+
+---
+
+## When a new Pyodide prerelease becomes available
+
+For example, consider a scenario when Pyodide ships a new `315.0.0a1` with cp315 support.
+
+### 1. Add the new Python configuration
+
+In `cibuildwheel/resources/build-platforms.toml`, add an entry under `[pyodide]`:
+
+```toml
+{ identifier = "cp315-pyodide_wasm32", version = "3.15", default_pyodide_version = "315.0.0a1", node_version = "v24", sha256 = "SHA256" },
+```
+
+`version` is the CPython version string, `default_pyodide_version` is the Pyodide release to use when the user does not pin one explicitly (use the latest available alpha/beta for a prerelease entry), and `node_version` is the minimum Node.js major required by that Pyodide release — check the [pyodide-build FAQ](https://pyodide-build.readthedocs.io/en/latest/faq.html#what-node-js-version-do-i-need) for a rudimentary idea of what the correct value is. `sha256` is the checksum of the Pyodide xbuildenv tarball.
+
+### 2. Update the prerelease guards in the selector
+
+In `cibuildwheel/selector.py`, update the patterns in the `PyodidePrerelease` guards to match the new identifier:
+
+```python
+if EnableGroup.PyodidePrerelease not in self.enable and fnmatch(
+    build_id, "cp315-pyodide_*"
+):
+    return False
+```
+
+### 3. Generate and pin a constraints file
+
+Run the `update_constraints` `nox` session, which reads `build-platforms.toml` and regenerates all Pyodide constraints files automatically:
+
+```bash
+nox -s update_constraints
+```
+
+### 4. Update tests
+
+Update the unit tests so the new identifier is accepted by the selector with `PyodidePrerelease` enabled and rejected without it. Pyodide-specific integration tests may also need their hardcoded expected-wheel lists extended.
+
+## When a Pyodide prerelease becomes stable
+
+Pyodide uses a versioning scheme where the stable release for a given CPython version is named `[PythonMajorMinor].0.0`, so the first stable release shipping cp314 will be **`314.0.0`**. See [pyodide/pyodide#6084](https://github.com/pyodide/pyodide/issues/6084) for a rationale of this versioning scheme.
+
+### 1. Update the stable entries, and remove (or replace) the prerelease entry
+
+In `build-platforms.toml`, update the former prerelease entry's `default_pyodide_version` to the new stable release (e.g. `314.0.0`) and remove the prerelease marker from the identifier if present. Remove previous prerelease entries if they are now obsolete, or update them to the next prerelease if one is available. Move the previous stable version behind `pyodide-eol` rather than dropping it outright (see below).
+
+### 2. Disable or update the prerelease guards
+
+In `selector.py`:
+
+- **If a new prerelease is available**: update the `fnmatch` pattern to the next identifier (e.g. `cp315-pyodide_*`) as described above.
+- **If there is no new prerelease**: comment out the `PyodidePrerelease` logic.
+
+### 3. Update the constraints file
+
+Run `nox -s update_constraints` to regenerate the constraints file for the newly stable version. If the entry was already in `build-platforms.toml` as a prerelease, its constraints file already exists, and this step just refreshes it against the stable Pyodide release and updates the dependencies' versions.
+
+### 4. Update tests
+
+Update the unit tests so the newly stable identifier is accepted by the selector without needing `PyodidePrerelease` in the enable set. Pyodide-specific integration tests may also need their hardcoded expected-wheel lists extended.
+
+## When an old Pyodide version is to be moved to end-of-life
+
+When a Pyodide version is superseded by a new stable release, move it behind the `pyodide-eol` enable flag. We want to allow users who still build for older Pyodide ABIs time to upgrade.
+
+### 1. Add the `pyodide-eol` guard in the selector
+
+In `cibuildwheel/selector.py`, add (or update) the `PyodideEoL` guard to include the old identifier:
+
+```python
+if EnableGroup.PyodideEoL not in self.enable and fnmatch(build_id, "cp312-pyodide_*"):
+    return False
+```
+
+### 2. Update tests
+
+Update the unit tests so the EoL identifier requires `PyodideEoL` to be included in the enable set. The default (no `CIBW_ENABLE`) should exclude it.
+
+## When an old Pyodide version is to be fully retired
+
+Retirement is not expected to happen on a routine basis. It is only warranted when the Pyodide ecosystem itself has evolved to the point where an older ABI version is considered obsolete – for example, if the surrounding toolchain, packaging standards, or runtime infrastructure have moved on so substantially that building for the older version no longer makes practical sense. Any retirement is to be discussed and agreed upon by Pyodide maintainers before proceeding.
+
+### 1. Remove the Python configuration
+
+Delete the entry from `build-platforms.toml` and remove the `PyodideEoL` guard for that identifier in `selector.py`.
+
+### 2. Delete the constraints file
+
+Remove `cibuildwheel/resources/constraints-pyodideXYZ.txt`.
+
+### 3. Update tests
+
+Remove references to the old identifier from the unit tests, integration tests, and drop any expected-wheel entries for it from the test helper.

docs/changelog.md

@@ -1,9 +1,66 @@
 ---
 title: Changelog
+ref: changelog
 ---
 
 # Changelog
 
+### v4.0.0
+
+_7 June 2026_
+
+See @henryiii's [release post](https://iscinumpy.dev/post/cibuildwheel-4-0-0/) for more info on new features!
+
+- 🌟 Adds wheel auditing with `abi3audit` as a default after the repair step, with new [`audit-requires`](https://cibuildwheel.pypa.io/en/stable/options/#audit-requires) and [`audit-command`](https://cibuildwheel.pypa.io/en/stable/options/#audit-command) options (#2805)
+- 🌟 Adds `pyemscripten` platform tag support (PEP 783), updates Pyodide to 314.0.0a2, and adds a `pyodide-eol` [`enable`](https://cibuildwheel.pypa.io/en/stable/options/#enable) flag for building end-of-life Pyodide versions (#2812, #2848)
+- 🌟 Sets up `delvewheel` as the default [`repair-wheel-command`](https://cibuildwheel.pypa.io/en/stable/options/#repair-wheel-command) for Windows, so extension module DLLs are now bundled automatically. Skip by setting it to empty if not needed. (#2831)
+- ✨ Adds CPython 3.15 support, under the [`enable` option](https://cibuildwheel.pypa.io/en/stable/options/#enable) `cpython-prerelease`. This version of cibuildwheel uses 3.15.0b1. (#2833, #2850)
+
+    _While CPython is in beta, the ABI can change, so your wheels might not be compatible with the final release. For this reason, we don't recommend distributing wheels until RC1, at which point 3.15 will be available in cibuildwheel without the flag._
+- ✨ Adds CPython 3.15 support for iOS and Android (#2857, #2858)
+- ✨ Adds Android improvements for building NumPy and related packages, including auditwheel support, pkg-config and Fortran configuration, and the [`xbuild-files`](https://cibuildwheel.pypa.io/en/stable/options/#xbuild-files) option (#2695)
+- ✨ Adds `CIBUILDWHEEL_BUILD_IDENTIFIER` environment variable set to the current build identifier (e.g. `cp311-manylinux_x86_64`) during per-build steps (#2872)
+- ✨ Adds `{project}` and `{package}` placeholders to [`config-settings`](https://cibuildwheel.pypa.io/en/stable/options/#config-settings) (#2827)
+- ⚠️ Drops support for Python 3.8 (#2686)
+- ⚠️ Removes the experimental CPython 3.13 free-threading builds and the `cpython-freethreading` [`enable`](https://cibuildwheel.pypa.io/en/stable/options/#enable) option. CPython 3.14+ free-threading support remains available without the enable flag. (#2684)
+- ⚠️ Drops support for Cirrus CI, which is shutting down June 1, 2026 (#2817)
+- ⚠️ Drops GraalPy 3.11 (gp311) support, as agreed in #2741, and removes GraalPy 24-only workarounds (#2895)
+- 🔐 Adds SHA256 verification for direct downloads of Python interpreters, virtualenv, and python-build-standalone assets (#2873)
+- 🔐 Adds tarfile extraction filter for safe archive extraction (#2856)
+- 🐛 Fixes `UV_PYTHON` not being set for [`before-build`](https://cibuildwheel.pypa.io/en/stable/options/#before-build) on Linux when using `uv` as the [`build-frontend`](https://cibuildwheel.pypa.io/en/stable/options/#build-frontend) (#2830)
+- 🐛 Fixes detection of musl libc when downloading python-build-standalone, which previously always selected the gnu asset on musl hosts like Alpine (#2889)
+- 🐛 Fixes [`config-settings`](https://cibuildwheel.pypa.io/en/stable/options/#config-settings) expansion when `{project}` or `{package}` contains spaces or backslashes (#2886)
+- 🐛 Prevents deadlock when `linux32` fails and forwards platform args to the sanity check (#2880, #2888)
+- 🐛 Fixes container resource leaks on start failure and during teardown (#2879, #2887)
+- 🐛 Removes potential partial cache-population in case of error (#2892)
+- 🐛 Raises a clear error when `ANDROID_API_LEVEL` is not an integer (#2891)
+- 🐛 Replaces assert with proper exception in python-build-standalone (#2859)
+- 🐛 Uses ConfigurationError when `package_dir` is outside cwd instead of a generic Exception (#2898)
+- 🛠 Updates dependencies and container pins (#2893, #2882, #2874, #2868, #2862, #2884, #2845, #2837, #2818, #2810, #2838, #2813)
+- 🛠 Updates Android to Python 3.13.13 and 3.14.4 (#2821)
+- 🛠 Applies Pyodide-specific patches to the Emscripten toolchain installation (#2800)
+- 🛠 Uses `python -V -V` for Windows build diagnostics (#2832)
+- 🛠 Simplifies pinned container image lookup (#2897)
+- 🛠 Minor fixups across error messages, OCI container, and options (#2860)
+- 💼 Adds PEP 723 metadata for `bin/` scripts and drops the `bin` dependency group (#2819)
+- 💼 Improves Azure test reliability with retries and caching (#2890)
+- 💼 Fixes Windows GitLab CI test running (#2870)
+- 💼 Updates CI action pins and dev dependencies (#2902, #2867, #2851, #2843, #2826, #2823, #2820, #2807)
+- 💼 Adds agent and copilot setup files (#2861)
+- 💼 Uses `if TYPE_CHECKING:` blocks (#2866, #2864)
+- 🧪 Fixes Android tests using the `uv` frontend (#2809)
+- 🧪 Fixes the update-dependencies workflow to use `uv` to run `nox` (#2808)
+- 🧪 Adds unit tests for `OCIContainer._get_platform_args` (#2878)
+- 📚 Updates documentation for delvewheel as the default Windows [`repair-wheel-command`](https://cibuildwheel.pypa.io/en/stable/options/#repair-wheel-command), including the build diagram, schema defaults, and legal note (#2877, #2853, #2891)
+- 📚 Documents platform-specific [`before-build`](https://cibuildwheel.pypa.io/en/stable/options/#before-build) configuration (#2834)
+- 📚 Updates the "How it works" diagram with details of Android, iOS, and Pyodide builds (#2816)
+- 📚 Adds Pyodide icon and regenerates working examples data for Android, iOS, and Pyodide (#2815, #2811)
+- 📚 Adds intersphinx support for external documentation linking (#2871)
+- 📚 Adds instructions for building CUDA wheels and fixes manylinux container references in FAQ (#2896, #2900)
+- 📚 Links back to source in docs (#2806)
+- 📚 Removes outdated numpy info (#2855)
+
+
 ### v3.4.1
 
 _2 April 2026_

docs/ci-services.md

@@ -1,5 +1,6 @@
 ---
 title: Configuring a CI service
+ref: ci-services
 ---
 
 ## Configuring a CI service

docs/configuration.md

@@ -1,3 +1,8 @@
+---
+title: Configuration
+ref: configuration
+---
+
 # Configuration methods
 
 cibuildwheel can either be configured using environment variables, or from
@@ -58,8 +63,8 @@ cibuildwheel to run tests, add the following YAML to your CI config file:
 You can configure cibuildwheel with a config file, such as `pyproject.toml`.
 Options have the same names as the environment variable overrides, but are
 placed in `[tool.cibuildwheel]` and are lower case, with dashes, following
-common [TOML](https://toml.io) practice. Anything placed in subsections `linux`, `windows`,
+common [TOML](https://toml.io) practice. Anything placed in subsections
-`macos`, or `pyodide` will only affect those platforms. Lists can be used
+named after a platform will only affect those platforms. Lists can be used
 instead of strings for items that are naturally a list. Multiline strings also
 work just like in the environment variables. Environment variables will take
 precedence if defined.
@@ -132,17 +137,17 @@ which means it can be given multiple times.
 manylinux-x86_64-image = "manylinux_2_34"
 
 [[tool.cibuildwheel.overrides]]
-select = "cp38-*"
+select = "cp39-*"
 manylinux-x86_64-image = "manylinux2014"
 
 [[tool.cibuildwheel.overrides]]
-select = "cp3{9,10}-*"
+select = "cp3{10,11}-*"
 manylinux-x86_64-image = "manylinux_2_28"
 ```
 
-This example will build CPython 3.8 wheels on manylinux2014, CPython 3.9-3.10
+This example will build CPython 3.9 wheels on manylinux2014, CPython 3.10-3.11
 wheels on manylinux_2_28, and manylinux_2_34 wheels for any newer Python
-(like 3.10).
+(like 3.14).
 
 ```toml
 [tool.cibuildwheel]

docs/contributing.md

@@ -1,5 +1,6 @@
 ---
 title: Contributing
+ref: contributing
 ---
 
 # Contributing
@@ -26,7 +27,7 @@ Other notes:
 
 ### cibuildwheel's relationship with build errors
 
-cibuildwheel doesn't really do anything itself - it's always deferring to other tools (pip, wheel, auditwheel, delocate, docker). Without cibuildwheel, the process is really fragmented. Different tools, across different OSs need to be stitched together in just the right way to make it work.
+cibuildwheel doesn't really do anything itself - it's always deferring to other tools (pip, wheel, auditwheel, delocate, delvewheel, docker). Without cibuildwheel, the process is really fragmented. Different tools, across different OSs need to be stitched together in just the right way to make it work.
 
 We're not responsible for errors in those tools, for fixing errors/crashes there. But cibuildwheel's job is providing users with an 'integrated' user experience across those tools. We provide an abstraction. The user says 'build me some wheels', not 'open the docker container, build a wheel with pip, fix up the symbols with auditwheel' etc.  However, errors have a habit of breaking abstractions. And this is where users get confused, because the mechanism of cibuildwheel is laid bare, and they must understand a little bit how it works to debug.
 
@@ -82,7 +83,7 @@ A few notes-
 
 - Running the macOS integration tests requires _system installs_ of Python from python.org for all the versions that are tested. We won't attempt to install these when running locally, but you can do so manually using the URL in the error message that is printed when the install is not found.
 
-- The ['enable groups'](options.md#enable) run by default are just 'cpython-prerelease' and 'cpython-freethreading'. You can add other groups like pypy or graalpy by passing the `--enable` argument to pytest, i.e. `nox -s tests -- test --enable pypy`. On GitHub PRs, you can add a label to the PR to enable these groups.
+- The ['enable groups'](options.md#enable) run by default is just 'cpython-prerelease'. You can add other groups like pypy or graalpy by passing the `--enable` argument to pytest, i.e. `nox -s tests -- test --enable pypy`. On GitHub PRs, you can add a label to the PR to enable these groups.
 
 #### Running pytest directly
 
@@ -161,32 +162,6 @@ bin/run_example_ci_configs.py examples/github-with-qemu.yml
 
 The script then outputs a Markdown table that can be copy/pasted into a PR to monitor and record the test.
 
-### Preparing environments
-
-This has been moved to using docker, so you only need the following instructions if you add `--no-docker` to avoid using docker.
-
-The dependency update script in the next section requires multiple python versions installed. One way to do this is to use `pyenv`:
-
-```bash
-pyenv install 3.7.8
-# Optionally add 3.8 and make it the local version;
-# otherwise assuming 3.8+ already is your current python version
-```
-
-Then, you need to make the required virtual environments:
-
-```bash
-$(pyenv prefix 3.7.8)/bin/python -m venv env37
-```
-
-<!-- Note for fish users: use zsh/bash for these lines for now, there's not a nice one-line fish replacement -->
-
-And, you need to install the requirements into each environment:
-
-```bash
-for f in env*/bin/pip; do $f install pip-tools; done
-```
-
 ### Making a release
 
 Before making a release, ensure pinned dependencies are up-to-date. Autoupdates are run weekly, with a PR being raised with any changes as required, so just make sure the latest one is merged before continuing.
@@ -208,3 +183,9 @@ git push && git push --tags
 Then head to https://github.com/pypa/cibuildwheel/releases and create a GitHub release from the new tag, pasting in the changelog entry. Once the release is created inside GitHub, a CI job will create the assets and upload them to PyPI.
 
 If there were any schema updates, run `pipx run ./bin/generate_schema.py --schemastore > partial-cibuildwheel.json` and contribute the changes to SchemaStore.
+
+### Platform-specific maintenance
+
+This section is a stub. Please open a PR to add guidance for any platform you would like to help maintain!
+
+- **Pyodide**: see [Maintaining Pyodide support](_internal/pyodide-maintenance.md) for instructions and maintainer-specific information on updating Pyodide-related code in cibuildwheel and updating to new Pyodide releases.

docs/cpp_standards.md

@@ -1,5 +1,6 @@
 ---
 title: Modern C++ standards
+ref: cpp-standards
 ---
 
 # Modern C++ standards

docs/deliver-to-pypi.md

@@ -1,5 +1,6 @@
 ---
 title: Delivering to PyPI
+ref: deliver-to-pypi
 ---
 
 # Delivering to PyPI

docs/diagram.html

@@ -38,7 +38,7 @@
     </div>
     <div class="grid-column-label"
          style="grid-row: 2 / span 1;
-                grid-column: 9 / -3;
+                grid-column: 10 / -3;
                 margin-bottom: 0.5em;">
       <div class="label">If tests are configured</div>
     </div>
@@ -179,19 +179,30 @@
           },
         },
         {
-          label: 'Repair wheel',
+          label: 'Repair using auditwheel',
           href: 'options/#repair-wheel-command',
           platforms: ['android'],
           style: 'block',
           tooltip: {
             title: 'CIBW_REPAIR_WHEEL_COMMAND',
             tag: 'Customisable step',
-            description: 'By default, bundles libc++ into the wheel if any shared library links against it, using patchelf. Can be overridden with a custom repair command.'
+            description: 'Bundle shared libraries by running auditwheel on each built wheel.'
+          },
+        },
+        {
+          label: 'Repair using delvewheel',
+          href: 'options/#repair-wheel-command',
+          platforms: ['windows'],
+          style: 'block',
+          tooltip: {
+            title: 'CIBW_REPAIR_WHEEL_COMMAND',
+            tag: 'Customisable step',
+            description: 'Bundle shared libraries by running delvewheel on each built wheel.'
           },
         },
         {
           href: 'options/#repair-wheel-command',
-          platforms: ['windows', 'ios', 'pyodide'],
+          platforms: ['ios', 'pyodide'],
           style: 'dot',
           tooltip: {
             title: 'CIBW_REPAIR_WHEEL_COMMAND',
@@ -200,6 +211,20 @@
           },
         },
       ],
+      [
+        {
+          env: "CIBW_AUDIT_COMMAND",
+          href: 'options/#audit-command',
+          label: 'audit wheel',
+          platforms: ['linux', 'macos', 'windows'],
+          style: 'dot',
+          tooltip: {
+            title: 'CIBW_AUDIT_COMMAND',
+            tag: 'Optional step',
+            description: 'Runs a shell command to check each built wheel. By default this runs abi3audit if produced wheels are abi3.'
+          },
+        }
+      ],
       [
         {
           href: 'options/#before-test',
@@ -481,7 +506,7 @@
     grid-column: 3 / -2;
   }
   .grid-outline.testVenv {
-    grid-column: 9 / span 3;
+    grid-column: 10 / span 3;
   }
   .grid-outline .outline {
     position: absolute;

docs/faq.md

@@ -1,5 +1,6 @@
 ---
 title: Tips and tricks
+ref: faq
 ---
 
 # Tips and tricks
@@ -33,7 +34,7 @@ The CPython Limited API is a subset of the Python C Extension API that's declare
 
 To create a package that builds ABI3 wheels, you'll need to configure your build backend to compile libraries correctly create wheels with the right tags. [Check this repo](https://github.com/joerick/python-abi3-package-sample) for an example of how to do this with setuptools.
 
-You could also consider running [abi3audit](https://github.com/trailofbits/abi3audit) against the produced wheels in order to check for abi3 violations or inconsistencies. You can run it alongside the default in your [repair-wheel-command](options.md#repair-wheel-command).
+cibuildwheel automatically runs [abi3audit](https://github.com/trailofbits/abi3audit) on any abi3 wheel after the repair step to check for stable ABI violations or inconsistencies. If abi3audit detects any issues, the build will fail with a detailed report.
 
 ### Packages with optional C extensions {: #optional-extensions}
 
@@ -51,20 +52,7 @@ myextension = Extension(
 
 ### Building with NumPy
 
-If using NumPy, there are a couple of things that can help.
+If using NumPy, there might be platforms you want to ship for that NumPy (or some other scientific Python libraries) are not shipping yet for. This is often true for beta candidates of new Python releases, for example. To work with this, you can use the Scientific Python Nightly wheels. Here's an example, depending on what frontend you use:
-
-First, if you require the `numpy` package at build-time (some binding tools, like `pybind11` and `nanobind`, do not), then the backward compatibility for your `build-backend.build-requires` is a little complicated for Python <3.9:
-
-* NumPy <1.25: You must build with the oldest version of NumPy you want to support at runtime.
-* NumPy 1.25 and 1.26: Anything you build will be compatible with 1.19+ by default, and you can set the minimum target to, for example, 1.22 with `#define NPY_TARGET_VERSION NPY_1_22_API_VERSION`.
-* NumPy 2.x: You must build with NumPy 2 to support NumPy 2; otherwise the same as 1.25+.
-
-So the rule is:
-
-* Python <3.8: Use the oldest supported NumPy (via helper `oldest-supported-numpy` if you want)
-* Python 3.9+: Use latest supported NumPy (2+).
-
-Second, there might be platforms you want to ship for that NumPy (or some other scientific Python libraries) are not shipping yet for. This is often true for beta candidates of new Python releases, for example. To work with this, you can use the Scientific Python Nightly wheels. Here's an example, depending on what frontend you use:
 
 !!! tab "pip based"
     For frontends like `build` (the default) and `pip`:
@@ -125,7 +113,7 @@ There are two suggested methods for keeping cibuildwheel up to date that instead
 If you use GitHub Actions for builds, you can use cibuildwheel as an action:
 
 ```yaml
-uses: pypa/cibuildwheel@v3.4.1
+uses: pypa/cibuildwheel@v4.0.0
 ```
 
 This is a composite step that just runs cibuildwheel using pipx. You can set command-line options as `with:` parameters, and use `env:` as normal.
@@ -150,7 +138,7 @@ The second option, and the only one that supports other CI systems, is using a `
 
 ```bash
 # requirements-cibw.txt
-cibuildwheel==3.4.1
+cibuildwheel==4.0.0
 ```
 
 Then your install step would have `python -m pip install -r requirements-cibw.txt` in it. Your `.github/dependabot.yml` file could look like this:
@@ -233,6 +221,60 @@ Your build might need some compiler flags to be set through environment variable
 Consider incorporating these into your package, for example, in `setup.py` using [`extra_compile_args` or
 `extra_link_args`](https://setuptools.pypa.io/en/latest/userguide/ext_modules.html#setuptools.Extension).
 
+### Building wheels with CUDA on Linux
+
+On Linux, you can build binary wheels with CUDA to take advantage of NVIDIA GPUs for hardware acceleration.
+Specify the custom Docker containers with CUDA Toolkit as follows:
+
+```yaml
+CIBW_MANYLINUX_X86_64_IMAGE: >-
+  quay.io/manylinux_cuda/manylinux_2_28_x86_64_cuda13_1:latest
+CIBW_MANYLINUX_AARCH64_IMAGE: >-
+  quay.io/manylinux_cuda/manylinux_2_28_aarch64_cuda13_1:latest
+```
+Currently, we support the following CUDA manylinux containers:
+
+* `quay.io/manylinux_cuda/manylinux_2_28_x86_64_cuda12_9:latest`
+* `quay.io/manylinux_cuda/manylinux_2_28_aarch64_cuda12_9:latest`
+* `quay.io/manylinux_cuda/manylinux_2_28_x86_64_cuda13_1:latest`
+* `quay.io/manylinux_cuda/manylinux_2_28_aarch64_cuda13_1:latest`
+* `quay.io/manylinux_cuda/manylinux_2_34_x86_64_cuda12_9:latest`
+* `quay.io/manylinux_cuda/manylinux_2_34_aarch64_cuda12_9:latest`
+* `quay.io/manylinux_cuda/manylinux_2_34_x86_64_cuda13_1:latest`
+* `quay.io/manylinux_cuda/manylinux_2_34_aarch64_cuda13_1:latest`
+
+A typical GitHub Actions workflow will look like this:
+
+```yaml
+jobs:
+  build-wheels:
+    name: Build wheels
+    runs-on: ${{ matrix.target.runner }}
+    strategy:
+      matrix:
+        manylinux-base: [manylinux_2_28, manylinux_2_34]
+        cuda-version: [12_9, 13_1]
+        target:
+          - arch: x86_64
+            runner: ubuntu-24.04
+          - arch: aarch64
+            runner: ubuntu-24.04-arm
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+
+      - name: Build wheels
+        uses: pypa/cibuildwheel@v3
+        env:
+          CIBW_MANYLINUX_X86_64_IMAGE: >-
+            quay.io/manylinux_cuda/${{ matrix.manylinux-base }}_x86_64_cuda${{ matrix.cuda-version }}:latest
+          CIBW_MANYLINUX_AARCH64_IMAGE: >-
+            quay.io/manylinux_cuda/${{ matrix.manylinux-base }}_aarch64_cuda${{ matrix.cuda-version }}:latest
+          CIBW_BUILD: cp312-manylinux_${{ matrix.target.arch }}
+```
+
+
 ## Troubleshooting
 
 If your wheel didn't compile, you might have a mistake in your config.
@@ -247,7 +289,7 @@ Sometimes a build will fail due to a missing dependency.
 
 **If you need a build tool** (e.g. cmake, automake, ninja), you can install it through a package manager like apt/yum, brew or choco, using the [`before-all`](options.md#before-all) option.
 
-**If your build is linking into a native library dependency**, you can build/install that in [`before-all`](options.md#before-all). However, on Linux, Mac (and Windows if you're using [delvewheel]), the library that you install will be bundled into the wheel in the [repair step]. So take care to ensure that
+**If your build is linking into a native library dependency**, you can build/install that in [`before-all`](options.md#before-all). However, on Linux, Mac, and Windows (which uses [delvewheel] by default since cibuildwheel 4.0), the library that you install will be bundled into the wheel in the [repair step]. So take care to ensure that
 
 - the bundled library doesn't accidentally increase the minimum system requirements (such as the minimum macOS version)
 - the bundled library matches the architecture of the wheel you're building when cross-compiling
@@ -315,7 +357,7 @@ Solutions to this vary, but the simplest is to use pipx:
 # most runners have pipx preinstalled, but in case you don't
 python3 -m pip install pipx
 
-pipx run cibuildwheel==3.4.1 --output-dir wheelhouse
+pipx run cibuildwheel==4.0.0 --output-dir wheelhouse
 pipx run twine upload wheelhouse/*.whl
 ```
 
@@ -344,34 +386,6 @@ To work around this, use a different environment variable such as `REPAIR_LIBRAR
 
 See [#816](https://github.com/pypa/cibuildwheel/issues/816), thanks to @phoerious for reporting.
 
-### macOS: Building CPython 3.8 wheels on arm64
-
-If you're building on an arm64 runner, you might notice something strange about CPython 3.8 - unlike Python 3.9+, it's cross-compiled to arm64 from an x86_64 version of Python running under Rosetta emulation. This is because (despite the prevalence of arm64 versions of Python 3.8 from Apple and Homebrew) there is no officially supported Python.org installer of Python 3.8 for arm64.
-
-This is fine for simple C extensions, but for more complicated builds on arm64 it becomes an issue.
-
-So, if you want to build macOS arm64 wheels on an arm64 runner (e.g., `macos-14`) on Python 3.8, before invoking cibuildwheel, you should install a native arm64 Python 3.8 interpreter on the runner:
-
-
-!!! tab "GitHub Actions"
-
-    ```yaml
-    - uses: actions/setup-python@v5
-      with:
-        python-version: 3.8
-      if: runner.os == 'macOS' && runner.arch == 'ARM64'
-    ```
-
-!!! tab "Generic"
-
-    ```bash
-    curl -o /tmp/Python38.pkg https://www.python.org/ftp/python/3.8.10/python-3.8.10-macos11.pkg
-    sudo installer -pkg /tmp/Python38.pkg -target /
-    sh "/Applications/Python 3.8/Install Certificates.command"
-    ```
-
-Then cibuildwheel will detect that it's installed and use it instead. However, you probably don't want to build x86_64 wheels on this Python, unless you're happy with them only supporting macOS 11+.
-
 ### macOS: Library dependencies do not satisfy target MacOS
 
 Since delocate 0.11.0 there is added verification that the library binary dependencies match the target macOS version. This is to prevent the situation where a wheel platform tag is lower than the actual minimum macOS version required by the library. To resolve this error you need to build the library to the same macOS version as the target wheel (for example using `MACOSX_DEPLOYMENT_TARGET` environment variable).

docs/index.md

@@ -1,5 +1,6 @@
 ---
 title: Home
+ref: index
 ---
 
 # cibuildwheel

docs/options.md

@@ -1,3 +1,8 @@
+---
+title: Options
+ref: options
+---
+
 # Options
 
 <div class="options-toc"></div>
@@ -45,7 +50,7 @@ This option can also be set using the [command-line option](#command-line) `--pl
 
 > Choose the Python versions to build
 
-List of builds to build and skip. Each build has an identifier like `cp38-manylinux_x86_64` or `cp37-macosx_x86_64` - you can list specific ones to build and cibuildwheel will only build those, and/or list ones to skip and cibuildwheel won't try to build them.
+List of builds to build and skip. Each build has an identifier like `cp314-manylinux_x86_64` or `cp313-macosx_x86_64` - you can list specific ones to build and cibuildwheel will only build those, and/or list ones to skip and cibuildwheel won't try to build them.
 
 When both options are specified, both conditions are applied and only builds with a tag that matches `build` and does not match `skip` will be built.
 
@@ -54,18 +59,16 @@ When setting the options, you can use shell-style globbing syntax, as per [fnmat
 <div class="build-id-table-marker"></div>
 |               | macOS                                                                  | Windows                                             | Linux Intel                                                                                         | Linux Other                                                                                                                                                                                                                                                                   | Android                                          | iOS                                                                                               | pyodide (WASM)       |
 |---------------|------------------------------------------------------------------------|-----------------------------------------------------|-----------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------|---------------------------------------------------------------------------------------------------|----------------------|
-| Python 3.8    | cp38-macosx_x86_64<br/>cp38-macosx_universal2<br/>cp38-macosx_arm64    | cp38-win_amd64<br/>cp38-win32                       | cp38-manylinux_x86_64<br/>cp38-manylinux_i686<br/>cp38-musllinux_x86_64<br/>cp38-musllinux_i686     | cp38-manylinux_aarch64<br/>cp38-manylinux_ppc64le<br/>cp38-manylinux_s390x<br/>cp38-manylinux_armv7l<br/>cp38-manylinux_riscv64<br/>cp38-musllinux_aarch64<br/>cp38-musllinux_ppc64le<br/>cp38-musllinux_s390x<br/>cp38-musllinux_armv7l<br/>cp38-musllinux_riscv64           |                                                  |                                                                                                   |                      |
 | Python 3.9    | cp39-macosx_x86_64<br/>cp39-macosx_universal2<br/>cp39-macosx_arm64    | cp39-win_amd64<br/>cp39-win32<br/>cp39-win_arm64    | cp39-manylinux_x86_64<br/>cp39-manylinux_i686<br/>cp39-musllinux_x86_64<br/>cp39-musllinux_i686     | cp39-manylinux_aarch64<br/>cp39-manylinux_ppc64le<br/>cp39-manylinux_s390x<br/>cp39-manylinux_armv7l<br/>cp39-manylinux_riscv64<br/>cp39-musllinux_aarch64<br/>cp39-musllinux_ppc64le<br/>cp39-musllinux_s390x<br/>cp39-musllinux_armv7l<br/>cp39-musllinux_riscv64           |                                                  |                                                                                                   |                      |
 | Python 3.10   | cp310-macosx_x86_64<br/>cp310-macosx_universal2<br/>cp310-macosx_arm64 | cp310-win_amd64<br/>cp310-win32<br/>cp310-win_arm64 | cp310-manylinux_x86_64<br/>cp310-manylinux_i686<br/>cp310-musllinux_x86_64<br/>cp310-musllinux_i686 | cp310-manylinux_aarch64<br/>cp310-manylinux_ppc64le<br/>cp310-manylinux_s390x<br/>cp310-manylinux_armv7l<br/>cp310-manylinux_riscv64<br/>cp310-musllinux_aarch64<br/>cp310-musllinux_ppc64le<br/>cp310-musllinux_s390x<br/>cp310-musllinux_armv7l<br/>cp310-musllinux_riscv64 |                                                  |                                                                                                   |                      |
 | Python 3.11   | cp311-macosx_x86_64<br/>cp311-macosx_universal2<br/>cp311-macosx_arm64 | cp311-win_amd64<br/>cp311-win32<br/>cp311-win_arm64 | cp311-manylinux_x86_64<br/>cp311-manylinux_i686<br/>cp311-musllinux_x86_64<br/>cp311-musllinux_i686 | cp311-manylinux_aarch64<br/>cp311-manylinux_ppc64le<br/>cp311-manylinux_s390x<br/>cp311-manylinux_armv7l<br/>cp311-manylinux_riscv64<br/>cp311-musllinux_aarch64<br/>cp311-musllinux_ppc64le<br/>cp311-musllinux_s390x<br/>cp311-musllinux_armv7l<br/>cp311-musllinux_riscv64 |                                                  |                                                                                                   |                      |
 | Python 3.12   | cp312-macosx_x86_64<br/>cp312-macosx_universal2<br/>cp312-macosx_arm64 | cp312-win_amd64<br/>cp312-win32<br/>cp312-win_arm64 | cp312-manylinux_x86_64<br/>cp312-manylinux_i686<br/>cp312-musllinux_x86_64<br/>cp312-musllinux_i686 | cp312-manylinux_aarch64<br/>cp312-manylinux_ppc64le<br/>cp312-manylinux_s390x<br/>cp312-manylinux_armv7l<br/>cp312-manylinux_riscv64<br/>cp312-musllinux_aarch64<br/>cp312-musllinux_ppc64le<br/>cp312-musllinux_s390x<br/>cp312-musllinux_armv7l<br/>cp312-musllinux_riscv64 |                                                  |                                                                                                   | cp312-pyodide_wasm32 |
-| Python 3.13   | cp313-macosx_x86_64<br/>cp313-macosx_universal2<br/>cp313-macosx_arm64<br><br>cp313t-macosx_x86_64<br/>cp313t-macosx_universal2<br/>cp313t-macosx_arm64 | cp313-win_amd64<br/>cp313-win32<br/>cp313-win_arm64<br><br>cp313t-win_amd64<br/>cp313t-win32<br/>cp313t-win_arm64 | cp313-manylinux_x86_64<br/>cp313-manylinux_i686<br/>cp313-musllinux_x86_64<br/>cp313-musllinux_i686<br><br>cp313t-manylinux_x86_64<br/>cp313t-manylinux_i686<br/>cp313t-musllinux_x86_64<br/>cp313t-musllinux_i686 | cp313-manylinux_aarch64<br/>cp313-manylinux_ppc64le<br/>cp313-manylinux_s390x<br/>cp313-manylinux_armv7l<br/>cp313-manylinux_riscv64<br/>cp313-musllinux_aarch64<br/>cp313-musllinux_ppc64le<br/>cp313-musllinux_s390x<br/>cp313-musllinux_armv7l<br/>cp313-musllinux_riscv64<br><br>cp313t-manylinux_aarch64<br/>cp313t-manylinux_ppc64le<br/>cp313t-manylinux_s390x<br/>cp313t-manylinux_armv7l<br/>cp313t-manylinux_riscv64<br/>cp313t-musllinux_aarch64<br/>cp313t-musllinux_ppc64le<br/>cp313t-musllinux_s390x<br/>cp313t-musllinux_armv7l<br/>cp313t-musllinux_riscv64 | cp313-android_arm64_v8a<br/>cp313-android_x86_64 | cp313-ios_arm64_iphoneos<br/>cp313-ios_arm64_iphonesimulator<br/>cp313-ios_x86_64_iphonesimulator | cp313-pyodide_wasm32 |
+| Python 3.13   | cp313-macosx_x86_64<br/>cp313-macosx_universal2<br/>cp313-macosx_arm64 | cp313-win_amd64<br/>cp313-win32<br/>cp313-win_arm64 | cp313-manylinux_x86_64<br/>cp313-manylinux_i686<br/>cp313-musllinux_x86_64<br/>cp313-musllinux_i686 | cp313-manylinux_aarch64<br/>cp313-manylinux_ppc64le<br/>cp313-manylinux_s390x<br/>cp313-manylinux_armv7l<br/>cp313-manylinux_riscv64<br/>cp313-musllinux_aarch64<br/>cp313-musllinux_ppc64le<br/>cp313-musllinux_s390x<br/>cp313-musllinux_armv7l<br/>cp313-musllinux_riscv64 | cp313-android_arm64_v8a<br/>cp313-android_x86_64 | cp313-ios_arm64_iphoneos<br/>cp313-ios_arm64_iphonesimulator<br/>cp313-ios_x86_64_iphonesimulator | cp313-pyodide_wasm32 |
 | Python 3.14   | cp314-macosx_x86_64<br/>cp314-macosx_universal2<br/>cp314-macosx_arm64<br><br>cp314t-macosx_x86_64<br/>cp314t-macosx_universal2<br/>cp314t-macosx_arm64 | cp314-win_amd64<br/>cp314-win32<br/>cp314-win_arm64<br><br>cp314t-win_amd64<br/>cp314t-win32<br/>cp314t-win_arm64 | cp314-manylinux_x86_64<br/>cp314-manylinux_i686<br/>cp314-musllinux_x86_64<br/>cp314-musllinux_i686<br><br>cp314t-manylinux_x86_64<br/>cp314t-manylinux_i686<br/>cp314t-musllinux_x86_64<br/>cp314t-musllinux_i686 | cp314-manylinux_aarch64<br/>cp314-manylinux_ppc64le<br/>cp314-manylinux_s390x<br/>cp314-manylinux_armv7l<br/>cp314-manylinux_riscv64<br/>cp314-musllinux_aarch64<br/>cp314-musllinux_ppc64le<br/>cp314-musllinux_s390x<br/>cp314-musllinux_armv7l<br/>cp314-musllinux_riscv64<br><br>cp314t-manylinux_aarch64<br/>cp314t-manylinux_ppc64le<br/>cp314t-manylinux_s390x<br/>cp314t-manylinux_armv7l<br/>cp314t-manylinux_riscv64<br/>cp314t-musllinux_aarch64<br/>cp314t-musllinux_ppc64le<br/>cp314t-musllinux_s390x<br/>cp314t-musllinux_armv7l<br/>cp314t-musllinux_riscv64 | cp314-android_arm64_v8a<br/>cp314-android_x86_64 | cp314-ios_arm64_iphoneos<br/>cp314-ios_arm64_iphonesimulator<br/>cp314-ios_x86_64_iphonesimulator |                      |
-| PyPy3.8 v7.3  | pp38-macosx_x86_64<br/>pp38-macosx_arm64                               | pp38-win_amd64                                      | pp38-manylinux_x86_64<br/>pp38-manylinux_i686                                                       | pp38-manylinux_aarch64                                                                                                                                                                                                                                                        |                                                  |                                                                                                   |                      |
+| Python 3.15   | cp315-macosx_x86_64<br/>cp315-macosx_universal2<br/>cp315-macosx_arm64<br><br>cp315t-macosx_x86_64<br/>cp315t-macosx_universal2<br/>cp315t-macosx_arm64 | cp315-win_amd64<br/>cp315-win32<br/>cp315-win_arm64<br><br>cp315t-win_amd64<br/>cp315t-win32<br/>cp315t-win_arm64 | cp315-manylinux_x86_64<br/>cp315-manylinux_i686<br/>cp315-musllinux_x86_64<br/>cp315-musllinux_i686<br><br>cp315t-manylinux_x86_64<br/>cp315t-manylinux_i686<br/>cp315t-musllinux_x86_64<br/>cp315t-musllinux_i686 | cp315-manylinux_aarch64<br/>cp315-manylinux_ppc64le<br/>cp315-manylinux_s390x<br/>cp315-manylinux_armv7l<br/>cp315-manylinux_riscv64<br/>cp315-musllinux_aarch64<br/>cp315-musllinux_ppc64le<br/>cp315-musllinux_s390x<br/>cp315-musllinux_armv7l<br/>cp315-musllinux_riscv64<br><br>cp315t-manylinux_aarch64<br/>cp315t-manylinux_ppc64le<br/>cp315t-manylinux_s390x<br/>cp315t-manylinux_armv7l<br/>cp315t-manylinux_riscv64<br/>cp315t-musllinux_aarch64<br/>cp315t-musllinux_ppc64le<br/>cp315t-musllinux_s390x<br/>cp315t-musllinux_armv7l<br/>cp315t-musllinux_riscv64 | cp315-android_arm64_v8a<br/>cp315-android_x86_64 | cp315-ios_arm64_iphoneos<br/>cp315-ios_arm64_iphonesimulator<br/>cp315-ios_x86_64_iphonesimulator |                      |
 | PyPy3.9 v7.3  | pp39-macosx_x86_64<br/>pp39-macosx_arm64                               | pp39-win_amd64                                      | pp39-manylinux_x86_64<br/>pp39-manylinux_i686                                                       | pp39-manylinux_aarch64                                                                                                                                                                                                                                                        |                                                  |                                                                                                   |                      |
 | PyPy3.10 v7.3 | pp310-macosx_x86_64<br/>pp310-macosx_arm64                             | pp310-win_amd64                                     | pp310-manylinux_x86_64<br/>pp310-manylinux_i686                                                     | pp310-manylinux_aarch64                                                                                                                                                                                                                                                       |                                                  |                                                                                                   |                      |
 | PyPy3.11 v7.3 | pp311-macosx_x86_64<br/>pp311-macosx_arm64                             | pp311-win_amd64                                     | pp311-manylinux_x86_64<br/>pp311-manylinux_i686                                                     | pp311-manylinux_aarch64                                                                                                                                                                                                                                                       |                                                  |                                                                                                   |                      |
-| GraalPy 3.11 v24.2 | gp311_242-macosx_x86_64<br/>gp311_242-macosx_arm64                             | gp311_242-win_amd64                                     | gp311_242-manylinux_x86_64                                                                              | gp311_242-manylinux_aarch64                                                                                                                                                                                                                                                       |                                                                                                   |                      |
 | GraalPy 3.12 v25.0 | gp312_250-macosx_x86_64<br/>gp312_250-macosx_arm64                             | gp312_250-win_amd64                                     | gp312_250-manylinux_x86_64                                                                              | gp312_250-manylinux_aarch64                                                                                                                                                                                                                                                       |                                                                                                   |                      |
 
 The list of supported and currently selected build identifiers can also be retrieved by passing the `--print-build-identifiers` flag to cibuildwheel.
@@ -81,29 +84,29 @@ See the [cibuildwheel 2 documentation](https://cibuildwheel.pypa.io/en/2.x/) for
 
     ```toml
     [tool.cibuildwheel]
-    # Only build on CPython 3.8
+    # Only build on CPython 3.14
-    build = "cp38-*"
+    build = "cp314-*"
 
-    # Skip building on CPython 3.8 on the Mac
+    # Skip building on CPython 3.9 on the Mac
-    skip = "cp38-macosx_x86_64"
+    skip = "cp39-macosx_x86_64"
 
-    # Skip building on CPython 3.8 on all platforms
+    # Skip building on CPython 3.9 on all platforms
-    skip = "cp38-*"
+    skip = "cp39-*"
 
-    # Skip CPython 3.8 on Windows
+    # Skip CPython 3.9 on Windows
-    skip = "cp38-win*"
+    skip = "cp39-win*"
 
-    # Skip CPython 3.8 on 32-bit Windows
+    # Skip CPython 3.9 on 32-bit Windows
-    skip = "cp38-win32"
+    skip = "cp39-win32"
 
-    # Skip CPython 3.8 and CPython 3.9
+    # Skip CPython 3.9 and CPython 3.10
-    skip = ["cp38-*", "cp39-*"]
+    skip = ["cp39-*", "cp310-*"]
 
-    # Skip Python 3.8 on Linux
+    # Skip Python 3.9 on Linux
-    skip = "cp38-manylinux*"
+    skip = "cp39-*linux*"
 
     # Skip 32-bit builds
-    skip = ["*-win32", "*-manylinux_i686"]
+    skip = ["*-win32", "*-*linux_i686"]
 
     # Disable building PyPy wheels on all platforms
     skip = "pp*"
@@ -118,29 +121,29 @@ See the [cibuildwheel 2 documentation](https://cibuildwheel.pypa.io/en/2.x/) for
 !!! tab examples "Environment variables"
 
     ```yaml
-    # Only build on CPython 3.8
+    # Only build on CPython 3.14
-    CIBW_BUILD: cp38-*
+    CIBW_BUILD: cp314-*
 
-    # Skip building on CPython 3.8 on the Mac
+    # Skip building on CPython 3.9 on the Mac
-    CIBW_SKIP: cp38-macosx_x86_64
+    CIBW_SKIP: cp39-macosx_x86_64
 
-    # Skip building on CPython 3.8 on all platforms
+    # Skip building on CPython 3.9 on all platforms
-    CIBW_SKIP: cp38-*
+    CIBW_SKIP: cp39-*
 
-    # Skip CPython 3.8 on Windows
+    # Skip CPython 3.9 on Windows
-    CIBW_SKIP: cp38-win*
+    CIBW_SKIP: cp39-win*
 
-    # Skip CPython 3.8 on 32-bit Windows
+    # Skip CPython 3.9 on 32-bit Windows
-    CIBW_SKIP: cp38-win32
+    CIBW_SKIP: cp39-win32
 
-    # Skip CPython 3.8 and CPython 3.9
+    # Skip CPython 3.9 and CPython 3.10
-    CIBW_SKIP: cp38-* cp39-*
+    CIBW_SKIP: cp39-* cp310-*
 
-    # Skip Python 3.8 on Linux
+    # Skip Python 3.9 on Linux
-    CIBW_SKIP: cp38-manylinux*
+    CIBW_SKIP: cp39-*linux*
 
     # Skip 32-bit builds
-    CIBW_SKIP: "*-win32 *-manylinux_i686"
+    CIBW_SKIP: "*-win32 *-*linux_i686"
 
     # Disable building PyPy wheels on all platforms
     CIBW_SKIP: pp*
@@ -304,7 +307,7 @@ simple keyword assignment in a top level function call. If you need to override
 this behaviour for some reason, you can use this option.
 
 When setting this option, the syntax is the same as `project.requires-python`,
-using 'version specifiers' like `>=3.8`, according to
+using 'version specifiers' like `>=3.12`, according to
 [PEP440](https://www.python.org/dev/peps/pep-0440/#version-specifiers).
 
 Default: reads your package's Python compatibility from `pyproject.toml`
@@ -325,7 +328,7 @@ the package is compatible with all versions of Python that it can build.
         ```toml
         [project]
         ...
-        requires-python = ">=3.8"
+        requires-python = ">=3.12"
         ```
 
         Note that not all build backends fully support using a `[project]` table yet;
@@ -341,7 +344,7 @@ the package is compatible with all versions of Python that it can build.
 !!! tab examples "Environment variables"
 
     ```yaml
-    CIBW_PROJECT_REQUIRES_PYTHON: ">=3.8"
+    CIBW_PROJECT_REQUIRES_PYTHON: ">=3.12"
     ```
 
 ### `enable` {: #enable toml env-var}
@@ -355,15 +358,14 @@ values are:
 
 - `cpython-prerelease`: Enables beta versions of Pythons if any are available
   (May-July, approximately).
-- `cpython-freethreading`: Enable experimental free-threaded builds for CPython 3.13.
-  Free-threading wheels for 3.14+ are available without this flag, as it's [no
-  longer considered experimental](https://peps.python.org/pep-0779/).
 - `pypy`: Enable PyPy.
 - `pypy-eol`: Enable PyPy versions that have passed end of life (if still available).
 - `graalpy`: Enable GraalPy.
 - `pyodide-prerelease`: Pyodide versions that haven't released yet, if one is
   available. Safe if you are shipping a site with an early build, not for
   general distribution.
+- `pyodide-eol`: Enable Pyodide versions that are no longer the current stable
+  release (if still available).
 - `all`: Enable all of the above.
 
 !!! caution
@@ -379,9 +381,7 @@ values are:
     CPython that can be built without the Global Interpreter Lock (GIL). Those
     variants are also known as free-threaded / no-gil. The build identifiers for
     those variants have a `t` suffix in their `python_tag` (e.g.
-    `cp313t-manylinux_x86_64`).
+    `cp314t-manylinux_x86_64`).
-
-    Free threading was [experimental in 3.13](https://docs.python.org/3.13/whatsnew/3.13.html#free-threaded-cpython), so it required an explicit enable flag. But, as noted above, free-threading doesn't require an enable flag for 3.14+.
 
     For more info on building for free-threading, see the [Python Free-Threading Guide](https://py-free-threading.github.io/).
 
@@ -407,9 +407,6 @@ without disabling your other enables.
 
     ```toml
     [tool.cibuildwheel]
-    # Enable free-threaded support for CPython 3.13
-    enable = ["cpython-freethreading"]
-
     # Include all PyPy versions
     enable = ["pypy", "pypy-eol"]
     ```
@@ -421,14 +418,11 @@ without disabling your other enables.
     # Include latest Python beta
     CIBW_ENABLE: cpython-prerelease
 
-    # Include free-threaded support for CPython 3.13
-    CIBW_ENABLE: cpython-freethreading
-
-    # Include both
-    CIBW_ENABLE: cpython-prerelease cpython-freethreading
-
     # Include all PyPy versions
     CIBW_ENABLE: pypy pypy-eol
+
+    # Include both
+    CIBW_ENABLE: cpython-prerelease pypy pypy-eol
     ```
 
 
@@ -552,6 +546,9 @@ Specify config settings for the build backend. Each space separated
 item will be passed via `--config-setting`. In TOML, you can specify
 a table of items, including arrays.
 
+You can use the `{project}` or `{package}` placeholders in `config-settings`
+to refer to the project root or package being built, respectively.
+
 !!! tip
     Currently, "build" supports arrays for options, but "pip" only supports
     single values.
@@ -575,6 +572,14 @@ Platform-specific environment variables also available:<br/>
     CIBW_CONFIG_SETTINGS: "--build-option=--use-mypyc"
     ```
 
+    ```yaml
+    CIBW_CONFIG_SETTINGS_LINUX: "setup-args=--cross-file={project}/cross_file.txt"
+    ```
+
+    ```yaml
+    CIBW_CONFIG_SETTINGS: "editable-verbose=true source-dir={package}"
+    ```
+
 
 
 
@@ -668,6 +673,9 @@ Platform-specific environment variables are also available:<br/>
 !!! note
     cibuildwheel always defines the environment variable `CIBUILDWHEEL=1`. This can be useful for [building wheels with optional extensions](faq.md#optional-extensions).
 
+!!! note
+    For each per-build step (`before_build`, the build itself, `repair_command`, `before_test`, `test_command`), cibuildwheel also sets `CIBUILDWHEEL_BUILD_IDENTIFIER` to the current build identifier (e.g. `cp311-manylinux_x86_64`). This can be used in scripts to distinguish different builds.
+
 !!! note
     To do its work, cibuildwheel sets the variables `VIRTUALENV_PIP`, `DIST_EXTRA_CONFIG`, `SETUPTOOLS_EXT_SUFFIX`, `PIP_DISABLE_PIP_VERSION_CHECK`, `PIP_ROOT_USER_ACTION`, and it extends the variables `PATH` and `PIP_CONSTRAINT`. Your assignments to these options might be replaced or extended.
 
@@ -793,6 +801,8 @@ The command is run in a shell, so you can write things like `cmd1 && cmd2`.
 Platform-specific environment variables are also available:<br/>
  `CIBW_BEFORE_BUILD_MACOS` | `CIBW_BEFORE_BUILD_WINDOWS` | `CIBW_BEFORE_BUILD_LINUX` | `CIBW_BEFORE_BUILD_ANDROID` | `CIBW_BEFORE_BUILD_IOS` | `CIBW_BEFORE_BUILD_PYODIDE`
 
+In configuration files, use platform tables like `[tool.cibuildwheel.macos]`.
+
 #### Examples
 
 !!! tab examples "pyproject.toml"
@@ -816,6 +826,13 @@ Platform-specific environment variables are also available:<br/>
 
     # If cibuildwheel is called with a package_dir argument, it's available as {package}
     before-build = "{package}/script/prepare_for_build.sh"
+
+    # Use a different command on a specific platform
+    [tool.cibuildwheel.linux]
+    before-build = "python scripts/install-linux-deps.py"
+
+    [tool.cibuildwheel.macos]
+    before-build = "python scripts/install-macos-deps.py"
     ```
 
     In configuration files, you can use a array, and the items will be joined
@@ -836,6 +853,10 @@ Platform-specific environment variables are also available:<br/>
 
     # If cibuildwheel is called with a package_dir argument, it's available as {package}
     CIBW_BEFORE_BUILD: "{package}/script/prepare_for_build.sh"
+
+    # Use a different command on a specific platform
+    CIBW_BEFORE_BUILD_LINUX: python scripts/install-linux-deps.py
+    CIBW_BEFORE_BUILD_MACOS: python scripts/install-macos-deps.py
     ```
 
 
@@ -902,15 +923,44 @@ Platform-specific environment variables are also available on platforms that use
     ```
 
 
+### `xbuild-files` {: #xbuild-files env-var toml}
+> Platform-specific files in the build environment
+
+When cross-compiling a package for Android, any dependencies in its [`build-system.requires`](https://packaging.python.org/en/latest/guides/writing-pyproject-toml/) are installed for the build platform. However, some dependencies contain platform-specific files such as headers and static libraries, which must correspond to the target platform.
+
+This option maps a [normalized](https://packaging.python.org/en/latest/specifications/name-normalization/#name-normalization) package name to a list of paths within that package. If the package is present in the build environment, then a matching version will be downloaded for the target platform, and used to overwrite the given paths within the build environment.
+
+The default value of this option includes [paths from popular packages](configuration.md#configuration-file).
+
+Platform-specific environment variables are also available:<br/>
+ `CIBW_XBUILD_FILES_ANDROID`
+
+#### Examples
+
+!!! tab examples "pyproject.toml"
+
+    ```toml
+    [tool.cibuildwheel.xbuild-files]
+    package1 = ["some/header.h", "some/library.a"]
+    package2 = ["other/header.h"]
+    ```
+
+!!! tab examples "Environment variables"
+
+    ```yaml
+    CIBW_XBUILD_FILES: "package1: some/header.h some/library.a; package2: other/header.h"
+    ```
+
+
 ### `repair-wheel-command` {: #repair-wheel-command env-var toml}
 > Execute a shell command to repair each built wheel
 
 Default:
 
 - on Linux: `'auditwheel repair -w {dest_dir} {wheel}'`
+- on Windows: `'delvewheel repair -w {dest_dir} -v {wheel}'`
 - on macOS: `'delocate-wheel --require-archs {delocate_archs} -w {dest_dir} -v {wheel}'`
-- on Android: There is no default command, but cibuildwheel will add `libc++` to the
+- on Android: `'auditwheel repair --ldpaths {ldpaths} -w {dest_dir} {wheel}'`
-  wheel if anything links against it. Setting a command will replace this behavior.
 - on Pyodide: You can use `pyodide auditwheel repair --libdir /path/to/libraries --output-dir {dest_dir} {wheel}` command to repair the wheel.
   Unlike other platforms, this command is not set by default as you need to explicitly
   specify the library directory. You might not want to use the libraries in the system
@@ -920,11 +970,15 @@ Default:
 A shell command to repair a built wheel by copying external library dependencies into the wheel tree and relinking them.
 The command is run on each built wheel (except for pure Python ones) before testing it.
 
+!!! note
+    Since cibuildwheel 4.0, `delvewheel` is the default `repair-wheel-command` on Windows, so extension-module DLLs are bundled automatically. If a wheel has a platform tag but contains no extension module (for example, a package that sets a platform tag but ships a pre-built DLL itself), `delvewheel` may error. In that case, set `repair-wheel-command = ""` to skip the repair step.
+
 The following placeholders must be used inside the command and will be replaced by cibuildwheel:
 
 - `{wheel}` for the absolute path to the built wheel
 - `{dest_dir}` for the absolute path of the directory where to create the repaired wheel
 - `{delocate_archs}` (macOS only) comma-separated list of architectures in the wheel.
+- `{ldpaths}` (Android only) colon-separated list of directories to search for external libraries, set by cibuildwheel to include any necessary locations in the NDK. You can add more directories by appending them with a colon separator after the placeholder, or by setting the `AUDITWHEEL_LD_LIBRARY_PATH` environment variable.
 
 You can use the `{package}` or `{project}` placeholders in your `repair-wheel-command` to refer to the package being built or the project root, respectively.
 
@@ -933,24 +987,14 @@ The command is run in a shell, so you can run multiple commands like `cmd1 && cm
 Platform-specific environment variables are also available:<br/>
 `CIBW_REPAIR_WHEEL_COMMAND_MACOS` | `CIBW_REPAIR_WHEEL_COMMAND_WINDOWS` | `CIBW_REPAIR_WHEEL_COMMAND_LINUX` | `CIBW_REPAIR_WHEEL_COMMAND_ANDROID` | `CIBW_REPAIR_WHEEL_COMMAND_IOS` | `CIBW_REPAIR_WHEEL_COMMAND_PYODIDE`
 
-!!! tip
-    cibuildwheel doesn't yet ship a default repair command for Windows.
-
-    **If that's an issue for you, check out [delvewheel]** - a new package that aims to do the same as auditwheel or delocate for Windows.
-
-    Because delvewheel is still relatively early-stage, cibuildwheel does not yet run it by default. However, we'd recommend giving it a try! See the examples below for usage.
-
-    [Delvewheel]: https://github.com/adang1345/delvewheel
-
 #### Examples
 
 !!! tab examples "pyproject.toml"
 
     ```toml
-    # Use delvewheel on windows
+    # Don't repair Windows wheels
     [tool.cibuildwheel.windows]
-    before-build = "pip install delvewheel"
+    repair-wheel-command = ""
-    repair-wheel-command = "delvewheel repair -w {dest_dir} {wheel}"
 
     # Don't repair macOS wheels
     [tool.cibuildwheel.macos]
@@ -967,33 +1011,19 @@ Platform-specific environment variables are also available:<br/>
       'python scripts/check_repaired_wheel.py -w {dest_dir} {wheel}',
     ]
 
-    # Use abi3audit to catch issues with Limited API wheels
-    [tool.cibuildwheel.linux]
-    repair-wheel-command = [
-      "auditwheel repair -w {dest_dir} {wheel}",
-      "pipx run abi3audit --strict --report {wheel}",
-    ]
-    [tool.cibuildwheel.macos]
-    repair-wheel-command = [
-      "delocate-wheel --require-archs {delocate_archs} -w {dest_dir} -v {wheel}",
-      "pipx run abi3audit --strict --report {wheel}",
-    ]
-    [tool.cibuildwheel.windows]
-    repair-wheel-command = [
-      "copy {wheel} {dest_dir}",
-      "pipx run abi3audit --strict --report {wheel}",
-    ]
     ```
 
+    !!! note
+        cibuildwheel automatically runs [abi3audit](https://github.com/trailofbits/abi3audit) on abi3 wheels after the repair step. You no longer need to add it to your repair command manually.
+
     In configuration files, you can use an inline array, and the items will be joined with `&&`.
 
 
 !!! tab examples "Environment variables"
 
     ```yaml
-    # Use delvewheel on windows
+    # Don't repair Windows wheels
-    CIBW_BEFORE_BUILD_WINDOWS: "pip install delvewheel"
+    CIBW_REPAIR_WHEEL_COMMAND_WINDOWS: ""
-    CIBW_REPAIR_WHEEL_COMMAND_WINDOWS: "delvewheel repair -w {dest_dir} {wheel}"
 
     # Don't repair macOS wheels
     CIBW_REPAIR_WHEEL_COMMAND_MACOS: ""
@@ -1006,16 +1036,6 @@ Platform-specific environment variables are also available:<br/>
       python scripts/repair_wheel.py -w {dest_dir} {wheel} &&
       python scripts/check_repaired_wheel.py -w {dest_dir} {wheel}
 
-    # Use abi3audit to catch issues with Limited API wheels
-    CIBW_REPAIR_WHEEL_COMMAND_LINUX: >
-      auditwheel repair -w {dest_dir} {wheel} &&
-      pipx run abi3audit --strict --report {wheel}
-    CIBW_REPAIR_WHEEL_COMMAND_MACOS: >
-      delocate-wheel --require-archs {delocate_archs} -w {dest_dir} -v {wheel} &&
-      pipx run abi3audit --strict --report {wheel}
-    CIBW_REPAIR_WHEEL_COMMAND_WINDOWS: >
-      copy {wheel} {dest_dir} &&
-      pipx run abi3audit --strict --report {wheel}
     ```
 
 
@@ -1223,7 +1243,7 @@ specifiers inline with the `packages: SPECIFIER...` syntax.
     If you need different dependencies for each python version, provide them
     in the same folder with a `-pythonXY` suffix. e.g. if your
     `dependency-versions="./constraints.txt"`, cibuildwheel will use
-    `./constraints-python38.txt` on Python 3.8, or fallback to
+    `./constraints-python314.txt` on Python 3.14, or fallback to
     `./constraints.txt` if that's not found.
 
 Platform-specific environment variables are also available:<br/>
@@ -1235,6 +1255,10 @@ Platform-specific environment variables are also available:<br/>
     dependency versions on Linux, use the [`manylinux-*` / `musllinux-*`](#linux-image)
     options.
 
+    There is one exception to this rule - when `audit-requires` is left as the
+    default `["abi3audit"]`, the `abi3audit` version is governed by this option,
+    because audits take place outside of the build container.
+
 #### Examples
 
 !!! tab examples "pyproject.toml"
@@ -1329,6 +1353,102 @@ The available Pyodide versions are determined by the version of `pyodide-build`
     ```
 
 
+## Auditing
+
+### `audit-requires` {: #audit-requires toml env-var }
+
+> Install Python dependencies for the audit step
+
+Default: `abi3audit`
+
+Space-separated list of package dependencies required for the audit command.
+These are installed into an isolated environment before running the
+[`audit-command`](#audit-command).
+
+If no audit command is specified, or no audit is required (i.e. your project builds non-abi3 wheels and the command refers only to abi3 wheels), then the audit environment won't be created and this option is ignored.
+
+If you leave this as the default, the versions of abi3audit and libraries are pinned according to [`dependency-versions`](#dependency-versions), even on Linux.
+
+#### Examples
+
+!!! tab examples "pyproject.toml"
+
+    ```toml
+    # Install twine for wheel metadata checks
+    [tool.cibuildwheel]
+    audit-requires = "twine"
+
+    # Install specific versions of audit dependencies
+    [tool.cibuildwheel]
+    audit-requires = ["twine==6.1.0", "abi3audit==0.0.17"]
+    ```
+
+    In configuration files, you can use an array, and the items will be joined with a space.
+
+!!! tab examples "Environment variables"
+
+    ```yaml
+    # Install twine for wheel metadata checks
+    CIBW_AUDIT_REQUIRES: twine
+
+    # Install specific versions of audit dependencies
+    CIBW_AUDIT_REQUIRES: twine==6.1.0 abi3audit==0.0.17
+    ```
+
+### `audit-command` {: #audit-command toml env-var }
+
+> Use a tool to check wheels before the end of the run
+
+Default: `abi3audit --strict --report {abi3_wheel}`
+
+Run shell commands to verify your wheels once they are built. Multiple commands can be passed, they should be separated with ` && `. In each command, you must use one of the following placeholders:
+
+- `{abi3_wheel}`: if your build produces an [ABI3 wheel](https://docs.python.org/3/c-api/stable.html#limited-c-api), as determined by the presence of an ABI3 tag in the filename, the command is run and this placeholder is substituted for the wheel path.
+- `{wheel}`: inserts the wheel path for all wheels that were built.
+
+#### Examples
+
+!!! tab examples "pyproject.toml"
+
+    ```toml
+    # Run a custom audit tool on all wheels
+    [tool.cibuildwheel]
+    audit-command = "my-audit-tool --check {wheel}"
+
+    # Run multiple audit commands, one for abi3 wheels only and one for all wheels
+    [tool.cibuildwheel]
+    audit-command = [
+      "./my-audit-tool --check-abi3 {abi3_wheel}",
+      "./my-audit-tool --check {wheel}",
+    ]
+
+    # Use twine check to validate wheel metadata
+    [tool.cibuildwheel]
+    audit-requires = ["twine"]
+    audit-command = "twine check {wheel}"
+
+    # Add an additional audit command using overrides, keeping the default abi3audit check
+    [[tool.cibuildwheel.overrides]]
+    select = "*"
+    inherit.audit-command = "append"
+    audit-command = "twine check {wheel}"
+    ```
+
+!!! tab examples "Environment variables"
+
+    ```yaml
+    # Run a custom audit tool on all wheels
+    CIBW_AUDIT_COMMAND: "my-audit-tool --check {wheel}"
+
+    # Run multiple audit commands
+    CIBW_AUDIT_COMMAND: "./my-audit-tool --check-abi3 {abi3_wheel} && ./my-audit-tool --check {wheel}"
+
+    # Use twine check to validate wheel metadata
+    CIBW_AUDIT_REQUIRES: "twine"
+    CIBW_AUDIT_COMMAND: "twine check {wheel}"
+    ```
+
+
 ## Testing
 
 ### `test-command` {: #test-command env-var toml}
@@ -1765,16 +1885,14 @@ will not produce more logging about the build itself. Other levels only affect
 the build frontend output, which is usually things like resolving and
 downloading dependencies. The settings are:
 
-|             | build | pip    | uv    | desc                             |
+|             | build | pip    | uv    | desc                                   |
-|-------------|-------|--------|-------|----------------------------------|
+|-------------|-------|--------|-------|----------------------------------------|
-| -2          | `-qq`[^1] | `-qq`  | `-qq` | even more quiet, where supported |
+| -2          | `-qq` | `-qq`  | `-qq` | even more quiet, where supported       |
-| -1          | `-q`[^1]  | `-q`   | `-q`  | quiet mode, where supported      |
+| -1          | `-q`  | `-q`   | `-q`  | quiet mode, where supported            |
-| 0 (default) |       |        |       | default for build tool           |
+| 0 (default) |       |        |       | default for build tool                 |
-| 1           |       | `-v`   |       | print backend output             |
+| 1           |       | `-v`   |       | print backend output                   |
 | 2           | `-v`  | `-vv`  | `-v`  | print log messages e.g. resolving info |
-| 3           | `-vv` | `-vvv` | `-vv` | print even more debug info       |
+| 3           | `-vv` | `-vvv` | `-vv` | print even more debug info             |
-
-[^1]: Not supported on Python 3.8, will be ignored with a warning.
 
 Settings that are not supported for a specific frontend will log a warning.
 The default build frontend is `build`, which does show build backend output by

docs/platforms.md

@@ -1,5 +1,6 @@
 ---
 title: Platforms
+ref: platforms
 ---
 # Platforms
 
@@ -62,11 +63,10 @@ macOS builds will honor the `MACOSX_DEPLOYMENT_TARGET` environment variable to c
 
 | Arch  | Python version range | Minimum target |
 |-------|----------------------|----------------|
-| Intel | CPython 3.8-3.11     | 10.9           |
+| Intel | CPython 3.9-3.11     | 10.9           |
 | Intel | CPython 3.12-3.13    | 10.13          |
 | Intel | CPython 3.14+        | 10.15          |
 | AS    | CPython or PyPy      | 11             |
-| Intel | PyPy 3.8             | 10.13          |
 | Intel | PyPy 3.9+            | 10.15          |
 
 If you set the value lower, cibuildwheel will cap it to the lowest supported value for each target as needed.
@@ -74,7 +74,7 @@ If you set the value lower, cibuildwheel will cap it to the lowest supported val
 !!! note
     For Rust-based extensions, `Rustc` requires `MACOSX_DEPLOYMENT_TARGET` to be at
     least 10.12. However, `cibuildwheel` defaults to 10.9 for
-    **Intel / CPython 3.8-3.11** builds. Users must manually set
+    **Intel / CPython 3.9-3.11** builds. Users must manually set
     `MACOSX_DEPLOYMENT_TARGET` to 10.12 or higher when building Rust extensions.
 
 ### macOS architectures
@@ -159,8 +159,6 @@ By default, `ARM64` is not enabled when running on non-`ARM64` runners. Use [`CI
 
 ## Pyodide/WebAssembly {: #pyodide}
 
-Pyodide is offered as an experimental feature in cibuildwheel.
-
 ### System requirements
 
 Pyodide builds require a Linux or macOS machine.
@@ -173,7 +171,7 @@ You must target pyodide with `--platform pyodide` (or use `--only` on the identi
 
 It is also possible to target a specific Pyodide version by setting the [`pyodide-version`](options.md#pyodide-version) option to the desired version. Users are responsible for setting an appropriate Pyodide version according to the `pyodide-build` version. A list is available in Pyodide's [cross-build environments metadata file](https://github.com/pyodide/pyodide/blob/main/pyodide-cross-build-environments.json), which can be viewed more easily by installing `pyodide-build` from PyPI and using `pyodide xbuildenv search --all` to see a compatibility table.
 
-If there are pre-releases available for a newer Pyodide version, the `pyodide-prerelease` [`enable`](options.md#enable) can be used to include pre-release versions.
+If there are pre-releases available for a newer Pyodide version, the `pyodide-prerelease` [`enable`](options.md#enable) can be used to include pre-release versions. To build for older Pyodide versions that are no longer the current stable, use the `pyodide-eol` [`enable`](options.md#enable).
 
 ### Running tests
 
@@ -222,13 +220,9 @@ It also requires the following commands to be on the `PATH`:
 
 Android builds will honor the `ANDROID_API_LEVEL` environment variable to set the
 minimum supported [API level](https://developer.android.com/tools/releases/platforms)
-for generated wheels. This will default to the minimum API level of the selected Python
+for generated wheels. This defaults to 24, which is supported by [99% of active
-version.
+devices](https://dl.google.com/android/studio/metadata/distributions.json), and is the first
-
+version to support RUNPATH, which auditwheel needs in order to graft external libraries.
-If the [`repair-wheel-command`](options.md#repair-wheel-command) adds any libraries to
-the wheel, then `ANDROID_API_LEVEL` must be at least 24. This is already the default
-when building for Python 3.14 and later, but you may need to set it when building for
-Python 3.13.
 
 ### Build frontend support
 

docs/setup.md

@@ -1,5 +1,6 @@
 ---
 title: 'Getting started'
+ref: setup
 ---
 
 # Getting started

docs/working-examples.md

@@ -1,5 +1,6 @@
 ---
 title: Working examples
+ref: working-examples
 ---
 
 <!-- START bin/projects.py -->
@@ -32,19 +33,19 @@ title: Working examples
 | [pyinstrument][]                  | ![github icon][] | ![windows icon][] ![apple icon][] ![linux icon][] | Python profiler with a C extension. No external dependencies. |
 | [scikit-image][]                  | ![github icon][] | ![windows icon][] ![apple icon][] ![linux icon][] ![pyodide icon][] | Image processing library. Uses cibuildwheel to build and test a project that uses Cython with platform-native code.  |
 | [cvxpy][]                         | ![github icon][] | ![apple icon][] ![linux icon][] ![windows icon][] | A Python-embedded modeling language for convex optimization problems. |
-| [PyOxidizer][]                    | ![github icon][] | ![apple icon][] ![linux icon][] ![windows icon][] | A modern Python application packaging and distribution tool |
 | [pedalboard][]                    | ![github icon][] | ![windows icon][] ![linux icon][] ![apple icon][] | A Python library for working with audio data and audio plugins by wrapping the [JUCE](https://github.com/juce-framework/JUCE/) C++ framework. Uses cibuildwheel to deploy on as many operating systems and Python versions as possible with only one dependency (any NumPy).  |
+| [PyOxidizer][]                    | ![github icon][] | ![apple icon][] ![linux icon][] ![windows icon][] | A modern Python application packaging and distribution tool |
 | [twisted-iocpsupport][]           | ![github icon][] | ![windows icon][] | A submodule of Twisted that hooks into native C APIs using Cython. |
 | [River][]                         | ![github icon][] | ![windows icon][] ![apple icon][] ![linux icon][] | 🌊 Online machine learning in Python |
 | [websockets][]                    | ![travisci icon][] | ![apple icon][] ![linux icon][] | Library for building WebSocket servers and clients. Mostly written in Python, with a small C 'speedups' extension module.  |
 | [OpenSpiel][]                     | ![github icon][] | ![apple icon][] ![linux icon][] | OpenSpiel is a collection of environments and algorithms for research in general reinforcement learning and search/planning in games. |
 | [aiortc][]                        | ![github icon][] | ![apple icon][] ![linux icon][] | WebRTC and ORTC implementation for Python using asyncio. |
 | [Dependency Injector][]           | ![travisci icon][] | ![windows icon][] ![apple icon][] ![linux icon][] | Dependency injection framework for Python, uses Windows TravisCI |
-| [UltraJSON][]                     | ![github icon][] | ![windows icon][] ![apple icon][] ![linux icon][] | Ultra fast JSON decoder and encoder written in C with Python bindings |
 | [CTranslate2][]                   | ![github icon][] | ![windows icon][] ![apple icon][] ![linux icon][] | Includes libraries from the [Intel oneAPI toolkit](https://www.intel.com/content/www/us/en/developer/tools/oneapi/base-toolkit.html) and CUDA kernels compiled for multiple GPU architectures. |
+| [UltraJSON][]                     | ![github icon][] | ![windows icon][] ![apple icon][] ![linux icon][] | Ultra fast JSON decoder and encoder written in C with Python bindings |
 | [pyzmq][]                         | ![github icon][] | ![windows icon][] ![apple icon][] ![linux icon][] ![android icon][] | Python bindings for zeromq, the networking library. Uses Cython on CPython and CFFI on PyPy. ARM wheels for linux are built natively on GitHub Actions.  |
-| [Implicit][]                      | ![github icon][] | ![windows icon][] ![apple icon][] ![linux icon][] | Includes GPU support for linux wheels |
 | [tinyobjloader][]                 | ![azurepipelines icon][] | ![apple icon][] ![linux icon][] ![windows icon][] | Tiny but powerful single file wavefront obj loader |
+| [Implicit][]                      | ![github icon][] | ![windows icon][] ![apple icon][] ![linux icon][] | Includes GPU support for linux wheels |
 | [vispy][]                         | ![github icon][] | ![apple icon][] ![linux icon][] ![windows icon][] | Main repository for Vispy |
 | [coverage.py][]                   | ![github icon][] | ![windows icon][] ![apple icon][] ![linux icon][] | The coverage tool for Python |
 | [Line Profiler][]                 | ![github icon][] | ![apple icon][] ![linux icon][] ![windows icon][] | Line-by-line profiling for Python |
@@ -80,9 +81,9 @@ title: Working examples
 | [sourmash][]                      | ![github icon][] | ![apple icon][] ![linux icon][] ![windows icon][] ![pyodide icon][] | Quickly search, compare, and analyze genomic and metagenomic data sets. |
 | [python-rapidjson][]              | ![travisci icon][] ![gitlab icon][] | ![windows icon][] ![linux icon][] | Python wrapper around rapidjson |
 | [pybind11 python_example][]       | ![github icon][] | ![windows icon][] ![apple icon][] ![linux icon][] ![pyodide icon][] | Example pybind11 module built with a Python-based build system |
-| [abess][]                         | ![github icon][] | ![windows icon][] ![apple icon][] ![linux icon][] | A fast best-subset selection library. It uses cibuildwheel to build a large project with C++ extensions. |
 | [python-snappy][]                 | ![github icon][] | ![apple icon][] ![linux icon][] ![windows icon][] | Python bindings for the snappy google library |
 | [Confluent client for Kafka][]    | ![travisci icon][] | ![apple icon][] ![linux icon][] ![windows icon][] | setup in `tools/wheels/build-wheels.bat` |
+| [abess][]                         | ![github icon][] | ![windows icon][] ![apple icon][] ![linux icon][] | A fast best-subset selection library. It uses cibuildwheel to build a large project with C++ extensions. |
 | [jq.py][]                         | ![travisci icon][] | ![apple icon][] ![linux icon][] | Python bindings for jq |
 | [cyvcf2][]                        | ![github icon][] | ![apple icon][] ![linux icon][] | cython + htslib == fast VCF and BCF processing |
 | [matrixprofile][]                 | ![travisci icon][] | ![windows icon][] ![apple icon][] ![linux icon][] | A Python 3 library making time series data mining tasks, utilizing matrix profile algorithms, accessible to everyone. |
@@ -106,11 +107,11 @@ title: Working examples
 | [clang-format][]                  | ![github icon][] | ![apple icon][] ![linux icon][] ![windows icon][] | Scikit-build wrapper around LLVM's CMake, all platforms, generic wheels. |
 | [polaroid][]                      | ![github icon][] | ![apple icon][] ![linux icon][] ![windows icon][] | Full range of wheels for setuptools rust, with auto release and PyPI deploy. |
 | [ninja][]                         | ![github icon][] ![travisci icon][] | ![apple icon][] ![linux icon][] ![windows icon][] | Multitagged binary builds for all supported platforms, using cibw 2 config configuration. |
-| [etebase-py][]                    | ![travisci icon][] | ![linux icon][] | Python bindings to a Rust library using `setuptools-rust`, and `sccache` for improved speed. |
 | [cf-units][]                      | ![github icon][] | ![apple icon][] ![linux icon][] | Units of measure as required by the Climate and Forecast (CF) Metadata Conventions |
+| [etebase-py][]                    | ![travisci icon][] | ![linux icon][] | Python bindings to a Rust library using `setuptools-rust`, and `sccache` for improved speed. |
 | [SiPM][]                          | ![github icon][] | ![apple icon][] ![linux icon][] | High performance library for SiPM detectors simulation using C++17, OpenMP and AVX2 intrinsics. |
-| [numpythia][]                     | ![github icon][] | ![apple icon][] ![linux icon][] | The interface between PYTHIA and NumPy |
 | [aalink][]                        | ![github icon][] | ![windows icon][] ![apple icon][] ![linux icon][] | Async Python interface for Ableton Link. |
+| [numpythia][]                     | ![github icon][] | ![apple icon][] ![linux icon][] | The interface between PYTHIA and NumPy |
 | [pyjet][]                         | ![github icon][] | ![windows icon][] ![apple icon][] ![linux icon][] | The interface between FastJet and NumPy |
 | [ril][]                           | ![github icon][] | ![windows icon][] ![apple icon][] ![linux icon][] | A python binding to Rust Imaging library using maturin and Pyo3, utilizes Github Action cache to improve speed. Builds abi3 wheels. |
 | [GSD][]                           | ![github icon][] | ![apple icon][] ![linux icon][] ![windows icon][] | Cython and NumPy project with 64-bit wheels. |
@@ -143,19 +144,19 @@ title: Working examples
 [pyinstrument]: https://github.com/joerick/pyinstrument
 [scikit-image]: https://github.com/scikit-image/scikit-image
 [cvxpy]: https://github.com/cvxpy/cvxpy
-[PyOxidizer]: https://github.com/indygreg/PyOxidizer
 [pedalboard]: https://github.com/spotify/pedalboard
+[PyOxidizer]: https://github.com/indygreg/PyOxidizer
 [twisted-iocpsupport]: https://github.com/twisted/twisted-iocpsupport
 [River]: https://github.com/online-ml/river
 [websockets]: https://github.com/python-websockets/websockets
 [OpenSpiel]: https://github.com/google-deepmind/open_spiel
 [aiortc]: https://github.com/aiortc/aiortc
 [Dependency Injector]: https://github.com/ets-labs/python-dependency-injector
-[UltraJSON]: https://github.com/ultrajson/ultrajson
 [CTranslate2]: https://github.com/OpenNMT/CTranslate2
+[UltraJSON]: https://github.com/ultrajson/ultrajson
 [pyzmq]: https://github.com/zeromq/pyzmq
-[Implicit]: https://github.com/benfred/implicit
 [tinyobjloader]: https://github.com/tinyobjloader/tinyobjloader
+[Implicit]: https://github.com/benfred/implicit
 [vispy]: https://github.com/vispy/vispy
 [coverage.py]: https://github.com/nedbat/coveragepy
 [Line Profiler]: https://github.com/pyutils/line_profiler
@@ -191,9 +192,9 @@ title: Working examples
 [sourmash]: https://github.com/sourmash-bio/sourmash
 [python-rapidjson]: https://github.com/python-rapidjson/python-rapidjson
 [pybind11 python_example]: https://github.com/pybind/python_example
-[abess]: https://github.com/abess-team/abess
 [python-snappy]: https://github.com/intake/python-snappy
 [Confluent client for Kafka]: https://github.com/confluentinc/confluent-kafka-python
+[abess]: https://github.com/abess-team/abess
 [jq.py]: https://github.com/mwilliamson/jq.py
 [cyvcf2]: https://github.com/brentp/cyvcf2
 [matrixprofile]: https://github.com/matrix-profile-foundation/matrixprofile
@@ -217,11 +218,11 @@ title: Working examples
 [clang-format]: https://github.com/ssciwr/clang-format-wheel
 [polaroid]: https://github.com/daggy1234/polaroid
 [ninja]: https://github.com/scikit-build/ninja-python-distributions
-[etebase-py]: https://github.com/etesync/etebase-py
 [cf-units]: https://github.com/SciTools/cf-units
+[etebase-py]: https://github.com/etesync/etebase-py
 [SiPM]: https://github.com/EdoPro98/SimSiPM
-[numpythia]: https://github.com/scikit-hep/numpythia
 [aalink]: https://github.com/artfwo/aalink
+[numpythia]: https://github.com/scikit-hep/numpythia
 [pyjet]: https://github.com/scikit-hep/pyjet
 [ril]: https://github.com/Cryptex-github/ril-py
 [GSD]: https://github.com/glotzerlab/gsd

examples/azure-pipelines-minimal.yml

@@ -6,7 +6,7 @@ jobs:
     - bash: |
         set -o errexit
         python3 -m pip install --upgrade pip
-        pip3 install cibuildwheel==3.4.1
+        pip3 install cibuildwheel==4.0.0
       displayName: Install dependencies
     - bash: cibuildwheel --output-dir wheelhouse .
       displayName: Build wheels
@@ -20,7 +20,7 @@ jobs:
     - bash: |
         set -o errexit
         python3 -m pip install --upgrade pip
-        python3 -m pip install cibuildwheel==3.4.1
+        python3 -m pip install cibuildwheel==4.0.0
       displayName: Install dependencies
     - bash: cibuildwheel --output-dir wheelhouse .
       displayName: Build wheels
@@ -34,7 +34,7 @@ jobs:
     - bash: |
         set -o errexit
         python -m pip install --upgrade pip
-        pip install cibuildwheel==3.4.1
+        pip install cibuildwheel==4.0.0
       displayName: Install dependencies
     - bash: cibuildwheel --output-dir wheelhouse .
       displayName: Build wheels

examples/circleci-minimal.yml

@@ -11,7 +11,7 @@ jobs:
       - run:
           name: Build the Linux wheels.
           command: |
-            python3 -m pip install --user cibuildwheel==3.4.1
+            python3 -m pip install --user cibuildwheel==4.0.0
             cibuildwheel --output-dir wheelhouse
       - store_artifacts:
           path: wheelhouse/
@@ -28,7 +28,7 @@ jobs:
       - run:
           name: Build the Linux aarch64 wheels.
           command: |
-            python3 -m pip install --user cibuildwheel==3.4.1
+            python3 -m pip install --user cibuildwheel==4.0.0
             python3 -m cibuildwheel --output-dir wheelhouse
       - store_artifacts:
           path: wheelhouse/
@@ -43,8 +43,8 @@ jobs:
       - run:
           name: Build the OS X wheels.
           command: |
-            sudo softwareupdate --install-rosetta --agree-to-license  # for python<=3.8 or x86_64/universal2 tests
+            sudo softwareupdate --install-rosetta --agree-to-license  # for x86_64/universal2 tests
-            pip3 install cibuildwheel==3.4.1
+            pip3 install cibuildwheel==4.0.0
             cibuildwheel --output-dir wheelhouse
       - store_artifacts:
           path: wheelhouse/

examples/github-deploy.yml

@@ -53,7 +53,7 @@ jobs:
           persist-credentials: false
 
       - name: Build wheels
-        uses: pypa/cibuildwheel@v3.4.1
+        uses: pypa/cibuildwheel@v4.0.0
         env:
           CIBW_PLATFORM: ${{ matrix.platform || 'auto' }}
           CIBW_ARCHS: ${{ matrix.archs || 'auto' }}

examples/github-minimal.yml

@@ -17,7 +17,7 @@ jobs:
           persist-credentials: false
 
       - name: Build wheels
-        uses: pypa/cibuildwheel@v3.4.1
+        uses: pypa/cibuildwheel@v4.0.0
         # env:
         #   CIBW_SOME_OPTION: value
         #   ...