[Bot] Update dependencies (#2976 )

Update dependencies Co-authored-by: cibuildwheel-bot[bot] <83877280+cibuildwheel-bot[bot]@users.noreply.github.com>
chore(deps): bump astral-sh/setup-uv from 9.0.0 to 10.0.1 in the actions group (#2974 )
2026-08-28 12:15:55 -04:00 · 2026-08-24 00:30:47 -04:00 · 2026-08-18 08:41:07 -04:00 · 2026-08-18 08:40:46 -04:00 · 2026-08-17 19:02:37 -04:00 · 2026-08-15 10:05:08 +02:00
90 changed files with 2220 additions and 1339 deletions
@@ -19,16 +19,16 @@ jobs:
      contents: read

    steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

-      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.x"
          allow-prereleases: true

-      - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1

      - name: Install tooling
        run: |
@@ -13,11 +13,11 @@ jobs:
  dist:
    runs-on: ubuntu-latest
    steps:
-    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      with:
        persist-credentials: false

-    - uses: hynek/build-and-inspect-python-package@d44ca7d91762de7a7d5436ddae667c6da6d1c3df # v2.18.0
+    - uses: hynek/build-and-inspect-python-package@2abe76da66d0a6a4a227101f9348ee855797cfa5 # v3.0.1

  publish:
    needs: [dist]
@@ -37,10 +37,10 @@ jobs:
        path: dist

    - name: Generate artifact attestation for sdist and wheel
-      uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0
+      uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
      with:
        subject-path: "dist/cibuildwheel-*"

-    - uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
+    - uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
      with:
        attestations: true
@@ -23,7 +23,7 @@ on:
      - .travis.yml
      - README.md
      - azure-pipelines.yml
-      - mkdocs.yml
+      - properdocs.yml
      - noxfile.py
  workflow_dispatch:
    # allow manual runs on branches without a PR
@@ -34,19 +34,23 @@ concurrency:
  group: test-${{ github.ref }}
  cancel-in-progress: true

+env:
+  # runners see short DNS/network outages; uv's default of 3 retries is too few
+  UV_HTTP_RETRIES: "6"
+
 jobs:
  lint:
    name: Linters (mypy, ruff, etc.)
    runs-on: ubuntu-latest
    steps:
-    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      with:
        persist-credentials: false
-    - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+    - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
      with:
        python-version: "3.x"
-    - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
-    - uses: j178/prek-action@bdca6f102f98e2b4c7029491a53dfd366469e33d # v2.0.4
+    - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+    - uses: j178/prek-action@4e14d07f9231acabce116ccfca13b13dd9755ece # v3.0.0
    - name: PyLint checks
      run: uvx nox -s pylint -- --output-format=github

@@ -55,14 +59,14 @@ jobs:
    needs: lint
    runs-on: ubuntu-latest
    steps:
-    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      with:
        persist-credentials: false
-    - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+    - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
      name: Install Python
      with:
        python-version: "3.x"
-    - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+    - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
    - name: Install dependencies
      run: uv sync --no-dev --group test
    - name: Generate a sample project
@@ -117,16 +121,16 @@ jobs:
          test_select: android
    timeout-minutes: 180
    steps:
-    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      with:
        persist-credentials: false
-    - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+    - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
      name: Install Python ${{ matrix.python_version }}
      with:
        python-version: ${{ matrix.python_version }}
        allow-prereleases: true

-    - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+    - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1

    - name: Free up disk space
      if: runner.os == 'Linux' && matrix.test_select != 'android'
@@ -139,7 +143,7 @@ jobs:
    # for oci_container unit tests
    - name: Set up QEMU
      if: runner.os == 'Linux'
-      uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
+      uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0

    - name: Set up Xcode
      if: ${{ startsWith(matrix.os, 'macos-15') }}
@@ -168,6 +172,9 @@ jobs:
          if [[ -n "$GITHUB_PR_LABEL_CI_GRAALPY" ]]; then
            CIBW_ENABLE+=" graalpy"
          fi
+          if [[ -n "$GITHUB_PR_LABEL_CI_PYPY_EOL" ]]; then
+            CIBW_ENABLE+=" pypy-eol"
+          fi
        fi
        echo "CIBW_ENABLE=${CIBW_ENABLE}" >> $GITHUB_ENV

@@ -247,13 +254,13 @@ jobs:
    outputs:
      archs: ${{ steps.archs.outputs.archs }}
    steps:
-    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      with:
        persist-credentials: false
-    - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+    - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
      with:
        python-version: "3.x"
-    - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+    - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
    - name: Install dependencies
      run: uv sync --no-dev --group test
    - name: Get qemu emulated architectures
@@ -272,18 +279,18 @@ jobs:
      matrix:
        arch: ${{ fromJSON(needs.emulated-archs.outputs.archs) }}
    steps:
-    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      with:
        persist-credentials: false
-    - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+    - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
      with:
        python-version: "3.x"
-    - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+    - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
    - name: Install dependencies
      run: uv sync --no-dev --group test

    - name: Set up QEMU
-      uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
+      uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0

    - name: Run the emulation tests
      env:
@@ -296,14 +303,14 @@ jobs:
    runs-on: ubuntu-24.04
    timeout-minutes: 180
    steps:
-    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      with:
        persist-credentials: false
-    - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+    - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
      name: Install Python 3.12
      with:
        python-version: '3.12'
-    - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+    - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1

    - name: Install dependencies
      run: uv sync --no-dev --group test
@@ -321,13 +328,13 @@ jobs:
        output-dir: wheelhouse
      env:
        CIBW_PLATFORM: pyodide
-        CIBW_ENABLE: pyodide-prerelease
+        CIBW_ENABLE: cpython-prerelease

    - name: Run tests with 'CIBW_PLATFORM' set to 'pyodide'
      run: uv run --no-sync ./bin/run_tests.py
      env:
        CIBW_PLATFORM: pyodide
-        CIBW_ENABLE: pyodide-prerelease
+        CIBW_ENABLE: cpython-prerelease

  test-uv-extras:
    name: Test uv extra on ${{ matrix.os }} ${{ matrix.test_select }}
@@ -348,7 +355,7 @@ jobs:
        - os: macos-15
          test_select: android
    steps:
-    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      with:
        persist-credentials: false
    - name: Download a sample project
@@ -37,11 +37,11 @@ jobs:
        permission-contents: write
        permission-pull-requests: write

-    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      with:
        persist-credentials: false

-    - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+    - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
      with:
        python-version: "3.14"

@@ -69,4 +69,5 @@ jobs:
        labels: |
          CI: GraalPy
          CI: PyPy
+          CI: PyPy EoL
          dependencies
@@ -21,7 +21,7 @@ jobs:
    permissions:
      contents: write
    steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

@@ -16,9 +16,9 @@ jobs:
      security-events: write
    steps:
      - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Run zizmor 🌈
-        uses: zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d # v0.5.6
+        uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2
@@ -122,3 +122,4 @@ site/

 # This file should be a symlink or contain "See @AGENTS.md"
 CLAUDE.md
+.claude/
@@ -18,14 +18,14 @@ repos:
    exclude: ^cibuildwheel/resources/android/android.patch$

 - repo: https://github.com/astral-sh/ruff-pre-commit
-  rev: 0671d8ab202c4ac093b78433ae5baf74f3fc7246  # frozen: v0.15.15
+  rev: 39d9ac5938dadb73df0564a45f163e25ff9fa6e2  # frozen: v0.16.1
  hooks:
  - id: ruff-check
    args: ["--fix"]
  - id: ruff-format

 - repo: https://github.com/pre-commit/mirrors-mypy
-  rev: d2823d321df3af8f878f7ee3414dc94d037145b9  # frozen: v2.1.0
+  rev: 41e691678310dfd3833f7ab4e180ddb014310356  # frozen: v2.3.0
  hooks:
  - id: mypy
    name: mypy 3.11 on cibuildwheel/
@@ -77,7 +77,7 @@ repos:
    additional_dependencies: [cogapp>=3.5]

 - repo: https://github.com/henryiii/flake8-lazy
-  rev: 65b94e97b1091634368592d98072160842265fe4  # frozen: v0.8.2
+  rev: 5fed9a818f2583f0403aed779bf2b6c9aa8d25f4  # frozen: v0.8.5
  hooks:
  - id: flake8-lazy
    args: ["--apply=set"]
@@ -85,7 +85,7 @@ repos:
    exclude: "^cibuildwheel/resources/"

 - repo: https://github.com/codespell-project/codespell
-  rev: 2ccb47ff45ad361a21071a7eedda4c37e6ae8c5a  # frozen: v2.4.2
+  rev: 57b21406f092110c18776e39b0bda50d37c945c8  # frozen: v2.4.3
  hooks:
  - id: codespell
    args: ["-w"]
@@ -93,7 +93,7 @@ repos:


 - repo: https://github.com/python-jsonschema/check-jsonschema
-  rev: 943377262562a12b57292fc98fabd7dbf81451fe  # frozen: 0.37.2
+  rev: 1a4bb160cab6417b3045e1b37b6b72449243e658  # frozen: 0.37.4
  hooks:
    - id: check-dependabot
    - id: check-github-actions
@@ -8,4 +8,4 @@ build:
    - asdf plugin add uv
    - asdf install uv latest
    - asdf global uv latest
-    - NO_COLOR=1 uv run --python 3.14 --managed-python --no-dev --group docs mkdocs build --strict --site-dir $READTHEDOCS_OUTPUT/html
+    - NO_COLOR=1 uv run --python 3.14 --managed-python --no-dev --group docs properdocs build --strict --site-dir $READTHEDOCS_OUTPUT/html
@@ -11,7 +11,7 @@
 - `nox -s tests -- test -k before_build` — single integration test/file via pytest `-k`.
 - `nox -s lint` — run all linters (pre-commit/prek).
 - `nox -s pylint` — run pylint separately (not in pre-commit).
- `nox -s docs` — mkdocs serve (interactive) or build (non-interactive).
+- `nox -s docs` — properdocs serve (interactive) or build (non-interactive).
 - Set up local dev env at `.venv`: `uv sync` (dependency groups used).

 ## Project layout
@@ -19,7 +19,7 @@
 - `test/` — **integration tests** (expensive, run actual wheel builds).
 - `unit_test/` — **unit tests** (fast, no wheel builds).
 - `bin/` — maintainer scripts (update pins, generate README tables, schema, etc.).
- `docs/` — mkdocs source.
+- `docs/` — properdocs (MkDocs fork) source.

 ## Testing specifics
 - Three test suites exist, run in this order by `bin/run_tests.py`:
@@ -22,25 +22,24 @@ What does it do?

 While cibuildwheel itself requires a recent Python version to run (we support the last three releases), it can target the following versions to build wheels:

-|                          | macOS Intel | macOS Apple Silicon | Windows 64bit | Windows 32bit | Windows Arm64  | manylinux<br/>musllinux x86_64 | manylinux<br/>musllinux i686 | manylinux<br/>musllinux aarch64 | manylinux<br/>musllinux ppc64le | manylinux<br/>musllinux s390x | manylinux<br/>musllinux armv7l | Android | iOS | Pyodide        |
-| ------------------------ | ----------- | ------------------- | ------------- | ------------- | -------------- | ------------------------------ | ---------------------------- | ------------------------------- | ------------------------------- | ----------------------------- | ------------------------------ | ------- | --- | -------------- |
-| CPython 3.9              | ✅          | ✅                  | ✅            | ✅            | ✅<sup>2</sup> | ✅                             | ✅                           | ✅                              | ✅                              | ✅                            | ✅<sup>4</sup>                 | N/A     | N/A | N/A            |
-| CPython 3.10             | ✅          | ✅                  | ✅            | ✅            | ✅<sup>2</sup> | ✅                             | ✅                           | ✅                              | ✅                              | ✅                            | ✅<sup>4</sup>                 | N/A     | N/A | N/A            |
-| CPython 3.11             | ✅          | ✅                  | ✅            | ✅            | ✅<sup>2</sup> | ✅                             | ✅                           | ✅                              | ✅                              | ✅                            | ✅<sup>4</sup>                 | N/A     | N/A | N/A            |
-| CPython 3.12             | ✅          | ✅                  | ✅            | ✅            | ✅<sup>2</sup> | ✅                             | ✅                           | ✅                              | ✅                              | ✅                            | ✅<sup>4</sup>                 | N/A     | N/A | ✅<sup>3</sup> |
-| CPython 3.13             | ✅          | ✅                  | ✅            | ✅            | ✅<sup>2</sup> | ✅                             | ✅                           | ✅                              | ✅                              | ✅                            | ✅<sup>4</sup>                 | ✅      | ✅  | ✅             |
-| CPython 3.14             | ✅          | ✅                  | ✅            | ✅            | ✅<sup>2</sup> | ✅                             | ✅                           | ✅                              | ✅                              | ✅                            | ✅<sup>4</sup>                 | ✅      | ✅  | ✅             |
-| CPython 3.15<sup>5</sup> | ✅          | ✅                  | ✅            | ✅            | ✅<sup>2</sup> | ✅                             | ✅                           | ✅                              | ✅                              | ✅                            | ✅<sup>4</sup>                 | ✅      | ✅  | N/A            |
-| PyPy 3.9 v7.3            | ✅          | ✅                  | ✅            | N/A           | N/A            | ✅<sup>1</sup>                 | ✅<sup>1</sup>               | ✅<sup>1</sup>                  | N/A                             | N/A                           | N/A                            | N/A     | N/A | N/A            |
-| PyPy 3.10 v7.3           | ✅          | ✅                  | ✅            | N/A           | N/A            | ✅<sup>1</sup>                 | ✅<sup>1</sup>               | ✅<sup>1</sup>                  | N/A                             | N/A                           | N/A                            | N/A     | N/A | N/A            |
-| PyPy 3.11 v7.3           | ✅          | ✅                  | ✅            | N/A           | N/A            | ✅<sup>1</sup>                 | ✅<sup>1</sup>               | ✅<sup>1</sup>                  | N/A                             | N/A                           | N/A                            | N/A     | N/A | N/A            |
-| GraalPy 3.12 v25.0       | ✅          | ✅                  | ✅            | N/A           | N/A            | ✅<sup>1</sup>                 | N/A                          | ✅<sup>1</sup>                  | N/A                             | N/A                           | N/A                            | N/A     | N/A | N/A            |
+|                    | macOS Intel | macOS Apple Silicon | Windows 64bit | Windows 32bit | Windows Arm64  | manylinux<br/>musllinux x86_64 | manylinux<br/>musllinux i686 | manylinux<br/>musllinux aarch64 | manylinux<br/>musllinux ppc64le | manylinux<br/>musllinux s390x | manylinux<br/>musllinux armv7l | Android | iOS | Pyodide        |
+|--------------------| ----------- | ------------------- | ------------- | ------------- | -------------- | ------------------------------ | ---------------------------- | ------------------------------- | ------------------------------- | ----------------------------- | ------------------------------ | ------- | --- | -------------- |
+| CPython 3.9        | ✅          | ✅                  | ✅            | ✅            | ✅<sup>2</sup> | ✅                             | ✅                           | ✅                              | ✅                              | ✅                            | ✅<sup>4</sup>                 | N/A     | N/A | N/A            |
+| CPython 3.10       | ✅          | ✅                  | ✅            | ✅            | ✅<sup>2</sup> | ✅                             | ✅                           | ✅                              | ✅                              | ✅                            | ✅<sup>4</sup>                 | N/A     | N/A | N/A            |
+| CPython 3.11       | ✅          | ✅                  | ✅            | ✅            | ✅<sup>2</sup> | ✅                             | ✅                           | ✅                              | ✅                              | ✅                            | ✅<sup>4</sup>                 | N/A     | N/A | N/A            |
+| CPython 3.12       | ✅          | ✅                  | ✅            | ✅            | ✅<sup>2</sup> | ✅                             | ✅                           | ✅                              | ✅                              | ✅                            | ✅<sup>4</sup>                 | N/A     | N/A | ✅<sup>3</sup> |
+| CPython 3.13       | ✅          | ✅                  | ✅            | ✅            | ✅<sup>2</sup> | ✅                             | ✅                           | ✅                              | ✅                              | ✅                            | ✅<sup>4</sup>                 | ✅      | ✅  | ✅             |
+| CPython 3.14       | ✅          | ✅                  | ✅            | ✅            | ✅<sup>2</sup> | ✅                             | ✅                           | ✅                              | ✅                              | ✅                            | ✅<sup>4</sup>                 | ✅      | ✅  | ✅             |
+| CPython 3.15       | ✅          | ✅                  | ✅            | ✅            | ✅<sup>2</sup> | ✅                             | ✅                           | ✅                              | ✅                              | ✅                            | ✅<sup>4</sup>                 | ✅      | ✅  | ✅             |
+| PyPy 3.9 v7.3      | ✅          | ✅                  | ✅            | N/A           | N/A            | ✅<sup>1</sup>                 | ✅<sup>1</sup>               | ✅<sup>1</sup>                  | N/A                             | N/A                           | N/A                            | N/A     | N/A | N/A            |
+| PyPy 3.10 v7.3     | ✅          | ✅                  | ✅            | N/A           | N/A            | ✅<sup>1</sup>                 | ✅<sup>1</sup>               | ✅<sup>1</sup>                  | N/A                             | N/A                           | N/A                            | N/A     | N/A | N/A            |
+| PyPy 3.11 v7.3     | ✅          | ✅                  | ✅            | N/A           | N/A            | ✅<sup>1</sup>                 | ✅<sup>1</sup>               | ✅<sup>1</sup>                  | N/A                             | N/A                           | N/A                            | N/A     | N/A | N/A            |
+| GraalPy 3.12 v25.0 | ✅          | ✅                  | ✅            | N/A           | N/A            | ✅<sup>1</sup>                 | N/A                          | ✅<sup>1</sup>                  | N/A                             | N/A                           | N/A                            | N/A     | N/A | N/A            |

 <sup>**1** PyPy & GraalPy are only supported for manylinux wheels.</sup><br>
 <sup>**2** Windows arm64 support is experimental.</sup><br>
 <sup>**3** Not supported on PyPI, uses old `pyodide` tag instead of `pyemscripten`. Requires `pyodide-eol` [`enable`](https://cibuildwheel.pypa.io/en/stable/options/#enable).</sup><br>
 <sup>**4** manylinux armv7l support is experimental. As there are no RHEL based image for this architecture, it's using an Ubuntu based image instead.</sup><br>
-<sup>**5** Python 3.15 requires opt-in using [`enable`](https://cibuildwheel.pypa.io/en/stable/options/#enable).</sup><br>

 - Builds manylinux, musllinux, macOS, Windows, pyemscripten, iOS, and Android wheels
 - Supports CPython, PyPy, and GraalPy
@@ -98,7 +97,7 @@ jobs:
      - uses: actions/setup-python@v6

      - name: Install cibuildwheel
-        run: python -m pip install cibuildwheel==4.1.0
+        run: python -m pip install cibuildwheel==4.2.0

      - name: Build wheels
        run: python -m cibuildwheel --output-dir wheelhouse
@@ -189,8 +188,8 @@ Here are some repos that use cibuildwheel.
 |-----------------------------------|----|----|:------|
 | [scikit-learn][]                  | ![github icon][] | ![windows icon][] ![apple icon][] ![linux icon][] ![pyodide icon][] | The machine learning library. A complex but clean config using many of cibuildwheel's features to build a large project with Cython and C++ extensions.  |
 | [duckdb][]                        | ![github icon][] | ![apple icon][] ![linux icon][] ![windows icon][] | DuckDB is an analytical in-process SQL database management system |
-| [pytorch-fairseq][]               | ![github icon][] | ![apple icon][] ![linux icon][] | Facebook AI Research Sequence-to-Sequence Toolkit written in Python. |
 | [NumPy][]                         | ![github icon][] ![travisci icon][] | ![windows icon][] ![apple icon][] ![linux icon][] ![pyodide icon][] | The fundamental package for scientific computing with Python. |
+| [pytorch-fairseq][]               | ![github icon][] | ![apple icon][] ![linux icon][] | Facebook AI Research Sequence-to-Sequence Toolkit written in Python. |
 | [NCNN][]                          | ![github icon][] | ![windows icon][] ![apple icon][] ![linux icon][] | ncnn is a high-performance neural network inference framework optimized for the mobile platform |
 | [Matplotlib][]                    | ![github icon][] | ![windows icon][] ![apple icon][] ![linux icon][] ![pyodide icon][] | The venerable Matplotlib, a Python library with C++ portions |
 | [Tornado][]                       | ![github icon][] | ![linux icon][] ![apple icon][] ![windows icon][] | Tornado is a Python web framework and asynchronous networking library. Uses stable ABI for a small C extension. |
@@ -200,8 +199,8 @@ Here are some repos that use cibuildwheel.

 [scikit-learn]: https://github.com/scikit-learn/scikit-learn
 [duckdb]: https://github.com/duckdb/duckdb
-[pytorch-fairseq]: https://github.com/facebookresearch/fairseq
 [NumPy]: https://github.com/numpy/numpy
+[pytorch-fairseq]: https://github.com/facebookresearch/fairseq
 [NCNN]: https://github.com/Tencent/ncnn
 [Matplotlib]: https://github.com/matplotlib/matplotlib
 [Tornado]: https://github.com/tornadoweb/tornado
@@ -239,6 +238,42 @@ Changelog

 <!-- [[[cog from readme_changelog import mini_changelog; print(mini_changelog()) ]]] -->

+### v4.2.0
+
+_4 August 2026_
+
+- 🌟 CPython 3.15 wheels are now built by default - without the `"cpython-prerelease"` [`enable`](https://cibuildwheel.pypa.io/en/stable/options/#enable) set. It's time to build and upload these wheels to PyPI! This release includes CPython 3.15.0rc1, which is guaranteed to be ABI compatible with the final release. (#2944)
+- ✨ Adds Pyodide 3.15 support with the `cp315-pyodide_wasm32` build identifier, using Pyodide 315.0.0a2. These are also stable wrt. the final release. (#2958)
+- 🐛 Retries a failed download six times with exponential backoff, so short network outages no longer stop a build. A `4xx` response is still reported at once. (#2953)
+- 🐛 Accepts `default` as a [`build-frontend`](https://cibuildwheel.pypa.io/en/stable/options/#build-frontend) value on Pyodide, and accepts `pyodide-build` in the top-level table and in overrides (#2951)
+- 🛠 Holds pip back on GraalPy, where newer pip breaks the build (#2955)
+- 🛠 Updates Pyodide to 314.0.4 (#2949, #2952)
+- 🛠 Updates dependencies and container pins (#2952, #2960)
+- 💼 Updates CI action pins (#2948, #2954)
+- 🧪 Uses pp311 for the abi3 test, and deletes `test_overridden_pip_constraint`, which is not necessary since #2583 (#2956, #2957)
+
+### v4.1.1
+
+_24 July 2026_
+
+- ✨ Adds `pyodide-build` as a separate [`build-frontend`](https://cibuildwheel.pypa.io/en/stable/options/#build-frontend), now the default frontend for Pyodide, with verbosity flags handling. Any other frontend is ignored with a warning on Pyodide. (#2609, #2945)
+- 🔐 Uses digests instead of tags for pinned container images, strengthening supply-chain security. The human-readable tags remain as comments in `pinned_docker_images.cfg`. (#2915)
+- 🐛 Fixes platform-specific [`test-runtime`](https://cibuildwheel.pypa.io/en/stable/options/#test-runtime) environment variables (e.g. `CIBW_TEST_RUNTIME_ANDROID`) not being honored (#2941)
+- 🐛 Fixes quoting of [`test-requires`](https://cibuildwheel.pypa.io/en/stable/options/#test-requires) and [`audit-requires`](https://cibuildwheel.pypa.io/en/stable/options/#audit-requires) so PEP 508 specifiers containing spaces work (#2913)
+- 🐛 Makes [`archs`](https://cibuildwheel.pypa.io/en/stable/options/#archs) parsing case-insensitive and platform-aware, so e.g. `arm64` works on Windows (#2920)
+- 🐛 Uses an absolute path for the `{project}` placeholder in [`config-settings`](https://cibuildwheel.pypa.io/en/stable/options/#config-settings) (#2934)
+- 🐛 Validates the [`pyodide-version`](https://cibuildwheel.pypa.io/en/stable/options/#pyodide-version) option against the build identifier with a clear error (#2925)
+- 🐛 Fixes PyPy installs on macOS after PyPy switched its downloads from `.tar.bz2` to `.tar.gz` (#2939)
+- 🐛 Makes a matching `python3-config` available in the build and test venvs on macOS (#2922)
+- 🛠 Updates dependencies and container pins (#2917, #2935, #2939)
+- 🛠 Updates Android tests to current Python versions and the new test repository URL (#2933)
+- 🛠 Drops the `orjson` dependency, no longer used by mypy 2+ (#2923)
+- 📚 Builds the docs with properdocs, a MkDocs fork (#2946)
+- 📚 Adds the missing `cp314-pyodide_wasm32` entry to the build identifier table (#2947)
+- 📚 Removes outdated notes about the `pip wheel` build frontend and ClearLinux (#2926)
+- 💼 Adds a "CI: PyPy EoL" PR label to run PyPy EoL tests on PRs (#2930)
+- 💼 Updates CI action pins and pre-commit hooks (#2914, #2932, #2938, #2940, #2942, #2943)
+
 ### v4.1.0

 _12 June 2026_
@@ -316,25 +351,7 @@ _2 April 2026_
 - ✨ cibuildwheel prints the selected build identifiers at the start of the build. (#2785)
 - 🔐 The GitHub Action now references other actions with a full SHA (#2744)

-### v3.4.0
-
-_5 March 2026_
-
- 🌟 You can now build wheels using `uv` as a build frontend. This should improve performance, especially if your project has lots of build dependencies. To use, set [`build-frontend`](https://cibuildwheel.pypa.io/en/stable/options/#build-frontend) to `uv`. (#2322)
- ⚠️ We no longer support running on Travis CI. It may continue working but we don't run tests there anymore so we can't be sure. (#2682)
- ✨ Improvements to building rust wheels on Android (#2650)
- 🛠 Update Pyodide to 0.29.3 (#2719, #2733)
- 🐛 Fix bug with the GitHub Action on Windows, where PATH was getting unnecessarily changed, causing issues with meson builds. (#2723)
- ✨ Add support for quiet setting on `build` and `uv` from the cibuildwheel `build-verbosity` setting. (#2737)
- 📚 Docs updates, including guidance on using Meson on Windows (#2718)
-
-### v3.3.1
-
-_5 January 2026_
-
- 🛠 Update dependencies and container pins, including updating to CPython 3.14.2. (#2708)
-
-<!-- [[[end]]] (sum: s3fkxPyqwC) -->
+<!-- [[[end]]] (sum: fEuiF50wvg) -->

 ---

@@ -28,7 +28,7 @@ branding:
 runs:
  using: composite
  steps:
-    - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+    - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
      id: python
      with:
        python-version: "3.11 - 3.14"
@@ -12,7 +12,7 @@ pr:
      - .readthedocs.yml
      - .travis.yml
      - README.md
-      - mkdocs.yml
+      - properdocs.yml
      - noxfile.py

 jobs:
@@ -35,7 +35,7 @@ $defs:
      - pyodide-prerelease
      - pypy
      - pypy-eol
-  description: A Python version or flavor to enable.
+    description: A Python version or flavor to enable.
 additionalProperties: false
 description: cibuildwheel's settings.
 type: object
@@ -62,29 +62,7 @@ properties:
    default: ['*']
    description: Choose the Python versions to build.
    type: string_array
-  build-frontend:
-    default: default
-    description: Set the tool to use to build, either "build" (default), "build[uv]", "uv", or "pip"
-    oneOf:
-      - enum: [pip, build, "build[uv]", uv, default]
-      - type: string
-        pattern: '^pip; ?args:'
-      - type: string
-        pattern: '^build; ?args:'
-      - type: string
-        pattern: '^build\\[uv\\]; ?args:'
-      - type: string
-        pattern: '^uv; ?args:'
-      - type: object
-        additionalProperties: false
-        required: [name]
-        properties:
-          name:
-            enum: [pip, build, "build[uv]", uv]
-          args:
-            type: array
-            items:
-              type: string
+  build-frontend: {}  # filled in by build_frontend_schema below
  build-verbosity:
    type: integer
    minimum: -3
@@ -292,6 +270,43 @@ string_table = yaml.safe_load(
 """
 )

+FRONTENDS = ["pip", "build", "build[uv]", "uv"]
+
+
+def build_frontend_schema(
+    names: list[str], description: str, default: str = "default"
+) -> dict[str, Any]:
+    """
+    A frontend is a name, a "name; args: ..." string, or a table with a name and args.
+    """
+    # Only the brackets in "build[uv]" need escaping
+    patterns = [name.replace("[", r"\[").replace("]", r"\]") for name in names]
+    return {
+        "default": default,
+        "description": description,
+        "oneOf": [
+            {"enum": [*names, "default"]},
+            *({"type": "string", "pattern": f"^{pattern}; ?args:"} for pattern in patterns),
+            {
+                "type": "object",
+                "additionalProperties": False,
+                "required": ["name"],
+                "properties": {
+                    "name": {"enum": names},
+                    "args": {"type": "array", "items": {"type": "string"}},
+                },
+            },
+        ],
+        "title": "CIBW_BUILD_FRONTEND",
+    }
+
+
+schema["properties"]["build-frontend"] = build_frontend_schema(
+    [*FRONTENDS, "pyodide-build"],
+    'Set the tool to use to build, either "build" (default), "build[uv]", "uv", or "pip"'
+    ' ("pyodide-build" for pyodide)',
+)
+
 for value in schema["properties"].values():
    match value:
        case {"type": "string_array"}:
@@ -303,6 +318,8 @@ for value in schema["properties"].values():
        case {"type": "string_table_array"}:
            del value["type"]
            value["oneOf"] = string_table_array
+        case _:
+            pass

 overrides = yaml.safe_load(
    """
@@ -393,6 +410,21 @@ for os_name, command in [

 del oses["linux"]["properties"]["dependency-versions"]

+
+schema["$defs"]["build-frontend-no-pyodide"] = build_frontend_schema(
+    FRONTENDS,
+    'Set the tool to use to build, either "build" (default), "build[uv]", "uv", or "pip"',
+)
+
+for os_val in oses.values():
+    os_val["properties"]["build-frontend"] = {"$ref": "#/$defs/build-frontend-no-pyodide"}
+
+oses["pyodide"]["properties"]["build-frontend"] = build_frontend_schema(
+    ["pyodide-build"],
+    'On the pyodide platform, the build frontend must be "pyodide-build"',
+    default="pyodide-build",
+)
+
 schema["properties"]["overrides"] = overrides
 schema["properties"] |= oses

@@ -49,7 +49,7 @@ def parse(contents: str) -> str | None:
        analyzer = Analyzer()
        analyzer.visit(tree)
        return analyzer.requires_python or ""
-    except Exception:
+    except Exception:  # noqa: BLE001
        return None


@@ -9,6 +9,7 @@

 import configparser
 import dataclasses
+from functools import cache
 from pathlib import Path

 import requests
@@ -33,7 +34,7 @@ class PyPAImage(Image):
        super().__init__(manylinux_version, platforms, image_name, tag, True)


-images = [
+IMAGES = [
    # manylinux2014 images
    PyPAImage(
        "manylinux2014",
@@ -88,49 +89,71 @@ images = [
    ),
 ]

-config = configparser.ConfigParser()

-for image in images:
-    # get the tag name whose digest matches 'latest'
-    if image.tag is not None:
-        # image has been pinned, do not update
-        tag_name = image.tag
-    elif image.image_name.startswith("quay.io/"):
-        _, _, repository_name = image.image_name.partition("/")
-        response = requests.get(
-            f"https://quay.io/api/v1/repository/{repository_name}?includeTags=true"
-        )
-        response.raise_for_status()
-        repo_info = response.json()
-        tags_dict = repo_info["tags"]
-
-        latest_tag = tags_dict.pop("latest")
+@cache
+def quay_lookup(image_name: str, tag_name: str) -> tuple[str, str]:
+    _, _, repository_name = image_name.partition("/")
+    if tag_name == "latest":
+        url = f"https://quay.io/api/v1/repository/{repository_name}?includeTags=true"
+    else:
+        url = f"https://quay.io/api/v1/repository/{repository_name}/tag?specificTag={tag_name}"
+    response = requests.get(url)
+    response.raise_for_status()
+    info = response.json()
+    if tag_name == "latest":
+        tags_dict = info["tags"]
+        tag_info = tags_dict.pop(tag_name)
        # find the tag whose manifest matches 'latest'
-        tag_name = next(
-            name
+        tag_name, digest = next(
+            (name, info["manifest_digest"])
            for (name, info) in tags_dict.items()
-            if info["manifest_digest"] == latest_tag["manifest_digest"]
+            if info["manifest_digest"] == tag_info["manifest_digest"]
        )
-    elif image.image_name.startswith("ghcr.io/"):
-        repository = image.image_name[8:]
-        response = requests.get(
-            "https://ghcr.io/token", params={"scope": f"repository:{repository}:pull"}
-        )
-        response.raise_for_status()
-        token = response.json()["token"]
+    else:
+        tags_list = info["tags"]
+        tag_info = next(tag for tag in tags_list if tag["name"] == tag_name)
+        digest = tag_info["manifest_digest"]
+
+    return tag_name, digest
+
+
+@cache
+def ghcr_lookup(image_name: str, tag_name: str) -> tuple[str, str]:
+    repository = image_name[8:]
+    response = requests.get(
+        "https://ghcr.io/token", params={"scope": f"repository:{repository}:pull"}
+    )
+    response.raise_for_status()
+    token = response.json()["token"]
+    if tag_name == "latest":
        response = requests.get(
            f"https://ghcr.io/v2/{repository}/tags/list",
            headers={"Authorization": f"Bearer {token}"},
        )
        response.raise_for_status()
-        ghcr_tags = [(Version(tag), tag) for tag in response.json()["tags"] if tag != "latest"]
+        info = response.json()
+        ghcr_tags = [(Version(tag), tag) for tag in info["tags"] if tag != "latest"]
        ghcr_tags.sort(reverse=True)
        tag_name = ghcr_tags[0][1]
-    else:
-        response = requests.get(f"https://hub.docker.com/v2/repositories/{image.image_name}/tags")
-        response.raise_for_status()
-        tags = response.json()["results"]

+    response = requests.head(
+        f"https://ghcr.io/v2/{repository}/manifests/{tag_name}",
+        headers={
+            "Authorization": f"Bearer {token}",
+            "Accept": "application/vnd.docker.distribution.manifest.v2+json, application/vnd.docker.distribution.manifest.list.v2+json, application/vnd.oci.image.manifest.v1+json, application/vnd.oci.image.index.v1+json, application/vnd.oci.artifact.manifest.v1+json",
+        },
+    )
+    response.raise_for_status()
+    digest = response.headers["Docker-Content-Digest"]
+    return tag_name, digest
+
+
+@cache
+def dockerhub_lookup(image_name: str, tag_name: str) -> tuple[str, str]:
+    response = requests.get(f"https://hub.docker.com/v2/repositories/{image_name}/tags")
+    response.raise_for_status()
+    tags = response.json()["results"]
+    if tag_name == "latest":
        latest_tag = next(tag for tag in tags if tag["name"] == "latest")
        # i don't know what it would mean to have multiple images per tag
        assert len(latest_tag["images"]) == 1
@@ -139,15 +162,40 @@ for image in images:
        pinned_tag = next(
            tag for tag in tags if tag != latest_tag and tag["images"][0]["digest"] == digest
        )
-        tag_name = pinned_tag["name"]
+    else:
+        pinned_tag = next(tag for tag in tags if tag["name"] == tag_name)
+        digest = pinned_tag["images"][0]["digest"]
+    tag_name = pinned_tag["name"]
+    return tag_name, digest

-    for platform in image.platforms:
-        if not config.has_section(platform):
-            config[platform] = {}
-        suffix = ""
-        if image.use_platform_suffix:
-            suffix = f"_{platform.removeprefix('pypy_')}"
-        config[platform][image.manylinux_version] = f"{image.image_name}{suffix}:{tag_name}"

-with open(RESOURCES / "pinned_docker_images.cfg", "w") as f:
-    config.write(f)
+def main() -> None:
+    config = configparser.ConfigParser()
+    for image in IMAGES:
+        # get the tag name whose digest matches 'latest'
+        # if image has been pinned, do not update
+        search_tag = image.tag or "latest"
+        if image.image_name.startswith("quay.io/"):
+            lookup = quay_lookup
+        elif image.image_name.startswith("ghcr.io/"):
+            lookup = ghcr_lookup
+        else:
+            lookup = dockerhub_lookup
+
+        tag_name, digest = lookup(image.image_name, search_tag)
+        for platform in image.platforms:
+            if not config.has_section(platform):
+                config[platform] = {}
+            image_name = image.image_name
+            if image.use_platform_suffix:
+                image_name = f"{image_name}_{platform.removeprefix('pypy_')}"
+                _, digest = lookup(image_name, tag_name)
+            assert digest.startswith("sha256:")
+            config[platform][image.manylinux_version] = f"{image_name}@{digest}  # {tag_name}"
+
+    with open(RESOURCES / "pinned_docker_images.cfg", "w") as f:
+        config.write(f)
+
+
+if __name__ == "__main__":
+    main()
@@ -76,9 +76,9 @@ class WindowsVersions:
        response.raise_for_status()
        api_info = response.json()

-        for resource in api_info["resources"]:
-            if resource["@type"] == "PackageBaseAddress/3.0.0":
-                endpoint = resource["@id"]
+        endpoint = next(
+            r["@id"] for r in api_info["resources"] if r["@type"] == "PackageBaseAddress/3.0.0"
+        )

        ARCH_DICT = {"32": "win32", "64": "win_amd64", "ARM64": "win_arm64"}
        PACKAGE_DICT = {"32": "pythonx86", "64": "python", "ARM64": "pythonarm64"}
@@ -1 +1 @@
-__version__ = "4.1.0"
+__version__ = "4.2.0"
@@ -83,7 +83,7 @@ def github_api_request(path: str, *, max_retries: int = 3) -> dict[str, Any]:

            if retry_count == max_retries - 1:
                print(f"GitHub API request failed (Network error: {e}). Check network connection.")
-                raise e
+                raise

    # Should never be reached but to keep the type checker happy
    msg = "Unexpected execution path in github_api_request"
@@ -16,7 +16,7 @@ if TYPE_CHECKING:

    from cibuildwheel.typing import PathOrStr

-BuildFrontendName = Literal["pip", "build", "build[uv]", "uv"]
+BuildFrontendName = Literal["pip", "build", "build[uv]", "uv", "pyodide-build"]


@dataclasses.dataclass(frozen=True)
@@ -46,6 +46,11 @@ class BuildFrontendConfig:


 def _get_verbosity_flags(level: int, frontend: BuildFrontendName) -> list[str]:
+    if frontend == "pyodide-build":
+        if level > 0:
+            return ["-" + min(level, 2) * "v"]
+        return []
+
    if level < 0:
        return ["-" + -level * "q"]

@@ -546,9 +546,14 @@ class OCIContainer:
        else:
            output_io = sys.stdout.buffer

-        while True:
+        return_code = None
+        while return_code is None:
            line = self.bash_stdout.readline()

+            if not line:
+                msg = "Failed to read the return code, the container shell has exited"
+                raise RuntimeError(msg)
+
            if line.endswith(bytes(end_of_message, encoding="utf8") + b"\n"):
                # fmt: off
                footer_offset = (
@@ -563,7 +568,6 @@ class OCIContainer:
                # add the last line to output, without the footer
                output_io.write(line[0:footer_offset])
                output_io.flush()
-                break
            else:
                output_io.write(line)
                output_io.flush()
@@ -43,7 +43,7 @@ from packaging.specifiers import SpecifierSet
 from cibuildwheel import errors
 from cibuildwheel.architecture import Architecture
 from cibuildwheel.environment import EnvironmentParseError, ParsedEnvironment, parse_environment
-from cibuildwheel.frontend import BuildFrontendConfig
+from cibuildwheel.frontend import BuildFrontendConfig, BuildFrontendName
 from cibuildwheel.logger import log
 from cibuildwheel.oci_container import OCIContainerEngineConfig
 from cibuildwheel.projectfiles import get_requires_python_str, resolve_dependency_groups
@@ -821,7 +821,6 @@ class Options:

            test_runtime_str = self.reader.get(
                "test-runtime",
-                env_plat=False,
                option_format=ShlexTableFormat(sep="; ", pair_sep=":", allow_merge=False),
            )
            if not test_runtime_str:
@@ -851,8 +850,11 @@ class Options:
                env_plat=False,
                option_format=ShlexTableFormat(sep="; ", pair_sep=":", allow_merge=False),
            )
+            default_frontend: BuildFrontendName = (
+                "pyodide-build" if self.platform == "pyodide" else "build"
+            )
            if not build_frontend_str or build_frontend_str == "default":
-                build_frontend = BuildFrontendConfig("build")
+                build_frontend = BuildFrontendConfig(default_frontend)
            else:
                try:
                    build_frontend = BuildFrontendConfig.from_config_string(build_frontend_str)
@@ -860,6 +862,18 @@ class Options:
                    msg = f"Failed to parse build frontend. {e}"
                    raise errors.ConfigurationError(msg) from e

+            if self.platform == "pyodide" and build_frontend.name != "pyodide-build":
+                # pip and uv could become an error, eventually. build -> pyodide-build is
+                # probably fine to keep as a warning
+                log.warning(
+                    f"The pyodide platform ignores the {build_frontend.name!r} build "
+                    "frontend; using 'pyodide-build' instead"
+                )
+                build_frontend = BuildFrontendConfig("pyodide-build", build_frontend.args)
+            if self.platform != "pyodide" and build_frontend.name == "pyodide-build":
+                msg = "The 'pyodide-build' build frontend is only supported on the pyodide platform"
+                raise errors.ConfigurationError(msg)
+
            try:
                environment = parse_environment(environment_config)
            except (EnvironmentParseError, ValueError) as e:
@@ -1124,6 +1138,6 @@ def _get_pinned_container_images() -> Mapping[str, Mapping[str, str]]:
      'pypy_x86_64': {'manylinux2010': '...' }
      ... }
    """
-    all_pinned_images = configparser.ConfigParser()
+    all_pinned_images = configparser.ConfigParser(inline_comment_prefixes="#")
    all_pinned_images.read(resources.PINNED_DOCKER_IMAGES)
    return all_pinned_images
@@ -222,16 +222,6 @@ def setup_target_python(config: PythonConfiguration, build_path: Path) -> Path:
    python_dir = build_path / "python"
    python_dir.mkdir()
    shutil.unpack_archive(python_tgz, python_dir)
-
-    # Patch a testbed bug. This code and the patch file can both be removed once we've
-    # updated to Python versions that include the fix.
-    call("patch", "-p1", "-i", RESOURCES_ANDROID / "android.patch", cwd=python_dir)
-
-    # Work around https://github.com/python/cpython/issues/138800. This can be removed
-    # once we've updated to Python versions that include the fix.
-    pc_path = python_dir / f"prefix/lib/pkgconfig/python-{config.version}.pc"
-    pc_path.write_text(pc_path.read_text().replace("$(BLDLIBRARY)", f"-lpython{config.version}"))
-
    return python_dir


@@ -314,7 +304,9 @@ def setup_env(
        "wheel",
        parse_config_settings(
            prepare_config_settings(
-                build_options.config_settings, project=".", package=build_options.package_dir
+                build_options.config_settings,
+                project=Path.cwd(),
+                package=build_options.package_dir,
            )
        ),
    )
@@ -604,7 +596,7 @@ def build_wheel(state: BuildState) -> Path:
                    state.options.build_verbosity,
                    prepare_config_settings(
                        state.options.config_settings,
-                        project=".",
+                        project=Path.cwd(),
                        package=state.options.package_dir,
                    ),
                ),
@@ -625,7 +617,7 @@ def build_wheel(state: BuildState) -> Path:
                    state.options.build_verbosity,
                    prepare_config_settings(
                        state.options.config_settings,
-                        project=".",
+                        project=Path.cwd(),
                        package=state.options.package_dir,
                    ),
                ),
@@ -463,6 +463,9 @@ def setup_python(
                *constraint_flags(dependency_constraint),
                env=env,
            )
+        case "pyodide-build":
+            msg = "The 'pyodide-build' build frontend is not supported on this platform"
+            raise errors.FatalError(msg)
        case _:
            assert_never(build_frontend)

@@ -537,7 +540,7 @@ def build(options: Options, tmp_path: Path) -> None:
                    f"that is compatible with {config.identifier}. "
                    "Skipping build step..."
                )
-                test_wheel = compatible_wheel
+                repaired_wheel = compatible_wheel
            else:
                if build_options.before_build:
                    log.step("Running before_build...")
@@ -556,7 +559,7 @@ def build(options: Options, tmp_path: Path) -> None:
                    build_options.build_verbosity,
                    prepare_config_settings(
                        build_options.config_settings,
-                        project=".",
+                        project=Path.cwd(),
                        package=build_options.package_dir,
                    ),
                )
@@ -588,6 +591,9 @@ def build(options: Options, tmp_path: Path) -> None:
                            *extra_flags,
                            env=env,
                        )
+                    case "pyodide-build":
+                        msg = "The 'pyodide-build' build frontend is not supported on this platform"
+                        raise errors.FatalError(msg)
                    case _:
                        assert_never(build_frontend)

@@ -626,8 +632,6 @@ def build(options: Options, tmp_path: Path) -> None:

                run_audit(tmp_dir=tmp_path, build_options=build_options, wheel=repaired_wheel)

-                test_wheel = repaired_wheel
-
            if build_options.test_command and build_options.test_selector(config.identifier):
                if not config.is_simulator:
                    log.step("Skipping tests on non-simulator SDK")
@@ -687,7 +691,7 @@ def build(options: Options, tmp_path: Path) -> None:
                        platform_tag,
                        "--target",
                        testbed_path / "iOSTestbed" / "app_packages",
-                        f"{test_wheel}{build_options.test_extras}",
+                        f"{repaired_wheel}{build_options.test_extras}",
                        *build_options.test_requires,
                        env=test_env,
                    )
@@ -360,6 +360,9 @@ def build_in_container(
                        ],
                        env=env,
                    )
+                case "pyodide-build":
+                    msg = "The 'pyodide-build' build frontend is not supported on this platform"
+                    raise errors.FatalError(msg)
                case _:
                    assert_never(build_frontend)

@@ -215,18 +215,19 @@ def install_cpython(_tmp: Path, version: str, url: str, free_threading: bool, sh


 def install_pypy(tmp: Path, url: str, sha256: str) -> Path:
-    pypy_tar_bz2 = url.rsplit("/", 1)[-1]
-    extension = ".tar.bz2"
-    assert pypy_tar_bz2.endswith(extension)
-    installation_path = CIBW_CACHE_PATH / pypy_tar_bz2[: -len(extension)]
+    pypy_archive = url.rsplit("/", 1)[-1]
+    # PyPy ships .tar.bz2 for some platforms and .tar.gz for others.
+    extension = ".tar.bz2" if pypy_archive.endswith(".tar.bz2") else ".tar.gz"
+    assert pypy_archive.endswith(extension)
+    installation_path = CIBW_CACHE_PATH / pypy_archive[: -len(extension)]
    with FileLock(str(installation_path) + ".lock"):
        if not installation_path.exists():
-            downloaded_tar_bz2 = tmp / pypy_tar_bz2
-            download(url, downloaded_tar_bz2, sha256=sha256)
+            downloaded_archive = tmp / pypy_archive
+            download(url, downloaded_archive, sha256=sha256)
            installation_path.parent.mkdir(parents=True, exist_ok=True)
            with remove_on_error(installation_path):
-                call("tar", "-C", installation_path.parent, "-xf", downloaded_tar_bz2)
-            downloaded_tar_bz2.unlink()
+                call("tar", "-C", installation_path.parent, "-xf", downloaded_archive)
+            downloaded_archive.unlink()
    return installation_path / "bin" / "pypy3"


@@ -449,6 +450,9 @@ def setup_python(
                *constraint_flags(dependency_constraint),
                env=env,
            )
+        case "pyodide-build":
+            msg = "The 'pyodide-build' build frontend is not supported on this platform"
+            raise errors.FatalError(msg)
        case _:
            assert_never(build_frontend)

@@ -534,7 +538,7 @@ def build(options: Options, tmp_path: Path) -> None:
                    build_options.build_verbosity,
                    prepare_config_settings(
                        build_options.config_settings,
-                        project=".",
+                        project=Path.cwd(),
                        package=build_options.package_dir,
                    ),
                )
@@ -585,6 +589,9 @@ def build(options: Options, tmp_path: Path) -> None:
                            *extra_flags,
                            env=build_env,
                        )
+                    case "pyodide-build":
+                        msg = "The 'pyodide-build' build frontend is not supported on this platform"
+                        raise errors.FatalError(msg)
                    case _:
                        assert_never(build_frontend)

@@ -426,10 +426,6 @@ def build(options: Options, tmp_path: Path) -> None:
            build_options = options.build_options(config.identifier)
            build_frontend = build_options.build_frontend

-            if build_frontend.name == "pip":
-                msg = "The pyodide platform doesn't support pip frontend"
-                raise errors.FatalError(msg)
-
            log.build_start(config.identifier)

            identifier_tmp_dir = tmp_path / config.identifier
@@ -477,7 +473,7 @@ def build(options: Options, tmp_path: Path) -> None:
                print(
                    f"\nFound previously built wheel {compatible_wheel.name}, that's compatible with {config.identifier}. Skipping build step..."
                )
-                built_wheel = compatible_wheel
+                repaired_wheel = compatible_wheel
            else:
                if build_options.before_build:
                    log.step("Running before_build...")
@@ -493,7 +489,7 @@ def build(options: Options, tmp_path: Path) -> None:
                    build_options.build_verbosity,
                    prepare_config_settings(
                        build_options.config_settings,
-                        project=".",
+                        project=Path.cwd(),
                        package=build_options.package_dir,
                    ),
                )
@@ -401,6 +401,9 @@ def setup_python(
                *constraint_flags(dependency_constraint),
                env=env,
            )
+        case "pyodide-build":
+            msg = "The 'pyodide-build' build frontend is not supported on this platform"
+            raise errors.FatalError(msg)
        case _:
            assert_never(build_frontend)

@@ -489,7 +492,7 @@ def build(options: Options, tmp_path: Path) -> None:
                    build_options.build_verbosity,
                    prepare_config_settings(
                        build_options.config_settings,
-                        project=".",
+                        project=Path.cwd(),
                        package=options.globals.package_dir,
                    ),
                )
@@ -539,6 +542,9 @@ def build(options: Options, tmp_path: Path) -> None:
                            *extra_flags,
                            env=env,
                        )
+                    case "pyodide-build":
+                        msg = "The 'pyodide-build' build frontend is not supported on this platform"
+                        raise errors.FatalError(msg)
                    case _:
                        assert_never(build_frontend)

@@ -60,6 +60,8 @@ class Analyzer(ast.NodeVisitor):
            case ast.keyword(arg="python_requires", value=ast.Constant(value=str() as version)):
                if unnested or name_main_unnested:
                    self.requires_python = version
+            case _:
+                pass


 def setup_py_python_requires(content: str) -> str | None:
@@ -68,7 +70,7 @@ def setup_py_python_requires(content: str) -> str | None:
        analyzer = Analyzer()
        analyzer.visit(tree)
        return analyzer.requires_python or None
-    except Exception:  # pylint: disable=broad-except
+    except Exception:  # noqa: BLE001
        return None


@@ -1,11 +0,0 @@
--- a/android.py
-+++ b/android.py
-@@ -1021,7 +1021,7 @@ def main():
-     context = parse_args()
- 
-     # Set the CROSS_BUILD_DIR if an argument was provided
-    if context.cross_build_dir:
-+    if getattr(context, "cross_build_dir", None):
-         global CROSS_BUILD_DIR
-         CROSS_BUILD_DIR = context.cross_build_dir.resolve()
- 
@@ -153,27 +153,27 @@ python_configurations = [
  { identifier = "cp312-macosx_x86_64", version = "3.12", url = "https://www.python.org/ftp/python/3.12.10/python-3.12.10-macos11.pkg", sha256 = "8373e58da4ea146b3eb1c1f9834f19a319440b6b679b06050b1f9ee3237aa8e4" },
  { identifier = "cp312-macosx_arm64", version = "3.12", url = "https://www.python.org/ftp/python/3.12.10/python-3.12.10-macos11.pkg", sha256 = "8373e58da4ea146b3eb1c1f9834f19a319440b6b679b06050b1f9ee3237aa8e4" },
  { identifier = "cp312-macosx_universal2", version = "3.12", url = "https://www.python.org/ftp/python/3.12.10/python-3.12.10-macos11.pkg", sha256 = "8373e58da4ea146b3eb1c1f9834f19a319440b6b679b06050b1f9ee3237aa8e4" },
-  { identifier = "cp313-macosx_x86_64", version = "3.13", url = "https://www.python.org/ftp/python/3.13.13/python-3.13.13-macos11.pkg", sha256 = "a909cb655af5db67d5a90b3603437a1d58bec3446d624e4034e278ac62023cc9" },
-  { identifier = "cp313-macosx_arm64", version = "3.13", url = "https://www.python.org/ftp/python/3.13.13/python-3.13.13-macos11.pkg", sha256 = "a909cb655af5db67d5a90b3603437a1d58bec3446d624e4034e278ac62023cc9" },
-  { identifier = "cp313-macosx_universal2", version = "3.13", url = "https://www.python.org/ftp/python/3.13.13/python-3.13.13-macos11.pkg", sha256 = "a909cb655af5db67d5a90b3603437a1d58bec3446d624e4034e278ac62023cc9" },
-  { identifier = "cp314-macosx_x86_64", version = "3.14", url = "https://www.python.org/ftp/python/3.14.5/python-3.14.5-macos11.pkg", sha256 = "b28a8dc33c456dd06c97024697d63ca916cfb494594c06fa3e4ef4d41fa82335" },
-  { identifier = "cp314-macosx_arm64", version = "3.14", url = "https://www.python.org/ftp/python/3.14.5/python-3.14.5-macos11.pkg", sha256 = "b28a8dc33c456dd06c97024697d63ca916cfb494594c06fa3e4ef4d41fa82335" },
-  { identifier = "cp314-macosx_universal2", version = "3.14", url = "https://www.python.org/ftp/python/3.14.5/python-3.14.5-macos11.pkg", sha256 = "b28a8dc33c456dd06c97024697d63ca916cfb494594c06fa3e4ef4d41fa82335" },
-  { identifier = "cp314t-macosx_x86_64", version = "3.14", url = "https://www.python.org/ftp/python/3.14.5/python-3.14.5-macos11.pkg", sha256 = "b28a8dc33c456dd06c97024697d63ca916cfb494594c06fa3e4ef4d41fa82335" },
-  { identifier = "cp314t-macosx_arm64", version = "3.14", url = "https://www.python.org/ftp/python/3.14.5/python-3.14.5-macos11.pkg", sha256 = "b28a8dc33c456dd06c97024697d63ca916cfb494594c06fa3e4ef4d41fa82335" },
-  { identifier = "cp314t-macosx_universal2", version = "3.14", url = "https://www.python.org/ftp/python/3.14.5/python-3.14.5-macos11.pkg", sha256 = "b28a8dc33c456dd06c97024697d63ca916cfb494594c06fa3e4ef4d41fa82335" },
-  { identifier = "cp315-macosx_x86_64", version = "3.15", url = "https://www.python.org/ftp/python/3.15.0/python-3.15.0b2-macos11.pkg", sha256 = "29b5c95f255f846f77e1c119146836445f929de1392a3ae9ef24f559e1345418" },
-  { identifier = "cp315-macosx_arm64", version = "3.15", url = "https://www.python.org/ftp/python/3.15.0/python-3.15.0b2-macos11.pkg", sha256 = "29b5c95f255f846f77e1c119146836445f929de1392a3ae9ef24f559e1345418" },
-  { identifier = "cp315-macosx_universal2", version = "3.15", url = "https://www.python.org/ftp/python/3.15.0/python-3.15.0b2-macos11.pkg", sha256 = "29b5c95f255f846f77e1c119146836445f929de1392a3ae9ef24f559e1345418" },
-  { identifier = "cp315t-macosx_x86_64", version = "3.15", url = "https://www.python.org/ftp/python/3.15.0/python-3.15.0b2-macos11.pkg", sha256 = "29b5c95f255f846f77e1c119146836445f929de1392a3ae9ef24f559e1345418" },
-  { identifier = "cp315t-macosx_arm64", version = "3.15", url = "https://www.python.org/ftp/python/3.15.0/python-3.15.0b2-macos11.pkg", sha256 = "29b5c95f255f846f77e1c119146836445f929de1392a3ae9ef24f559e1345418" },
-  { identifier = "cp315t-macosx_universal2", version = "3.15", url = "https://www.python.org/ftp/python/3.15.0/python-3.15.0b2-macos11.pkg", sha256 = "29b5c95f255f846f77e1c119146836445f929de1392a3ae9ef24f559e1345418" },
-  { identifier = "pp39-macosx_x86_64", version = "3.9", url = "https://downloads.python.org/pypy/pypy3.9-v7.3.16-macos_x86_64.tar.bz2", sha256 = "fda015431621e7e5aa16359d114f2c45a77ed936992c1efff86302e768a6b21c" },
-  { identifier = "pp39-macosx_arm64", version = "3.9", url = "https://downloads.python.org/pypy/pypy3.9-v7.3.16-macos_arm64.tar.bz2", sha256 = "88f824e7a2d676440d09bc90fc959ae0fd3557d7e2f14bfbbe53d41d159a47fe" },
-  { identifier = "pp310-macosx_x86_64", version = "3.10", url = "https://downloads.python.org/pypy/pypy3.10-v7.3.19-macos_x86_64.tar.bz2", sha256 = "2c5e5c2a33ac882551d7f28b98d19d486b8995aa50824a73b4edcc6aeec35c63" },
-  { identifier = "pp310-macosx_arm64", version = "3.10", url = "https://downloads.python.org/pypy/pypy3.10-v7.3.19-macos_arm64.tar.bz2", sha256 = "3db8a03fc496164801646844d7f3b12baa0adb3ad9a0b7cb124521bc2e168a36" },
-  { identifier = "pp311-macosx_x86_64", version = "3.11", url = "https://downloads.python.org/pypy/pypy3.11-v7.3.23-macos_x86_64.tar.bz2", sha256 = "c95363c4e87235d11a6cec8128239c291b1eb67a752778fbcfe029a71da82b5e" },
-  { identifier = "pp311-macosx_arm64", version = "3.11", url = "https://downloads.python.org/pypy/pypy3.11-v7.3.23-macos_arm64.tar.bz2", sha256 = "4747b3aceba4c1c6104cddc0fe5ea302101d32955f0957347b9ecc4fbd7aed05" },
+  { identifier = "cp313-macosx_x86_64", version = "3.13", url = "https://www.python.org/ftp/python/3.13.15/python-3.13.15-macos11.pkg", sha256 = "3b7eaf7f29825f796e8267024435540ddf1f17fc9a97ad58095daa7a75bfdcd3" },
+  { identifier = "cp313-macosx_arm64", version = "3.13", url = "https://www.python.org/ftp/python/3.13.15/python-3.13.15-macos11.pkg", sha256 = "3b7eaf7f29825f796e8267024435540ddf1f17fc9a97ad58095daa7a75bfdcd3" },
+  { identifier = "cp313-macosx_universal2", version = "3.13", url = "https://www.python.org/ftp/python/3.13.15/python-3.13.15-macos11.pkg", sha256 = "3b7eaf7f29825f796e8267024435540ddf1f17fc9a97ad58095daa7a75bfdcd3" },
+  { identifier = "cp314-macosx_x86_64", version = "3.14", url = "https://www.python.org/ftp/python/3.14.7/python-3.14.7-macos11.pkg", sha256 = "70c5239ad2d62925d2947e46921d0ddd3d35be3d2f0a2d50db33da507dbcb419" },
+  { identifier = "cp314-macosx_arm64", version = "3.14", url = "https://www.python.org/ftp/python/3.14.7/python-3.14.7-macos11.pkg", sha256 = "70c5239ad2d62925d2947e46921d0ddd3d35be3d2f0a2d50db33da507dbcb419" },
+  { identifier = "cp314-macosx_universal2", version = "3.14", url = "https://www.python.org/ftp/python/3.14.7/python-3.14.7-macos11.pkg", sha256 = "70c5239ad2d62925d2947e46921d0ddd3d35be3d2f0a2d50db33da507dbcb419" },
+  { identifier = "cp314t-macosx_x86_64", version = "3.14", url = "https://www.python.org/ftp/python/3.14.7/python-3.14.7-macos11.pkg", sha256 = "70c5239ad2d62925d2947e46921d0ddd3d35be3d2f0a2d50db33da507dbcb419" },
+  { identifier = "cp314t-macosx_arm64", version = "3.14", url = "https://www.python.org/ftp/python/3.14.7/python-3.14.7-macos11.pkg", sha256 = "70c5239ad2d62925d2947e46921d0ddd3d35be3d2f0a2d50db33da507dbcb419" },
+  { identifier = "cp314t-macosx_universal2", version = "3.14", url = "https://www.python.org/ftp/python/3.14.7/python-3.14.7-macos11.pkg", sha256 = "70c5239ad2d62925d2947e46921d0ddd3d35be3d2f0a2d50db33da507dbcb419" },
+  { identifier = "cp315-macosx_x86_64", version = "3.15", url = "https://www.python.org/ftp/python/3.15.0/python-3.15.0rc1-macos11.pkg", sha256 = "57e0b1095f5dda52a8ff8b3b73140a52dfb3b76bdcf9e0284f2dbe10f7ee92ea" },
+  { identifier = "cp315-macosx_arm64", version = "3.15", url = "https://www.python.org/ftp/python/3.15.0/python-3.15.0rc1-macos11.pkg", sha256 = "57e0b1095f5dda52a8ff8b3b73140a52dfb3b76bdcf9e0284f2dbe10f7ee92ea" },
+  { identifier = "cp315-macosx_universal2", version = "3.15", url = "https://www.python.org/ftp/python/3.15.0/python-3.15.0rc1-macos11.pkg", sha256 = "57e0b1095f5dda52a8ff8b3b73140a52dfb3b76bdcf9e0284f2dbe10f7ee92ea" },
+  { identifier = "cp315t-macosx_x86_64", version = "3.15", url = "https://www.python.org/ftp/python/3.15.0/python-3.15.0rc1-macos11.pkg", sha256 = "57e0b1095f5dda52a8ff8b3b73140a52dfb3b76bdcf9e0284f2dbe10f7ee92ea" },
+  { identifier = "cp315t-macosx_arm64", version = "3.15", url = "https://www.python.org/ftp/python/3.15.0/python-3.15.0rc1-macos11.pkg", sha256 = "57e0b1095f5dda52a8ff8b3b73140a52dfb3b76bdcf9e0284f2dbe10f7ee92ea" },
+  { identifier = "cp315t-macosx_universal2", version = "3.15", url = "https://www.python.org/ftp/python/3.15.0/python-3.15.0rc1-macos11.pkg", sha256 = "57e0b1095f5dda52a8ff8b3b73140a52dfb3b76bdcf9e0284f2dbe10f7ee92ea" },
+  { identifier = "pp39-macosx_x86_64", version = "3.9", url = "https://downloads.python.org/pypy/pypy3.9-v7.3.16-macos_x86_64.tar.gz", sha256 = "7ea762a1b0af7545a74cd4260bb3fd2812813deffef2ef8d2fddd5e03fa63ef1" },
+  { identifier = "pp39-macosx_arm64", version = "3.9", url = "https://downloads.python.org/pypy/pypy3.9-v7.3.16-macos_arm64.tar.gz", sha256 = "b09ce3a865c1c0f4e58c0ee4f70511f1b27dfc1f7148f4b6060cfdfd581c9e82" },
+  { identifier = "pp310-macosx_x86_64", version = "3.10", url = "https://downloads.python.org/pypy/pypy3.10-v7.3.19-macos_x86_64.tar.gz", sha256 = "63f9d30cdd9e47cfe279be941975ac3d24e46c79756cd1d1bd2c551c27d8b32c" },
+  { identifier = "pp310-macosx_arm64", version = "3.10", url = "https://downloads.python.org/pypy/pypy3.10-v7.3.19-macos_arm64.tar.gz", sha256 = "72a74cf645e43608f7d88831581fb0f8e1f963fb38f0793bacd37d5018a9aeb8" },
+  { identifier = "pp311-macosx_x86_64", version = "3.11", url = "https://downloads.python.org/pypy/pypy3.11-v7.3.23-macos_x86_64.tar.gz", sha256 = "798279b0f233893ae22754290aedf35a1aea1ec9013a8ad8110f166d85944c91" },
+  { identifier = "pp311-macosx_arm64", version = "3.11", url = "https://downloads.python.org/pypy/pypy3.11-v7.3.23-macos_arm64.tar.gz", sha256 = "f837b3c203d60d7e25a31e267671a07ba0c9b9ac8081ad225571fb06fccf1b7b" },
  { identifier = "gp312_250-macosx_x86_64", version = "3.12", url = "https://github.com/oracle/graalpython/releases/download/graal-25.0.1/graalpy-25.0.1-macos-amd64.tar.gz", sha256 = "10b0721d52397f0cc85f038900318da2203711cbcfae7899e3faed49d3dc6221" },
  { identifier = "gp312_250-macosx_arm64", version = "3.12", url = "https://github.com/oracle/graalpython/releases/download/graal-25.0.3/graalpy-25.0.3-macos-aarch64.tar.gz", sha256 = "387d9f5b376860842bea4d55aae5820974f3f3b68fc36c77ae863a061a888857" },
 ]
@@ -188,25 +188,25 @@ python_configurations = [
  { identifier = "cp311-win_amd64", version = "3.11.9" },
  { identifier = "cp312-win32", version = "3.12.10" },
  { identifier = "cp312-win_amd64", version = "3.12.10" },
-  { identifier = "cp313-win32", version = "3.13.13" },
-  { identifier = "cp313-win_amd64", version = "3.13.13" },
-  { identifier = "cp314-win32", version = "3.14.5" },
-  { identifier = "cp314t-win32", version = "3.14.5" },
-  { identifier = "cp314-win_amd64", version = "3.14.5" },
-  { identifier = "cp314t-win_amd64", version = "3.14.5" },
-  { identifier = "cp315-win32", version = "3.15.0-b2" },
-  { identifier = "cp315t-win32", version = "3.15.0-b2" },
-  { identifier = "cp315-win_amd64", version = "3.15.0-b2" },
-  { identifier = "cp315t-win_amd64", version = "3.15.0-b2" },
+  { identifier = "cp313-win32", version = "3.13.15" },
+  { identifier = "cp313-win_amd64", version = "3.13.15" },
+  { identifier = "cp314-win32", version = "3.14.7" },
+  { identifier = "cp314t-win32", version = "3.14.7" },
+  { identifier = "cp314-win_amd64", version = "3.14.7" },
+  { identifier = "cp314t-win_amd64", version = "3.14.7" },
+  { identifier = "cp315-win32", version = "3.15.0-rc1" },
+  { identifier = "cp315t-win32", version = "3.15.0-rc1" },
+  { identifier = "cp315-win_amd64", version = "3.15.0-rc1" },
+  { identifier = "cp315t-win_amd64", version = "3.15.0-rc1" },
  { identifier = "cp39-win_arm64", version = "3.9.10" },
  { identifier = "cp310-win_arm64", version = "3.10.11" },
  { identifier = "cp311-win_arm64", version = "3.11.9" },
  { identifier = "cp312-win_arm64", version = "3.12.10" },
-  { identifier = "cp313-win_arm64", version = "3.13.13" },
-  { identifier = "cp314-win_arm64", version = "3.14.5" },
-  { identifier = "cp314t-win_arm64", version = "3.14.5" },
-  { identifier = "cp315-win_arm64", version = "3.15.0-b2" },
-  { identifier = "cp315t-win_arm64", version = "3.15.0-b2" },
+  { identifier = "cp313-win_arm64", version = "3.13.15" },
+  { identifier = "cp314-win_arm64", version = "3.14.7" },
+  { identifier = "cp314t-win_arm64", version = "3.14.7" },
+  { identifier = "cp315-win_arm64", version = "3.15.0-rc1" },
+  { identifier = "cp315t-win_arm64", version = "3.15.0-rc1" },
  { identifier = "pp39-win_amd64", version = "3.9", url = "https://downloads.python.org/pypy/pypy3.9-v7.3.16-win64.zip", sha256 = "06ec12a5e964dc0ad33e6f380185a4d295178dce6d6df512f508e7aee00a1323" },
  { identifier = "pp310-win_amd64", version = "3.10", url = "https://downloads.python.org/pypy/pypy3.10-v7.3.19-win64.zip", sha256 = "c0d07bba6c8fb4e5804f4a8b3f8ef07cc3d89f6ad1db42a45ffb9be60bbb7cc2" },
  { identifier = "pp311-win_amd64", version = "3.11", url = "https://downloads.python.org/pypy/pypy3.11-v7.3.23-win64.zip", sha256 = "948b8ea58dea5b9917210fe4afd242c788fbfaba1c3f1a25e696a404f703389a" },
@@ -217,28 +217,29 @@ python_configurations = [
 python_configurations = [
  { identifier = "cp312-pyodide_wasm32", version = "3.12", default_pyodide_version = "0.27.7", node_version = "v22", sha256 = "0c2e7db42efa5d1dac38b50f8b3d659a1e3885d0a233494831b8206281307d52" },
  { identifier = "cp313-pyodide_wasm32", version = "3.13", default_pyodide_version = "0.29.4", node_version = "v22", sha256 = "a29fc4a076408a18fc29eb4b280f80c6dddc95c19514c874c29e590d0931c02a" },
-  { identifier = "cp314-pyodide_wasm32", version = "3.14", default_pyodide_version = "314.0.0", node_version = "v24", sha256 = "6e76cf18251bd7d046bdb7ef35c9f938c8e995f10d88397497ca4b7020f27ba6" },
+  { identifier = "cp314-pyodide_wasm32", version = "3.14", default_pyodide_version = "314.0.5", node_version = "v24", sha256 = "77bde42a27695e28525fe19933c2ff13ba63598c536060fa60143726a284acdd" },
+  { identifier = "cp315-pyodide_wasm32", version = "3.15", default_pyodide_version = "315.0.0a2", node_version = "v24", sha256 = "d7c0d6ddf0fce807668d7413d0e0f20fbc7922128ba8361ed71d9cff048cb96a" },
 ]

 [android]
 python_configurations = [
-  { identifier = "cp313-android_arm64_v8a", version = "3.13", url = "https://repo.maven.apache.org/maven2/com/chaquo/python/python/3.13.13/python-3.13.13-aarch64-linux-android.tar.gz", sha256 = "a21250c246b36eb704be096be51e40ab24cafa3ae1d7ca4c396e6bf780cf87cf" },
-  { identifier = "cp313-android_x86_64", version = "3.13", url = "https://repo.maven.apache.org/maven2/com/chaquo/python/python/3.13.13/python-3.13.13-x86_64-linux-android.tar.gz", sha256 = "b021b76df2c8d64e41c76d18a2d91f27652356bd932c06f9076bac1b664c0e37" },
-  { identifier = "cp314-android_arm64_v8a", version = "3.14", url = "https://www.python.org/ftp/python/3.14.5/python-3.14.5-aarch64-linux-android.tar.gz", sha256 = "f008321abf837fcaec569df143283ece0e764b18d8c75763200160553f906af1" },
-  { identifier = "cp314-android_x86_64", version = "3.14", url = "https://www.python.org/ftp/python/3.14.5/python-3.14.5-x86_64-linux-android.tar.gz", sha256 = "36184e31464b2b959d92c81ded8d025834342cc080623bced282a2a9a57bd47c" },
-  { identifier = "cp315-android_arm64_v8a", version = "3.15", url = "https://www.python.org/ftp/python/3.15.0/python-3.15.0b2-aarch64-linux-android.tar.gz", sha256 = "de5e36ffc3c33b63a1ed53fe83db4dee16b003a3180ac35e5c4c203d3750e076" },
-  { identifier = "cp315-android_x86_64", version = "3.15", url = "https://www.python.org/ftp/python/3.15.0/python-3.15.0b2-x86_64-linux-android.tar.gz", sha256 = "e05ef9c142ea83b41b194b16014ffe2249d27783313c3b00b97f6c93d9a56b92" },
+  { identifier = "cp313-android_arm64_v8a", version = "3.13", url = "https://repo.maven.apache.org/maven2/com/chaquo/python/python/3.13.15/python-3.13.15-aarch64-linux-android.tar.gz", sha256 = "a51d1e153f68f1c40f612a5431e9f79870d993da795173b3d27564e42b056271" },
+  { identifier = "cp313-android_x86_64", version = "3.13", url = "https://repo.maven.apache.org/maven2/com/chaquo/python/python/3.13.15/python-3.13.15-x86_64-linux-android.tar.gz", sha256 = "2096ecd6e180274ad1637cf140f7d6c2a160fe5ef9bfb47fd318e3d963f2d929" },
+  { identifier = "cp314-android_arm64_v8a", version = "3.14", url = "https://www.python.org/ftp/python/3.14.7/python-3.14.7-aarch64-linux-android.tar.gz", sha256 = "6d50cc3aa66e414a439594089bcdfb5f1264358155c70c1f00471c24cfb477fb" },
+  { identifier = "cp314-android_x86_64", version = "3.14", url = "https://www.python.org/ftp/python/3.14.7/python-3.14.7-x86_64-linux-android.tar.gz", sha256 = "2c16ce2359565cd8c24f86cfb75630768ba6607e732946b294b969797f583b60" },
+  { identifier = "cp315-android_arm64_v8a", version = "3.15", url = "https://www.python.org/ftp/python/3.15.0/python-3.15.0rc1-aarch64-linux-android.tar.gz", sha256 = "7d6fb28a69368841656f919a08141b0e3720837ac67987388037ee9d2a5c5492" },
+  { identifier = "cp315-android_x86_64", version = "3.15", url = "https://www.python.org/ftp/python/3.15.0/python-3.15.0rc1-x86_64-linux-android.tar.gz", sha256 = "f048f5c60b538efc64e4c26399a0a21202ce430949d5b2c10369d624548a5dc3" },
 ]

 [ios]
 python_configurations = [
-  { identifier = "cp313-ios_arm64_iphoneos", version = "3.13", url = "https://github.com/beeware/Python-Apple-support/releases/download/3.13-b13/Python-3.13-iOS-support.b13.tar.gz", sha256 = "d1f95f95137a4b91dc0cbe9b99ddfc0a78918dde883c7fbe7147074a5e715274" },
-  { identifier = "cp313-ios_x86_64_iphonesimulator", version = "3.13", url = "https://github.com/beeware/Python-Apple-support/releases/download/3.13-b13/Python-3.13-iOS-support.b13.tar.gz", sha256 = "d1f95f95137a4b91dc0cbe9b99ddfc0a78918dde883c7fbe7147074a5e715274" },
-  { identifier = "cp313-ios_arm64_iphonesimulator", version = "3.13", url = "https://github.com/beeware/Python-Apple-support/releases/download/3.13-b13/Python-3.13-iOS-support.b13.tar.gz", sha256 = "d1f95f95137a4b91dc0cbe9b99ddfc0a78918dde883c7fbe7147074a5e715274" },
-  { identifier = "cp314-ios_arm64_iphoneos", version = "3.14", url = "https://github.com/beeware/Python-Apple-support/releases/download/3.14-b9/Python-3.14-iOS-support.b9.tar.gz", sha256 = "8e4123b543bf17fdae2e2c6c033434487752438431014eb12e6d833aa35927a8" },
-  { identifier = "cp314-ios_x86_64_iphonesimulator", version = "3.14", url = "https://github.com/beeware/Python-Apple-support/releases/download/3.14-b9/Python-3.14-iOS-support.b9.tar.gz", sha256 = "8e4123b543bf17fdae2e2c6c033434487752438431014eb12e6d833aa35927a8" },
-  { identifier = "cp314-ios_arm64_iphonesimulator", version = "3.14", url = "https://github.com/beeware/Python-Apple-support/releases/download/3.14-b9/Python-3.14-iOS-support.b9.tar.gz", sha256 = "8e4123b543bf17fdae2e2c6c033434487752438431014eb12e6d833aa35927a8" },
-  { identifier = "cp315-ios_arm64_iphoneos", version = "3.15", url = "https://www.python.org/ftp/python/3.15.0/python-3.15.0b2-iOS-XCframework.tar.gz", sha256 = "fd6b6fb8f82cf44622d28ea53b8197c89fb06505557d29d4d7a47f9386c1c896" },
-  { identifier = "cp315-ios_x86_64_iphonesimulator", version = "3.15", url = "https://www.python.org/ftp/python/3.15.0/python-3.15.0b2-iOS-XCframework.tar.gz", sha256 = "fd6b6fb8f82cf44622d28ea53b8197c89fb06505557d29d4d7a47f9386c1c896" },
-  { identifier = "cp315-ios_arm64_iphonesimulator", version = "3.15", url = "https://www.python.org/ftp/python/3.15.0/python-3.15.0b2-iOS-XCframework.tar.gz", sha256 = "fd6b6fb8f82cf44622d28ea53b8197c89fb06505557d29d4d7a47f9386c1c896" },
+  { identifier = "cp313-ios_arm64_iphoneos", version = "3.13", url = "https://github.com/beeware/Python-Apple-support/releases/download/3.13-b14/Python-3.13-iOS-support.b14.tar.gz", sha256 = "8b5cb76ef8d8a2946052479358eeec9d54b4496cb60920e175ec1489b5cf7963" },
+  { identifier = "cp313-ios_x86_64_iphonesimulator", version = "3.13", url = "https://github.com/beeware/Python-Apple-support/releases/download/3.13-b14/Python-3.13-iOS-support.b14.tar.gz", sha256 = "8b5cb76ef8d8a2946052479358eeec9d54b4496cb60920e175ec1489b5cf7963" },
+  { identifier = "cp313-ios_arm64_iphonesimulator", version = "3.13", url = "https://github.com/beeware/Python-Apple-support/releases/download/3.13-b14/Python-3.13-iOS-support.b14.tar.gz", sha256 = "8b5cb76ef8d8a2946052479358eeec9d54b4496cb60920e175ec1489b5cf7963" },
+  { identifier = "cp314-ios_arm64_iphoneos", version = "3.14", url = "https://github.com/beeware/Python-Apple-support/releases/download/3.14-b10/Python-3.14-iOS-support.b10.tar.gz", sha256 = "200ef60eb67be0483ceb638daa9048f84f41a9a952707a5ad4c3198037c7b583" },
+  { identifier = "cp314-ios_x86_64_iphonesimulator", version = "3.14", url = "https://github.com/beeware/Python-Apple-support/releases/download/3.14-b10/Python-3.14-iOS-support.b10.tar.gz", sha256 = "200ef60eb67be0483ceb638daa9048f84f41a9a952707a5ad4c3198037c7b583" },
+  { identifier = "cp314-ios_arm64_iphonesimulator", version = "3.14", url = "https://github.com/beeware/Python-Apple-support/releases/download/3.14-b10/Python-3.14-iOS-support.b10.tar.gz", sha256 = "200ef60eb67be0483ceb638daa9048f84f41a9a952707a5ad4c3198037c7b583" },
+  { identifier = "cp315-ios_arm64_iphoneos", version = "3.15", url = "https://www.python.org/ftp/python/3.15.0/python-3.15.0rc1-iOS-XCframework.tar.gz", sha256 = "178bf7bef9cd0f18b27cacb98b14332a5ba44c9427543ffb71f8809bc1f11c3c" },
+  { identifier = "cp315-ios_x86_64_iphonesimulator", version = "3.15", url = "https://www.python.org/ftp/python/3.15.0/python-3.15.0rc1-iOS-XCframework.tar.gz", sha256 = "178bf7bef9cd0f18b27cacb98b14332a5ba44c9427543ffb71f8809bc1f11c3c" },
+  { identifier = "cp315-ios_arm64_iphonesimulator", version = "3.15", url = "https://www.python.org/ftp/python/3.15.0/python-3.15.0rc1-iOS-XCframework.tar.gz", sha256 = "178bf7bef9cd0f18b27cacb98b14332a5ba44c9427543ffb71f8809bc1f11c3c" },
 ]
@@ -18,9 +18,64 @@
        "pyodide-prerelease",
        "pypy",
        "pypy-eol"
-      ]
+      ],
+      "description": "A Python version or flavor to enable."
    },
-    "description": "A Python version or flavor to enable."
+    "build-frontend-no-pyodide": {
+      "default": "default",
+      "description": "Set the tool to use to build, either \"build\" (default), \"build[uv]\", \"uv\", or \"pip\"",
+      "oneOf": [
+        {
+          "enum": [
+            "pip",
+            "build",
+            "build[uv]",
+            "uv",
+            "default"
+          ]
+        },
+        {
+          "type": "string",
+          "pattern": "^pip; ?args:"
+        },
+        {
+          "type": "string",
+          "pattern": "^build; ?args:"
+        },
+        {
+          "type": "string",
+          "pattern": "^build\\[uv\\]; ?args:"
+        },
+        {
+          "type": "string",
+          "pattern": "^uv; ?args:"
+        },
+        {
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "name"
+          ],
+          "properties": {
+            "name": {
+              "enum": [
+                "pip",
+                "build",
+                "build[uv]",
+                "uv"
+              ]
+            },
+            "args": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              }
+            }
+          }
+        }
+      ],
+      "title": "CIBW_BUILD_FRONTEND"
+    }
  },
  "additionalProperties": false,
  "description": "cibuildwheel's settings.",
@@ -136,7 +191,7 @@
    },
    "build-frontend": {
      "default": "default",
-      "description": "Set the tool to use to build, either \"build\" (default), \"build[uv]\", \"uv\", or \"pip\"",
+      "description": "Set the tool to use to build, either \"build\" (default), \"build[uv]\", \"uv\", or \"pip\" (\"pyodide-build\" for pyodide)",
      "oneOf": [
        {
          "enum": [
@@ -144,6 +199,7 @@
            "build",
            "build[uv]",
            "uv",
+            "pyodide-build",
            "default"
          ]
        },
@@ -163,6 +219,10 @@
          "type": "string",
          "pattern": "^uv; ?args:"
        },
+        {
+          "type": "string",
+          "pattern": "^pyodide-build; ?args:"
+        },
        {
          "type": "object",
          "additionalProperties": false,
@@ -175,7 +235,8 @@
                "pip",
                "build",
                "build[uv]",
-                "uv"
+                "uv",
+                "pyodide-build"
              ]
            },
            "args": {
@@ -894,7 +955,7 @@
          "$ref": "#/properties/before-test"
        },
        "build-frontend": {
-          "$ref": "#/properties/build-frontend"
+          "$ref": "#/$defs/build-frontend-no-pyodide"
        },
        "build-verbosity": {
          "$ref": "#/properties/build-verbosity"
@@ -1033,7 +1094,7 @@
          "$ref": "#/properties/before-test"
        },
        "build-frontend": {
-          "$ref": "#/properties/build-frontend"
+          "$ref": "#/$defs/build-frontend-no-pyodide"
        },
        "build-verbosity": {
          "$ref": "#/properties/build-verbosity"
@@ -1118,7 +1179,7 @@
          "$ref": "#/properties/before-test"
        },
        "build-frontend": {
-          "$ref": "#/properties/build-frontend"
+          "$ref": "#/$defs/build-frontend-no-pyodide"
        },
        "build-verbosity": {
          "$ref": "#/properties/build-verbosity"
@@ -1203,7 +1264,41 @@
          "$ref": "#/properties/before-test"
        },
        "build-frontend": {
-          "$ref": "#/properties/build-frontend"
+          "default": "pyodide-build",
+          "description": "On the pyodide platform, the build frontend must be \"pyodide-build\"",
+          "oneOf": [
+            {
+              "enum": [
+                "pyodide-build",
+                "default"
+              ]
+            },
+            {
+              "type": "string",
+              "pattern": "^pyodide-build; ?args:"
+            },
+            {
+              "type": "object",
+              "additionalProperties": false,
+              "required": [
+                "name"
+              ],
+              "properties": {
+                "name": {
+                  "enum": [
+                    "pyodide-build"
+                  ]
+                },
+                "args": {
+                  "type": "array",
+                  "items": {
+                    "type": "string"
+                  }
+                }
+              }
+            }
+          ],
+          "title": "CIBW_BUILD_FRONTEND"
        },
        "build-verbosity": {
          "$ref": "#/properties/build-verbosity"
@@ -1275,7 +1370,7 @@
          "$ref": "#/properties/before-test"
        },
        "build-frontend": {
-          "$ref": "#/properties/build-frontend"
+          "$ref": "#/$defs/build-frontend-no-pyodide"
        },
        "build-verbosity": {
          "$ref": "#/properties/build-verbosity"
@@ -1360,7 +1455,7 @@
          "$ref": "#/properties/before-test"
        },
        "build-frontend": {
-          "$ref": "#/properties/build-frontend"
+          "$ref": "#/$defs/build-frontend-no-pyodide"
        },
        "build-verbosity": {
          "$ref": "#/properties/build-verbosity"
@@ -1,29 +1,36 @@
 # This file was autogenerated by uv via the following command:
 #    nox -s update_constraints
-annotated-types==0.7.0
-    # via pydantic
+attrs==26.1.0
+    # via
+    #   cattrs
+    #   pyodide-build
+    #   pyodide-lock
 auditwheel-emscripten==0.2.5
    # via pyodide-build
 build==1.5.0
    # via
    #   -r .nox/update_constraints/tmp/constraints-pyodide.in
    #   pyodide-build
-certifi==2026.5.20
+cattrs==26.1.0
+    # via
+    #   pyodide-build
+    #   pyodide-lock
+certifi==2026.7.22
    # via requests
-charset-normalizer==3.4.7
+charset-normalizer==3.5.1
    # via requests
 click==8.1.8
    # via
    #   -r .nox/update_constraints/tmp/constraints-pyodide.in
    #   pyodide-build
    #   pyodide-cli
-distlib==0.4.1
+distlib==0.4.3
    # via virtualenv
-filelock==3.29.1
+filelock==3.32.4
    # via
    #   python-discovery
    #   virtualenv
-idna==3.18
+idna==3.19
    # via requests
 leb128==1.0.9
    # via auditwheel-emscripten
@@ -31,38 +38,31 @@ markdown-it-py==4.2.0
    # via rich
 mdurl==0.1.2
    # via markdown-it-py
-packaging==26.2
+packaging==26.3
    # via
    #   auditwheel-emscripten
    #   build
    #   pyodide-build
    #   wheel
-pip==26.1.2
+pip==26.2.1
    # via -r .nox/update_constraints/tmp/constraints-pyodide.in
-platformdirs==4.10.0
+platformdirs==4.11.3
    # via
    #   pyodide-build
-    #   python-discovery
    #   virtualenv
-pydantic==2.13.4
-    # via
-    #   pyodide-build
-    #   pyodide-lock
-pydantic-core==2.46.4
-    # via pydantic
-pygments==2.20.0
+pygments==2.21.0
    # via rich
-pyodide-build==0.35.0
+pyodide-build==0.39.0
    # via -r .nox/update_constraints/tmp/constraints-pyodide.in
 pyodide-cli==0.5.0
    # via
    #   auditwheel-emscripten
    #   pyodide-build
-pyodide-lock==0.1.3
+pyodide-lock==0.2.0
    # via pyodide-build
 pyproject-hooks==1.2.0
    # via build
-python-discovery==1.4.0
+python-discovery==1.5.2
    # via virtualenv
 requests==2.34.2
    # via pyodide-build
@@ -72,20 +72,15 @@ rich==15.0.0
    #   pyodide-cli
 ruamel-yaml==0.19.1
    # via pyodide-build
-typing-extensions==4.15.0
-    # via
-    #   pydantic
-    #   pydantic-core
-    #   typing-inspection
-typing-inspection==0.4.2
-    # via pydantic
+typing-extensions==4.16.0
+    # via cattrs
 urllib3==2.7.0
    # via requests
-virtualenv==21.4.2
+virtualenv==21.7.4
    # via
    #   build
    #   pyodide-build
-wheel==0.47.0
+wheel==0.48.0
    # via
    #   auditwheel-emscripten
    #   pyodide-build
@@ -1,29 +1,36 @@
 # This file was autogenerated by uv via the following command:
 #    nox -s update_constraints
-annotated-types==0.7.0
-    # via pydantic
+attrs==26.1.0
+    # via
+    #   cattrs
+    #   pyodide-build
+    #   pyodide-lock
 auditwheel-emscripten==0.2.5
    # via pyodide-build
 build==1.5.0
    # via
    #   -r .nox/update_constraints/tmp/constraints-pyodide.in
    #   pyodide-build
-certifi==2026.5.20
+cattrs==26.1.0
+    # via
+    #   pyodide-build
+    #   pyodide-lock
+certifi==2026.7.22
    # via requests
-charset-normalizer==3.4.7
+charset-normalizer==3.5.1
    # via requests
 click==8.1.8
    # via
    #   -r .nox/update_constraints/tmp/constraints-pyodide.in
    #   pyodide-build
    #   pyodide-cli
-distlib==0.4.1
+distlib==0.4.3
    # via virtualenv
-filelock==3.29.1
+filelock==3.32.4
    # via
    #   python-discovery
    #   virtualenv
-idna==3.18
+idna==3.19
    # via requests
 leb128==1.0.9
    # via auditwheel-emscripten
@@ -31,38 +38,31 @@ markdown-it-py==4.2.0
    # via rich
 mdurl==0.1.2
    # via markdown-it-py
-packaging==26.2
+packaging==26.3
    # via
    #   auditwheel-emscripten
    #   build
    #   pyodide-build
    #   wheel
-pip==26.1.2
+pip==26.2.1
    # via -r .nox/update_constraints/tmp/constraints-pyodide.in
-platformdirs==4.10.0
+platformdirs==4.11.3
    # via
    #   pyodide-build
-    #   python-discovery
    #   virtualenv
-pydantic==2.13.4
-    # via
-    #   pyodide-build
-    #   pyodide-lock
-pydantic-core==2.46.4
-    # via pydantic
-pygments==2.20.0
+pygments==2.21.0
    # via rich
-pyodide-build==0.35.0
+pyodide-build==0.39.0
    # via -r .nox/update_constraints/tmp/constraints-pyodide.in
 pyodide-cli==0.5.0
    # via
    #   auditwheel-emscripten
    #   pyodide-build
-pyodide-lock==0.1.3
+pyodide-lock==0.2.0
    # via pyodide-build
 pyproject-hooks==1.2.0
    # via build
-python-discovery==1.4.0
+python-discovery==1.5.2
    # via virtualenv
 requests==2.34.2
    # via pyodide-build
@@ -72,20 +72,15 @@ rich==15.0.0
    #   pyodide-cli
 ruamel-yaml==0.19.1
    # via pyodide-build
-typing-extensions==4.15.0
-    # via
-    #   pydantic
-    #   pydantic-core
-    #   typing-inspection
-typing-inspection==0.4.2
-    # via pydantic
+typing-extensions==4.16.0
+    # via cattrs
 urllib3==2.7.0
    # via requests
-virtualenv==21.4.2
+virtualenv==21.7.4
    # via
    #   build
    #   pyodide-build
-wheel==0.47.0
+wheel==0.48.0
    # via
    #   auditwheel-emscripten
    #   pyodide-build
@@ -1,29 +1,36 @@
 # This file was autogenerated by uv via the following command:
 #    nox -s update_constraints
-annotated-types==0.7.0
-    # via pydantic
+attrs==26.1.0
+    # via
+    #   cattrs
+    #   pyodide-build
+    #   pyodide-lock
 auditwheel-emscripten==0.2.5
    # via pyodide-build
 build==1.5.0
    # via
    #   -r .nox/update_constraints/tmp/constraints-pyodide.in
    #   pyodide-build
-certifi==2026.5.20
+cattrs==26.1.0
+    # via
+    #   pyodide-build
+    #   pyodide-lock
+certifi==2026.7.22
    # via requests
-charset-normalizer==3.4.7
+charset-normalizer==3.5.1
    # via requests
 click==8.1.8
    # via
    #   -r .nox/update_constraints/tmp/constraints-pyodide.in
    #   pyodide-build
    #   pyodide-cli
-distlib==0.4.1
+distlib==0.4.3
    # via virtualenv
-filelock==3.29.1
+filelock==3.32.4
    # via
    #   python-discovery
    #   virtualenv
-idna==3.18
+idna==3.19
    # via requests
 leb128==1.0.9
    # via auditwheel-emscripten
@@ -31,38 +38,31 @@ markdown-it-py==4.2.0
    # via rich
 mdurl==0.1.2
    # via markdown-it-py
-packaging==26.2
+packaging==26.3
    # via
    #   auditwheel-emscripten
    #   build
    #   pyodide-build
    #   wheel
-pip==26.1.2
+pip==26.2.1
    # via -r .nox/update_constraints/tmp/constraints-pyodide.in
-platformdirs==4.10.0
+platformdirs==4.11.3
    # via
    #   pyodide-build
-    #   python-discovery
    #   virtualenv
-pydantic==2.13.4
-    # via
-    #   pyodide-build
-    #   pyodide-lock
-pydantic-core==2.46.4
-    # via pydantic
-pygments==2.20.0
+pygments==2.21.0
    # via rich
-pyodide-build==0.35.0
+pyodide-build==0.39.0
    # via -r .nox/update_constraints/tmp/constraints-pyodide.in
 pyodide-cli==0.5.0
    # via
    #   auditwheel-emscripten
    #   pyodide-build
-pyodide-lock==0.1.3
+pyodide-lock==0.2.0
    # via pyodide-build
 pyproject-hooks==1.2.0
    # via build
-python-discovery==1.4.0
+python-discovery==1.5.2
    # via virtualenv
 requests==2.34.2
    # via pyodide-build
@@ -72,20 +72,15 @@ rich==15.0.0
    #   pyodide-cli
 ruamel-yaml==0.19.1
    # via pyodide-build
-typing-extensions==4.15.0
-    # via
-    #   pydantic
-    #   pydantic-core
-    #   typing-inspection
-typing-inspection==0.4.2
-    # via pydantic
+typing-extensions==4.16.0
+    # via cattrs
 urllib3==2.7.0
    # via requests
-virtualenv==21.4.2
+virtualenv==21.7.4
    # via
    #   build
    #   pyodide-build
-wheel==0.47.0
+wheel==0.48.0
    # via
    #   auditwheel-emscripten
    #   pyodide-build
@@ -0,0 +1,86 @@
+# This file was autogenerated by uv via the following command:
+#    nox -s update_constraints
+attrs==26.1.0
+    # via
+    #   cattrs
+    #   pyodide-build
+    #   pyodide-lock
+auditwheel-emscripten==0.2.5
+    # via pyodide-build
+build==1.5.0
+    # via
+    #   -r .nox/update_constraints/tmp/constraints-pyodide.in
+    #   pyodide-build
+cattrs==26.1.0
+    # via
+    #   pyodide-build
+    #   pyodide-lock
+certifi==2026.7.22
+    # via requests
+charset-normalizer==3.5.1
+    # via requests
+click==8.1.8
+    # via
+    #   -r .nox/update_constraints/tmp/constraints-pyodide.in
+    #   pyodide-build
+    #   pyodide-cli
+distlib==0.4.3
+    # via virtualenv
+filelock==3.32.4
+    # via
+    #   python-discovery
+    #   virtualenv
+idna==3.19
+    # via requests
+leb128==1.0.9
+    # via auditwheel-emscripten
+markdown-it-py==4.2.0
+    # via rich
+mdurl==0.1.2
+    # via markdown-it-py
+packaging==26.3
+    # via
+    #   auditwheel-emscripten
+    #   build
+    #   pyodide-build
+    #   wheel
+pip==26.2.1
+    # via -r .nox/update_constraints/tmp/constraints-pyodide.in
+platformdirs==4.11.3
+    # via
+    #   pyodide-build
+    #   virtualenv
+pygments==2.21.0
+    # via rich
+pyodide-build==0.39.0
+    # via -r .nox/update_constraints/tmp/constraints-pyodide.in
+pyodide-cli==0.5.0
+    # via
+    #   auditwheel-emscripten
+    #   pyodide-build
+pyodide-lock==0.2.0
+    # via pyodide-build
+pyproject-hooks==1.2.0
+    # via build
+python-discovery==1.5.2
+    # via virtualenv
+requests==2.34.2
+    # via pyodide-build
+rich==15.0.0
+    # via
+    #   pyodide-build
+    #   pyodide-cli
+ruamel-yaml==0.19.1
+    # via pyodide-build
+typing-extensions==4.16.0
+    # via cattrs
+urllib3==2.7.0
+    # via requests
+virtualenv==21.7.4
+    # via
+    #   build
+    #   pyodide-build
+wheel==0.48.0
+    # via
+    #   auditwheel-emscripten
+    #   pyodide-build
@@ -10,29 +10,29 @@ attrs==26.1.0
    # via
    #   cattrs
    #   requests-cache
-auditwheel==6.7.0
+auditwheel==6.8.1
    # via -r cibuildwheel/resources/constraints.in
 build==1.5.0
    # via -r cibuildwheel/resources/constraints.in
 cattrs==26.1.0
    # via requests-cache
-certifi==2026.5.20
+certifi==2026.7.22
    # via requests
-charset-normalizer==3.4.7
+charset-normalizer==3.5.1
    # via requests
 delocate==0.13.0
    # via -r cibuildwheel/resources/constraints.in
 delvewheel==1.13.0
    # via -r cibuildwheel/resources/constraints.in
-distlib==0.4.1
+distlib==0.4.3
    # via virtualenv
 exceptiongroup==1.3.1
    # via cattrs
-filelock==3.29.1
+filelock==3.32.4
    # via
    #   python-discovery
    #   virtualenv
-idna==3.18
+idna==3.19
    # via
    #   requests
    #   url-normalize
@@ -46,48 +46,47 @@ markdown-it-py==4.2.0
    # via rich
 mdurl==0.1.2
    # via markdown-it-py
-packaging==26.2
+packaging==26.3
    # via
    #   abi3audit
    #   auditwheel
    #   build
    #   delocate
-patchelf==0.17.2.4
+patchelf==0.19.1.0
    # via -r cibuildwheel/resources/constraints.in
 pefile==2024.8.26
    # via
    #   abi3audit
    #   delvewheel
-pip==26.1.2
+pip==26.2.1
    # via -r cibuildwheel/resources/constraints.in
-pkgconf==2.5.1.post2
+pkgconf==3.0.1.post0
    # via -r cibuildwheel/resources/constraints.in
-platformdirs==4.10.0
+platformdirs==4.11.3
    # via
-    #   python-discovery
    #   requests-cache
    #   virtualenv
 pyelftools==0.33
    # via
    #   abi3audit
    #   auditwheel
-pygments==2.20.0
+pygments==2.21.0
    # via rich
 pyproject-hooks==1.2.0
    # via build
-python-discovery==1.4.0
+python-discovery==1.5.2
    # via virtualenv
 requests==2.34.2
    # via
    #   abi3audit
    #   requests-cache
-requests-cache==1.3.2
+requests-cache==1.3.3
    # via abi3audit
 rich==15.0.0
    # via abi3audit
 tomli==2.4.1
    # via build
-typing-extensions==4.15.0
+typing-extensions==4.16.0
    # via
    #   cattrs
    #   delocate
@@ -99,7 +98,7 @@ urllib3==2.7.0
    # via
    #   requests
    #   requests-cache
-virtualenv==21.4.2
+virtualenv==21.7.4
    # via -r cibuildwheel/resources/constraints.in
 zipp==4.1.0
    # via importlib-metadata
@@ -10,27 +10,27 @@ attrs==26.1.0
    # via
    #   cattrs
    #   requests-cache
-auditwheel==6.7.0
+auditwheel==6.8.1
    # via -r cibuildwheel/resources/constraints.in
 build==1.5.0
    # via -r cibuildwheel/resources/constraints.in
 cattrs==26.1.0
    # via requests-cache
-certifi==2026.5.20
+certifi==2026.7.22
    # via requests
-charset-normalizer==3.4.7
+charset-normalizer==3.5.1
    # via requests
 delocate==0.13.0
    # via -r cibuildwheel/resources/constraints.in
 delvewheel==1.13.0
    # via -r cibuildwheel/resources/constraints.in
-distlib==0.4.1
+distlib==0.4.3
    # via virtualenv
-filelock==3.29.1
+filelock==3.32.4
    # via
    #   python-discovery
    #   virtualenv
-idna==3.18
+idna==3.19
    # via
    #   requests
    #   url-normalize
@@ -42,47 +42,45 @@ markdown-it-py==4.2.0
    # via rich
 mdurl==0.1.2
    # via markdown-it-py
-packaging==26.2
+packaging==26.3
    # via
    #   abi3audit
    #   auditwheel
    #   build
    #   delocate
-patchelf==0.17.2.4
+patchelf==0.19.1.0
    # via -r cibuildwheel/resources/constraints.in
 pefile==2024.8.26
    # via
    #   abi3audit
    #   delvewheel
-pip==26.1.2; implementation_name != "graalpy" or platform_system != "Windows"
-pip==26.0.1; implementation_name == "graalpy" and platform_system == "Windows"
+pip==26.2.1
    # via -r cibuildwheel/resources/constraints.in
-pkgconf==2.5.1.post2
+pkgconf==3.0.1.post0
    # via -r cibuildwheel/resources/constraints.in
-platformdirs==4.10.0
+platformdirs==4.11.3
    # via
-    #   python-discovery
    #   requests-cache
    #   virtualenv
 pyelftools==0.33
    # via
    #   abi3audit
    #   auditwheel
-pygments==2.20.0
+pygments==2.21.0
    # via rich
 pyproject-hooks==1.2.0
    # via build
-python-discovery==1.4.0
+python-discovery==1.5.2
    # via virtualenv
 requests==2.34.2
    # via
    #   abi3audit
    #   requests-cache
-requests-cache==1.3.2
+requests-cache==1.3.3
    # via abi3audit
 rich==15.0.0
    # via abi3audit
-typing-extensions==4.15.0
+typing-extensions==4.16.0
    # via
    #   cattrs
    #   delocate
@@ -92,5 +90,5 @@ urllib3==2.7.0
    # via
    #   requests
    #   requests-cache
-virtualenv==21.4.2
+virtualenv==21.7.4
    # via -r cibuildwheel/resources/constraints.in
@@ -10,27 +10,28 @@ attrs==26.1.0
    # via
    #   cattrs
    #   requests-cache
-auditwheel==6.7.0
+auditwheel==6.8.1
    # via -r cibuildwheel/resources/constraints.in
 build==1.5.0
    # via -r cibuildwheel/resources/constraints.in
 cattrs==26.1.0
    # via requests-cache
-certifi==2026.5.20
+certifi==2026.7.22
    # via requests
-charset-normalizer==3.4.7
+charset-normalizer==3.5.1
    # via requests
 delocate==0.13.0
    # via -r cibuildwheel/resources/constraints.in
 delvewheel==1.13.0
    # via -r cibuildwheel/resources/constraints.in
-distlib==0.4.1
+distlib==0.4.3
    # via virtualenv
-filelock==3.29.1
+filelock==3.32.4; implementation_name != "graalpy"
+filelock==3.29.7; implementation_name == "graalpy"
    # via
    #   python-discovery
    #   virtualenv
-idna==3.18
+idna==3.19
    # via
    #   requests
    #   url-normalize
@@ -42,47 +43,47 @@ markdown-it-py==4.2.0
    # via rich
 mdurl==0.1.2
    # via markdown-it-py
-packaging==26.2
+packaging==26.3
    # via
    #   abi3audit
    #   auditwheel
    #   build
    #   delocate
-patchelf==0.17.2.4
+patchelf==0.19.1.0
    # via -r cibuildwheel/resources/constraints.in
 pefile==2024.8.26
    # via
    #   abi3audit
    #   delvewheel
-pip==26.1.2; implementation_name != "graalpy" or platform_system != "Windows"
+pip==26.2.1; implementation_name != "graalpy"
+pip==26.1.2; implementation_name == "graalpy" and platform_system != "Windows"
 pip==26.0.1; implementation_name == "graalpy" and platform_system == "Windows"
    # via -r cibuildwheel/resources/constraints.in
-pkgconf==2.5.1.post2
+pkgconf==3.0.1.post0
    # via -r cibuildwheel/resources/constraints.in
-platformdirs==4.10.0
+platformdirs==4.11.3
    # via
-    #   python-discovery
    #   requests-cache
    #   virtualenv
 pyelftools==0.33
    # via
    #   abi3audit
    #   auditwheel
-pygments==2.20.0
+pygments==2.21.0
    # via rich
 pyproject-hooks==1.2.0
    # via build
-python-discovery==1.4.0
+python-discovery==1.5.2
    # via virtualenv
 requests==2.34.2
    # via
    #   abi3audit
    #   requests-cache
-requests-cache==1.3.2
+requests-cache==1.3.3
    # via abi3audit
 rich==15.0.0
    # via abi3audit
-typing-extensions==4.15.0
+typing-extensions==4.16.0
    # via
    #   cattrs
    #   delocate
@@ -92,5 +93,5 @@ urllib3==2.7.0
    # via
    #   requests
    #   requests-cache
-virtualenv==21.4.2
+virtualenv==21.7.4
    # via -r cibuildwheel/resources/constraints.in
@@ -10,27 +10,27 @@ attrs==26.1.0
    # via
    #   cattrs
    #   requests-cache
-auditwheel==6.7.0
+auditwheel==6.8.1
    # via -r cibuildwheel/resources/constraints.in
 build==1.5.0
    # via -r cibuildwheel/resources/constraints.in
 cattrs==26.1.0
    # via requests-cache
-certifi==2026.5.20
+certifi==2026.7.22
    # via requests
-charset-normalizer==3.4.7
+charset-normalizer==3.5.1
    # via requests
 delocate==0.13.0
    # via -r cibuildwheel/resources/constraints.in
 delvewheel==1.13.0
    # via -r cibuildwheel/resources/constraints.in
-distlib==0.4.1
+distlib==0.4.3
    # via virtualenv
-filelock==3.29.1
+filelock==3.32.4
    # via
    #   python-discovery
    #   virtualenv
-idna==3.18
+idna==3.19
    # via
    #   requests
    #   url-normalize
@@ -42,46 +42,45 @@ markdown-it-py==4.2.0
    # via rich
 mdurl==0.1.2
    # via markdown-it-py
-packaging==26.2
+packaging==26.3
    # via
    #   abi3audit
    #   auditwheel
    #   build
    #   delocate
-patchelf==0.17.2.4
+patchelf==0.19.1.0
    # via -r cibuildwheel/resources/constraints.in
 pefile==2024.8.26
    # via
    #   abi3audit
    #   delvewheel
-pip==26.1.2
+pip==26.2.1
    # via -r cibuildwheel/resources/constraints.in
-pkgconf==2.5.1.post2
+pkgconf==3.0.1.post0
    # via -r cibuildwheel/resources/constraints.in
-platformdirs==4.10.0
+platformdirs==4.11.3
    # via
-    #   python-discovery
    #   requests-cache
    #   virtualenv
 pyelftools==0.33
    # via
    #   abi3audit
    #   auditwheel
-pygments==2.20.0
+pygments==2.21.0
    # via rich
 pyproject-hooks==1.2.0
    # via build
-python-discovery==1.4.0
+python-discovery==1.5.2
    # via virtualenv
 requests==2.34.2
    # via
    #   abi3audit
    #   requests-cache
-requests-cache==1.3.2
+requests-cache==1.3.3
    # via abi3audit
 rich==15.0.0
    # via abi3audit
-typing-extensions==4.15.0
+typing-extensions==4.16.0
    # via
    #   cattrs
    #   delocate
@@ -91,5 +90,5 @@ urllib3==2.7.0
    # via
    #   requests
    #   requests-cache
-virtualenv==21.4.2
+virtualenv==21.7.4
    # via -r cibuildwheel/resources/constraints.in
@@ -10,27 +10,27 @@ attrs==26.1.0
    # via
    #   cattrs
    #   requests-cache
-auditwheel==6.7.0
+auditwheel==6.8.1
    # via -r cibuildwheel/resources/constraints.in
 build==1.5.0
    # via -r cibuildwheel/resources/constraints.in
 cattrs==26.1.0
    # via requests-cache
-certifi==2026.5.20
+certifi==2026.7.22
    # via requests
-charset-normalizer==3.4.7
+charset-normalizer==3.5.1
    # via requests
 delocate==0.13.0
    # via -r cibuildwheel/resources/constraints.in
 delvewheel==1.13.0
    # via -r cibuildwheel/resources/constraints.in
-distlib==0.4.1
+distlib==0.4.3
    # via virtualenv
-filelock==3.29.1
+filelock==3.32.4
    # via
    #   python-discovery
    #   virtualenv
-idna==3.18
+idna==3.19
    # via
    #   requests
    #   url-normalize
@@ -42,46 +42,45 @@ markdown-it-py==4.2.0
    # via rich
 mdurl==0.1.2
    # via markdown-it-py
-packaging==26.2
+packaging==26.3
    # via
    #   abi3audit
    #   auditwheel
    #   build
    #   delocate
-patchelf==0.17.2.4
+patchelf==0.19.1.0
    # via -r cibuildwheel/resources/constraints.in
 pefile==2024.8.26
    # via
    #   abi3audit
    #   delvewheel
-pip==26.1.2
+pip==26.2.1
    # via -r cibuildwheel/resources/constraints.in
-pkgconf==2.5.1.post2
+pkgconf==3.0.1.post0
    # via -r cibuildwheel/resources/constraints.in
-platformdirs==4.10.0
+platformdirs==4.11.3
    # via
-    #   python-discovery
    #   requests-cache
    #   virtualenv
 pyelftools==0.33
    # via
    #   abi3audit
    #   auditwheel
-pygments==2.20.0
+pygments==2.21.0
    # via rich
 pyproject-hooks==1.2.0
    # via build
-python-discovery==1.4.0
+python-discovery==1.5.2
    # via virtualenv
 requests==2.34.2
    # via
    #   abi3audit
    #   requests-cache
-requests-cache==1.3.2
+requests-cache==1.3.3
    # via abi3audit
 rich==15.0.0
    # via abi3audit
-typing-extensions==4.15.0
+typing-extensions==4.16.0
    # via
    #   cattrs
    #   delocate
@@ -91,5 +90,5 @@ urllib3==2.7.0
    # via
    #   requests
    #   requests-cache
-virtualenv==21.4.2
+virtualenv==21.7.4
    # via -r cibuildwheel/resources/constraints.in
@@ -10,27 +10,27 @@ attrs==26.1.0
    # via
    #   cattrs
    #   requests-cache
-auditwheel==6.7.0
+auditwheel==6.8.1
    # via -r cibuildwheel/resources/constraints.in
 build==1.5.0
    # via -r cibuildwheel/resources/constraints.in
 cattrs==26.1.0
    # via requests-cache
-certifi==2026.5.20
+certifi==2026.7.22
    # via requests
-charset-normalizer==3.4.7
+charset-normalizer==3.5.1
    # via requests
 delocate==0.13.0
    # via -r cibuildwheel/resources/constraints.in
 delvewheel==1.13.0
    # via -r cibuildwheel/resources/constraints.in
-distlib==0.4.1
+distlib==0.4.3
    # via virtualenv
-filelock==3.29.1
+filelock==3.32.4
    # via
    #   python-discovery
    #   virtualenv
-idna==3.18
+idna==3.19
    # via
    #   requests
    #   url-normalize
@@ -42,46 +42,45 @@ markdown-it-py==4.2.0
    # via rich
 mdurl==0.1.2
    # via markdown-it-py
-packaging==26.2
+packaging==26.3
    # via
    #   abi3audit
    #   auditwheel
    #   build
    #   delocate
-patchelf==0.17.2.4
+patchelf==0.19.1.0
    # via -r cibuildwheel/resources/constraints.in
 pefile==2024.8.26
    # via
    #   abi3audit
    #   delvewheel
-pip==26.1.2
+pip==26.2.1
    # via -r cibuildwheel/resources/constraints.in
-pkgconf==2.5.1.post2
+pkgconf==3.0.1.post0
    # via -r cibuildwheel/resources/constraints.in
-platformdirs==4.10.0
+platformdirs==4.11.3
    # via
-    #   python-discovery
    #   requests-cache
    #   virtualenv
 pyelftools==0.33
    # via
    #   abi3audit
    #   auditwheel
-pygments==2.20.0
+pygments==2.21.0
    # via rich
 pyproject-hooks==1.2.0
    # via build
-python-discovery==1.4.0
+python-discovery==1.5.2
    # via virtualenv
 requests==2.34.2
    # via
    #   abi3audit
    #   requests-cache
-requests-cache==1.3.2
+requests-cache==1.3.3
    # via abi3audit
 rich==15.0.0
    # via abi3audit
-typing-extensions==4.15.0
+typing-extensions==4.16.0
    # via
    #   cattrs
    #   delocate
@@ -91,5 +90,5 @@ urllib3==2.7.0
    # via
    #   requests
    #   requests-cache
-virtualenv==21.4.2
+virtualenv==21.7.4
    # via -r cibuildwheel/resources/constraints.in
@@ -16,15 +16,15 @@ build==1.4.4
    # via -r cibuildwheel/resources/constraints.in
 cattrs==25.3.0
    # via requests-cache
-certifi==2026.5.20
+certifi==2026.7.22
    # via requests
-charset-normalizer==3.4.7
+charset-normalizer==3.5.1
    # via requests
 delocate==0.13.0
    # via -r cibuildwheel/resources/constraints.in
 delvewheel==1.13.0
    # via -r cibuildwheel/resources/constraints.in
-distlib==0.4.1
+distlib==0.4.3
    # via virtualenv
 exceptiongroup==1.3.1
    # via cattrs
@@ -32,7 +32,7 @@ filelock==3.19.1
    # via
    #   python-discovery
    #   virtualenv
-idna==3.18
+idna==3.19
    # via
    #   requests
    #   url-normalize
@@ -54,7 +54,7 @@ packaging==25.0
    #   auditwheel
    #   build
    #   delocate
-patchelf==0.17.2.4
+patchelf==0.19.1.0
    # via -r cibuildwheel/resources/constraints.in
 pefile==2024.8.26
    # via
@@ -66,18 +66,17 @@ pkgconf==2.4.3.post2
    # via -r cibuildwheel/resources/constraints.in
 platformdirs==4.4.0
    # via
-    #   python-discovery
    #   requests-cache
    #   virtualenv
 pyelftools==0.32
    # via
    #   abi3audit
    #   auditwheel
-pygments==2.20.0
+pygments==2.21.0
    # via rich
 pyproject-hooks==1.2.0
    # via build
-python-discovery==1.4.0
+python-discovery==1.5.2
    # via virtualenv
 requests==2.32.5
    # via
@@ -89,7 +88,7 @@ rich==14.2.0
    # via abi3audit
 tomli==2.4.1
    # via build
-typing-extensions==4.15.0
+typing-extensions==4.16.0
    # via
    #   cattrs
    #   delocate
@@ -101,7 +100,7 @@ urllib3==2.6.3
    # via
    #   requests
    #   requests-cache
-virtualenv==21.4.2
+virtualenv==21.7.4
    # via -r cibuildwheel/resources/constraints.in
 zipp==3.23.1
    # via importlib-metadata
@@ -10,27 +10,27 @@ attrs==26.1.0
    # via
    #   cattrs
    #   requests-cache
-auditwheel==6.7.0
+auditwheel==6.8.1
    # via -r cibuildwheel/resources/constraints.in
 build==1.5.0
    # via -r cibuildwheel/resources/constraints.in
 cattrs==26.1.0
    # via requests-cache
-certifi==2026.5.20
+certifi==2026.7.22
    # via requests
-charset-normalizer==3.4.7
+charset-normalizer==3.5.1
    # via requests
 delocate==0.13.0
    # via -r cibuildwheel/resources/constraints.in
 delvewheel==1.13.0
    # via -r cibuildwheel/resources/constraints.in
-distlib==0.4.1
+distlib==0.4.3
    # via virtualenv
-filelock==3.29.1
+filelock==3.32.4
    # via
    #   python-discovery
    #   virtualenv
-idna==3.18
+idna==3.19
    # via
    #   requests
    #   url-normalize
@@ -42,46 +42,45 @@ markdown-it-py==4.2.0
    # via rich
 mdurl==0.1.2
    # via markdown-it-py
-packaging==26.2
+packaging==26.3
    # via
    #   abi3audit
    #   auditwheel
    #   build
    #   delocate
-patchelf==0.17.2.4
+patchelf==0.19.1.0
    # via -r cibuildwheel/resources/constraints.in
 pefile==2024.8.26
    # via
    #   abi3audit
    #   delvewheel
-pip==26.1.2
+pip==26.2.1
    # via -r cibuildwheel/resources/constraints.in
-pkgconf==2.5.1.post2
+pkgconf==3.0.1.post0
    # via -r cibuildwheel/resources/constraints.in
-platformdirs==4.10.0
+platformdirs==4.11.3
    # via
-    #   python-discovery
    #   requests-cache
    #   virtualenv
 pyelftools==0.33
    # via
    #   abi3audit
    #   auditwheel
-pygments==2.20.0
+pygments==2.21.0
    # via rich
 pyproject-hooks==1.2.0
    # via build
-python-discovery==1.4.0
+python-discovery==1.5.2
    # via virtualenv
 requests==2.34.2
    # via
    #   abi3audit
    #   requests-cache
-requests-cache==1.3.2
+requests-cache==1.3.3
    # via abi3audit
 rich==15.0.0
    # via abi3audit
-typing-extensions==4.15.0
+typing-extensions==4.16.0
    # via
    #   cattrs
    #   delocate
@@ -91,5 +90,5 @@ urllib3==2.7.0
    # via
    #   requests
    #   requests-cache
-virtualenv==21.4.2
+virtualenv==21.7.4
    # via -r cibuildwheel/resources/constraints.in
@@ -79,3 +79,4 @@ repair-wheel-command = "auditwheel repair --ldpaths {ldpaths} -w {dest_dir} {whe

 [tool.cibuildwheel.pyodide]
 audit-command = ""
+build-frontend = "pyodide-build"
@@ -1,4 +1,4 @@
 url = "https://nodejs.org/dist/"
-v24 = "v24.16.0"
-v22 = "v22.22.3"
+v24 = "v24.19.0"
+v22 = "v22.23.2"
 v20 = "v20.20.2"
@@ -1,54 +1,54 @@
 [x86_64]
-manylinux2014 = quay.io/pypa/manylinux2014_x86_64:2026.06.04-1
-manylinux_2_28 = quay.io/pypa/manylinux_2_28_x86_64:2026.06.04-1
-manylinux_2_34 = quay.io/pypa/manylinux_2_34_x86_64:2026.06.04-1
-musllinux_1_2 = quay.io/pypa/musllinux_1_2_x86_64:2026.06.04-1
+manylinux2014 = quay.io/pypa/manylinux2014_x86_64@sha256:95440e0e72dd3a81dc8d2cf59a84d57af661456620f5bc821ff92048d0e54ff9  # 2026.08.15-1
+manylinux_2_28 = quay.io/pypa/manylinux_2_28_x86_64@sha256:0c87ccb5996dab6c3b7612ee4fda7b80c4ab3c44a86c2541e4a872afdf4f131b  # 2026.08.15-1
+manylinux_2_34 = quay.io/pypa/manylinux_2_34_x86_64@sha256:266610f48ef368cca34f521813ef61ed99d396b782e528fd0b0f58aa67c2189c  # 2026.08.15-1
+musllinux_1_2 = quay.io/pypa/musllinux_1_2_x86_64@sha256:75327606c7666fc971bd9239c6b220fd205b4bb9563b588075164622609219ca  # 2026.08.15-1

 [i686]
-manylinux2014 = quay.io/pypa/manylinux2014_i686:2026.06.04-1
-manylinux_2_28 = quay.io/pypa/manylinux_2_28_i686:2026.06.04-1
-manylinux_2_34 = quay.io/pypa/manylinux_2_34_i686:2026.06.04-1
-musllinux_1_2 = quay.io/pypa/musllinux_1_2_i686:2026.06.04-1
+manylinux2014 = quay.io/pypa/manylinux2014_i686@sha256:2962468349f2e55378e16706fb1dfc36983ab376ed1bb942959c65376671b37e  # 2026.08.15-1
+manylinux_2_28 = quay.io/pypa/manylinux_2_28_i686@sha256:4458e9ec6af8588fe269d23adf2306231c15b949a9b0637a9c0943f80d6931d5  # 2026.08.15-1
+manylinux_2_34 = quay.io/pypa/manylinux_2_34_i686@sha256:d3a55a555fc6ff7914238acfd73c0e56b63d9b21e6a064e1f92269f518bc265d  # 2026.08.15-1
+musllinux_1_2 = quay.io/pypa/musllinux_1_2_i686@sha256:8ca1be90979cb290909c1c945573ccdc7114505d66c563567ee6c78927fb215f  # 2026.08.15-1

 [aarch64]
-manylinux2014 = quay.io/pypa/manylinux2014_aarch64:2026.06.04-1
-manylinux_2_28 = quay.io/pypa/manylinux_2_28_aarch64:2026.06.04-1
-manylinux_2_34 = quay.io/pypa/manylinux_2_34_aarch64:2026.06.04-1
-musllinux_1_2 = quay.io/pypa/musllinux_1_2_aarch64:2026.06.04-1
+manylinux2014 = quay.io/pypa/manylinux2014_aarch64@sha256:b63ff749fee6f3f2a6b67ed3101a073db3211df1791da19e9acf96f43c0dd6ff  # 2026.08.15-1
+manylinux_2_28 = quay.io/pypa/manylinux_2_28_aarch64@sha256:561427136aabf3787bffb294b3515748241e0962d1527ae28bea1e076bfb9d99  # 2026.08.15-1
+manylinux_2_34 = quay.io/pypa/manylinux_2_34_aarch64@sha256:691d9ffc1b3432c3ef12bcef756d10da38c10ef8022d6a92c18e781d6aac7aef  # 2026.08.15-1
+musllinux_1_2 = quay.io/pypa/musllinux_1_2_aarch64@sha256:cea133e28484a93e9c40fc661256e8f1ec69b2887d0b64acbfaf48f26bbab103  # 2026.08.15-1

 [ppc64le]
-manylinux2014 = quay.io/pypa/manylinux2014_ppc64le:2026.06.04-1
-manylinux_2_28 = quay.io/pypa/manylinux_2_28_ppc64le:2026.06.04-1
-manylinux_2_34 = quay.io/pypa/manylinux_2_34_ppc64le:2026.06.04-1
-musllinux_1_2 = quay.io/pypa/musllinux_1_2_ppc64le:2026.06.04-1
+manylinux2014 = quay.io/pypa/manylinux2014_ppc64le@sha256:ea4e5065bef4bfd6514d0540a7a8e69a22e0bb1b8ffee093523e95b216a84134  # 2026.08.15-1
+manylinux_2_28 = quay.io/pypa/manylinux_2_28_ppc64le@sha256:dd8da6e6a692832be06ace33c08e1a92704472d84dc20f2b6069b026aa19d185  # 2026.08.15-1
+manylinux_2_34 = quay.io/pypa/manylinux_2_34_ppc64le@sha256:f1a788008370c5b5a8937eed968bb13c7d70bb53d3dfae06e0d3059c4a107a6d  # 2026.08.15-1
+musllinux_1_2 = quay.io/pypa/musllinux_1_2_ppc64le@sha256:d70f4708a377ba4a21eee38be20e35c757e911b5ca90df0fce002fd71a6df3a8  # 2026.08.15-1

 [s390x]
-manylinux2014 = quay.io/pypa/manylinux2014_s390x:2026.06.04-1
-manylinux_2_28 = quay.io/pypa/manylinux_2_28_s390x:2026.06.04-1
-manylinux_2_34 = quay.io/pypa/manylinux_2_34_s390x:2026.06.04-1
-musllinux_1_2 = quay.io/pypa/musllinux_1_2_s390x:2026.06.04-1
+manylinux2014 = quay.io/pypa/manylinux2014_s390x@sha256:840a6e20bd092a9f3ab71b76b252801f9e419646640822ce9f8ca43d1a4b9a2c  # 2026.08.15-1
+manylinux_2_28 = quay.io/pypa/manylinux_2_28_s390x@sha256:2eda6ec2dc9ce2ed6da698f5dac9b3ea764bfc469e5e81206d5a829d73332c60  # 2026.08.15-1
+manylinux_2_34 = quay.io/pypa/manylinux_2_34_s390x@sha256:966ec041ce4772e500da8a7e452681361cbe2b47ce882c4eb1186fd89ed9693a  # 2026.08.15-1
+musllinux_1_2 = quay.io/pypa/musllinux_1_2_s390x@sha256:97af923ea31a097445fcaad1af154e1f0fd997a6d722141d55607dc3767f8782  # 2026.08.15-1

 [pypy_x86_64]
-manylinux2014 = quay.io/pypa/manylinux2014_x86_64:2026.06.04-1
-manylinux_2_28 = quay.io/pypa/manylinux_2_28_x86_64:2026.06.04-1
-manylinux_2_34 = quay.io/pypa/manylinux_2_34_x86_64:2026.06.04-1
+manylinux2014 = quay.io/pypa/manylinux2014_x86_64@sha256:95440e0e72dd3a81dc8d2cf59a84d57af661456620f5bc821ff92048d0e54ff9  # 2026.08.15-1
+manylinux_2_28 = quay.io/pypa/manylinux_2_28_x86_64@sha256:0c87ccb5996dab6c3b7612ee4fda7b80c4ab3c44a86c2541e4a872afdf4f131b  # 2026.08.15-1
+manylinux_2_34 = quay.io/pypa/manylinux_2_34_x86_64@sha256:266610f48ef368cca34f521813ef61ed99d396b782e528fd0b0f58aa67c2189c  # 2026.08.15-1

 [pypy_i686]
-manylinux2014 = quay.io/pypa/manylinux2014_i686:2026.06.04-1
-manylinux_2_28 = quay.io/pypa/manylinux_2_28_i686:2026.06.04-1
-manylinux_2_34 = quay.io/pypa/manylinux_2_34_i686:2026.06.04-1
+manylinux2014 = quay.io/pypa/manylinux2014_i686@sha256:2962468349f2e55378e16706fb1dfc36983ab376ed1bb942959c65376671b37e  # 2026.08.15-1
+manylinux_2_28 = quay.io/pypa/manylinux_2_28_i686@sha256:4458e9ec6af8588fe269d23adf2306231c15b949a9b0637a9c0943f80d6931d5  # 2026.08.15-1
+manylinux_2_34 = quay.io/pypa/manylinux_2_34_i686@sha256:d3a55a555fc6ff7914238acfd73c0e56b63d9b21e6a064e1f92269f518bc265d  # 2026.08.15-1

 [pypy_aarch64]
-manylinux2014 = quay.io/pypa/manylinux2014_aarch64:2026.06.04-1
-manylinux_2_28 = quay.io/pypa/manylinux_2_28_aarch64:2026.06.04-1
-manylinux_2_34 = quay.io/pypa/manylinux_2_34_aarch64:2026.06.04-1
+manylinux2014 = quay.io/pypa/manylinux2014_aarch64@sha256:b63ff749fee6f3f2a6b67ed3101a073db3211df1791da19e9acf96f43c0dd6ff  # 2026.08.15-1
+manylinux_2_28 = quay.io/pypa/manylinux_2_28_aarch64@sha256:561427136aabf3787bffb294b3515748241e0962d1527ae28bea1e076bfb9d99  # 2026.08.15-1
+manylinux_2_34 = quay.io/pypa/manylinux_2_34_aarch64@sha256:691d9ffc1b3432c3ef12bcef756d10da38c10ef8022d6a92c18e781d6aac7aef  # 2026.08.15-1

 [armv7l]
-manylinux_2_31 = quay.io/pypa/manylinux_2_31_armv7l:2026.06.04-1
-manylinux_2_35 = quay.io/pypa/manylinux_2_35_armv7l:2026.06.04-1
-musllinux_1_2 = quay.io/pypa/musllinux_1_2_armv7l:2026.06.04-1
+manylinux_2_31 = quay.io/pypa/manylinux_2_31_armv7l@sha256:235c282aa532e01136e5e1db0a9403463032c9281fa56d89b39e45dfb5081484  # 2026.08.15-1
+manylinux_2_35 = quay.io/pypa/manylinux_2_35_armv7l@sha256:e073f25a6b46c38f58b67cb3d40c4c4346fc6b481b791fb4ccd721bd63bce10b  # 2026.08.15-1
+musllinux_1_2 = quay.io/pypa/musllinux_1_2_armv7l@sha256:c7ee1ecd4967a3ea682c814b564a900d90dc81d75b0b7c2deeb8d6819752a460  # 2026.08.15-1

 [riscv64]
-manylinux_2_39 = quay.io/pypa/manylinux_2_39_riscv64:2026.06.04-1
-musllinux_1_2 = quay.io/pypa/musllinux_1_2_riscv64:2026.06.04-1
+manylinux_2_39 = quay.io/pypa/manylinux_2_39_riscv64@sha256:9fa1bc388ea2494e457eec44e7c16a9e66fff892d73da8af3621009e76167949  # 2026.08.15-1
+musllinux_1_2 = quay.io/pypa/musllinux_1_2_riscv64@sha256:c81bcd3275ce4372b3ceb59ad132619ffe3e7c591193c2d5f2ed97aba198ec51  # 2026.08.15-1

@@ -1 +1 @@
-default = { version = "21.4.2", url = "https://github.com/pypa/get-virtualenv/releases/download/21.4.2/virtualenv.pyz", sha256 = "b54c48b9c81468403626762747c5ee5939616f18f46c3c4bbebdbe0aa3a8ba1d" }
+default = { version = "21.7.4", url = "https://github.com/pypa/get-virtualenv/releases/download/21.7.4/virtualenv.pyz", sha256 = "2dfdb6785b762b8a7a7a31d413c16516aa785552d05f61435b072fde1cb340cc" }
@@ -92,7 +92,7 @@ class BuildSelector:
                return False

        # filter out groups that are not enabled
-        if EnableGroup.CPythonPrerelease not in self.enable and fnmatch(build_id, "cp315*"):
+        if EnableGroup.CPythonPrerelease not in self.enable and fnmatch(build_id, "cp316*"):
            return False
        is_pypy_eol = fnmatch(build_id, "pp3?-*") or fnmatch(build_id, "pp310-*")
        is_pypy = fnmatch(build_id, "pp*") and not is_pypy_eol
@@ -104,19 +104,6 @@ class BuildSelector:
            return False
        if EnableGroup.PyodideEoL not in self.enable and fnmatch(build_id, "cp312-pyodide_*"):
            return False
-        # NOTE: Re-enable this when we have a new Pyodide prerelease (e.g., 315.0.0a1+)
-        # When doing this, also:
-        #   1. update Pyodide tests in unit_test/build_selector_test.py and unit_test/options_test.py accordingly.
-        #   2. update Python versions for Pyodide identifiers in cibuildwheel/selector.py.
-        #   3. update constraints as necessary via bin/generate_pyodide_constraints.py and add/delete
-        #      Pyodide constraints files in cibuildwheel/resources/constraints/ as necessary.
-        # When re-enabling, update the pattern to match the experimental Python version when
-        # it is bumped to Python 3.15 (likely cp315-pyodide_*).
-        # This depends on the CPython version being used in the Pyodide runtime at the time.
-        # if EnableGroup.PyodidePrerelease not in self.enable and fnmatch(
-        #     build_id, "cp315-pyodide_*"
-        # ):
-        #     return False

        should_build = selector_matches(self.build_config, build_id)
        should_skip = selector_matches(self.skip_config, build_id)
@@ -9,6 +9,7 @@ __lazy_modules__ = {
    "tarfile",
    "typing",
    "urllib",
+    "urllib.error",
    "urllib.request",
    "zipfile",
 }
@@ -20,6 +21,7 @@ import shutil
 import ssl
 import tarfile
 import time
+import urllib.error
 import urllib.request
 from contextlib import contextmanager
 from pathlib import Path, PurePath
@@ -51,7 +53,7 @@ def remove_on_error(path: Path) -> Generator[None, None, None]:
                shutil.rmtree(path)
            elif path.exists() or path.is_symlink():
                path.unlink()
-        except BaseException as cleanup_exception:
+        except BaseException as cleanup_exception:  # noqa: BLE001
            msg = f"Failed to remove {path}. Please remove it manually."
            raise BaseExceptionGroup(msg, [original_exception, cleanup_exception]) from None
        raise
@@ -86,17 +88,24 @@ def download(url: str, dest: Path, *, sha256: str | None = None) -> None:
    # so we use certifi (this sounds odd but requests also does this by default)
    cafile = os.environ.get("SSL_CERT_FILE", certifi.where())
    context = ssl.create_default_context(cafile=cafile)
-    repeat_num = 3
+    # exponential backoff, so that a network outage of about a minute is survivable
+    repeat_num = 6
    for i in range(repeat_num):
        try:
            with urllib.request.urlopen(url, context=context) as response:
                dest.write_bytes(response.read())
                break

+        except urllib.error.HTTPError as error:
+            # a client error, such as a bad URL, will not fix itself
+            if i == repeat_num - 1 or 400 <= error.code < 500:
+                raise
+            time.sleep(3 * 2**i)
+
        except OSError:
            if i == repeat_num - 1:
                raise
-            time.sleep(3)
+            time.sleep(3 * 2**i)

    if sha256:
        with dest.open("rb") as f:
@@ -3,6 +3,7 @@ from __future__ import annotations
 __lazy_modules__ = {"tomllib"}

 import functools
+import os
 import tomllib
 from pathlib import Path

@@ -18,7 +19,9 @@ FREE_THREAD_ENABLE_314: Final[Path] = PATH / "free-threaded-enable-314.xml"
 FREE_THREAD_ENABLE_315: Final[Path] = PATH / "free-threaded-enable-315.xml"
 NODEJS: Final[Path] = PATH / "nodejs.toml"
 DEFAULTS: Final[Path] = PATH / "defaults.toml"
-PINNED_DOCKER_IMAGES: Final[Path] = PATH / "pinned_docker_images.cfg"
+PINNED_DOCKER_IMAGES: Final[Path] = Path(
+    os.environ.get("CIBW_INTERNAL_PINNED_DOCKER_IMAGES", str(PATH / "pinned_docker_images.cfg"))
+)
 BUILD_PLATFORMS: Final[Path] = PATH / "build-platforms.toml"
 CONSTRAINTS: Final[Path] = PATH / "constraints.txt"
 VIRTUALENV: Final[Path] = PATH / "virtualenv.toml"
@@ -152,6 +152,10 @@ def virtualenv(
    venv. Otherwise, pip is installed.
    """

+    # the unresolved path, so e.g. the python.org framework bin directory is
+    # used rather than the internal location of the real binary
+    base_python_bin_dir = None if _IS_WIN else python.parent
+
    # virtualenv may fail if this is a symlink.
    python = python.resolve()

@@ -189,7 +193,7 @@ def virtualenv(
            python,
            venv_path,
        )
-    venv_env = activate_virtualenv(venv_path, env=env)
+    venv_env = activate_virtualenv(venv_path, env=env, base_python_bin_dir=base_python_bin_dir)
    if not use_uv and pip_version == "embed":
        call(
            "python",
@@ -208,11 +212,19 @@ def virtualenv(
 def activate_virtualenv(
    venv_path: Path,
    env: dict[str, str] | None = None,
+    base_python_bin_dir: Path | None = None,
 ) -> dict[str, str]:
    """
    Return a copy of the environment with the virtualenv at `venv_path` activated.
+
+    If given, `base_python_bin_dir` is placed on PATH right after the venv, so
+    that scripts installed alongside the base interpreter that aren't copied
+    into the venv (such as python3-config, see #2021) resolve to the matching
+    interpreter.
    """
    paths = [str(venv_path), str(venv_path / "Scripts")] if _IS_WIN else [str(venv_path / "bin")]
+    if base_python_bin_dir is not None:
+        paths.append(str(base_python_bin_dir))
    venv_env = os.environ.copy() if env is None else env.copy()
    venv_env["PATH"] = os.pathsep.join([*paths, venv_env["PATH"]])
    venv_env["VIRTUAL_ENV"] = str(venv_path)
@@ -1,6 +1,6 @@
 # Maintaining Pyodide support

-Last updated: May 2026
+Last updated: August 2026

 This page describes how to update cibuildwheel's Pyodide platform code when either:

@@ -11,17 +11,26 @@ This page describes how to update cibuildwheel's Pyodide platform code when eith

 Pyodide has three types of releases that matter to cibuildwheel:

- **Stable** – the most recent full Pyodide release (e.g., `0.29.x` / cp313). This is enabled by default with no special `CIBW_ENABLE` flag needed.
- **Prerelease** – an alpha/beta/rc Pyodide release that uses the _next_ CPython version (e.g., `314.0.0a1` / cp314). Users must opt in with `CIBW_ENABLE: pyodide-prerelease` to build against this version. This may or may not be available at any given time, depending on the Pyodide release cycle.
- **End-of-life (EoL)** – older Pyodide stable releases that are no longer the current stable. These are kept available behind `CIBW_ENABLE: pyodide-eol` so that users who still need to build for older Pyodide versions can do so.
+- **Stable** – the most recent full Pyodide release.
+  This is enabled by default with no special `CIBW_ENABLE` flag needed.
+- **Prerelease** – an alpha/beta/rc Pyodide release that uses the _next_ CPython
+  version. Users must opt in with `CIBW_ENABLE:
+  cpython-prerelease` to build against this version. This may or may not be
+  available at any given time, depending on the Pyodide release cycle.
+- **End-of-life (EoL)** – older Pyodide stable releases that are no longer the
+  current stable. These are kept available behind `CIBW_ENABLE: pyodide-eol` so
+  that users who still need to build for older Pyodide versions can do so.

-The guards in `cibuildwheel/selector.py` enforce this distinction. The constraints files under `cibuildwheel/resources/` pin the exact tool versions that go with each build.
+The guards in `cibuildwheel/selector.py` enforce this distinction. The
+constraints files under `cibuildwheel/resources/` pin the exact tool versions
+that go with each build.

 ---

 ## When a new Pyodide prerelease becomes available

-For example, consider a scenario when Pyodide ships a new `315.0.0a1` with cp315 support.
+For example, consider a scenario when Pyodide ships a new `315.0.0a1` with cp315
+support.

 ### 1. Add the new Python configuration

@@ -31,61 +40,39 @@ In `cibuildwheel/resources/build-platforms.toml`, add an entry under `[pyodide]`
 { identifier = "cp315-pyodide_wasm32", version = "3.15", default_pyodide_version = "315.0.0a1", node_version = "v24", sha256 = "SHA256" },
 ```

-`version` is the CPython version string, `default_pyodide_version` is the Pyodide release to use when the user does not pin one explicitly (use the latest available alpha/beta for a prerelease entry), and `node_version` is the minimum Node.js major required by that Pyodide release — check the [pyodide-build FAQ](https://pyodide-build.readthedocs.io/en/latest/faq.html#what-node-js-version-do-i-need) for a rudimentary idea of what the correct value is. `sha256` is the checksum of the Pyodide xbuildenv tarball.
+`version` is the CPython version string, `default_pyodide_version` is the
+Pyodide release to use when the user does not pin one explicitly (use the latest
+available alpha/beta for a prerelease entry), and `node_version` is the minimum
+Node.js major required by that Pyodide release — check the
+[pyodide-build FAQ](https://pyodide-build.readthedocs.io/en/latest/faq.html#what-node-js-version-do-i-need)
+for a rudimentary idea of what the correct value is. `sha256` is the checksum of
+the Pyodide xbuildenv tarball.

-### 2. Update the prerelease guards in the selector
+### 2. Generate and pin a constraints file

-In `cibuildwheel/selector.py`, update the patterns in the `PyodidePrerelease` guards to match the new identifier:
-
-```python
-if EnableGroup.PyodidePrerelease not in self.enable and fnmatch(
-    build_id, "cp315-pyodide_*"
-):
-    return False
-```
-
-### 3. Generate and pin a constraints file
-
-Run the `update_constraints` `nox` session, which reads `build-platforms.toml` and regenerates all Pyodide constraints files automatically:
+Run the `update_constraints` `nox` session, which reads `build-platforms.toml`
+and regenerates all Pyodide constraints files automatically:

 ```bash
 nox -s update_constraints
 ```

-### 4. Update tests
+### 3. Update tests

-Update the unit tests so the new identifier is accepted by the selector with `PyodidePrerelease` enabled and rejected without it. Pyodide-specific integration tests may also need their hardcoded expected-wheel lists extended.
-
-## When a Pyodide prerelease becomes stable
-
-Pyodide uses a versioning scheme where the stable release for a given CPython version is named `[PythonMajorMinor].0.0`, so the first stable release shipping cp314 will be **`314.0.0`**. See [pyodide/pyodide#6084](https://github.com/pyodide/pyodide/issues/6084) for a rationale of this versioning scheme.
-
-### 1. Update the stable entries, and remove (or replace) the prerelease entry
-
-In `build-platforms.toml`, update the former prerelease entry's `default_pyodide_version` to the new stable release (e.g. `314.0.0`) and remove the prerelease marker from the identifier if present. Remove previous prerelease entries if they are now obsolete, or update them to the next prerelease if one is available. Move the previous stable version behind `pyodide-eol` rather than dropping it outright (see below).
-
-### 2. Disable or update the prerelease guards
-
-In `selector.py`:
-
- **If a new prerelease is available**: update the `fnmatch` pattern to the next identifier (e.g. `cp315-pyodide_*`) as described above.
- **If there is no new prerelease**: comment out the `PyodidePrerelease` logic.
-
-### 3. Update the constraints file
-
-Run `nox -s update_constraints` to regenerate the constraints file for the newly stable version. If the entry was already in `build-platforms.toml` as a prerelease, its constraints file already exists, and this step just refreshes it against the stable Pyodide release and updates the dependencies' versions.
-
-### 4. Update tests
-
-Update the unit tests so the newly stable identifier is accepted by the selector without needing `PyodidePrerelease` in the enable set. Pyodide-specific integration tests may also need their hardcoded expected-wheel lists extended.
+Update the unit tests so the new identifier is accepted by the selector with
+`CPythonPrerelease` enabled and rejected without it. Pyodide-specific
+integration tests may also need their hardcoded expected-wheel lists extended.

 ## When an old Pyodide version is to be moved to end-of-life

-When a Pyodide version is superseded by a new stable release, move it behind the `pyodide-eol` enable flag. We want to allow users who still build for older Pyodide ABIs time to upgrade.
+When a Pyodide version is superseded by a new stable release, move it behind the
+`pyodide-eol` enable flag. We want to allow users who still build for older
+Pyodide ABIs time to upgrade.

 ### 1. Add the `pyodide-eol` guard in the selector

-In `cibuildwheel/selector.py`, add (or update) the `PyodideEoL` guard to include the old identifier:
+In `cibuildwheel/selector.py`, add (or update) the `PyodideEoL` guard to include
+the old identifier:

 ```python
 if EnableGroup.PyodideEoL not in self.enable and fnmatch(build_id, "cp312-pyodide_*"):
@@ -94,15 +81,23 @@ if EnableGroup.PyodideEoL not in self.enable and fnmatch(build_id, "cp312-pyodid

 ### 2. Update tests

-Update the unit tests so the EoL identifier requires `PyodideEoL` to be included in the enable set. The default (no `CIBW_ENABLE`) should exclude it.
+Update the unit tests so the EoL identifier requires `PyodideEoL` to be included
+in the enable set. The default (no `CIBW_ENABLE`) should exclude it.

 ## When an old Pyodide version is to be fully retired

-Retirement is not expected to happen on a routine basis. It is only warranted when the Pyodide ecosystem itself has evolved to the point where an older ABI version is considered obsolete – for example, if the surrounding toolchain, packaging standards, or runtime infrastructure have moved on so substantially that building for the older version no longer makes practical sense. Any retirement is to be discussed and agreed upon by Pyodide maintainers before proceeding.
+Retirement is not expected to happen on a routine basis. It is only warranted
+when the Pyodide ecosystem itself has evolved to the point where an older ABI
+version is considered obsolete – for example, if the surrounding toolchain,
+packaging standards, or runtime infrastructure have moved on so substantially
+that building for the older version no longer makes practical sense. Any
+retirement is to be discussed and agreed upon by Pyodide maintainers before
+proceeding.

 ### 1. Remove the Python configuration

-Delete the entry from `build-platforms.toml` and remove the `PyodideEoL` guard for that identifier in `selector.py`.
+Delete the entry from `build-platforms.toml` and remove the `PyodideEoL` guard
+for that identifier in `selector.py`.

 ### 2. Delete the constraints file

@@ -110,4 +105,5 @@ Remove `cibuildwheel/resources/constraints-pyodideXYZ.txt`.

 ### 3. Update tests

-Remove references to the old identifier from the unit tests, integration tests, and drop any expected-wheel entries for it from the test helper.
+Remove references to the old identifier from the unit tests, integration tests,
+and drop any expected-wheel entries for it from the test helper.
@@ -5,6 +5,42 @@ ref: changelog

 # Changelog

+### v4.2.0
+
+_4 August 2026_
+
+- 🌟 CPython 3.15 wheels are now built by default - without the `"cpython-prerelease"` [`enable`](https://cibuildwheel.pypa.io/en/stable/options/#enable) set. It's time to build and upload these wheels to PyPI! This release includes CPython 3.15.0rc1, which is guaranteed to be ABI compatible with the final release. (#2944)
+- ✨ Adds Pyodide 3.15 support with the `cp315-pyodide_wasm32` build identifier, using Pyodide 315.0.0a2. These are also stable wrt. the final release. (#2958)
+- 🐛 Retries a failed download six times with exponential backoff, so short network outages no longer stop a build. A `4xx` response is still reported at once. (#2953)
+- 🐛 Accepts `default` as a [`build-frontend`](https://cibuildwheel.pypa.io/en/stable/options/#build-frontend) value on Pyodide, and accepts `pyodide-build` in the top-level table and in overrides (#2951)
+- 🛠 Holds pip back on GraalPy, where newer pip breaks the build (#2955)
+- 🛠 Updates Pyodide to 314.0.4 (#2949, #2952)
+- 🛠 Updates dependencies and container pins (#2952, #2960)
+- 💼 Updates CI action pins (#2948, #2954)
+- 🧪 Uses pp311 for the abi3 test, and deletes `test_overridden_pip_constraint`, which is not necessary since #2583 (#2956, #2957)
+
+### v4.1.1
+
+_24 July 2026_
+
+- ✨ Adds `pyodide-build` as a separate [`build-frontend`](https://cibuildwheel.pypa.io/en/stable/options/#build-frontend), now the default frontend for Pyodide, with verbosity flags handling. Any other frontend is ignored with a warning on Pyodide. (#2609, #2945)
+- 🔐 Uses digests instead of tags for pinned container images, strengthening supply-chain security. The human-readable tags remain as comments in `pinned_docker_images.cfg`. (#2915)
+- 🐛 Fixes platform-specific [`test-runtime`](https://cibuildwheel.pypa.io/en/stable/options/#test-runtime) environment variables (e.g. `CIBW_TEST_RUNTIME_ANDROID`) not being honored (#2941)
+- 🐛 Fixes quoting of [`test-requires`](https://cibuildwheel.pypa.io/en/stable/options/#test-requires) and [`audit-requires`](https://cibuildwheel.pypa.io/en/stable/options/#audit-requires) so PEP 508 specifiers containing spaces work (#2913)
+- 🐛 Makes [`archs`](https://cibuildwheel.pypa.io/en/stable/options/#archs) parsing case-insensitive and platform-aware, so e.g. `arm64` works on Windows (#2920)
+- 🐛 Uses an absolute path for the `{project}` placeholder in [`config-settings`](https://cibuildwheel.pypa.io/en/stable/options/#config-settings) (#2934)
+- 🐛 Validates the [`pyodide-version`](https://cibuildwheel.pypa.io/en/stable/options/#pyodide-version) option against the build identifier with a clear error (#2925)
+- 🐛 Fixes PyPy installs on macOS after PyPy switched its downloads from `.tar.bz2` to `.tar.gz` (#2939)
+- 🐛 Makes a matching `python3-config` available in the build and test venvs on macOS (#2922)
+- 🛠 Updates dependencies and container pins (#2917, #2935, #2939)
+- 🛠 Updates Android tests to current Python versions and the new test repository URL (#2933)
+- 🛠 Drops the `orjson` dependency, no longer used by mypy 2+ (#2923)
+- 📚 Builds the docs with properdocs, a MkDocs fork (#2946)
+- 📚 Adds the missing `cp314-pyodide_wasm32` entry to the build identifier table (#2947)
+- 📚 Removes outdated notes about the `pip wheel` build frontend and ClearLinux (#2926)
+- 💼 Adds a "CI: PyPy EoL" PR label to run PyPy EoL tests on PRs (#2930)
+- 💼 Updates CI action pins and pre-commit hooks (#2914, #2932, #2938, #2940, #2942, #2943)
+
 ### v4.1.0

 _12 June 2026_
@@ -158,7 +158,7 @@ There are two suggested methods for keeping cibuildwheel up to date that instead
 If you use GitHub Actions for builds, you can use cibuildwheel as an action:

 ```yaml
-uses: pypa/cibuildwheel@v4.1.0
+uses: pypa/cibuildwheel@v4.2.0
 ```

 This is a composite step that just runs cibuildwheel using pipx. You can set command-line options as `with:` parameters, and use `env:` as normal.
@@ -183,7 +183,7 @@ The second option, and the only one that supports other CI systems, is using a `

 ```bash
 # requirements-cibw.txt
-cibuildwheel==4.1.0
+cibuildwheel==4.2.0
 ```

 Then your install step would have `python -m pip install -r requirements-cibw.txt` in it. Your `.github/dependabot.yml` file could look like this:
@@ -402,7 +402,7 @@ Solutions to this vary, but the simplest is to use pipx:
 # most runners have pipx preinstalled, but in case you don't
 python3 -m pip install pipx

-pipx run cibuildwheel==4.1.0 --output-dir wheelhouse
+pipx run cibuildwheel==4.2.0 --output-dir wheelhouse
 pipx run twine upload wheelhouse/*.whl
 ```

@@ -12,7 +12,7 @@ def define_env(env: Any) -> None:  # noqa: ANN401
    "Hook function for mkdocs-macros"

    @env.macro  # type: ignore[untyped-decorator]
-    def subprocess_run(*args: str) -> str:
+    def subprocess_run(*args: str) -> str:  # type: ignore[misc]
        "Run a subprocess and return the stdout"
        env = os.environ.copy()
        scripts = sysconfig.get_path("scripts")
@@ -64,8 +64,8 @@ When setting the options, you can use shell-style globbing syntax, as per [fnmat
 | Python 3.11   | cp311-macosx_x86_64<br/>cp311-macosx_universal2<br/>cp311-macosx_arm64 | cp311-win_amd64<br/>cp311-win32<br/>cp311-win_arm64 | cp311-manylinux_x86_64<br/>cp311-manylinux_i686<br/>cp311-musllinux_x86_64<br/>cp311-musllinux_i686 | cp311-manylinux_aarch64<br/>cp311-manylinux_ppc64le<br/>cp311-manylinux_s390x<br/>cp311-manylinux_armv7l<br/>cp311-manylinux_riscv64<br/>cp311-musllinux_aarch64<br/>cp311-musllinux_ppc64le<br/>cp311-musllinux_s390x<br/>cp311-musllinux_armv7l<br/>cp311-musllinux_riscv64 |                                                  |                                                                                                   |                      |
 | Python 3.12   | cp312-macosx_x86_64<br/>cp312-macosx_universal2<br/>cp312-macosx_arm64 | cp312-win_amd64<br/>cp312-win32<br/>cp312-win_arm64 | cp312-manylinux_x86_64<br/>cp312-manylinux_i686<br/>cp312-musllinux_x86_64<br/>cp312-musllinux_i686 | cp312-manylinux_aarch64<br/>cp312-manylinux_ppc64le<br/>cp312-manylinux_s390x<br/>cp312-manylinux_armv7l<br/>cp312-manylinux_riscv64<br/>cp312-musllinux_aarch64<br/>cp312-musllinux_ppc64le<br/>cp312-musllinux_s390x<br/>cp312-musllinux_armv7l<br/>cp312-musllinux_riscv64 |                                                  |                                                                                                   | cp312-pyodide_wasm32 |
 | Python 3.13   | cp313-macosx_x86_64<br/>cp313-macosx_universal2<br/>cp313-macosx_arm64 | cp313-win_amd64<br/>cp313-win32<br/>cp313-win_arm64 | cp313-manylinux_x86_64<br/>cp313-manylinux_i686<br/>cp313-musllinux_x86_64<br/>cp313-musllinux_i686 | cp313-manylinux_aarch64<br/>cp313-manylinux_ppc64le<br/>cp313-manylinux_s390x<br/>cp313-manylinux_armv7l<br/>cp313-manylinux_riscv64<br/>cp313-musllinux_aarch64<br/>cp313-musllinux_ppc64le<br/>cp313-musllinux_s390x<br/>cp313-musllinux_armv7l<br/>cp313-musllinux_riscv64 | cp313-android_arm64_v8a<br/>cp313-android_x86_64 | cp313-ios_arm64_iphoneos<br/>cp313-ios_arm64_iphonesimulator<br/>cp313-ios_x86_64_iphonesimulator | cp313-pyodide_wasm32 |
-| Python 3.14   | cp314-macosx_x86_64<br/>cp314-macosx_universal2<br/>cp314-macosx_arm64<br><br>cp314t-macosx_x86_64<br/>cp314t-macosx_universal2<br/>cp314t-macosx_arm64 | cp314-win_amd64<br/>cp314-win32<br/>cp314-win_arm64<br><br>cp314t-win_amd64<br/>cp314t-win32<br/>cp314t-win_arm64 | cp314-manylinux_x86_64<br/>cp314-manylinux_i686<br/>cp314-musllinux_x86_64<br/>cp314-musllinux_i686<br><br>cp314t-manylinux_x86_64<br/>cp314t-manylinux_i686<br/>cp314t-musllinux_x86_64<br/>cp314t-musllinux_i686 | cp314-manylinux_aarch64<br/>cp314-manylinux_ppc64le<br/>cp314-manylinux_s390x<br/>cp314-manylinux_armv7l<br/>cp314-manylinux_riscv64<br/>cp314-musllinux_aarch64<br/>cp314-musllinux_ppc64le<br/>cp314-musllinux_s390x<br/>cp314-musllinux_armv7l<br/>cp314-musllinux_riscv64<br><br>cp314t-manylinux_aarch64<br/>cp314t-manylinux_ppc64le<br/>cp314t-manylinux_s390x<br/>cp314t-manylinux_armv7l<br/>cp314t-manylinux_riscv64<br/>cp314t-musllinux_aarch64<br/>cp314t-musllinux_ppc64le<br/>cp314t-musllinux_s390x<br/>cp314t-musllinux_armv7l<br/>cp314t-musllinux_riscv64 | cp314-android_arm64_v8a<br/>cp314-android_x86_64 | cp314-ios_arm64_iphoneos<br/>cp314-ios_arm64_iphonesimulator<br/>cp314-ios_x86_64_iphonesimulator |                      |
-| Python 3.15   | cp315-macosx_x86_64<br/>cp315-macosx_universal2<br/>cp315-macosx_arm64<br><br>cp315t-macosx_x86_64<br/>cp315t-macosx_universal2<br/>cp315t-macosx_arm64 | cp315-win_amd64<br/>cp315-win32<br/>cp315-win_arm64<br><br>cp315t-win_amd64<br/>cp315t-win32<br/>cp315t-win_arm64 | cp315-manylinux_x86_64<br/>cp315-manylinux_i686<br/>cp315-musllinux_x86_64<br/>cp315-musllinux_i686<br><br>cp315t-manylinux_x86_64<br/>cp315t-manylinux_i686<br/>cp315t-musllinux_x86_64<br/>cp315t-musllinux_i686 | cp315-manylinux_aarch64<br/>cp315-manylinux_ppc64le<br/>cp315-manylinux_s390x<br/>cp315-manylinux_armv7l<br/>cp315-manylinux_riscv64<br/>cp315-musllinux_aarch64<br/>cp315-musllinux_ppc64le<br/>cp315-musllinux_s390x<br/>cp315-musllinux_armv7l<br/>cp315-musllinux_riscv64<br><br>cp315t-manylinux_aarch64<br/>cp315t-manylinux_ppc64le<br/>cp315t-manylinux_s390x<br/>cp315t-manylinux_armv7l<br/>cp315t-manylinux_riscv64<br/>cp315t-musllinux_aarch64<br/>cp315t-musllinux_ppc64le<br/>cp315t-musllinux_s390x<br/>cp315t-musllinux_armv7l<br/>cp315t-musllinux_riscv64 | cp315-android_arm64_v8a<br/>cp315-android_x86_64 | cp315-ios_arm64_iphoneos<br/>cp315-ios_arm64_iphonesimulator<br/>cp315-ios_x86_64_iphonesimulator |                      |
+| Python 3.14   | cp314-macosx_x86_64<br/>cp314-macosx_universal2<br/>cp314-macosx_arm64<br><br>cp314t-macosx_x86_64<br/>cp314t-macosx_universal2<br/>cp314t-macosx_arm64 | cp314-win_amd64<br/>cp314-win32<br/>cp314-win_arm64<br><br>cp314t-win_amd64<br/>cp314t-win32<br/>cp314t-win_arm64 | cp314-manylinux_x86_64<br/>cp314-manylinux_i686<br/>cp314-musllinux_x86_64<br/>cp314-musllinux_i686<br><br>cp314t-manylinux_x86_64<br/>cp314t-manylinux_i686<br/>cp314t-musllinux_x86_64<br/>cp314t-musllinux_i686 | cp314-manylinux_aarch64<br/>cp314-manylinux_ppc64le<br/>cp314-manylinux_s390x<br/>cp314-manylinux_armv7l<br/>cp314-manylinux_riscv64<br/>cp314-musllinux_aarch64<br/>cp314-musllinux_ppc64le<br/>cp314-musllinux_s390x<br/>cp314-musllinux_armv7l<br/>cp314-musllinux_riscv64<br><br>cp314t-manylinux_aarch64<br/>cp314t-manylinux_ppc64le<br/>cp314t-manylinux_s390x<br/>cp314t-manylinux_armv7l<br/>cp314t-manylinux_riscv64<br/>cp314t-musllinux_aarch64<br/>cp314t-musllinux_ppc64le<br/>cp314t-musllinux_s390x<br/>cp314t-musllinux_armv7l<br/>cp314t-musllinux_riscv64 | cp314-android_arm64_v8a<br/>cp314-android_x86_64 | cp314-ios_arm64_iphoneos<br/>cp314-ios_arm64_iphonesimulator<br/>cp314-ios_x86_64_iphonesimulator | cp314-pyodide_wasm32 |
+| Python 3.15   | cp315-macosx_x86_64<br/>cp315-macosx_universal2<br/>cp315-macosx_arm64<br><br>cp315t-macosx_x86_64<br/>cp315t-macosx_universal2<br/>cp315t-macosx_arm64 | cp315-win_amd64<br/>cp315-win32<br/>cp315-win_arm64<br><br>cp315t-win_amd64<br/>cp315t-win32<br/>cp315t-win_arm64 | cp315-manylinux_x86_64<br/>cp315-manylinux_i686<br/>cp315-musllinux_x86_64<br/>cp315-musllinux_i686<br><br>cp315t-manylinux_x86_64<br/>cp315t-manylinux_i686<br/>cp315t-musllinux_x86_64<br/>cp315t-musllinux_i686 | cp315-manylinux_aarch64<br/>cp315-manylinux_ppc64le<br/>cp315-manylinux_s390x<br/>cp315-manylinux_armv7l<br/>cp315-manylinux_riscv64<br/>cp315-musllinux_aarch64<br/>cp315-musllinux_ppc64le<br/>cp315-musllinux_s390x<br/>cp315-musllinux_armv7l<br/>cp315-musllinux_riscv64<br><br>cp315t-manylinux_aarch64<br/>cp315t-manylinux_ppc64le<br/>cp315t-manylinux_s390x<br/>cp315t-manylinux_armv7l<br/>cp315t-manylinux_riscv64<br/>cp315t-musllinux_aarch64<br/>cp315t-musllinux_ppc64le<br/>cp315t-musllinux_s390x<br/>cp315t-musllinux_armv7l<br/>cp315t-musllinux_riscv64 | cp315-android_arm64_v8a<br/>cp315-android_x86_64 | cp315-ios_arm64_iphoneos<br/>cp315-ios_arm64_iphonesimulator<br/>cp315-ios_x86_64_iphonesimulator | cp315-pyodide_wasm32 |
 | PyPy3.9 v7.3  | pp39-macosx_x86_64<br/>pp39-macosx_arm64                               | pp39-win_amd64                                      | pp39-manylinux_x86_64<br/>pp39-manylinux_i686                                                       | pp39-manylinux_aarch64                                                                                                                                                                                                                                                        |                                                  |                                                                                                   |                      |
 | PyPy3.10 v7.3 | pp310-macosx_x86_64<br/>pp310-macosx_arm64                             | pp310-win_amd64                                     | pp310-manylinux_x86_64<br/>pp310-manylinux_i686                                                     | pp310-manylinux_aarch64                                                                                                                                                                                                                                                       |                                                  |                                                                                                   |                      |
 | PyPy3.11 v7.3 | pp311-macosx_x86_64<br/>pp311-macosx_arm64                             | pp311-win_amd64                                     | pp311-manylinux_x86_64<br/>pp311-manylinux_i686                                                     | pp311-manylinux_aarch64                                                                                                                                                                                                                                                       |                                                  |                                                                                                   |                      |
@@ -357,13 +357,11 @@ values are:


 - `cpython-prerelease`: Enables beta versions of Pythons if any are available
-  (May-July, approximately).
+  (May-July, approximately). This also covers Pyodide versions built against a
+  beta CPython, which is the case for the current Pyodide prerelease.
 - `pypy`: Enable PyPy.
 - `pypy-eol`: Enable PyPy versions that have passed end of life (if still available).
 - `graalpy`: Enable GraalPy.
- `pyodide-prerelease`: Pyodide versions that haven't released yet, if one is
-  available. Safe if you are shipping a site with an early build, not for
-  general distribution.
 - `pyodide-eol`: Enable Pyodide versions that are no longer the current stable
  release (if still available).
 - `all`: Enable all of the above.
@@ -481,7 +479,11 @@ files (from workspaces) are not supported.
    are building GraalPy wheels, use `build` or `pip` as the build frontend
    instead of `build[uv]` or `uv`.

-On Android and Pyodide, the "pip" frontend is not supported.
+On Android, the "pip" frontend is not supported.
+
+On Pyodide, `pyodide-build` is the default and only supported frontend; setting
+another frontend produces a warning and uses `pyodide-build` instead. See
+[Pyodide build frontend support](platforms.md#pyodide-build-frontend) for details.

 You can specify extra arguments to pass to the build frontend using the
 optional `args` option.
@@ -1910,14 +1912,14 @@ will not produce more logging about the build itself. Other levels only affect
 the build frontend output, which is usually things like resolving and
 downloading dependencies. The settings are:

-|             | build | pip    | uv    | desc                                   |
-|-------------|-------|--------|-------|----------------------------------------|
-| -2          | `-qq` | `-qq`  | `-qq` | even more quiet, where supported       |
-| -1          | `-q`  | `-q`   | `-q`  | quiet mode, where supported            |
-| 0 (default) |       |        |       | default for build tool                 |
-| 1           |       | `-v`   |       | print backend output                   |
-| 2           | `-v`  | `-vv`  | `-v`  | print log messages e.g. resolving info |
-| 3           | `-vv` | `-vvv` | `-vv` | print even more debug info             |
+|             | build | pip    | uv    | pyodide-build | desc                                   |
+|-------------|-------|--------|-------|---------------|----------------------------------------|
+| -2          | `-qq` | `-qq`  | `-qq` |               | even more quiet, where supported       |
+| -1          | `-q`  | `-q`   | `-q`  |               | quiet mode, where supported            |
+| 0 (default) |       |        |       |               | default for build tool                 |
+| 1           |       | `-v`   |       | `-v`          | print backend output                   |
+| 2           | `-v`  | `-vv`  | `-v`  | `-vv`         | print log messages e.g. resolving info |
+| 3           | `-vv` | `-vvv` | `-vv` |               | print even more debug info             |

 Settings that are not supported for a specific frontend will log a warning.
 The default build frontend is `build`, which does show build backend output by
@@ -188,6 +188,11 @@ repair-wheel-command = "pyodide auditwheel repair --libdir /path/to/libraries --

 The `--libdir` option specifies the directory containing cross-compiled shared libraries for WASM. You should not use the system library directories (e.g. `/usr/lib`), as those libraries are not built for WebAssembly.

+### Build frontend support {: #pyodide-build-frontend}
+
+The pyodide platform builds wheels by shelling out to `pyodide build`, via the `pyodide-build` [`build-frontend`](options.md#build-frontend), which itself is a meta build frontend and passes through commands to pypa/build with specialised handling. This is the only supported frontend for this platform, and is used by default. A global [`build-frontend`](options.md#build-frontend) setting naming another frontend is ignored with a warning on this platform.
+
+[`build-verbosity`](options.md#build-verbosity) is passed through to `pyodide build` as `-v`/`-vv`. It is capped at `-vv`. `pyodide build` has no `-vvv` flag.

 ## Android {: android}

@@ -11,8 +11,8 @@ ref: working-examples
 |-----------------------------------|----|----|:------|
 | [scikit-learn][]                  | ![github icon][] | ![windows icon][] ![apple icon][] ![linux icon][] ![pyodide icon][] | The machine learning library. A complex but clean config using many of cibuildwheel's features to build a large project with Cython and C++ extensions.  |
 | [duckdb][]                        | ![github icon][] | ![apple icon][] ![linux icon][] ![windows icon][] | DuckDB is an analytical in-process SQL database management system |
-| [pytorch-fairseq][]               | ![github icon][] | ![apple icon][] ![linux icon][] | Facebook AI Research Sequence-to-Sequence Toolkit written in Python. |
 | [NumPy][]                         | ![github icon][] ![travisci icon][] | ![windows icon][] ![apple icon][] ![linux icon][] ![pyodide icon][] | The fundamental package for scientific computing with Python. |
+| [pytorch-fairseq][]               | ![github icon][] | ![apple icon][] ![linux icon][] | Facebook AI Research Sequence-to-Sequence Toolkit written in Python. |
 | [NCNN][]                          | ![github icon][] | ![windows icon][] ![apple icon][] ![linux icon][] | ncnn is a high-performance neural network inference framework optimized for the mobile platform |
 | [Matplotlib][]                    | ![github icon][] | ![windows icon][] ![apple icon][] ![linux icon][] ![pyodide icon][] | The venerable Matplotlib, a Python library with C++ portions |
 | [Tornado][]                       | ![github icon][] | ![linux icon][] ![apple icon][] ![windows icon][] | Tornado is a Python web framework and asynchronous networking library. Uses stable ABI for a small C extension. |
@@ -48,9 +48,9 @@ ref: working-examples
 | [Implicit][]                      | ![github icon][] | ![windows icon][] ![apple icon][] ![linux icon][] | Includes GPU support for linux wheels |
 | [vispy][]                         | ![github icon][] | ![apple icon][] ![linux icon][] ![windows icon][] | Main repository for Vispy |
 | [coverage.py][]                   | ![github icon][] | ![windows icon][] ![apple icon][] ![linux icon][] | The coverage tool for Python |
-| [Line Profiler][]                 | ![github icon][] | ![apple icon][] ![linux icon][] ![windows icon][] | Line-by-line profiling for Python |
-| [PyCryptodome][]                  | ![github icon][] | ![apple icon][] ![linux icon][] ![windows icon][] | A self-contained cryptographic library for Python |
 | [PyAV][]                          | ![github icon][] | ![windows icon][] ![apple icon][] ![linux icon][] | Pythonic bindings for FFmpeg's libraries. |
+| [PyCryptodome][]                  | ![github icon][] | ![apple icon][] ![linux icon][] ![windows icon][] | A self-contained cryptographic library for Python |
+| [Line Profiler][]                 | ![github icon][] | ![apple icon][] ![linux icon][] ![windows icon][] | Line-by-line profiling for Python |
 | [PyYAML][]                        | ![github icon][] | ![apple icon][] | Canonical source repository for PyYAML |
 | [pikepdf][]                       | ![github icon][] | ![windows icon][] ![apple icon][] ![linux icon][] | A Python library for reading and writing PDF, powered by QPDF |
 | [numexpr][]                       | ![github icon][] ![travisci icon][] | ![windows icon][] ![apple icon][] ![linux icon][] | Fast numerical array expression evaluator for Python, NumPy, Pandas, PyTables and more |
@@ -67,22 +67,22 @@ ref: working-examples
 | [google neuroglancer][]           | ![github icon][] | ![windows icon][] ![apple icon][] ![linux icon][] | WebGL-based viewer for volumetric data |
 | [Parselmouth][]                   | ![github icon][] | ![windows icon][] ![apple icon][] ![linux icon][] | A Python interface to the Praat software package, using pybind11, C++17 and CMake, with the core Praat static library built only once and shared between wheels. |
 | [H3-py][]                         | ![github icon][] | ![apple icon][] ![linux icon][] ![windows icon][] | Python bindings for H3, a hierarchical hexagonal geospatial indexing system |
-| [AutoPy][]                        | ![travisci icon][] | ![windows icon][] ![apple icon][] ![linux icon][] | Includes a Windows Travis build. |
 | [time-machine][]                  | ![github icon][] | ![apple icon][] ![linux icon][] ![windows icon][] | Time mocking library using only the CPython C API. |
+| [AutoPy][]                        | ![travisci icon][] | ![windows icon][] ![apple icon][] ![linux icon][] | Includes a Windows Travis build. |
 | [DeepForest][]                    | ![github icon][] | ![apple icon][] ![linux icon][] ![windows icon][] | An Efficient, Scalable and Optimized Python Framework for Deep Forest (2021.2.1) |
 | [mosec][]                         | ![github icon][] | ![linux icon][] ![apple icon][] | A machine learning model serving framework powered by Rust |
 | [Picologging][]                   | ![github icon][] | ![windows icon][] ![apple icon][] ![linux icon][] | A high-performance logging library for Python. |
 | [markupsafe][]                    | ![github icon][] | ![apple icon][] ![linux icon][] ![windows icon][] | Safely add untrusted strings to HTML/XML markup. |
 | [Rtree][]                         | ![github icon][] | ![windows icon][] ![apple icon][] ![linux icon][] | Rtree: spatial index for Python GIS |
 | [pybind11 cmake_example][]        | ![github icon][] | ![windows icon][] ![apple icon][] ![linux icon][] ![pyodide icon][] | Example pybind11 module built with a CMake-based build system |
-| [KDEpy][]                         | ![github icon][] | ![windows icon][] ![apple icon][] ![linux icon][] | Kernel Density Estimation in Python |
 | [dd-trace-py][]                   | ![github icon][] | ![windows icon][] ![apple icon][] ![linux icon][] | Uses custom alternate arch emulation on GitHub |
-| [tgcalls][]                       | ![github icon][] | ![apple icon][] ![windows icon][] | Python `pybind11` binding to Telegram's WebRTC library with third party dependencies like `OpenSSL`, `MozJPEG`, `FFmpeg`, etc. |
+| [KDEpy][]                         | ![github icon][] | ![windows icon][] ![apple icon][] ![linux icon][] | Kernel Density Estimation in Python |
 | [sourmash][]                      | ![github icon][] | ![apple icon][] ![linux icon][] ![windows icon][] ![pyodide icon][] | Quickly search, compare, and analyze genomic and metagenomic data sets. |
+| [tgcalls][]                       | ![github icon][] | ![apple icon][] ![windows icon][] | Python `pybind11` binding to Telegram's WebRTC library with third party dependencies like `OpenSSL`, `MozJPEG`, `FFmpeg`, etc. |
 | [python-rapidjson][]              | ![travisci icon][] ![gitlab icon][] | ![windows icon][] ![linux icon][] | Python wrapper around rapidjson |
 | [pybind11 python_example][]       | ![github icon][] | ![windows icon][] ![apple icon][] ![linux icon][] ![pyodide icon][] | Example pybind11 module built with a Python-based build system |
-| [python-snappy][]                 | ![github icon][] | ![apple icon][] ![linux icon][] ![windows icon][] | Python bindings for the snappy google library |
 | [Confluent client for Kafka][]    | ![travisci icon][] | ![apple icon][] ![linux icon][] ![windows icon][] | setup in `tools/wheels/build-wheels.bat` |
+| [python-snappy][]                 | ![github icon][] | ![apple icon][] ![linux icon][] ![windows icon][] | Python bindings for the snappy google library |
 | [abess][]                         | ![github icon][] | ![windows icon][] ![apple icon][] ![linux icon][] | A fast best-subset selection library. It uses cibuildwheel to build a large project with C++ extensions. |
 | [jq.py][]                         | ![travisci icon][] | ![apple icon][] ![linux icon][] | Python bindings for jq |
 | [cyvcf2][]                        | ![github icon][] | ![apple icon][] ![linux icon][] | cython + htslib == fast VCF and BCF processing |
@@ -92,18 +92,18 @@ ref: working-examples
 | [pillow-heif][]                   | ![github icon][] | ![apple icon][] ![linux icon][] ![windows icon][] | Bindings to libheif library with third party dependencies. Fully automated CI for tests and publishing including Apple Silicon builds. |
 | [keyvi][]                         | ![github icon][] | ![linux icon][] ![apple icon][] | FST based key value index highly optimized for size and lookup performance, utilizes ccache action for improved runtime |
 | [PyGLM][]                         | ![github icon][] | ![apple icon][] ![linux icon][] ![windows icon][] | Fast OpenGL Mathematics (GLM) for Python |
-| [iDynTree][]                      | ![github icon][] | ![linux icon][] | Uses manylinux_2_24 |
 | [power-grid-model][]              | ![github icon][] | ![windows icon][] ![apple icon][] ![linux icon][] | Python/C++ library for distribution power system analysis |
+| [iDynTree][]                      | ![github icon][] | ![linux icon][] | Uses manylinux_2_24 |
 | [TgCrypto][]                      | ![travisci icon][] | ![windows icon][] ![apple icon][] ![linux icon][] | Includes a Windows Travis build. |
-| [streaming-form-data][]           | ![github icon][] | ![apple icon][] ![linux icon][] ![windows icon][] | Streaming parser for multipart/form-data written in Cython |
 | [Imagecodecs (fork)][]            | ![azurepipelines icon][] | ![apple icon][] ![linux icon][] | Over 20 external dependencies in compiled libraries, custom docker image, `libomp`, `openblas` and `install_name_tool` for macOS. |
+| [streaming-form-data][]           | ![github icon][] | ![apple icon][] ![linux icon][] ![windows icon][] | Streaming parser for multipart/form-data written in Cython |
 | [pybase64][]                      | ![github icon][] | ![windows icon][] ![apple icon][] ![linux icon][] ![android icon][] ![ios icon][] ![pyodide icon][] | setuptools backend with custom CMake step for external sources. SBOM embedded via a custom repair step. |
 | [boost-histogram][]               | ![github icon][] ![travisci icon][] | ![windows icon][] ![apple icon][] ![linux icon][] ![pyodide icon][] | Supports full range of wheels, including PyPy and alternate archs. |
 | [bx-python][]                     | ![travisci icon][] | ![apple icon][] ![linux icon][] | A library that includes Cython extensions. |
 | [Python-WebRTC][]                 | ![github icon][] | ![windows icon][] ![apple icon][] ![linux icon][] | a Python extension that provides bindings to WebRTC M92 |
 | [pybind11 scikit_build_example][] | ![github icon][] | ![windows icon][] ![apple icon][] ![linux icon][] ![pyodide icon][] | An example combining scikit-build and pybind11 |
-| [fathon][]                        | ![travisci icon][] | ![apple icon][] ![linux icon][] | python package for DFA (Detrended Fluctuation Analysis) and related algorithms |
 | [Arbor][]                         | ![github icon][] | ![apple icon][] ![linux icon][] | Arbor is a multi-compartment neuron simulation library; compatible with next-generation accelerators; best-practices applied to research software; focused on community-driven development. Includes a [small script](https://github.com/arbor-sim/arbor/blob/master/scripts/patchwheel.py) patching `rpath` in bundled libraries.  |
+| [fathon][]                        | ![travisci icon][] | ![apple icon][] ![linux icon][] | python package for DFA (Detrended Fluctuation Analysis) and related algorithms |
 | [clang-format][]                  | ![github icon][] | ![apple icon][] ![linux icon][] ![windows icon][] | Scikit-build wrapper around LLVM's CMake, all platforms, generic wheels. |
 | [polaroid][]                      | ![github icon][] | ![apple icon][] ![linux icon][] ![windows icon][] | Full range of wheels for setuptools rust, with auto release and PyPI deploy. |
 | [ninja][]                         | ![github icon][] ![travisci icon][] | ![apple icon][] ![linux icon][] ![windows icon][] | Multitagged binary builds for all supported platforms, using cibw 2 config configuration. |
@@ -122,8 +122,8 @@ ref: working-examples

 [scikit-learn]: https://github.com/scikit-learn/scikit-learn
 [duckdb]: https://github.com/duckdb/duckdb
-[pytorch-fairseq]: https://github.com/facebookresearch/fairseq
 [NumPy]: https://github.com/numpy/numpy
+[pytorch-fairseq]: https://github.com/facebookresearch/fairseq
 [NCNN]: https://github.com/Tencent/ncnn
 [Matplotlib]: https://github.com/matplotlib/matplotlib
 [Tornado]: https://github.com/tornadoweb/tornado
@@ -159,9 +159,9 @@ ref: working-examples
 [Implicit]: https://github.com/benfred/implicit
 [vispy]: https://github.com/vispy/vispy
 [coverage.py]: https://github.com/nedbat/coveragepy
-[Line Profiler]: https://github.com/pyutils/line_profiler
-[PyCryptodome]: https://github.com/Legrandin/pycryptodome
 [PyAV]: https://github.com/PyAV-Org/PyAV
+[PyCryptodome]: https://github.com/Legrandin/pycryptodome
+[Line Profiler]: https://github.com/pyutils/line_profiler
 [PyYAML]: https://github.com/yaml/pyyaml
 [pikepdf]: https://github.com/pikepdf/pikepdf
 [numexpr]: https://github.com/pydata/numexpr
@@ -178,22 +178,22 @@ ref: working-examples
 [google neuroglancer]: https://github.com/google/neuroglancer
 [Parselmouth]: https://github.com/YannickJadoul/Parselmouth
 [H3-py]: https://github.com/uber/h3-py
-[AutoPy]: https://github.com/autopilot-rs/autopy
 [time-machine]: https://github.com/adamchainz/time-machine
+[AutoPy]: https://github.com/autopilot-rs/autopy
 [DeepForest]: https://github.com/LAMDA-NJU/Deep-Forest
 [mosec]: https://github.com/mosecorg/mosec
 [Picologging]: https://github.com/microsoft/picologging
 [markupsafe]: https://github.com/pallets/markupsafe
 [Rtree]: https://github.com/Toblerity/rtree
 [pybind11 cmake_example]: https://github.com/pybind/cmake_example
-[KDEpy]: https://github.com/tommyod/KDEpy
 [dd-trace-py]: https://github.com/DataDog/dd-trace-py
-[tgcalls]: https://github.com/MarshalX/tgcalls
+[KDEpy]: https://github.com/tommyod/KDEpy
 [sourmash]: https://github.com/sourmash-bio/sourmash
+[tgcalls]: https://github.com/MarshalX/tgcalls
 [python-rapidjson]: https://github.com/python-rapidjson/python-rapidjson
 [pybind11 python_example]: https://github.com/pybind/python_example
-[python-snappy]: https://github.com/intake/python-snappy
 [Confluent client for Kafka]: https://github.com/confluentinc/confluent-kafka-python
+[python-snappy]: https://github.com/intake/python-snappy
 [abess]: https://github.com/abess-team/abess
 [jq.py]: https://github.com/mwilliamson/jq.py
 [cyvcf2]: https://github.com/brentp/cyvcf2
@@ -203,18 +203,18 @@ ref: working-examples
 [pillow-heif]: https://github.com/bigcat88/pillow_heif
 [keyvi]: https://github.com/KeyviDev/keyvi
 [PyGLM]: https://github.com/Zuzu-Typ/PyGLM
-[iDynTree]: https://github.com/robotology/idyntree
 [power-grid-model]: https://github.com/PowerGridModel/power-grid-model
+[iDynTree]: https://github.com/robotology/idyntree
 [TgCrypto]: https://github.com/pyrogram/tgcrypto
-[streaming-form-data]: https://github.com/siddhantgoel/streaming-form-data
 [Imagecodecs (fork)]: https://github.com/czaki/imagecodecs_build
+[streaming-form-data]: https://github.com/siddhantgoel/streaming-form-data
 [pybase64]: https://github.com/mayeut/pybase64
 [boost-histogram]: https://github.com/scikit-hep/boost-histogram
 [bx-python]: https://github.com/bxlab/bx-python
 [Python-WebRTC]: https://github.com/MarshalX/python-webrtc
 [pybind11 scikit_build_example]: https://github.com/pybind/scikit_build_example
-[fathon]: https://github.com/stfbnc/fathon
 [Arbor]: https://github.com/arbor-sim/arbor
+[fathon]: https://github.com/stfbnc/fathon
 [clang-format]: https://github.com/ssciwr/clang-format-wheel
 [polaroid]: https://github.com/daggy1234/polaroid
 [ninja]: https://github.com/scikit-build/ninja-python-distributions
@@ -6,7 +6,7 @@ jobs:
    - bash: |
        set -o errexit
        python3 -m pip install --upgrade pip
-        pip3 install cibuildwheel==4.1.0
+        pip3 install cibuildwheel==4.2.0
      displayName: Install dependencies
    - bash: cibuildwheel --output-dir wheelhouse .
      displayName: Build wheels
@@ -20,7 +20,7 @@ jobs:
    - bash: |
        set -o errexit
        python3 -m pip install --upgrade pip
-        python3 -m pip install cibuildwheel==4.1.0
+        python3 -m pip install cibuildwheel==4.2.0
      displayName: Install dependencies
    - bash: cibuildwheel --output-dir wheelhouse .
      displayName: Build wheels
@@ -34,7 +34,7 @@ jobs:
    - bash: |
        set -o errexit
        python -m pip install --upgrade pip
-        pip install cibuildwheel==4.1.0
+        pip install cibuildwheel==4.2.0
      displayName: Install dependencies
    - bash: cibuildwheel --output-dir wheelhouse .
      displayName: Build wheels
@@ -11,7 +11,7 @@ jobs:
      - run:
          name: Build the Linux wheels.
          command: |
-            python3 -m pip install --user cibuildwheel==4.1.0
+            python3 -m pip install --user cibuildwheel==4.2.0
            cibuildwheel --output-dir wheelhouse
      - store_artifacts:
          path: wheelhouse/
@@ -28,7 +28,7 @@ jobs:
      - run:
          name: Build the Linux aarch64 wheels.
          command: |
-            python3 -m pip install --user cibuildwheel==4.1.0
+            python3 -m pip install --user cibuildwheel==4.2.0
            python3 -m cibuildwheel --output-dir wheelhouse
      - store_artifacts:
          path: wheelhouse/
@@ -44,7 +44,7 @@ jobs:
          name: Build the OS X wheels.
          command: |
            sudo softwareupdate --install-rosetta --agree-to-license  # for x86_64/universal2 tests
-            pip3 install cibuildwheel==4.1.0
+            pip3 install cibuildwheel==4.2.0
            cibuildwheel --output-dir wheelhouse
      - store_artifacts:
          path: wheelhouse/
@@ -53,7 +53,7 @@ jobs:
          persist-credentials: false

      - name: Build wheels
-        uses: pypa/cibuildwheel@v4.1.0
+        uses: pypa/cibuildwheel@v4.2.0
        env:
          CIBW_PLATFORM: ${{ matrix.platform || 'auto' }}
          CIBW_ARCHS: ${{ matrix.archs || 'auto' }}
@@ -17,7 +17,7 @@ jobs:
          persist-credentials: false

      - name: Build wheels
-        uses: pypa/cibuildwheel@v4.1.0
+        uses: pypa/cibuildwheel@v4.2.0
        # env:
        #   CIBW_SOME_OPTION: value
        #   ...
@@ -17,7 +17,7 @@ jobs:
          persist-credentials: false

      - name: Build wheels
-        run: pipx run cibuildwheel==4.1.0
+        run: pipx run cibuildwheel==4.2.0

      - uses: actions/upload-artifact@v4
        with:
@@ -23,7 +23,7 @@ jobs:
          platforms: all

      - name: Build wheels
-        uses: pypa/cibuildwheel@v4.1.0
+        uses: pypa/cibuildwheel@v4.2.0
        env:
          # configure cibuildwheel on Linux to build native archs ('auto'),
          # and to split the remaining architectures between the x86_64 and
@@ -12,7 +12,7 @@ linux:
    DOCKER_TLS_CERTDIR: ""
  script:
    - curl -sSL https://get.docker.com/ | sh
-    - python -m pip install cibuildwheel==4.1.0
+    - python -m pip install cibuildwheel==4.2.0
    - cibuildwheel --output-dir wheelhouse
  artifacts:
    paths:
@@ -23,7 +23,7 @@ windows:
  before_script:
    - choco install python -y --allow-downgrade --version 3.12.4
    - choco install git.install -y
-    - py -m pip install cibuildwheel==4.1.0
+    - py -m pip install cibuildwheel==4.2.0
  script:
    - py -m cibuildwheel --output-dir wheelhouse --platform windows
  artifacts:
@@ -35,7 +35,7 @@ windows:
 macos:
  image: macos-14-xcode-15
  before_script:
-    - python3 -m pip install cibuildwheel==4.1.0
+    - python3 -m pip install cibuildwheel==4.2.0
  script:
    - python3 -m cibuildwheel --output-dir wheelhouse
  artifacts:
@@ -14,7 +14,7 @@ linux:
    - curl -sSL https://get.docker.com/ | sh
    # Warning: This is extremely slow, be careful with how many wheels you build
    - docker run --rm --privileged multiarch/qemu-user-static --reset -p yes
-    - python -m pip install cibuildwheel==4.1.0
+    - python -m pip install cibuildwheel==4.2.0
    # Assuming your CI runner's default architecture is x86_64...
    - cibuildwheel --output-dir wheelhouse --platform linux --archs aarch64
  artifacts:
@@ -16,9 +16,11 @@ See sessions with `nox -l`
 """

 import os
+import re
 import shutil
 import sys
 from pathlib import Path
+from typing import Any

 import nox

@@ -63,6 +65,59 @@ def tests(session: nox.Session) -> None:
        session.run("pytest", "test", "-x", "--durations", "0", "--timeout=2400", "test")


+# Packages held back for GraalPy until upstream fixes land. uv pip compile
+# can't express a per-implementation split, so the compiled pin is patched:
+# GraalPy (matching `graalpy_marker`) gets `held`, everything else
+# (`other_marker`) tracks the freshly compiled version.
+GRAALPY_HELD_BACK = (
+    # Newer pip breaks GraalPy on macOS and Windows.
+    {
+        "package": "pip",
+        "held": ("26.1.2", "26.0.1"),
+        "graalpy_marker": (
+            'implementation_name == "graalpy" and platform_system != "Windows"',
+            'implementation_name == "graalpy" and platform_system == "Windows"',
+        ),
+        "other_marker": 'implementation_name != "graalpy"',
+    },
+    # filelock >=3.30 imports errno.ENOTSUP, which GraalPy lacks (fix due ~2026-08).
+    {
+        "package": "filelock",
+        "held": ("3.29.7",),
+        "graalpy_marker": ('implementation_name == "graalpy"',),
+        "other_marker": 'implementation_name != "graalpy"',
+    },
+)
+
+
+def _pin_graalpy_workarounds(output_file: Path) -> None:
+    text = output_file.read_text()
+    for pin in GRAALPY_HELD_BACK:
+        assert isinstance(pin["package"], str)
+        package = re.escape(pin["package"])
+        graalpy_pins = "\n".join(
+            f"{pin['package']}=={pin['held'][i]}; {pin['graalpy_marker'][i]}"
+            for i in range(len(pin["held"]))
+        )
+        text = re.sub(
+            rf"^{package}==(?P<version>[^\s;]+)$",
+            f"{pin['package']}==\\g<version>; {pin['other_marker']}\n{graalpy_pins}",
+            text,
+            flags=re.MULTILINE,
+        )
+    output_file.write_text(text)
+
+
+def _graalpy_python_versions(build_platforms: dict[str, Any]) -> set[str]:
+    """Python minor versions (e.g. "3.12") that ship a GraalPy configuration."""
+    return {
+        ".".join(config["version"].split(".")[:2])
+        for platform in build_platforms.values()
+        for config in platform["python_configurations"]
+        if config["identifier"].startswith("gp")
+    }
+
+
@nox.session(default=False, tags=["update"])
 def update_constraints(session: nox.Session) -> None:
    """
@@ -79,6 +134,9 @@ def update_constraints(session: nox.Session) -> None:
    env = os.environ.copy()
    env["UV_CUSTOM_COMPILE_COMMAND"] = f"nox -s {session.name}"

+    build_platforms = nox.project.load_toml(resources / "build-platforms.toml")
+    graalpy_versions = _graalpy_python_versions(build_platforms)
+
    for minor_version in range(9, 16):
        python_version = f"3.{minor_version}"
        output_file = resources / f"constraints-python{python_version.replace('.', '')}.txt"
@@ -92,13 +150,14 @@ def update_constraints(session: nox.Session) -> None:
            f"--output-file={output_file}",
            env=env,
        )
+        if python_version in graalpy_versions:
+            _pin_graalpy_workarounds(output_file)

    shutil.copyfile(
        resources / "constraints-python315.txt",
        resources / "constraints.txt",
    )

-    build_platforms = nox.project.load_toml(resources / "build-platforms.toml")
    pyodides = build_platforms["pyodide"]["python_configurations"]
    for pyodide in pyodides:
        python_version = ".".join(pyodide["version"].split(".")[:2])
@@ -176,7 +235,9 @@ def docs(session: nox.Session) -> None:
    """
    pyproject = nox.project.load_toml()
    session.install("-e.", *nox.project.dependency_groups(pyproject, "docs"))
-    session.run("mkdocs", "serve" if session.interactive else "build", "--strict", *session.posargs)
+    session.run(
+        "properdocs", "serve" if session.interactive else "build", "--strict", *session.posargs
+    )


@nox.session(default=False)
@@ -4,7 +4,7 @@ build-backend = "hatchling.build"

 [project]
 name = "cibuildwheel"
-version = "4.1.0"
+version = "4.2.0"
 description = "Build Python wheels on CI with minimal configuration."
 readme = "README.md"
 license = "BSD-2-Clause"
@@ -68,7 +68,8 @@ docs = [
    "mkdocs-include-markdown-plugin==7.1.8",
    "mkdocs-intersphinx>=0.1.1; python_version >= '3.12'",
    "mkdocs-macros-plugin>=1.4.1",
-    "mkdocs==1.6.1",
+    "properdocs==1.6.7",
+    "properdocs-theme-readthedocs",
    "pymdown-extensions",
    "rich",
 ]
@@ -115,10 +116,27 @@ files = [
    "bin/*.py",
    "noxfile.py",
 ]
+disallow_any_decorated = true
+disallow_any_unimported = true
+disallow_untyped_globals = true
+disallow_redefinition = true
 warn_unused_configs = true
 strict = true
-enable_error_code = ["ignore-without-code", "redundant-expr", "truthy-bool"]
+enable_error_code = [
+  "deprecated",
+  "exhaustive-match",
+  "ignore-without-code",
+  "mutable-override",
+  "possibly-undefined",
+  "redundant-expr",
+  "redundant-self",
+  "truthy-bool",
+  "truthy-iterable",
+  "unimported-reveal",
+  "unused-awaitable",
+]
 warn_unreachable = false
+native_parser = true

 [[tool.mypy.overrides]]
 module = [
@@ -129,6 +147,10 @@ module = [
 ]
 ignore_missing_imports = true

+[[tool.mypy.overrides]]
+module = ["cibuildwheel.bashlex_eval"]
+disable_error_code = ["no-any-unimported"]
+

 [tool.pylint]
 py-version = "3.11"
@@ -165,6 +187,7 @@ messages_control.disable = [
  "wrong-import-position",
  "unused-argument",  # Handled by Ruff
  "import-outside-toplevel",  # Handled by Ruff
+  "broad-exception-caught",  # Handled by Ruff
  "broad-exception-raised",  # Could be improved eventually
  "consider-using-in",  # MyPy can't narrow "in"
 ]
@@ -216,6 +239,7 @@ ignore = [
  "PT007",   # Lists of tuples in Pytest
  "PYI025",  # Set as AbstractSet
  "PTH123",  # open -> Path.open
+  "TRY002",  # Create your own exception
 ]
 flake8-unused-arguments.ignore-variadic-names = true
 flake8-tidy-imports.ban-relative-imports = "all"
@@ -233,7 +257,7 @@ future-annotations = true

 [tool.ruff.lint.per-file-ignores]
 "unit_test/*" = ["PLC1901", "TID252"]
-"test/*" = ["TID252"]
+"test/*" = ["TID252", "N999"]
 "bin/*" = ["TID251"]
 "cibuildwheel/resources/install_certifi.py" = ["PTH"]

@@ -1,5 +1,6 @@
 from __future__ import annotations

+import dataclasses
 import json
 import os
 import subprocess
@@ -12,14 +13,16 @@ from cibuildwheel.ci import detect_ci_provider
 from cibuildwheel.options import CommandLineArguments, Options
 from cibuildwheel.selector import EnableGroup
 from cibuildwheel.typing import PLATFORMS
+from cibuildwheel.util.resources import PINNED_DOCKER_IMAGES
 from cibuildwheel.venv import find_uv

 from . import utils
-from .utils import DEFAULT_CIBW_ENABLE, EMULATED_ARCHS, get_platform
+from .utils import DEFAULT_CIBW_ENABLE, EMULATED_ARCHS, get_enable_groups, get_platform

 TYPE_CHECKING = False
 if TYPE_CHECKING:
    from collections.abc import Generator
+    from pathlib import Path


 def pytest_addoption(parser: pytest.Parser) -> None:
@@ -74,7 +77,19 @@ def pytest_configure(config: pytest.Config) -> None:
        os.environ["CIBW_PLATFORM"] = flag_platform


-def docker_warmup(request: pytest.FixtureRequest) -> None:
+@dataclasses.dataclass(frozen=True)
+class DockerWarmUpImage:
+    source_name: str
+    cached_name: str
+
+
+def get_docker_warmup_images(request: pytest.FixtureRequest) -> list[DockerWarmUpImage] | None:
+    enable_groups = get_enable_groups()
+    # Check missing pre-installed interpreters are needed
+    enable_groups &= {EnableGroup.GraalPy, EnableGroup.PyPyEoL}
+    if not enable_groups:
+        return None
+
    machine = request.config.getoption("--run-emulation", default=None)
    if machine is None:
        archs = {arch.value for arch in Architecture.auto_archs("linux")}
@@ -86,7 +101,7 @@ def docker_warmup(request: pytest.FixtureRequest) -> None:
    # Only include architectures where there are missing pre-installed interpreters
    archs &= {"x86_64", "i686", "aarch64"}
    if not archs:
-        return
+        return None

    options = Options(
        platform="linux",
@@ -96,17 +111,28 @@ def docker_warmup(request: pytest.FixtureRequest) -> None:
    )
    build_options = options.build_options(None)
    assert build_options.manylinux_images is not None
-    assert build_options.musllinux_images is not None
-    images = [build_options.manylinux_images[arch] for arch in archs] + [
-        build_options.musllinux_images[arch] for arch in archs
-    ]
+    images: list[DockerWarmUpImage] = []
+    for arch in archs:
+        source_name = build_options.manylinux_images[arch]
+        cached_name = source_name
+        if "@sha256:" in source_name:
+            cached_name = source_name.rsplit("@sha256:", 1)[0] + ":cibw_cache_fixture"
+        images.append(DockerWarmUpImage(source_name, cached_name))
+    if images:
+        return images
+    return None
+
+
+def docker_warmup(images: list[DockerWarmUpImage], docker_warmup_config: Path) -> None:
    command = (
        "manylinux-interpreters ensure-all &&"
        "cpython3.13 -m pip download -d /tmp setuptools wheel pytest"
    )
+    config_content = PINNED_DOCKER_IMAGES.read_text()
    for image in images:
+        config_content = config_content.replace(image.source_name, image.cached_name)
        container_id = subprocess.run(
-            ["docker", "create", image, "bash", "-c", command],
+            ["docker", "create", image.source_name, "bash", "-c", command],
            text=True,
            check=True,
            stdout=subprocess.PIPE,
@@ -118,37 +144,48 @@ def docker_warmup(request: pytest.FixtureRequest) -> None:
            ).stdout.strip()
            assert exit_code == "0"
            subprocess.run(
-                ["docker", "commit", container_id, image], check=True, stdout=subprocess.DEVNULL
+                ["docker", "commit", container_id, image.cached_name],
+                check=True,
+                stdout=subprocess.DEVNULL,
            )
        finally:
            subprocess.run(["docker", "rm", container_id], check=True, stdout=subprocess.DEVNULL)
+    docker_warmup_config.write_text(config_content)


@pytest.fixture(scope="session", autouse=True)
 def docker_warmup_fixture(
    request: pytest.FixtureRequest, tmp_path_factory: pytest.TempPathFactory, worker_id: str
-) -> None:
+) -> Generator[None, None, None]:
    # if we're in CI testing linux, let's warm-up docker images
    if detect_ci_provider() is None or get_platform() != "linux":
-        return None
-    if request.config.getoption("--run-emulation", default=None) is not None:
+        images = None
+    elif request.config.getoption("--run-emulation", default=None) is not None:
        # emulation tests only run one test in CI, caching the image only slows down the test
-        return None
+        images = None
+    else:
+        images = get_docker_warmup_images(request)
+    if images is None:
+        yield None
+        return

    if worker_id == "master":
        # not executing with multiple workers
        # it might be unsafe to write to tmp_path_factory.getbasetemp().parent
-        return docker_warmup(request)
+        docker_warmup_config = tmp_path_factory.getbasetemp() / "docker_warmup.cfg"
+        docker_warmup(images, docker_warmup_config)
+    else:
+        # get the temp directory shared by all workers
+        root_tmp_dir = tmp_path_factory.getbasetemp().parent

-    # get the temp directory shared by all workers
-    root_tmp_dir = tmp_path_factory.getbasetemp().parent
+        docker_warmup_config = root_tmp_dir / "docker_warmup.cfg"
+        with FileLock(str(docker_warmup_config) + ".lock"):
+            if not docker_warmup_config.is_file():
+                docker_warmup(images, docker_warmup_config)

-    fn = root_tmp_dir / "warmup.done"
-    with FileLock(str(fn) + ".lock"):
-        if not fn.is_file():
-            docker_warmup(request)
-            fn.write_text("done")
-    return None
+    with pytest.MonkeyPatch.context() as monkeypatch:
+        monkeypatch.setenv("CIBW_INTERNAL_PINNED_DOCKER_IMAGES", str(docker_warmup_config))
+        yield None


@pytest.fixture(params=["pip", "build"])
@@ -157,8 +194,8 @@ def build_frontend_env_nouv(request: pytest.FixtureRequest) -> dict[str, str]:
    marks = {m.name for m in request.node.iter_markers()}

    platform = "pyodide" if "pyodide" in marks else get_platform()
-    if platform == "pyodide" and frontend == "pip":
-        pytest.skip("Can't use pip as build frontend for pyodide platform")
+    if platform == "pyodide":
+        pytest.skip("pyodide only supports the pyodide-build frontend")

    return {"CIBW_BUILD_FRONTEND": frontend}

@@ -176,10 +213,10 @@ def build_frontend_env(request: pytest.FixtureRequest) -> Generator[dict[str, st
    else:
        platform = get_platform()

-    if platform in {"pyodide", "ios", "android"} and frontend == "pip":
+    if platform == "pyodide":
+        pytest.skip("pyodide only supports the pyodide-build frontend")
+    if platform in {"ios", "android"} and frontend == "pip":
        pytest.skip(f"Can't use pip as build frontend for {platform}")
-    if platform == "pyodide" and frontend in {"build[uv]", "uv"}:
-        pytest.skip("Can't use uv with pyodide yet")
    uv_path = find_uv()
    if uv_path is None and frontend in {"build[uv]", "uv"}:
        pytest.skip("Can't find uv, so skipping uv tests")
@@ -54,7 +54,7 @@ def test_abi3(tmp_path: Path) -> None:
            "CIBW_BUILD": (
                "cp314-*"
                if utils.get_platform() == "pyodide"
-                else "cp39-* cp310-* pp310-* gp312_250-* cp312-* cp314t-*"
+                else "cp39-* cp310-* pp311-* gp312_250-* cp312-* cp314t-*"
            ),
            "CIBW_ENABLE": "all",
        },
@@ -77,7 +77,7 @@ def test_abi3(tmp_path: Path) -> None:
                "cp39-cp39",
                "cp310-abi3",  # <-- ABI3, works with 3.10 and 3.12
                "cp314-cp314t",
-                "pp310-pypy310_pp73",
+                "pp311-pypy311_pp73",
                "graalpy312-graalpy250_312_native",
            ],
        )
@@ -203,7 +203,7 @@ def test_abi_none(tmp_path: Path, capfd: pytest.CaptureFixture[str]) -> None:
            "CIBW_TEST_REQUIRES": "pytest",
            "CIBW_TEST_COMMAND": f"{utils.invoke_pytest()} {{project}}/test",
            # limit the number of builds for test performance reasons
-            "CIBW_BUILD": "cp39-* cp{}{}-* cp314t-* pp310-*".format(*utils.SINGLE_PYTHON_VERSION),
+            "CIBW_BUILD": "cp39-* cp{}{}-* cp314t-* pp311-*".format(*utils.SINGLE_PYTHON_VERSION),
            "CIBW_ENABLE": "all",
        },
    )
@@ -619,24 +619,54 @@ def test_repair_error(
    assert error in capfd.readouterr().err


-# This also tests integration with pkgconf, because Meson uses it to find Python.
+# This also tests integration with pkgconf, which Meson uses to find Python and
+# OpenBLAS.
@needs_emulator
 def test_meson(tmp_path: Path, capfd: pytest.CaptureFixture[str]) -> None:
-    # Alter spam.filter to return the value of a Fortran function.
    new_meson_project(
-        spam_c_top_level_add="int fortran_func_();",
-        spam_c_function_add="sts = fortran_func_();",
        project_args_add="'fortran',",
-        extension_args_add="'fortran.f90', link_language: 'fortran',",
+        extension_args_add=dedent(
+            """\
+            'fortran.f90',
+            link_language: 'fortran',
+            dependencies: [dependency('openblas', method: 'pkg-config')],
+            """
+        ),
+        # Alter spam.filter to call an OpenBLAS function, and return the value of a
+        # Fortran function.
+        spam_c_top_level_add=dedent(
+            """\
+            #include <cblas.h>
+            int fortran_func_();
+            """
+        ),
+        spam_c_function_add=dedent(
+            """\
+            openblas_get_config();
+            sts = fortran_func_();
+            """
+        ),
    ).generate(tmp_path)

-    # TODO: remove once meson-python has a release with Android support.
-    pyproject_path = tmp_path / "pyproject.toml"
-    pyproject_path.write_text(
-        pyproject_path.read_text().replace(
-            "meson-python", "meson-python @ git+https://github.com/mesonbuild/meson-python@main"
+    # Add a before-build script to download OpenBLAS.
+    before_build = tmp_path / "cibw_before_build.sh"
+    before_build.write_text(
+        dedent(
+            """\
+            #!/bin/sh
+            set -eu
+
+            openblas_dir=$(pwd)/openblas
+            rm -rf $openblas_dir
+            mkdir -p $openblas_dir
+            pip install \\
+                --target $openblas_dir \\
+                --index-url https://chaquo.com/pypi-upstream/ \\
+                chaquopy-openblas==0.3.33
+            """
        )
    )
+    before_build.chmod(0o755)

    # Add Fortran code.
    (tmp_path / "fortran.f90").write_text(
@@ -652,7 +682,15 @@ def test_meson(tmp_path: Path, capfd: pytest.CaptureFixture[str]) -> None:
    script = 'import spam; print(f"result: {spam.filter("")}")'
    cibuildwheel_run(
        tmp_path,
-        add_env={**cp313_env, "CIBW_TEST_COMMAND": f"python -c '{script}'"},
+        add_env={
+            **cp313_env,
+            "CIBW_BEFORE_BUILD": str(before_build),
+            "CIBW_ENVIRONMENT": (
+                'PKG_CONFIG_PATH="$(pwd)/openblas/chaquopy/lib/pkgconfig" '
+                'AUDITWHEEL_LD_LIBRARY_PATH="$(pwd)/openblas/chaquopy/lib"'
+            ),
+            "CIBW_TEST_COMMAND": f"python -c '{script}'",
+        },
    )
    assert "result: 42" in capfd.readouterr().out

@@ -690,7 +728,7 @@ def test_xbuild_files(tmp_path: Path, capfd: pytest.CaptureFixture[str]) -> None
        add_env={
            **cp313_env,
            # TODO: remove this once there are official Android NumPy wheels on PyPI.
-            "PIP_EXTRA_INDEX_URL": "https://chaquo.com/pypi-test",
+            "PIP_EXTRA_INDEX_URL": "https://chaquo.com/pypi-upstream",
            "CIBW_ARCHS": "all",  # Include both native and non-native archs.
            "CIBW_TEST_COMMAND": f"python -c '{script}'",
        },
@@ -50,7 +50,7 @@ def test(tmp_path: Path) -> None:
        """python -c "import pathlib, sys; pathlib.Path('{project}/pythonversion_bb.txt').write_text(sys.version)" && """
        f'''python -c "import pathlib, sys; pathlib.Path('{{project}}/pythonprefix_bb.txt').write_text({SYS_PREFIX})"'''
    )
-    frontend = "build"
+    frontend = "pyodide-build" if utils.get_platform() == "pyodide" else "build"
    if utils.get_platform() != "pyodide":
        before_build = f"python -m pip install setuptools && {before_build}"
        frontend = f"{frontend};args: --no-isolation"
@@ -15,7 +15,17 @@ if TYPE_CHECKING:
    "frontend_name",
    [
        pytest.param("pip", marks=utils.skip_if_pyodide("No pip for pyodide")),
-        "build",
+        pytest.param(
+            "build",
+            marks=utils.skip_if_pyodide("pyodide only supports the pyodide-build frontend"),
+        ),
+        pytest.param(
+            "pyodide-build",
+            marks=pytest.mark.skipif(
+                utils.get_platform() != "pyodide",
+                reason="pyodide-build frontend is only valid on pyodide",
+            ),
+        ),
    ],
 )
 def test_build_frontend_args(
@@ -27,7 +37,7 @@ def test_build_frontend_args(

    # the build will fail because the frontend is called with '-h' - it prints the help message
    add_env = {"CIBW_BUILD_FRONTEND": f"{frontend_name}; args: -h"}
-    if utils.get_platform() == "pyodide":
+    if frontend_name == "pyodide-build":
        add_env["TERM"] = "dumb"  # disable color / style
        add_env["NO_COLOR"] = "1"
    with pytest.raises(subprocess.CalledProcessError):
@@ -40,7 +50,7 @@ def test_build_frontend_args(
    if frontend_name == "pip":
        assert "Usage:" in captured.out
        assert "Wheel Options:" in captured.out
-    elif utils.get_platform() == "pyodide":
+    elif frontend_name == "pyodide-build":
        assert "Usage: pyodide build" in captured.out
    else:
        assert "usage:" in captured.out
@@ -12,7 +12,10 @@ basic_project = test_projects.new_c_project()


 def test_podman(
-    tmp_path: Path, capfd: pytest.CaptureFixture[str], request: pytest.FixtureRequest
+    tmp_path: Path,
+    capfd: pytest.CaptureFixture[str],
+    request: pytest.FixtureRequest,
+    monkeypatch: pytest.MonkeyPatch,
 ) -> None:
    if utils.get_platform() != "linux":
        pytest.skip("the test is only relevant to the linux build")
@@ -20,6 +23,9 @@ def test_podman(
    if not request.config.getoption("--run-podman"):
        pytest.skip("needs --run-podman option to run")

+    # we can't use images cached in the docker_warmup_fixture autouse fixture
+    monkeypatch.delenv("CIBW_INTERNAL_PINNED_DOCKER_IMAGES", raising=False)
+
    project_dir = tmp_path / "project"
    basic_project.generate(project_dir)

@@ -100,63 +100,3 @@ def test_overridden_path(tmp_path: Path, capfd: pytest.CaptureFixture[str]) -> N
    assert "python available on PATH doesn't match our installed instance" in captured.err.replace(
        "venv", "installed"
    )
-
-
-@pytest.mark.parametrize(
-    "build_frontend",
-    [
-        pytest.param("pip", marks=utils.skip_if_pyodide("No pip for pyodide")),
-        pytest.param(
-            "build",
-            marks=utils.skip_if_pyodide(
-                "pyodide doesn't support multiple values for PIP_CONSTRAINT"
-            ),
-        ),
-    ],
-)
-def test_overridden_pip_constraint(tmp_path: Path, build_frontend: str) -> None:
-    """
-    Verify that users can use PIP_CONSTRAINT to specify a specific version of
-    a build-system.requires dependency, by asserting the version of pytz in the
-    setup.py.
-    """
-    project_dir = tmp_path / "project"
-
-    project = test_projects.new_c_project(
-        setup_py_add=textwrap.dedent(
-            """
-            import pytz
-            assert pytz.__version__ == "2022.4", f"{pytz.__version__!r} != '2022.4'"
-        """
-        )
-    )
-    project.files["pyproject.toml"] = textwrap.dedent(
-        """
-        [build-system]
-        requires = ["setuptools", "pytz"]
-        build-backend = "setuptools.build_meta"
-    """
-    )
-    project.generate(project_dir)
-
-    if utils.get_platform() == "linux":
-        # put the constraints file in the project directory, so it's available
-        # in the docker container
-        constraints_file = project_dir / "constraints.txt"
-    else:
-        constraints_file = tmp_path / "constraints.txt"
-
-    constraints_file.write_text("pytz==2022.4")
-
-    actual_wheels = utils.cibuildwheel_run(
-        project_dir,
-        add_env={
-            "CIBW_BUILD_FRONTEND": build_frontend,
-            "PIP_CONSTRAINT": str(constraints_file),
-            "CIBW_ENVIRONMENT_LINUX": "PIP_CONSTRAINT=./constraints.txt",
-        },
-        single_python=True,
-    )
-
-    expected_wheels = utils.expected_wheels("spam", "0.1.0", single_python=True)
-    assert set(actual_wheels) == set(expected_wheels)
@@ -71,7 +71,9 @@ def test_pyodide_build(tmp_path: Path, use_pyproject_toml: bool) -> None:
    basic_project.generate(project_dir)

    # check for node in 1 case only to reduce CI load
-    add_env = {"CIBW_ENABLE": "pyodide-prerelease"}
+    # cp315 is a Pyodide prerelease embedding a prerelease CPython, so it is
+    # gated by `cpython-prerelease`.
+    add_env = {"CIBW_ENABLE": "cpython-prerelease"}
    if use_pyproject_toml:
        add_env["CIBW_TEST_COMMAND"] = f"python {{project}}/check_node.py {CIBW_CACHE_PATH}"

@@ -86,6 +88,7 @@ def test_pyodide_build(tmp_path: Path, use_pyproject_toml: bool) -> None:
    expected_wheels = [
        "spam-0.1.0-cp313-cp313-pyemscripten_2025_0_wasm32.whl",
        "spam-0.1.0-cp314-cp314-pyemscripten_2026_0_wasm32.whl",
+        "spam-0.1.0-cp315-cp315-pyemscripten_2026_5_wasm32.whl",
    ]

    print("actual_wheels", actual_wheels)
@@ -144,13 +147,14 @@ def test_pyodide_build_and_test(tmp_path: Path, expect_failure: bool) -> None:
            add_env={
                "CIBW_TEST_REQUIRES": "pytest",
                "CIBW_TEST_COMMAND": "python -m pytest {project}",
-                "CIBW_ENABLE": "pyodide-prerelease",
+                "CIBW_ENABLE": "cpython-prerelease",
            },
        )
        # check that the expected wheels are produced
        expected_wheels = [
            "spam-0.1.0-cp313-cp313-pyemscripten_2025_0_wasm32.whl",
            "spam-0.1.0-cp314-cp314-pyemscripten_2026_0_wasm32.whl",
+            "spam-0.1.0-cp315-cp315-pyemscripten_2026_5_wasm32.whl",
        ]
        assert set(actual_wheels) == set(expected_wheels)

@@ -278,18 +278,18 @@ def _expected_wheels(

    # To be kept in sync with Python versions for Pyodide identifiers in cibuildwheel/selector.py.
    if platform == "pyodide" and python_abi_tags is None:
-        python_abi_tags = ["cp313-cp313", "cp314-cp314"]
+        python_abi_tags = ["cp313-cp313", "cp314-cp314", "cp315-cp315"]
        if EnableGroup.PyodideEoL in enable_groups:
            python_abi_tags.insert(0, "cp312-cp312")
-    elif (platform == "android" and python_abi_tags is None) or (
-        platform == "ios" and python_abi_tags is None
-    ):
+    elif platform in {"android", "ios"} and python_abi_tags is None:
        python_abi_tags = [
            "cp313-cp313",
            "cp314-cp314",
+            "cp315-cp315",
        ]
        if EnableGroup.CPythonPrerelease in enable_groups:
-            python_abi_tags += ["cp315-cp315"]
+            # python_abi_tags += ["cp316-cp316"]
+            ...  # Add cp316 here when available
    elif python_abi_tags is None:
        python_abi_tags = [
            "cp39-cp39",
@@ -299,13 +299,16 @@ def _expected_wheels(
            "cp313-cp313",
            "cp314-cp314",
            "cp314-cp314t",
+            "cp315-cp315",
+            "cp315-cp315t",
        ]

        if EnableGroup.CPythonPrerelease in enable_groups:
-            python_abi_tags += [
-                "cp315-cp315",
-                "cp315-cp315t",
-            ]
+            # python_abi_tags += [
+            #     "cp316-cp316",
+            #     "cp316-cp316t",
+            # ]
+            ...  # Add cp316 here when available

        if EnableGroup.PyPyEoL in enable_groups:
            python_abi_tags += [
@@ -410,6 +413,7 @@ def _expected_wheels(
                "cp312-cp312": ["pyodide_2024_0_wasm32"],
                "cp313-cp313": ["pyemscripten_2025_0_wasm32"],
                "cp314-cp314": ["pyemscripten_2026_0_wasm32"],
+                "cp315-cp315": ["pyemscripten_2026_5_wasm32"],
            }.get(python_abi_tag, [])

            if not platform_tags:
@@ -1,10 +1,14 @@
 import tomllib
+from pathlib import Path

+import pytest
 from packaging.version import Version

 from cibuildwheel.extra import Printable, dump_python_configurations
 from cibuildwheel.util import resources

+OPTIONS_MD = Path(__file__).parents[1] / "docs" / "options.md"
+

 def test_compare_configs() -> None:
    txt = resources.BUILD_PLATFORMS.read_text()
@@ -18,6 +22,20 @@ def test_compare_configs() -> None:
    assert new_txt == txt


+@pytest.mark.skipif(not OPTIONS_MD.is_file(), reason="docs/options.md not present")
+def test_all_identifiers_in_docs_table() -> None:
+    # The build-id table in docs/options.md is hand-maintained; this guards
+    # against forgetting an identifier when build-platforms.toml changes.
+    docs = OPTIONS_MD.read_text()
+    identifiers = [
+        config["identifier"]
+        for configs in resources.read_all_configs().values()
+        for config in configs
+    ]
+    missing = [i for i in identifiers if i not in docs]
+    assert not missing, f"Missing from docs/options.md build-id table: {missing}"
+
+
 def test_dump_with_Version() -> None:
    # MyPy doesn't understand deeply nested dicts correctly
    example: dict[str, dict[str, list[dict[str, Printable]]]] = {
@@ -16,6 +16,7 @@ def test_build() -> None:
    assert build_selector("cp312-manylinux_x86_64")
    assert build_selector("cp313-manylinux_x86_64")
    assert build_selector("cp314-manylinux_x86_64")
+    assert build_selector("cp315-manylinux_x86_64")
    assert build_selector("pp311-manylinux_x86_64")
    assert build_selector("cp36-manylinux_i686")
    assert build_selector("cp37-manylinux_i686")
@@ -37,6 +38,7 @@ def test_build() -> None:
    assert build_selector("cp312-win_amd64")
    assert build_selector("cp313-win_amd64")
    assert build_selector("cp314-win_amd64")
+    assert build_selector("cp315-win_amd64")
    assert not build_selector("pp310-win_amd64")
    assert not build_selector("pp311-win_amd64")

@@ -91,17 +93,6 @@ def test_build_filter_pypy_all() -> None:
    assert build_selector("pp39-manylinux_x86_64")


-# Re-enable when we have Pyodide 3.15 prerelease builds to test against
-# def test_build_filter_pyodide_prerelease() -> None:
-#     build_selector = BuildSelector(
-#         build_config="*",
-#         skip_config="",
-#         enable=frozenset([EnableGroup.PyodidePrerelease]),
-#     )
-#     assert build_selector("cp314-pyodide_wasm32")
-#     assert build_selector("cp315-pyodide_wasm32")
-
-
 def test_build_filter_pyodide() -> None:
    build_selector = BuildSelector(
        build_config="*",
@@ -111,6 +102,7 @@ def test_build_filter_pyodide() -> None:
    assert build_selector("cp313-pyodide_wasm32")
    assert build_selector("cp314-pyodide_wasm32")
    assert not build_selector("cp312-pyodide_wasm32")
+    assert build_selector("cp315-pyodide_wasm32")


 def test_build_filter_pyodide_eol() -> None:
@@ -122,6 +114,7 @@ def test_build_filter_pyodide_eol() -> None:
    assert build_selector("cp312-pyodide_wasm32")
    assert build_selector("cp313-pyodide_wasm32")
    assert build_selector("cp314-pyodide_wasm32")
+    assert build_selector("cp315-pyodide_wasm32")


 def test_skip() -> None:
@@ -1,6 +1,10 @@
 from __future__ import annotations

+import io
 import ssl
+import time
+import urllib.error
+import urllib.request

 import certifi
 import pytest
@@ -9,9 +13,12 @@ from cibuildwheel.util.file import download

 TYPE_CHECKING = False
 if TYPE_CHECKING:
+    from collections.abc import Callable, Iterator
    from pathlib import Path
+    from typing import Self

 DOWNLOAD_URL = "https://cdn.jsdelivr.net/gh/pypa/cibuildwheel@v1.6.3/requirements-dev.txt"
+PAYLOAD = b"payload"


 def test_download(monkeypatch: pytest.MonkeyPatch, tmp_path: Path) -> None:
@@ -35,3 +42,131 @@ def test_download_bad_ssl_cert_file(monkeypatch: pytest.MonkeyPatch, tmp_path: P
    dest = tmp_path / "file.txt"
    with pytest.raises(ssl.SSLError):
        download(DOWNLOAD_URL, dest)
+
+
+def _no_sleep(seconds: float) -> None:
+    pass
+
+
+@pytest.fixture
+def http_error() -> Iterator[Callable[[str, int], urllib.error.HTTPError]]:
+    """Build HTTPErrors, and close them, as each one holds a temporary file."""
+    errors = []
+
+    def make(url: str, code: int) -> urllib.error.HTTPError:
+        error = urllib.error.HTTPError(url, code, "error", {}, io.BytesIO(b""))  # type: ignore[arg-type]
+        errors.append(error)
+        return error
+
+    yield make
+
+    for error in errors:
+        error.close()
+
+
+class FakeResponse:
+    def __enter__(self) -> Self:
+        return self
+
+    def __exit__(self, *args: object) -> None:
+        return None
+
+    def read(self) -> bytes:
+        return PAYLOAD
+
+
+@pytest.fixture
+def fake_network(
+    monkeypatch: pytest.MonkeyPatch,
+) -> Callable[[int], tuple[list[str], list[float]]]:
+    """Fail the first ``failures`` downloads, recording attempts and sleeps."""
+
+    def setup(failures: int) -> tuple[list[str], list[float]]:
+        attempts: list[str] = []
+        sleeps: list[float] = []
+
+        def fake_urlopen(url: str, context: object = None) -> FakeResponse:  # noqa: ARG001
+            attempts.append(url)
+            if len(attempts) <= failures:
+                msg = "temporary DNS failure"
+                raise OSError(msg)
+            return FakeResponse()
+
+        monkeypatch.setattr(urllib.request, "urlopen", fake_urlopen)
+        monkeypatch.setattr(time, "sleep", sleeps.append)
+        return attempts, sleeps
+
+    return setup
+
+
+def test_download_retries_transient_failures(
+    fake_network: Callable[[int], tuple[list[str], list[float]]], tmp_path: Path
+) -> None:
+    attempts, sleeps = fake_network(3)
+    dest = tmp_path / "file.txt"
+
+    download(DOWNLOAD_URL, dest)
+
+    assert dest.read_bytes() == PAYLOAD
+    assert len(attempts) == 4
+    # the wait must grow, so that a long outage is survivable
+    assert sleeps == sorted(sleeps)
+    assert sleeps[-1] > sleeps[0]
+
+
+def test_download_backoff_covers_a_minute_outage(
+    fake_network: Callable[[int], tuple[list[str], list[float]]], tmp_path: Path
+) -> None:
+    _, sleeps = fake_network(99)
+    dest = tmp_path / "file.txt"
+
+    with pytest.raises(OSError, match="temporary DNS failure"):
+        download(DOWNLOAD_URL, dest)
+
+    assert sum(sleeps) >= 60
+
+
+@pytest.mark.parametrize("code", [400, 404, 410])
+def test_download_does_not_retry_client_errors(
+    monkeypatch: pytest.MonkeyPatch,
+    tmp_path: Path,
+    code: int,
+    http_error: Callable[[str, int], urllib.error.HTTPError],
+) -> None:
+    """A bad URL is not going to fix itself, so report it at once."""
+    attempts: list[str] = []
+
+    def fake_urlopen(url: str, context: object = None) -> FakeResponse:  # noqa: ARG001
+        attempts.append(url)
+        raise http_error(url, code)
+
+    monkeypatch.setattr(urllib.request, "urlopen", fake_urlopen)
+    monkeypatch.setattr(time, "sleep", _no_sleep)
+
+    with pytest.raises(urllib.error.HTTPError):
+        download(DOWNLOAD_URL, tmp_path / "file.txt")
+
+    assert len(attempts) == 1
+
+
+@pytest.mark.parametrize("code", [500, 503])
+def test_download_retries_server_errors(
+    monkeypatch: pytest.MonkeyPatch,
+    tmp_path: Path,
+    code: int,
+    http_error: Callable[[str, int], urllib.error.HTTPError],
+) -> None:
+    attempts: list[str] = []
+
+    def fake_urlopen(url: str, context: object = None) -> FakeResponse:  # noqa: ARG001
+        attempts.append(url)
+        if len(attempts) == 1:
+            raise http_error(url, code)
+        return FakeResponse()
+
+    monkeypatch.setattr(urllib.request, "urlopen", fake_urlopen)
+    monkeypatch.setattr(time, "sleep", _no_sleep)
+
+    download(DOWNLOAD_URL, tmp_path / "file.txt")
+
+    assert len(attempts) == 2
@@ -97,9 +97,11 @@ def test_linux_container_split(tmp_path: Path, monkeypatch: pytest.MonkeyPatch)
        "cp313-manylinux_x86_64",
        "cp314-manylinux_x86_64",
        "cp314t-manylinux_x86_64",
+        "cp315-manylinux_x86_64",
+        "cp315t-manylinux_x86_64",
    ]
-    assert before_alls(build_steps[3]) == [""] * 4
-    assert container_engines(build_steps[3]) == [default_container_engine] * 4
+    assert before_alls(build_steps[3]) == [""] * 6
+    assert container_engines(build_steps[3]) == [default_container_engine] * 6


 def test_package_dir_outside_working_directory_raises_configuration_error(
@@ -173,19 +173,19 @@ def test_empty_selector(monkeypatch: pytest.MonkeyPatch) -> None:
@pytest.mark.parametrize(
    ("architecture", "image", "full_image"),
    [
-        ("x86_64", None, "quay.io/pypa/manylinux_2_28_x86_64:*"),
-        ("x86_64", "manylinux2014", "quay.io/pypa/manylinux2014_x86_64:*"),
-        ("x86_64", "manylinux_2_28", "quay.io/pypa/manylinux_2_28_x86_64:*"),
-        ("x86_64", "manylinux_2_34", "quay.io/pypa/manylinux_2_34_x86_64:*"),
+        ("x86_64", None, "quay.io/pypa/manylinux_2_28_x86_64@*"),
+        ("x86_64", "manylinux2014", "quay.io/pypa/manylinux2014_x86_64@*"),
+        ("x86_64", "manylinux_2_28", "quay.io/pypa/manylinux_2_28_x86_64@*"),
+        ("x86_64", "manylinux_2_34", "quay.io/pypa/manylinux_2_34_x86_64@*"),
        ("x86_64", "custom_image", "custom_image"),
-        ("i686", None, "quay.io/pypa/manylinux_2_28_i686:*"),
-        ("i686", "manylinux2014", "quay.io/pypa/manylinux2014_i686:*"),
-        ("i686", "manylinux_2_28", "quay.io/pypa/manylinux_2_28_i686:*"),
+        ("i686", None, "quay.io/pypa/manylinux_2_28_i686@*"),
+        ("i686", "manylinux2014", "quay.io/pypa/manylinux2014_i686@*"),
+        ("i686", "manylinux_2_28", "quay.io/pypa/manylinux_2_28_i686@*"),
        ("i686", "custom_image", "custom_image"),
-        ("pypy_x86_64", None, "quay.io/pypa/manylinux_2_28_x86_64:*"),
-        ("pypy_x86_64", "manylinux2014", "quay.io/pypa/manylinux2014_x86_64:*"),
-        ("pypy_x86_64", "manylinux_2_28", "quay.io/pypa/manylinux_2_28_x86_64:*"),
-        ("pypy_x86_64", "manylinux_2_34", "quay.io/pypa/manylinux_2_34_x86_64:*"),
+        ("pypy_x86_64", None, "quay.io/pypa/manylinux_2_28_x86_64@*"),
+        ("pypy_x86_64", "manylinux2014", "quay.io/pypa/manylinux2014_x86_64@*"),
+        ("pypy_x86_64", "manylinux_2_28", "quay.io/pypa/manylinux_2_28_x86_64@*"),
+        ("pypy_x86_64", "manylinux_2_34", "quay.io/pypa/manylinux_2_34_x86_64@*"),
        ("pypy_x86_64", "custom_image", "custom_image"),
    ],
 )
@@ -29,6 +29,7 @@ from cibuildwheel.oci_container import (
 TYPE_CHECKING = False
 if TYPE_CHECKING:
    from collections.abc import Iterator
+    from typing import Any

 # Test utilities

@@ -84,6 +85,18 @@ def test_no_lf(container_engine: OCIContainerEngineConfig) -> None:
        assert container.call(["printf", "hello"], capture_output=True) == "hello"


+def test_abnormal_exit(container_engine: OCIContainerEngineConfig) -> None:
+    container = OCIContainer(
+        engine=container_engine, image=DEFAULT_IMAGE, oci_platform=DEFAULT_OCI_PLATFORM
+    )
+    with container:
+        # kill the shell without a newline, so the write below still goes
+        # through the same buffer and the call fails on read, not on write
+        container.bash_stdin.write(b"exit")
+        with pytest.raises(RuntimeError):
+            container.call(["echo", "hello"])
+
+
 def test_debug_info(container_engine: OCIContainerEngineConfig) -> None:
    container = OCIContainer(
        engine=container_engine, image=DEFAULT_IMAGE, oci_platform=DEFAULT_OCI_PLATFORM
@@ -139,6 +152,7 @@ def test_container_removed(container_engine: OCIContainerEngineConfig) -> None:
    ) as container:
        assert container.name is not None
        container_name = container.name
+        docker_containers_listing = ""
        for _ in range(timeout):
            docker_containers_listing = subprocess.run(
                f"{container.engine.name} container ls",
@@ -330,7 +344,7 @@ def test_podman_vfs(
    # This requires that we write configuration files and point to them
    # with environment variables before we run podman
    # https://github.com/containers/common/blob/main/docs/containers.conf.5.md
-    vfs_containers_conf_data = {
+    vfs_containers_conf_data: dict[str, dict[str, Any]] = {
        "containers": {
            "default_capabilities": [
                "CHOWN",
@@ -348,6 +362,20 @@ def test_podman_vfs(
        },
        "engine": {"cgroup_manager": "cgroupfs", "events_logger": "file"},
    }
+
+    # Setting CONTAINERS_CONF makes podman ignore its usual config files, so
+    # carry over the default OCI runtime; the fallback found on PATH can be
+    # too old for the OCI spec version podman generates (e.g. Ubuntu 24.04's
+    # crun 1.14.1 with podman 5.x).
+    oci_runtime = subprocess.run(
+        ["podman", "info", "--format", "{{.Host.OCIRuntime.Path}}"],
+        check=True,
+        capture_output=True,
+        text=True,
+    ).stdout.strip()
+    runtime_name = Path(oci_runtime).name
+    vfs_containers_conf_data["engine"]["runtime"] = runtime_name
+    vfs_containers_conf_data["engine"]["runtimes"] = {runtime_name: [oci_runtime]}
    # https://github.com/containers/storage/blob/main/docs/containers-storage.conf.5.md
    storage_root = vfs_path / ".local/share/containers/vfs-storage"
    run_root = vfs_path / ".local/share/containers/vfs-runroot"
@@ -13,7 +13,7 @@ from cibuildwheel.__main__ import main
 from cibuildwheel.oci_container import OCIPlatform
 from cibuildwheel.util import file

-DEFAULT_IDS = {"cp39", "cp310", "cp311", "cp312", "cp313", "cp314", "cp314t"}
+DEFAULT_IDS = {"cp39", "cp310", "cp311", "cp312", "cp313", "cp314", "cp314t", "cp315", "cp315t"}
 ALL_IDS = DEFAULT_IDS | {"pp39", "pp310", "pp311", "gp312_250"}


@@ -155,6 +155,8 @@ before-all = "true"
            "cp313",
            "cp314",
            "cp314t",
+            "cp315",
+            "cp315t",
            "pp39",
            "pp310",
            "pp311",
@@ -176,6 +178,8 @@ before-all = "true"
            "cp313",
            "cp314",
            "cp314t",
+            "cp315",
+            "cp315t",
            "pp39",
            "pp310",
            "pp311",
@@ -39,6 +39,8 @@ TYPE_CHECKING = False
 if TYPE_CHECKING:
    from collections.abc import Callable, Sequence

+    from cibuildwheel.typing import PlatformName
+
 PYPROJECT_1 = """
 [tool.cibuildwheel]
 build = ["cp38-*", "cp313-*"]
@@ -480,6 +482,93 @@ def test_build_frontend_option(
        assert parsed_build_frontend.args == ()


+def test_pyodide_build_frontend_default(tmp_path: Path) -> None:
+    args = CommandLineArguments.defaults()
+    args.package_dir = tmp_path
+
+    tmp_path.joinpath("pyproject.toml").write_text("[tool.cibuildwheel]\n")
+
+    options = Options(platform="pyodide", command_line_arguments=args, env={})
+    build_frontend = options.build_options(identifier=None).build_frontend
+
+    assert build_frontend.name == "pyodide-build"
+    assert build_frontend.args == []
+
+
+def test_pyodide_build_frontend_args(tmp_path: Path) -> None:
+    args = CommandLineArguments.defaults()
+    args.package_dir = tmp_path
+
+    tmp_path.joinpath("pyproject.toml").write_text(
+        textwrap.dedent(
+            """\
+            [tool.cibuildwheel.pyodide]
+            build-frontend = {name = "pyodide-build", args = ["--exports=whole_archive"]}
+            """
+        )
+    )
+
+    options = Options(platform="pyodide", command_line_arguments=args, env={})
+    build_frontend = options.build_options(identifier=None).build_frontend
+
+    assert build_frontend.name == "pyodide-build"
+    assert build_frontend.args == ["--exports=whole_archive"]
+
+
+@pytest.mark.parametrize(
+    "build_frontend_str",
+    ["default", "pip", "build", "build[uv]", "uv"],
+)
+def test_pyodide_global_build_frontend_coerced(tmp_path: Path, build_frontend_str: str) -> None:
+    """A global non-pyodide frontend setting is coerced to pyodide-build, not an error."""
+    args = CommandLineArguments.defaults()
+    args.package_dir = tmp_path
+
+    tmp_path.joinpath("pyproject.toml").write_text(
+        textwrap.dedent(
+            f"""\
+            [tool.cibuildwheel]
+            build-frontend = "{build_frontend_str}"
+            """
+        )
+    )
+
+    options = Options(platform="pyodide", command_line_arguments=args, env={})
+    build_frontend = options.build_options(identifier=None).build_frontend
+
+    assert build_frontend.name == "pyodide-build"
+
+
+@pytest.mark.parametrize(
+    ("platform", "build_frontend_str"),
+    [
+        ("linux", "pyodide-build"),
+        ("macos", "pyodide-build"),
+        ("windows", "pyodide-build"),
+        ("android", "pyodide-build"),
+        ("ios", "pyodide-build"),
+    ],
+)
+def test_build_frontend_platform_mismatch(
+    tmp_path: Path, platform: PlatformName, build_frontend_str: str
+) -> None:
+    args = CommandLineArguments.defaults()
+    args.package_dir = tmp_path
+
+    tmp_path.joinpath("pyproject.toml").write_text(
+        textwrap.dedent(
+            f"""\
+            [tool.cibuildwheel]
+            build-frontend = "{build_frontend_str}"
+            """
+        )
+    )
+
+    options = Options(platform=platform, command_line_arguments=args, env={})
+    with pytest.raises(errors.ConfigurationError):
+        options.build_options(identifier=None)
+
+
 def test_override_inherit_environment(tmp_path: Path) -> None:
    args = CommandLineArguments.defaults()
    args.package_dir = tmp_path
@@ -663,10 +752,15 @@ def test_deprecated_image(
        ("build", 3, ["-Ca", "-Cb", "-1", "-vv"]),
        ("build[uv]", 3, ["-Ca", "-Cb", "-1", "-vv"]),
        ("uv", 3, ["-Ca", "-Cb", "-1", "-vv"]),
+        ("pyodide-build", -1, ["-Ca", "-Cb", "-1"]),
+        ("pyodide-build", 0, ["-Ca", "-Cb", "-1"]),
+        ("pyodide-build", 1, ["-Ca", "-Cb", "-1", "-v"]),
+        ("pyodide-build", 2, ["-Ca", "-Cb", "-1", "-vv"]),
+        ("pyodide-build", 3, ["-Ca", "-Cb", "-1", "-vv"]),
    ],
 )
 def test_get_build_frontend_extra_flags(
-    frontend: Literal["pip", "build", "build[uv]"],
+    frontend: Literal["pip", "build", "build[uv]", "uv", "pyodide-build"],
    verbosity: int,
    result: list[str],
    monkeypatch: pytest.MonkeyPatch,
@@ -758,6 +852,31 @@ def test_test_runtime_handling(
    assert local.test_runtime.args == expected_args


+@pytest.mark.parametrize(
+    ("platform", "platform_envvar"),
+    [
+        ("android", "CIBW_TEST_RUNTIME_ANDROID"),
+        ("ios", "CIBW_TEST_RUNTIME_IOS"),
+    ],
+)
+def test_test_runtime_platform_environment(
+    tmp_path: Path, platform: PlatformName, platform_envvar: str
+) -> None:
+    args = CommandLineArguments.defaults()
+    args.package_dir = tmp_path
+
+    options = Options(
+        platform=platform,
+        command_line_arguments=args,
+        env={
+            "CIBW_TEST_RUNTIME": "args: --global",
+            platform_envvar: "args: --platform-specific",
+        },
+    )
+
+    assert options.build_options(None).test_runtime.args == ["--platform-specific"]
+
+
@pytest.mark.parametrize(
    ("definition", "expected"),
    [
@@ -143,6 +143,65 @@ def test_overrides_invalid_inherit_value(validator: validate_pyproject.api.Valid
        validator(example)


+def test_pyodide_build_frontend(validator: validate_pyproject.api.Validator) -> None:
+    """
+    pyodide-build is accepted anywhere the frontend can be set, as an override
+    or a global value can apply to pyodide builds only.
+    """
+    example = tomllib.loads(
+        """
+        [tool.cibuildwheel]
+        build-frontend = "pyodide-build"
+
+        [tool.cibuildwheel.pyodide]
+        build-frontend = { name = "pyodide-build", args = ["--some-arg"] }
+
+        [[tool.cibuildwheel.overrides]]
+        select = "*pyodide*"
+        build-frontend = "pyodide-build; args: --some-arg"
+        """
+    )
+
+    assert validator(example) is not None
+
+
+@pytest.mark.parametrize("frontend", ['"uv"', '"build; args: --some-arg"', '{ name = "pip" }'])
+def test_pyodide_bad_build_frontend(
+    validator: validate_pyproject.api.Validator, frontend: str
+) -> None:
+    """
+    The pyodide table only accepts the pyodide-build frontend.
+    """
+    example = tomllib.loads(
+        f"""
+        [tool.cibuildwheel.pyodide]
+        build-frontend = {frontend}
+        """
+    )
+
+    with pytest.raises(validate_pyproject.error_reporting.ValidationError):
+        validator(example)
+
+
+@pytest.mark.parametrize("platform", ["linux", "macos", "windows", "ios", "android"])
+@pytest.mark.parametrize("frontend", ["pyodide-build", "pyodide-build; args: --some-arg"])
+def test_bad_pyodide_build_frontend(
+    validator: validate_pyproject.api.Validator, platform: str, frontend: str
+) -> None:
+    """
+    Only the pyodide table accepts the pyodide-build frontend.
+    """
+    example = tomllib.loads(
+        f"""
+        [tool.cibuildwheel.{platform}]
+        build-frontend = "{frontend}"
+        """
+    )
+
+    with pytest.raises(validate_pyproject.error_reporting.ValidationError):
+        validator(example)
+
+
 def test_docs_examples(validator: validate_pyproject.api.Validator) -> None:
    """
    Parse out all the configuration examples, build valid TOML out of them, and
@@ -0,0 +1,60 @@
+import os
+import sys
+from pathlib import Path
+
+import pytest
+
+import cibuildwheel.venv
+from cibuildwheel.venv import activate_virtualenv, find_uv, virtualenv
+
+
+def test_activate_virtualenv(tmp_path: Path) -> None:
+    venv_path = tmp_path / "venv"
+    env = activate_virtualenv(venv_path, env={"PATH": "/usr/bin"})
+    paths = env["PATH"].split(os.pathsep)
+    if sys.platform == "win32":
+        assert paths[:2] == [str(venv_path), str(venv_path / "Scripts")]
+    else:
+        assert paths[0] == str(venv_path / "bin")
+    assert paths[-1] == "/usr/bin"
+    assert env["VIRTUAL_ENV"] == str(venv_path)
+
+
+def test_activate_virtualenv_base_python_bin_dir(tmp_path: Path) -> None:
+    venv_path = tmp_path / "venv"
+    base_bin = tmp_path / "base" / "bin"
+    env = activate_virtualenv(venv_path, env={"PATH": "/usr/bin"}, base_python_bin_dir=base_bin)
+    paths = env["PATH"].split(os.pathsep)
+    # the base interpreter's bin dir comes right after the venv, so scripts
+    # like python3-config resolve to the matching interpreter (see #2021)
+    if sys.platform == "win32":
+        assert paths[:3] == [str(venv_path), str(venv_path / "Scripts"), str(base_bin)]
+    else:
+        assert paths[:2] == [str(venv_path / "bin"), str(base_bin)]
+    assert paths[-1] == "/usr/bin"
+
+
+@pytest.mark.skipif(sys.platform == "win32", reason="POSIX-only behavior")
+@pytest.mark.skipif(find_uv() is None, reason="requires uv")
+def test_virtualenv_puts_base_python_bin_dir_on_path(tmp_path: Path) -> None:
+    version = "{}.{}".format(*sys.version_info[:2])
+    venv_path = tmp_path / "venv"
+    env = virtualenv(
+        version, Path(sys.executable), venv_path, None, use_uv=True, env={"PATH": "/usr/bin"}
+    )
+    paths = env["PATH"].split(os.pathsep)
+    assert paths == [str(venv_path / "bin"), str(Path(sys.executable).parent), "/usr/bin"]
+
+
+@pytest.mark.skipif(find_uv() is None, reason="requires uv")
+def test_virtualenv_no_base_python_bin_dir_on_windows(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    monkeypatch.setattr(cibuildwheel.venv, "_IS_WIN", True)
+    version = "{}.{}".format(*sys.version_info[:2])
+    venv_path = tmp_path / "venv"
+    env = virtualenv(
+        version, Path(sys.executable), venv_path, None, use_uv=True, env={"PATH": "/usr/bin"}
+    )
+    paths = env["PATH"].split(os.pathsep)
+    assert str(Path(sys.executable).parent) not in paths