patch: 离线环境替换 setup-python 为本地 toolcache Python

* [2.x] Update virtualenv URLs to avoid blob URLs

It looks like many people are hitting the HTTP 429 for old versions of cibuildwheel. These hosted versions of virtualenv should work, let's see...

* Write the correct version strings

* ci: some updates based on main branch

Signed-off-by: Henry Schreiner <henryschreineriii@gmail.com>

* ci: move to using latest images

Signed-off-by: Henry Schreiner <henryschreineriii@gmail.com>

* chore: fix up style checks

Signed-off-by: Henry Schreiner <henryschreineriii@gmail.com>

* ci: newer azure images too

Signed-off-by: Henry Schreiner <henryschreineriii@gmail.com>

* tests: use new SSL test from main

Signed-off-by: Henry Schreiner <henryschreineriii@gmail.com>

* Drop `build`'s installation from Pyodide build tools

---------

Signed-off-by: Henry Schreiner <henryschreineriii@gmail.com>
Co-authored-by: Henry Schreiner <henryschreineriii@gmail.com>
Co-authored-by: Agriya Khetarpal <74401230+agriyakhetarpal@users.noreply.github.com>

.github/workflows/release.yml

@@ -7,11 +7,15 @@ on:
     types:
     - published
 
+permissions: {}
+
 jobs:
   dist:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
+      with:
+        persist-credentials: false
 
     - uses: hynek/build-and-inspect-python-package@v2
 
@@ -27,13 +31,13 @@ jobs:
       attestations: write
 
     steps:
-    - uses: actions/download-artifact@v4
+    - uses: actions/download-artifact@v8
       with:
         name: Packages
         path: dist
 
     - name: Generate artifact attestation for sdist and wheel
-      uses: actions/attest-build-provenance@ef244123eb79f2f7a7e75d99086184180e6d0018 # v1.4.4
+      uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0
       with:
         subject-path: "dist/cibuildwheel-*"
 

.github/workflows/test.yml

@@ -12,6 +12,8 @@ on:
   workflow_dispatch:
     # allow manual runs on branches without a PR
 
+permissions: {}
+
 concurrency:
   group: test-${{ github.ref }}
   cancel-in-progress: true
@@ -21,14 +23,14 @@ jobs:
     name: Linters (mypy, flake8, etc.)
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
-    - uses: actions/setup-python@v5
+    - uses: actions/checkout@v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-python@v6
       id: python
       with:
         python-version: "3.x"
-    - uses: pre-commit/action@v3.0.1
-    - name: Check manifest
-      run: pipx run --python "${{ steps.python.outputs.python-path }}" nox -s check_manifest
+    - uses: j178/prek-action@v1
     - name: PyLint checks
       run: pipx run --python "${{ steps.python.outputs.python-path }}" nox -s pylint -- --output-format=github
 
@@ -38,21 +40,23 @@ jobs:
     runs-on: ${{ matrix.os }}
     strategy:
       matrix:
-        os: [ubuntu-latest, ubuntu-24.04-arm, windows-latest, macos-13, macos-14]
+        os: [ubuntu-latest, ubuntu-24.04-arm, windows-latest, macos-15-intel, macos-latest]
         python_version: ['3.13']
         include:
         - os: ubuntu-latest
           python_version: '3.8'
     timeout-minutes: 180
     steps:
-    - uses: actions/checkout@v4
-    - uses: actions/setup-python@v5
+    - uses: actions/checkout@v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-python@v6
       name: Install Python ${{ matrix.python_version }}
       with:
         python-version: ${{ matrix.python_version }}
         allow-prereleases: true
 
-    - uses: astral-sh/setup-uv@v3
+    - uses: astral-sh/setup-uv@v7
 
     # free some space to prevent reaching GHA disk space limits
     - name: Clean docker images
@@ -64,7 +68,7 @@ jobs:
     # for oci_container unit tests
     - name: Set up QEMU
       if: runner.os == 'Linux'
-      uses: docker/setup-qemu-action@v3
+      uses: docker/setup-qemu-action@v4
 
     - name: Install dependencies
       run: |
@@ -118,7 +122,7 @@ jobs:
         test $(find wheelhouse_only -name '*.whl' | wc -l) -eq 1
         test $(find wheelhouse_config_file -name '*.whl' | wc -l) -eq 1
 
-    - uses: actions/upload-artifact@v4
+    - uses: actions/upload-artifact@v7
       with:
         name: cibw-wheels-${{ matrix.os }}-${{ strategy.job-index }}
         path: wheelhouse/*.whl
@@ -134,17 +138,19 @@ jobs:
     outputs:
       archs: ${{ steps.archs.outputs.archs }}
     steps:
-    - uses: actions/checkout@v4
-    - uses: actions/setup-python@v5
+    - uses: actions/checkout@v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-python@v6
       with:
         python-version: "3.x"
-    - uses: astral-sh/setup-uv@v3
+    - uses: astral-sh/setup-uv@v7
     - name: Install dependencies
       run: uv sync --no-dev --group test
     - name: Get qemu emulated architectures
       id: archs
       run: |
-        OUTPUT=$(uv run python -c "from json import dumps; from test.utils import EMULATED_ARCHS; print(dumps(EMULATED_ARCHS))")
+        OUTPUT=$(uv run --no-sync python -c "from json import dumps; from test.utils import EMULATED_ARCHS; print(dumps(EMULATED_ARCHS))")
         echo "${OUTPUT}"
         echo "archs=${OUTPUT}" >> "$GITHUB_OUTPUT"
 
@@ -157,32 +163,36 @@ jobs:
       matrix:
         arch: ${{ fromJSON(needs.emulated-archs.outputs.archs) }}
     steps:
-    - uses: actions/checkout@v4
-    - uses: actions/setup-python@v5
+    - uses: actions/checkout@v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-python@v6
       with:
         python-version: "3.x"
-    - uses: astral-sh/setup-uv@v3
+    - uses: astral-sh/setup-uv@v7
     - name: Install dependencies
       run: uv sync --no-dev --group test
 
     - name: Set up QEMU
-      uses: docker/setup-qemu-action@v3
+      uses: docker/setup-qemu-action@v4
 
     - name: Run the emulation tests
-      run: uv run pytest --run-emulation ${{ matrix.arch }} test/test_emulation.py
+      run: uv run --no-sync pytest --run-emulation ${{ matrix.arch }} test/test_emulation.py
 
   test-pyodide:
     name: Test cibuildwheel building Pyodide wheels
     needs: lint
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-latest
     timeout-minutes: 180
     steps:
-    - uses: actions/checkout@v4
-    - uses: actions/setup-python@v5
+    - uses: actions/checkout@v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-python@v6
       name: Install Python 3.12
       with:
         python-version: '3.12'
-    - uses: astral-sh/setup-uv@v3
+    - uses: astral-sh/setup-uv@v7
 
     - name: Install dependencies
       run: uv sync --no-dev --group test
@@ -200,7 +210,6 @@ jobs:
         CIBW_PLATFORM: pyodide
 
     - name: Run tests with 'CIBW_PLATFORM' set to 'pyodide'
-      run: |
-        uv run ./bin/run_tests.py
+      run: uv run --no-sync ./bin/run_tests.py
       env:
         CIBW_PLATFORM: pyodide

.github/workflows/update-dependencies.yml

@@ -1,57 +0,0 @@
-name: Update dependencies
-
-on:
-  pull_request:
-    paths:
-      - '.github/workflows/update-dependencies.yml'
-      - 'bin/update_pythons.py'
-      - 'bin/update_docker.py'
-      - 'bin/update_virtualenv.py'
-      - 'bin/projects.py'
-      - 'docs/data/projects.yml'
-      - 'noxfile.py'
-  workflow_dispatch:
-  schedule:
-    - cron: '0 6 * * 1'  # "At 06:00 on Monday."
-
-jobs:
-  update-dependencies:
-    name: Update dependencies
-    if: github.repository_owner == 'pypa' || github.event_name != 'schedule'
-    runs-on: ubuntu-latest
-    steps:
-
-    # we use this step to grab a Github App auth token, so that PRs generated by this workflow
-    # run the GHA tests.
-    - uses: actions/create-github-app-token@v1
-      id: generate-token
-      if: github.ref == 'refs/heads/main' && github.repository == 'pypa/cibuildwheel'
-      with:
-        app_id: ${{ secrets.CIBUILDWHEEL_BOT_APP_ID }}
-        private_key: ${{ secrets.CIBUILDWHEEL_BOT_APP_PRIVATE_KEY }}
-
-    - uses: actions/checkout@v4
-
-    - uses: wntrblm/nox@2024.10.09
-
-    - name: "Run update: dependencies"
-      run: nox --force-color -s update_constraints
-    - name: "Run update: python configs"
-      run: nox --force-color -s update_pins
-    - name: "Run update: docs user projects"
-      run: nox --force-color -s update_proj -- --auth=${{ secrets.GITHUB_TOKEN }}
-
-    - name: Create Pull Request
-      if: github.ref == 'refs/heads/main' && github.repository == 'pypa/cibuildwheel'
-      uses: peter-evans/create-pull-request@v7
-      with:
-        commit-message: Update dependencies
-        title: '[Bot] Update dependencies'
-        body: |
-          Update the versions of our dependencies.
-
-          PR generated by "Update dependencies" [workflow](https://github.com/${{github.repository}}/actions/runs/${{github.run_id}}).
-        branch: update-dependencies-pr
-        sign-commits: true
-        token: ${{ steps.generate-token.outputs.token }}
-        delete-branch: true

.github/workflows/update-major-minor-tag.yml

@@ -21,7 +21,9 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
 
       - name: Update the ${{ env.TAG_NAME }} tag
         id: update-major-minor-tag

.gitlab-ci.yml

@@ -34,7 +34,7 @@ windows:
     - saas-windows-medium-amd64
 
 macos:
-  image: macos-14-xcode-15
+  image: macos-latest-xcode-15
   variables:
     PYTEST_ADDOPTS: -k "unit_test or test_0_basic" --suppress-no-test-exit-code
   script:

.pre-commit-config.yaml

@@ -34,7 +34,7 @@ repos:
       - orjson
       - packaging
       - pygithub
-      - pytest
+      - pytest<9
       - rich
       - tomli
       - tomli_w

.readthedocs.yml

@@ -3,7 +3,7 @@
 version: 2
 
 build:
-  os: ubuntu-22.04
+  os: ubuntu-24.04
   tools:
     python: "3.12"
   commands:

README.md

@@ -89,7 +89,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     strategy:
       matrix:
-        os: [ubuntu-latest, ubuntu-24.04-arm, windows-latest, macos-13, macos-latest]
+        os: [ubuntu-latest, ubuntu-24.04-arm, windows-latest, macos-15-intel, macos-latest]
 
     steps:
       - uses: actions/checkout@v4
@@ -98,7 +98,7 @@ jobs:
       - uses: actions/setup-python@v5
 
       - name: Install cibuildwheel
-        run: python -m pip install cibuildwheel==2.23.3
+        run: python -m pip install cibuildwheel==2.23.4
 
       - name: Build wheels
         run: python -m cibuildwheel --output-dir wheelhouse
@@ -215,6 +215,12 @@ Changelog
 
 <!-- this section was generated by bin/update_readme_changelog.py -- do not edit manually -->
 
+### v2.23.4
+
+_16 March 2026_
+
+- 🐛 Fix HTTP 429 errors while downloading virtualenv from GitHub blob URLs – uses a https://bootstrap.pypa.io/ URL instead. (#2775)
+
 ### v2.23.3
 
 _26 April 2025_
@@ -244,24 +250,6 @@ _1 March 2025_
 - 🛠 Adopts the beta pypa/manylinux image for armv7l builds (#2269 via #2281)
 - 🛠 Dependency updates, including Pyodide 0.27 (#2117 and #2281)
 
-### v2.22.0
-
-_23 November 2024_
-
-- 🌟 Added a new `CIBW_ENABLE`/`enable` feature that replaces `CIBW_FREETHREADED_SUPPORT`/`free-threaded-support` and `CIBW_PRERELEASE_PYTHONS` with a system that supports both. In cibuildwheel 3, this will also include a PyPy setting and the deprecated options will be removed. (#2048)
-- 🌟 [Dependency groups](https://peps.python.org/pep-0735/) are now supported for tests. Use `CIBW_TEST_GROUPS`/`test-groups` to specify groups in `[dependency-groups]` for testing. (#2063)
-- 🌟 Support for the experimental Ubuntu-based ARMv7l manylinux image (#2052)
-- ✨ Show a warning when cibuildwheel is run from Python 3.10 or older; cibuildwheel 3.0 will require Python 3.11 or newer as host (#2050)
-- 🐛 Fix issue with stderr interfering with checking the docker version (#2074)
-- 🛠 Python 3.9 is now used in `CIBW_BEFORE_ALL`/`before-all` on linux, replacing 3.8, which is now EoL (#2043)
-- 🛠 Error messages for producing a pure-Python wheel are slightly more informative (#2044)
-- 🛠 Better error when `uname -m` fails on ARM (#2049)
-- 🛠 Better error when repair fails and docs for abi3audit on Windows (#2058)
-- 🛠 Better error when `manylinux-interpreters ensure` fails (#2066)
-- 🛠 Update Pyodide to 0.26.4, and adapt to the unbundled pyodide-build (now 0.29) (#2090)
-- 🛠 Now cibuildwheel uses dependency-groups for development dependencies (#2064, #2085)
-- 📚 Docs updates and tidy ups (#2061, #2067, #2072)
-
 <!-- END bin/update_readme_changelog.py -->
 
 ---

action.yml

@@ -24,12 +24,19 @@ branding:
 runs:
   using: composite
   steps:
-    # Set up the version of Python that supports pyodide
-    - uses: actions/setup-python@v5
-      id: python
-      with:
-        python-version: "3.12"
-        update-environment: false
+    # PATCHED for self-hosted runner (offline): 原 actions/setup-python@v5 需联网校验
+    # versions manifest，内网不可达；直接使用 toolcache 预置的 Python 3.12
+    - id: python
+      run: |
+        for p in /opt/hostedtoolcache/Python/3.12*/x64/bin/python3.12 /usr/bin/python3.12 /usr/bin/python3; do
+          if [ -x "$p" ]; then
+            echo "python-path=$p" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+        done
+        echo "no usable python found" >&2
+        exit 1
+      shell: bash
 
     - id: cibw
       run: |

azure-pipelines.yml

@@ -7,7 +7,7 @@ pr:
 jobs:
 - job: linux_38
   timeoutInMinutes: 120
-  pool: {vmImage: 'Ubuntu-20.04'}
+  pool: {vmImage: 'ubuntu-latest'}
   steps:
     - task: UsePythonVersion@0
       inputs:
@@ -19,7 +19,7 @@ jobs:
         python ./bin/run_tests.py
 
 - job: macos_38
-  pool: {vmImage: 'macOS-13'}
+  pool: {vmImage: 'macos-latest'}
   steps:
     - task: UsePythonVersion@0
       inputs:
@@ -30,7 +30,7 @@ jobs:
         python ./bin/run_tests.py --num-processes 2
 
 - job: windows_38
-  pool: {vmImage: 'windows-2019'}
+  pool: {vmImage: 'windows-latest'}
   timeoutInMinutes: 180
   steps:
     - task: UsePythonVersion@0

cibuildwheel/__init__.py

@@ -1,3 +1,3 @@
 from __future__ import annotations
 
-__version__ = "2.23.3"
+__version__ = "2.23.4"

cibuildwheel/pyodide.py

@@ -165,7 +165,6 @@ def setup_python(
         "install",
         "--upgrade",
         "auditwheel-emscripten",
-        "build[virtualenv]",
         "pyodide-build",
         *dependency_constraint_flags,
         env=env,

cibuildwheel/resources/virtualenv.toml

@@ -1,2 +1,2 @@
-py36 = { version = "20.21.1", url = "https://github.com/pypa/get-virtualenv/blob/20.21.1/public/virtualenv.pyz?raw=true" }
-default = { version = "20.30.0", url = "https://github.com/pypa/get-virtualenv/blob/20.30.0/public/virtualenv.pyz?raw=true" }
+py36 = { version = "20.17.1", url = "https://bootstrap.pypa.io/virtualenv/3.6/virtualenv.pyz" }
+default = { version = "20.26.6", url = "https://bootstrap.pypa.io/virtualenv/3.7/virtualenv.pyz" }

docs/changelog.md

@@ -4,6 +4,12 @@ title: Changelog
 
 # Changelog
 
+### v2.23.4
+
+_16 March 2026_
+
+- 🐛 Fix HTTP 429 errors while downloading virtualenv from GitHub blob URLs – uses a https://bootstrap.pypa.io/ URL instead. (#2775)
+
 ### v2.23.3
 
 _26 April 2025_
@@ -185,7 +191,7 @@ _12 May 2024_
 _11 March 2024_
 
 - 🌟 Adds the ability to inherit configuration in TOML overrides. This makes certain configurations much simpler. If you're overriding an option like `before-build` or `environment`, and you just want to add an  extra command or environment variable, you can just append (or prepend) to the previous config. See [the docs](https://cibuildwheel.pypa.io/en/stable/options/#inherit) for more information. (#1730)
-- 🌟 Adds official support for native `arm64` macOS GitHub runners. To use them, just specify `macos-14` as an `os` of your job in your workflow file. You can also keep `macos-13` in your build matrix to build `x86_64`. Check out the new [GitHub Actions example config](https://cibuildwheel.pypa.io/en/stable/setup/#github-actions).
+- 🌟 Adds official support for native `arm64` macOS GitHub runners. To use them, just specify `macos-latest` as an `os` of your job in your workflow file. You can also keep `macos-15-intel` in your build matrix to build `x86_64`. Check out the new [GitHub Actions example config](https://cibuildwheel.pypa.io/en/stable/setup/#github-actions).
 - ✨ You no longer need to specify `--platform` to run cibuildwheel locally! Instead it will detect your platform automatically. This was a safety feature, no longer necessary. (#1727)
 - 🛠 Removed setuptools and wheel pinned versions. This only affects old-style projects without a `pyproject.toml`, projects with `pyproject.toml` are already getting fresh versions of their `build-system.requires` installed into an isolated environment. (#1725)
 - 🛠 Improve how the GitHub Action passes arguments (#1757)
@@ -202,7 +208,7 @@ _11 March 2024_
 _30 January 2024_
 
 - 🐛 Fix an incompatibility with the GitHub Action and new GitHub Runner images for Windows that bundle Powershell 7.3+ (#1741)
-- 🛠 Preliminary support for new `macos-14` arm64 runners (#1743)
+- 🛠 Preliminary support for new `macos-latest` arm64 runners (#1743)
 
 ### v2.16.4
 

docs/faq.md

@@ -72,7 +72,7 @@ See [GitHub issue 1333](https://github.com/pypa/cibuildwheel/issues/1333) for mo
 
 It's easiest to build `x86_64` wheels on `x86_64` runners, and `arm64` wheels on `arm64` runners.
 
-On GitHub Actions, `macos-14` runners are `arm64`, and `macos-13` runners are `x86_64`. So all you need to do is ensure both are in your build matrix.
+On GitHub Actions, `macos-latest` runners are `arm64`, and `macos-15-intel` runners are `x86_64`. So all you need to do is ensure both are in your build matrix.
 
 #### Cross-compiling
 
@@ -142,7 +142,7 @@ There are two suggested methods for keeping cibuildwheel up to date that instead
 If you use GitHub Actions for builds, you can use cibuildwheel as an action:
 
 ```yaml
-uses: pypa/cibuildwheel@v2.23.3
+uses: pypa/cibuildwheel@v2.23.4
 ```
 
 This is a composite step that just runs cibuildwheel using pipx. You can set command-line options as `with:` parameters, and use `env:` as normal.
@@ -164,7 +164,7 @@ The second option, and the only one that supports other CI systems, is using a `
 
 ```bash
 # requirements-cibw.txt
-cibuildwheel==2.23.3
+cibuildwheel==2.23.4
 ```
 
 Then your install step would have `python -m pip install -r requirements-cibw.txt` in it. Your `.github/dependabot.yml` file could look like this:
@@ -328,7 +328,7 @@ Solutions to this vary, but the simplest is to use pipx:
 # most runners have pipx preinstalled, but in case you don't
 python3 -m pip install pipx
 
-pipx run cibuildwheel==2.23.3 --output-dir wheelhouse
+pipx run cibuildwheel==2.23.4 --output-dir wheelhouse
 pipx run twine upload wheelhouse/*.whl
 ```
 
@@ -363,7 +363,7 @@ If you're building on an arm64 runner, you might notice something strange about
 
 This is fine for simple C extensions, but for more complicated builds on arm64 it becomes an issue.
 
-So, if you want to build macOS arm64 wheels on an arm64 runner (e.g., `macos-14`) on Python 3.8, before invoking cibuildwheel, you should install a native arm64 Python 3.8 interpreter on the runner:
+So, if you want to build macOS arm64 wheels on an arm64 runner (e.g., `macos-latest`) on Python 3.8, before invoking cibuildwheel, you should install a native arm64 Python 3.8 interpreter on the runner:
 
 
 !!! tab "GitHub Actions"

docs/setup.md

@@ -154,14 +154,14 @@ To build Linux, Mac, and Windows wheels using GitHub Actions, create a `.github/
         runs-on: ${{ matrix.os }}
         strategy:
           matrix:
-            # macos-13 is an intel runner, macos-14 is apple silicon
-            os: [ubuntu-latest, windows-latest, macos-13, macos-14]
+            # macos-15-intel is an intel runner, macos-latest is apple silicon
+            os: [ubuntu-latest, windows-latest, macos-15-intel, macos-latest]
 
         steps:
           - uses: actions/checkout@v4
 
           - name: Build wheels
-            run: pipx run cibuildwheel==2.23.3
+            run: pipx run cibuildwheel==2.23.4
 
           - uses: actions/upload-artifact@v4
             with:
@@ -188,8 +188,8 @@ To build Linux, Mac, and Windows wheels using GitHub Actions, create a `.github/
         runs-on: ${{ matrix.os }}
         strategy:
           matrix:
-            # macos-13 is an intel runner, macos-14 is apple silicon
-            os: [ubuntu-latest, windows-latest, macos-13, macos-14]
+            # macos-15-intel is an intel runner, macos-latest is apple silicon
+            os: [ubuntu-latest, windows-latest, macos-15-intel, macos-latest]
 
         steps:
           - uses: actions/checkout@v4
@@ -198,7 +198,7 @@ To build Linux, Mac, and Windows wheels using GitHub Actions, create a `.github/
           - uses: actions/setup-python@v5
 
           - name: Install cibuildwheel
-            run: python -m pip install cibuildwheel==2.23.3
+            run: python -m pip install cibuildwheel==2.23.4
 
           - name: Build wheels
             run: python -m cibuildwheel --output-dir wheelhouse

examples/appveyor-minimal.yml

@@ -9,7 +9,7 @@ environment:
 
 stack: python 3.12
 
-install: python -m pip install cibuildwheel==2.23.3
+install: python -m pip install cibuildwheel==2.23.4
 
 build_script: python -m cibuildwheel --output-dir wheelhouse
 

examples/azure-pipelines-minimal.yml

@@ -6,7 +6,7 @@ jobs:
     - bash: |
         set -o errexit
         python3 -m pip install --upgrade pip
-        pip3 install cibuildwheel==2.23.3
+        pip3 install cibuildwheel==2.23.4
       displayName: Install dependencies
     - bash: cibuildwheel --output-dir wheelhouse .
       displayName: Build wheels
@@ -20,7 +20,7 @@ jobs:
     - bash: |
         set -o errexit
         python3 -m pip install --upgrade pip
-        python3 -m pip install cibuildwheel==2.23.3
+        python3 -m pip install cibuildwheel==2.23.4
       displayName: Install dependencies
     - bash: cibuildwheel --output-dir wheelhouse .
       displayName: Build wheels
@@ -34,7 +34,7 @@ jobs:
     - bash: |
         set -o errexit
         python -m pip install --upgrade pip
-        pip install cibuildwheel==2.23.3
+        pip install cibuildwheel==2.23.4
       displayName: Install dependencies
     - bash: cibuildwheel --output-dir wheelhouse .
       displayName: Build wheels

examples/circleci-minimal.yml

@@ -11,7 +11,7 @@ jobs:
       - run:
           name: Build the Linux wheels.
           command: |
-            python3 -m pip install --user cibuildwheel==2.23.3
+            python3 -m pip install --user cibuildwheel==2.23.4
             cibuildwheel --output-dir wheelhouse
       - store_artifacts:
           path: wheelhouse/
@@ -28,7 +28,7 @@ jobs:
       - run:
           name: Build the Linux aarch64 wheels.
           command: |
-            python3 -m pip install --user cibuildwheel==2.23.3
+            python3 -m pip install --user cibuildwheel==2.23.4
             python3 -m cibuildwheel --output-dir wheelhouse
       - store_artifacts:
           path: wheelhouse/
@@ -44,7 +44,7 @@ jobs:
           name: Build the OS X wheels.
           command: |
             sudo softwareupdate --install-rosetta --agree-to-license  # for python<=3.8 or x86_64/universal2 tests
-            pip3 install cibuildwheel==2.23.3
+            pip3 install cibuildwheel==2.23.4
             cibuildwheel --output-dir wheelhouse
       - store_artifacts:
           path: wheelhouse/

examples/cirrus-ci-intel-mac.yml

@@ -1,6 +1,6 @@
 build_and_store_wheels: &BUILD_AND_STORE_WHEELS
   install_cibuildwheel_script:
-    - python -m pip install cibuildwheel==2.23.3
+    - python -m pip install cibuildwheel==2.23.4
   run_cibuildwheel_script:
     - cibuildwheel
   wheels_artifacts:

examples/cirrus-ci-minimal.yml

@@ -1,6 +1,6 @@
 build_and_store_wheels: &BUILD_AND_STORE_WHEELS
   install_cibuildwheel_script:
-    - python -m pip install cibuildwheel==2.23.3
+    - python -m pip install cibuildwheel==2.23.4
   run_cibuildwheel_script:
     - cibuildwheel
   wheels_artifacts:

examples/github-deploy.yml

@@ -16,14 +16,14 @@ jobs:
     runs-on: ${{ matrix.os }}
     strategy:
       matrix:
-        # macos-13 is an intel runner, macos-14 is apple silicon
-        os: [ubuntu-latest, ubuntu-24.04-arm, windows-latest, macos-13, macos-14]
+        # macos-15-intel is an intel runner, macos-latest is apple silicon
+        os: [ubuntu-latest, ubuntu-24.04-arm, windows-latest, macos-15-intel, macos-latest]
 
     steps:
       - uses: actions/checkout@v4
 
       - name: Build wheels
-        uses: pypa/cibuildwheel@v2.23.3
+        uses: pypa/cibuildwheel@v2.23.4
 
       - uses: actions/upload-artifact@v4
         with:

examples/github-minimal.yml

@@ -8,14 +8,14 @@ jobs:
     runs-on: ${{ matrix.os }}
     strategy:
       matrix:
-        # macos-13 is an intel runner, macos-14 is apple silicon
-        os: [ubuntu-latest, ubuntu-24.04-arm, windows-latest, macos-13, macos-14]
+        # macos-15-intel is an intel runner, macos-latest is apple silicon
+        os: [ubuntu-latest, ubuntu-24.04-arm, windows-latest, macos-15-intel, macos-latest]
 
     steps:
       - uses: actions/checkout@v4
 
       - name: Build wheels
-        uses: pypa/cibuildwheel@v2.23.3
+        uses: pypa/cibuildwheel@v2.23.4
         # env:
         #   CIBW_SOME_OPTION: value
         #    ...

examples/github-with-qemu.yml

@@ -8,8 +8,8 @@ jobs:
     runs-on: ${{ matrix.os }}
     strategy:
       matrix:
-        # macos-13 is an intel runner, macos-14 is apple silicon
-        os: [ubuntu-latest, ubuntu-24.04-arm, windows-latest, macos-13, macos-14]
+        # macos-15-intel is an intel runner, macos-latest is apple silicon
+        os: [ubuntu-latest, ubuntu-24.04-arm, windows-latest, macos-15-intel, macos-latest]
 
     steps:
       - uses: actions/checkout@v4
@@ -21,7 +21,7 @@ jobs:
           platforms: all
 
       - name: Build wheels
-        uses: pypa/cibuildwheel@v2.23.3
+        uses: pypa/cibuildwheel@v2.23.4
         env:
           # configure cibuildwheel on Linux to build native archs ('auto'),
           # and to split the remaining architectures between the x86_64 and

examples/gitlab-minimal.yml

@@ -12,7 +12,7 @@ linux:
     DOCKER_TLS_CERTDIR: ""
   script:
     - curl -sSL https://get.docker.com/ | sh
-    - python -m pip install cibuildwheel==2.23.3
+    - python -m pip install cibuildwheel==2.23.4
     - cibuildwheel --output-dir wheelhouse
   artifacts:
     paths:
@@ -23,7 +23,7 @@ windows:
   before_script:
     - choco install python -y --version 3.12.4
     - choco install git.install -y
-    - py -m pip install cibuildwheel==2.23.3
+    - py -m pip install cibuildwheel==2.23.4
   script:
     - py -m cibuildwheel --output-dir wheelhouse --platform windows
   artifacts:
@@ -33,9 +33,9 @@ windows:
     - saas-windows-medium-amd64
 
 macos:
-  image: macos-14-xcode-15
+  image: macos-latest-xcode-15
   before_script:
-    - python3 -m pip install cibuildwheel==2.23.3
+    - python3 -m pip install cibuildwheel==2.23.4
   script:
     - python3 -m cibuildwheel --output-dir wheelhouse
   artifacts:

examples/gitlab-with-qemu.yml

@@ -14,7 +14,7 @@ linux:
     - curl -sSL https://get.docker.com/ | sh
     # Warning: This is extremely slow, be careful with how many wheels you build
     - docker run --rm --privileged multiarch/qemu-user-static --reset -p yes
-    - python -m pip install cibuildwheel==2.23.3
+    - python -m pip install cibuildwheel==2.23.4
     # Assuming your CI runner's default architecture is x86_64...
     - cibuildwheel --output-dir wheelhouse --platform linux --archs aarch64
   artifacts:

examples/travis-ci-deploy.yml

@@ -20,7 +20,7 @@ jobs:
         - ln -s /c/Python312/python.exe /c/Python312/python3.exe
 
 install:
-  - python3 -m pip install cibuildwheel==2.23.3
+  - python3 -m pip install cibuildwheel==2.23.4
 
 script:
   # build the wheels, put them into './dist'

examples/travis-ci-minimal.yml

@@ -26,7 +26,7 @@ jobs:
         - ln -s /c/Python312/python.exe /c/Python312/python3.exe
 
 install:
-  - python3 -m pip install cibuildwheel==2.23.3
+  - python3 -m pip install cibuildwheel==2.23.4
 
 script:
   # build the wheels, put them into './wheelhouse'

examples/travis-ci-test-and-deploy.yml

@@ -52,7 +52,7 @@ jobs:
     - stage: deploy
       name: Build and deploy Linux wheels
       services: docker
-      install: python3 -m pip install cibuildwheel==2.23.3 twine
+      install: python3 -m pip install cibuildwheel==2.23.4 twine
       script: python3 -m cibuildwheel --output-dir wheelhouse
       after_success: python3 -m twine upload --skip-existing wheelhouse/*.whl
     # Deploy on windows
@@ -60,7 +60,7 @@ jobs:
       name: Build and deploy Windows wheels
       os: windows
       language: shell
-      install: python3 -m pip install cibuildwheel==2.23.3 twine
+      install: python3 -m pip install cibuildwheel==2.23.4 twine
       script: python3 -m cibuildwheel --output-dir wheelhouse
       after_success: python3 -m twine upload --skip-existing wheelhouse/*.whl
 

noxfile.py

@@ -15,7 +15,7 @@ nox.options.default_venv_backend = "uv|virtualenv"
 DIR = Path(__file__).parent.resolve()
 
 
-def install_and_run(session: nox.Session, script: str, *args: str, **kwargs: Any) -> str | None:
+def install_and_run(session: nox.Session, script: str, *args: str, **kwargs: Any) -> Any:
     deps = nox.project.load_toml(script)["dependencies"]
     session.install(*deps)
     return session.run("python", script, *args, **kwargs)

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "cibuildwheel"
-version = "2.23.3"
+version = "2.23.4"
 description = "Build Python wheels on CI with minimal configuration."
 readme = "README.md"
 license = "BSD-2-Clause"
@@ -87,6 +87,7 @@ test = [
     "jinja2",
     "pytest-timeout",
     "pytest-xdist",
+    "pytest-rerunfailures!=16.0",
     "pytest>=6",
     "setuptools",
     "tomli_w",

test/test_ssl.py

@@ -1,25 +1,37 @@
-from __future__ import annotations
-
 import textwrap
 
+import pytest
+
 from . import test_projects, utils
 
 project_with_ssl_tests = test_projects.new_c_project(
     setup_py_add=textwrap.dedent(
         r"""
-        import ssl
+            import ssl, time, urllib.request, urllib.error
 
-        from urllib.request import urlopen
+            def check_https(context=None):
+                # google hosts this endpoint that returns a 204 No Content, it's used for
+                # connectivity checks in Android & Chrome
+                url = "https://google.com/generate_204"
 
-        context = ssl.SSLContext(ssl.PROTOCOL_TLSv1_2)
-        data = urlopen("https://www.nist.gov", context=context)
-        data = urlopen("https://raw.githubusercontent.com/pypa/cibuildwheel/main/CI.md", context=context)
-        data = urlopen("https://raw.githubusercontent.com/pypa/cibuildwheel/main/CI.md")
+                for i in range(5):
+                    try:
+                        urllib.request.urlopen(url, context=context, timeout=5)
+                        return
+                    except (OSError, urllib.error.URLError) as e:
+                        print(f"Attempt {i+1}: Could not connect to {url}: {e}")
+                        time.sleep(2 ** i)  # Backoff: 1s, 2s, 4s, 8s...
+
+                raise ConnectionError(f"Could not connect to {url} after retries.")
+
+            check_https()
+            check_https(context=ssl.SSLContext(ssl.PROTOCOL_TLSv1_2))
         """
     )
 )
 
 
+@pytest.mark.flaky(reruns=2)
 def test(tmp_path):
     # this test checks that SSL is working in the build environment using
     # some checks in setup.py.