Bump version: v4.1.1

docs: switch from mkdocs to properdocs (#2946 )
properdocs is a drop-in MkDocs fork by the original MkDocs maintainers. The existing plugins (include-markdown, macros, intersphinx) and pymdown extensions work unchanged; themes are unbundled, so the readthedocs theme comes from properdocs-theme-readthedocs. Assisted-by: ClaudeCode:claude-fable-5
2026-07-24 16:31:06 -04:00 · 2026-07-24 14:55:37 -04:00 · 2026-07-24 14:55:24 -04:00 · 2026-07-24 01:19:38 -04:00 · 2026-07-23 11:40:11 -04:00 · 2026-07-21 21:12:40 -04:00
209 changed files with 13621 additions and 4366 deletions
@@ -0,0 +1,122 @@
+---
+name: changelog-entry
+description: Generate a new changelog entry for cibuildwheel based on all changes since the last tag. Use when updating the changelog or preparing a release.
+---
+
+# Generate Changelog Entry
+
+Produce a new version section at the top of `docs/changelog.md` summarizing all changes since the last git tag.
+
+## Steps
+
+1. **Find the last tag** — run `git tag --sort=-version:refname | head -1` to get the most recent version tag.
+2. **Gather changes** — run `git log <last-tag>..HEAD --oneline` and `git log <last-tag>..HEAD --format="%H %s"` to see all commits since that tag.
+3. **Read each merge/commit** — for substantive commits, read the full message and any linked PRs to understand the change. Use `git log <last-tag>..HEAD --format="---%n%B"` for full messages. If a commit message is ambiguous, use `gh pr view <number>` to get richer context from GitHub.
+4. **Classify and draft entries** — assign each change an emoji and write a one-line description following the style rules below. Combine related small PRs of the same type (bot dependency updates, dependabot CI action bumps, pre-commit autoupdates) into a single entry listing all PR numbers. Skip meta-changelog PRs (e.g., "Add missing CHANGELOG entries") — they don't describe user-facing changes. If a bot/dependency PR contains a substantive fix mixed in (e.g., a pip revert inside a dependency update), split it: mention the fix separately under its own category.
+5. **Determine the new version number** — inspect commits for breaking changes or new features to decide patch/minor/major bump. Ask the user if unclear.
+6. **Determine the date** — use today's date.
+7. **Insert the new section** — add it at the top of `docs/changelog.md`, right after the `# Changelog` heading and a blank line, before any existing version sections.
+
+## Style Rules
+
+These are non-negotiable formatting conventions derived from the existing changelog.
+
+### Version heading
+
+```markdown
+### v3.4.2
+```
+
+`###` heading, `v` prefix, full semver.
+
+### Date line
+
+```markdown
+_14 May 2026_
+```
+
+Italic (underscore-wrapped), day without leading zero, full month name, 4-digit year. One blank line after the date.
+
+### Entry format
+
+```markdown
+- <emoji> <Description> (#<PR number>)
+```
+
+- Each entry is a single bullet starting with `- `.
+- Emoji immediately after the dash-space.
+- Space between emoji and description text.
+- PR number(s) in parens at end: `(#1234)` or `(#1234, #5678)`.
+- No trailing period for single-sentence entries.
+- Period at end of multi-sentence entries only.
+
+### Emoji categories
+
+Use exactly one emoji per entry, chosen by category:
+
+| Emoji | Category | Used for |
+|-------|----------|----------|
+| 🌟 | Major feature | New platforms, significant new capabilities |
+| ✨ | Feature | New features, additions, user-visible enhancements |
+| 🐛 | Bug fix | Bug fixes |
+| 🛠 | Maintenance | Dep updates, internal improvements, behavior tweaks |
+| ⚠️ | Warning | Deprecations, breaking changes, dropped support |
+| 📚 | Docs | Documentation changes |
+| 💼 | Internal | Non-user-facing infra/tooling changes |
+| 🧪 | Tests | Test changes |
+| 🔐 | Security | Security-related changes (used in past changelogs) |
+
+### Category disambiguation
+
+When a change could fit multiple categories, use these tiebreakers:
+
+- **CI/workflow fixes** → 💼 (not 🧪) — they fix infra, not test logic.
+- **Test suite changes** → 🧪 — only for changes to the test code itself.
+- **Diagnostic output changes** (e.g., printing more info during builds) → 🛠 (not 🐛) — they're improvements, not bug fixes.
+- **A bug fix that also changes test code** → 🐛 — the user-facing fix takes priority; test changes are implicit.
+
+### Writing style
+
+- **Present tense**: "Adds", "Fixes", "Updates", not "Added", "Fixed".
+- **Sentence case**: capitalize only the first word after the emoji.
+- **Link option names to docs**: `[`option-name`](https://cibuildwheel.pypa.io/en/stable/options/#option-name)`. Option anchors match the option name — verify in `docs/options.md` by searching for `{: #option-name }`.
+- Be specific about what changed and why, not just that something changed.
+
+### Ordering
+
+Within a version section, order entries by importance:
+
+1. 🌟 entries first
+2. ⚠️ entries next
+3. ✨ entries
+4. 🐛 entries
+5. 🛠 entries
+6. 📚 entries
+7. 💼 entries
+8. 🧪 entries last
+
+### Multi-line entries
+
+For complex features needing explanation, use an indented italic paragraph:
+
+```markdown
+- ✨ Short summary here. (#1234)
+
+    _Longer explanation with details and caveats._ (#1234)
+```
+
+Adding a new Python beta version always has a specific longer explanation, check for a previous addition (like 3.14) for the note to use.
+
+### Blank lines
+
+- One blank line between version sections.
+- No blank lines between bullets within a version.
+
+## Validation
+
+After inserting the new section:
+
+1. Check that the new section follows all style rules above.
+2. Verify PR numbers match actual PRs in the commit log.
+3. Ensure no duplicate entries — multiple commits to the same PR should produce one entry.
+4. Run a final review of the file to confirm formatting is consistent with surrounding entries.
@@ -1,91 +0,0 @@
-only_if: changesInclude('.cirrus.yml') || ($CIRRUS_BRANCH == "main" && !changesIncludeOnly('.github/*', 'bin/*', 'docs/*', '.circleci/*', '.travis.yml', '.pre-commit-config.yaml', '.readthedocs.yml', 'azure-pipelines.yml', 'README.md', 'mkdocs.yml', 'noxfile.py')) || $CIRRUS_BRANCH =~ 'cirrus.*'
-
-run_tests: &RUN_TESTS
-  install_cibuildwheel_script:
-    - python -m pip install -U pip
-    - python -m pip install -e. --group test
-  run_cibuildwheel_tests_script:
-    - python ./bin/run_tests.py
-
-linux_x86_task:
-  timeout_in: 120m
-  compute_engine_instance:
-    image_project: cirrus-images
-    image: family/docker-builder
-    platform: linux
-    cpu: 8
-    memory: 8G
-  env:
-    VENV_ROOT: ${HOME}/venv-cibuildwheel
-    PATH: ${VENV_ROOT}/bin:${PATH}
-  install_pre_requirements_script:
-    - docker run --rm --privileged docker.io/tonistiigi/binfmt:latest --install all
-    - add-apt-repository -y ppa:deadsnakes/ppa
-    - apt-get update
-    - apt-get install -y python3.12-venv
-    - python3.12 -m venv ${VENV_ROOT}
-  <<: *RUN_TESTS
-
-linux_aarch64_task:
-  compute_engine_instance:
-    image_project: cirrus-images
-    image: family/docker-builder-arm64
-    architecture: arm64
-    platform: linux
-    cpu: 4
-    memory: 4G
-  env:
-    VENV_ROOT: ${HOME}/venv-cibuildwheel
-    PATH: ${VENV_ROOT}/bin:${PATH}
-  install_pre_requirements_script:
-    - docker run --rm --privileged docker.io/tonistiigi/binfmt:latest --install all
-    - add-apt-repository -y ppa:deadsnakes/ppa
-    - apt-get update
-    - apt-get install -y python3.12-venv
-    - python3.12 -m venv ${VENV_ROOT}
-  <<: *RUN_TESTS
-
-windows_x86_task:
-  # The task takes ~55 minutes while the timeout happens
-  # after 60 minutes by default, let's allow some wiggle room.
-  timeout_in: 120m
-  windows_container:
-    image: cirrusci/windowsservercore:visualstudio2022
-    cpu: 8
-    memory: 8G
-
-  install_pre_requirements_script:
-    - certutil -generateSSTFromWU roots.sst
-    - certutil -addstore -f root roots.sst
-    - del roots.sst
-    - choco install -y --no-progress python3 --version 3.12.4
-    - refreshenv
-    - powershell -Command "$cleanPath = $env:PATH -replace ';+$', ''; Add-Content -Path $env:CIRRUS_ENV -Value ('PATH=' + $cleanPath)"
-  <<: *RUN_TESTS
-
-macos_arm64_task:
-  macos_instance:
-    image: ghcr.io/cirruslabs/macos-runner:sequoia
-  env:
-    VENV_ROOT: ${HOME}/venv-cibuildwheel
-    PATH: ${VENV_ROOT}/bin:${PATH}
-  install_pre_requirements_script:
-    - brew install python@3.12
-    - python3.12 -m venv ${VENV_ROOT}
-  <<: *RUN_TESTS
-
-macos_arm64_cp38_task:
-  macos_instance:
-    image: ghcr.io/cirruslabs/macos-runner:sequoia
-  env:
-    VENV_ROOT: ${HOME}/venv-cibuildwheel
-    PATH: ${VENV_ROOT}/bin:${PATH}
-    PYTEST_ADDOPTS: --run-cp38-universal2 -k 'test_cp38_arm64_testing_universal2_installer or test_arch_auto or test_dummy_serial'
-  install_pre_requirements_script:
-    - brew install python@3.12
-    - python3.12 -m venv ${VENV_ROOT}
-    - curl -fsSLO https://www.python.org/ftp/python/3.8.10/python-3.8.10-macos11.pkg
-    - sudo installer -pkg python-3.8.10-macos11.pkg -target /
-    - rm python-3.8.10-macos11.pkg
-    - sh "/Applications/Python 3.8/Install Certificates.command"
-  <<: *RUN_TESTS
@@ -0,0 +1,7 @@
+# Specification files for platform maintainers
+cibuildwheel/platforms/ios.py         @freakboy3742
+cibuildwheel/platforms/pyodide.py     @hoodmane @ryanking13 @agriyakhetarpal
+cibuildwheel/platforms/android.py     @mhsmith
+
+# Constraints files
+cibuildwheel/resources/constraints-pyodide*.txt @hoodmane @ryanking13 @agriyakhetarpal
@@ -9,3 +9,5 @@ updates:
      actions:
        patterns:
          - "*"
+    cooldown:
+      default-days: 7
@@ -0,0 +1,40 @@
+name: "Copilot Setup Steps"
+
+permissions: {}
+
+on:
+  workflow_dispatch:
+  push:
+    paths:
+      - .github/workflows/copilot-setup-steps.yml
+  pull_request:
+    paths:
+      - .github/workflows/copilot-setup-steps.yml
+
+jobs:
+  copilot-setup-steps:
+    name: Copilot Setup Steps
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        with:
+          python-version: "3.x"
+          allow-prereleases: true
+
+      - uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
+
+      - name: Install tooling
+        run: |
+          uv tool install nox
+          uv tool install prek
+
+      - name: Pre-install checks
+        run: |
+          prek prepare-hooks
@@ -7,13 +7,17 @@ on:
    types:
    - published

+permissions: {}
+
 jobs:
  dist:
    runs-on: ubuntu-latest
    steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      with:
+        persist-credentials: false

-    - uses: hynek/build-and-inspect-python-package@v2
+    - uses: hynek/build-and-inspect-python-package@d44ca7d91762de7a7d5436ddae667c6da6d1c3df # v2.18.0

  publish:
    needs: [dist]
@@ -27,16 +31,16 @@ jobs:
      attestations: write

    steps:
-    - uses: actions/download-artifact@v4
+    - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
      with:
        name: Packages
        path: dist

    - name: Generate artifact attestation for sdist and wheel
-      uses: actions/attest-build-provenance@db473fddc028af60658334401dc6fa3ffd8669fd # v2.3.0
+      uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1
      with:
        subject-path: "dist/cibuildwheel-*"

-    - uses: pypa/gh-action-pypi-publish@release/v1
+    - uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
      with:
        attestations: true
@@ -23,74 +23,139 @@ on:
      - .travis.yml
      - README.md
      - azure-pipelines.yml
-      - mkdocs.yml
+      - properdocs.yml
      - noxfile.py
  workflow_dispatch:
    # allow manual runs on branches without a PR

+permissions: {}
+
 concurrency:
  group: test-${{ github.ref }}
  cancel-in-progress: true

 jobs:
  lint:
-    name: Linters (mypy, flake8, etc.)
+    name: Linters (mypy, ruff, etc.)
    runs-on: ubuntu-latest
    steps:
-    - uses: actions/checkout@v4
-    - uses: actions/setup-python@v5
-      id: python
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      with:
+        persist-credentials: false
+    - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
      with:
        python-version: "3.x"
-    - uses: pre-commit/action@v3.0.1
+    - uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
+    - uses: j178/prek-action@e98a699c41eb69ab013a45817a0406469a748f8d # v2.0.5
    - name: PyLint checks
-      run: pipx run --python "${{ steps.python.outputs.python-path }}" nox -s pylint -- --output-format=github
+      run: uvx nox -s pylint -- --output-format=github
+
+  sample:
+    name: Generate a sample project
+    needs: lint
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      with:
+        persist-credentials: false
+    - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+      name: Install Python
+      with:
+        python-version: "3.x"
+    - uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
+    - name: Install dependencies
+      run: uv sync --no-dev --group test
+    - name: Generate a sample project
+      run: uv run --no-sync -m test.test_projects test.test_0_basic.basic_project sample_proj
+    - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      with:
+        name: sample_proj
+        path: sample_proj

  test:
-    name: Test on ${{ matrix.os }} (${{ matrix.python_version }})
-    needs: lint
+    name: Test on ${{ matrix.os }} (${{ matrix.python_version }}) ${{ matrix.test_select }}
+    needs: sample
    runs-on: ${{ matrix.os }}
    strategy:
+      fail-fast: false
      matrix:
-        os: [ubuntu-latest, ubuntu-24.04-arm, windows-latest, windows-11-arm, macos-13, macos-15]
-        python_version: ['3.13']
        include:
+        # Min Python
        - os: ubuntu-latest
          python_version: '3.11'
+        # Max Python
+        - os: ubuntu-latest
+          python_version: '3.15'
        - os: ubuntu-latest
          python_version: '3.14'
+          test_select: android
+        - os: ubuntu-24.04-arm
+          python_version: '3.13'
+        - os: windows-latest
+          python_version: '3.13'
+        - os: windows-11-arm
+          python_version: '3.13'
+        - os: macos-15-intel
+          python_version: '3.13'
+        - os: macos-15
+          python_version: '3.13'
+        - os: macos-15-intel
+          python_version: '3.13'
+          test_select: ios
+        - os: macos-15
+          python_version: '3.13'
+          test_select: ios
+          # Exercise iOS on a non-default simulator.
+          test_runtime: 'args: --simulator "iPhone 16e,OS=18.5"'
+        - os: macos-15-intel
+          python_version: '3.13'
+          test_select: android
+          # Exercise Android on a non-default simulator
+          test_runtime: 'args: --managed minVersion'
+        - os: macos-15
+          python_version: '3.13'
+          test_select: android
    timeout-minutes: 180
    steps:
-    - uses: actions/checkout@v4
-    - uses: actions/setup-python@v5
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      with:
+        persist-credentials: false
+    - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
      name: Install Python ${{ matrix.python_version }}
      with:
        python-version: ${{ matrix.python_version }}
        allow-prereleases: true

-    - uses: astral-sh/setup-uv@v6
+    - uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2

-    # free some space to prevent reaching GHA disk space limits
-    - name: Clean docker images
-      if: runner.os == 'Linux'
+    - name: Free up disk space
+      if: runner.os == 'Linux' && matrix.test_select != 'android'
      run: |
-        docker system prune -a -f
-        df -h
+        sudo rm -rf $ANDROID_HOME/ndk /opt/hostedtoolcache/CodeQL \
+          /usr/local/lib/node_modules /usr/local/share/chromium \
+          /usr/local/share/powershell
+        df -m

    # for oci_container unit tests
    - name: Set up QEMU
      if: runner.os == 'Linux'
-      uses: docker/setup-qemu-action@v3
+      uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
+
+    - name: Set up Xcode
+      if: ${{ startsWith(matrix.os, 'macos-15') }}
+      run: |
+        # GitHub recommends explicitly selecting the desired Xcode version
+        sudo xcode-select --switch /Applications/Xcode_16.4.app

    - name: Install dependencies
-      run: |
-        uv sync --no-dev --group test
+      run: uv sync --no-dev --group test
+
+    - uses: joerick/pr-labels-action@0543b277721e852d821c6738d449f2f4dea03d5f # v1.0.9

-    - uses: joerick/pr-labels-action@v1.0.9
    - name: Set CIBW_ENABLE
      shell: bash
      run: |
-        if [[ "${{ github.ref_name }}" == "main" ]]; then
+        if [[ "$GITHUB_REF_NAME" == "main" ]]; then
          CIBW_ENABLE=all
        else
          # get the default CIBW_ENABLE value from the test module
@@ -103,12 +168,17 @@ jobs:
          if [[ -n "$GITHUB_PR_LABEL_CI_GRAALPY" ]]; then
            CIBW_ENABLE+=" graalpy"
          fi
+          if [[ -n "$GITHUB_PR_LABEL_CI_PYPY_EOL" ]]; then
+            CIBW_ENABLE+=" pypy-eol"
+          fi
        fi
        echo "CIBW_ENABLE=${CIBW_ENABLE}" >> $GITHUB_ENV

-    - name: Generate a sample project
-      run: |
-        uv run --no-sync -m test.test_projects test.test_0_basic.basic_project sample_proj
+    - name: Download a sample project
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      with:
+        name: sample_proj
+        path: sample_proj

    - name: Run a sample build (GitHub Action)
      uses: ./
@@ -117,29 +187,35 @@ jobs:
        output-dir: wheelhouse
      env:
        CIBW_ARCHS_MACOS: x86_64 universal2 arm64
-        CIBW_BUILD_FRONTEND: 'build[uv]'
+        CIBW_BUILD_FRONTEND: ${{ matrix.test_select && 'build' || 'build[uv]' }}
+        CIBW_PLATFORM: ${{ matrix.test_select }}
+        CIBW_TEST_RUNTIME: ${{ matrix.test_runtime }}

    - name: Run a sample build (GitHub Action, only)
      uses: ./
+      if: matrix.test_select == ''
      with:
        package-dir: sample_proj
        output-dir: wheelhouse_only
-        only: cp312-${{ runner.os == 'Linux' && (runner.arch == 'ARM64' && 'manylinux_aarch64' || 'manylinux_x86_64') || (runner.os == 'Windows' && 'win_amd64' || 'macosx_x86_64') }}
+        only: cp313-${{ runner.os == 'Linux' && (runner.arch == 'ARM64' && 'manylinux_aarch64' || 'manylinux_x86_64') || (runner.os == 'Windows' && 'win_amd64' || 'macosx_x86_64') }}

    - name: Create custom configuration file
      shell: bash
      run: |
        cat > sample_proj/cibw.toml <<EOF
        [tool.cibuildwheel]
-        # Only build on CPython 3.12 on native arch
+        # Only build on CPython 3.13 on native arch
        archs = ["native"]
-        build = "cp312-*"
+        build = "cp313-*"
        # Skip musllinux
        skip = "*-musllinux*"
        EOF

    - name: Run a sample build (GitHub Action, config-file)
      uses: ./
+      env:
+        CIBW_PLATFORM: ${{ matrix.test_select }}
+        CIBW_TEST_RUNTIME: ${{ matrix.test_runtime }}
      with:
        package-dir: sample_proj
        output-dir: wheelhouse_config_file
@@ -149,17 +225,23 @@ jobs:
      shell: bash
      run: |
        test $(find wheelhouse -name '*.whl' | wc -l) -ge 1
-        test $(find wheelhouse_only -name '*.whl' | wc -l) -eq 1
        test $(find wheelhouse_config_file -name '*.whl' | wc -l) -eq 1

-    - uses: actions/upload-artifact@v4
+    - name: Check Action artifacts (native build only)
+      if: matrix.test_select == ''
+      shell: bash
+      run: |
+        test $(find wheelhouse_only -name '*.whl' | wc -l) -eq 1
+
+    - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
      with:
        name: cibw-wheels-${{ matrix.os }}-${{ strategy.job-index }}
        path: wheelhouse/*.whl

    - name: Test cibuildwheel
-      run: |
-        uv run --no-sync bin/run_tests.py ${{ (runner.os == 'Linux' && runner.arch == 'X64') && '--run-podman' || '' }}
+      env:
+        CIBW_TEST_RUNTIME: ${{ matrix.test_runtime }}
+      run: uv run --no-sync bin/run_tests.py --test-select=${{ matrix.test_select || 'native' }} ${{ (runner.os == 'Linux' && runner.arch == 'X64') && '--run-podman' || '' }}

  emulated-archs:
    name: Get qemu emulated architectures
@@ -168,11 +250,13 @@ jobs:
    outputs:
      archs: ${{ steps.archs.outputs.archs }}
    steps:
-    - uses: actions/checkout@v4
-    - uses: actions/setup-python@v5
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      with:
+        persist-credentials: false
+    - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
      with:
        python-version: "3.x"
-    - uses: astral-sh/setup-uv@v6
+    - uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
    - name: Install dependencies
      run: uv sync --no-dev --group test
    - name: Get qemu emulated architectures
@@ -191,39 +275,47 @@ jobs:
      matrix:
        arch: ${{ fromJSON(needs.emulated-archs.outputs.archs) }}
    steps:
-    - uses: actions/checkout@v4
-    - uses: actions/setup-python@v5
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      with:
+        persist-credentials: false
+    - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
      with:
        python-version: "3.x"
-    - uses: astral-sh/setup-uv@v6
+    - uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
    - name: Install dependencies
      run: uv sync --no-dev --group test

    - name: Set up QEMU
-      uses: docker/setup-qemu-action@v3
+      uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0

    - name: Run the emulation tests
-      run: uv run --no-sync pytest --run-emulation ${{ matrix.arch }} test/test_emulation.py
+      env:
+        MATRIX_ARCH: ${{ matrix.arch }}
+      run: uv run --no-sync pytest --run-emulation "$MATRIX_ARCH" test/test_emulation.py

  test-pyodide:
    name: Test pyodide
-    needs: lint
+    needs: sample
    runs-on: ubuntu-24.04
    timeout-minutes: 180
    steps:
-    - uses: actions/checkout@v4
-    - uses: actions/setup-python@v5
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      with:
+        persist-credentials: false
+    - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
      name: Install Python 3.12
      with:
        python-version: '3.12'
-    - uses: astral-sh/setup-uv@v6
+    - uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2

    - name: Install dependencies
      run: uv sync --no-dev --group test

-    - name: Generate a sample project
-      run: |
-        uv run --no-sync -m test.test_projects test.test_0_basic.basic_project sample_proj
+    - name: Download a sample project
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      with:
+        name: sample_proj
+        path: sample_proj

    - name: Run a sample build (GitHub Action)
      uses: ./
@@ -232,22 +324,49 @@ jobs:
        output-dir: wheelhouse
      env:
        CIBW_PLATFORM: pyodide
-
-    - name: Run a sample build (GitHub Action) for an overridden Pyodide version
-      uses: ./
-      with:
-        package-dir: sample_proj
-        output-dir: wheelhouse
-        # In case this breaks at any point in time, switch to using the latest version
-        # available or any other version that is not the same as the default one set
-        # in cibuildwheel/resources/build-platforms.toml.
-      env:
-        CIBW_PLATFORM: pyodide
-        CIBW_BUILD: "cp312*"
-        CIBW_PYODIDE_VERSION: "0.27.6"
+        CIBW_ENABLE: pyodide-prerelease

    - name: Run tests with 'CIBW_PLATFORM' set to 'pyodide'
-      run: |
-        uv run --no-sync ./bin/run_tests.py
+      run: uv run --no-sync ./bin/run_tests.py
      env:
        CIBW_PLATFORM: pyodide
+        CIBW_ENABLE: pyodide-prerelease
+
+  test-uv-extras:
+    name: Test uv extra on ${{ matrix.os }} ${{ matrix.test_select }}
+    needs: sample
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+        - os: ubuntu-latest
+          test_select: android
+        - os: windows-latest
+        - os: windows-11-arm
+        - os: macos-15-intel
+        - os: macos-15
+        - os: macos-15-intel
+          test_select: android
+        - os: macos-15
+          test_select: android
+    steps:
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      with:
+        persist-credentials: false
+    - name: Download a sample project
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      with:
+        name: sample_proj
+        path: sample_proj
+    - name: Run a sample build (GitHub Action)
+      uses: ./
+      with:
+        extras: uv
+        package-dir: sample_proj
+        output-dir: wheelhouse
+      env:
+        CIBW_ARCHS_MACOS: x86_64 universal2 arm64
+        CIBW_BUILD: cp314-*
+        CIBW_BUILD_FRONTEND: 'build[uv]'
+        CIBW_PLATFORM: ${{ matrix.test_select }}
@@ -14,36 +14,47 @@ on:
  schedule:
    - cron: '0 6 * * 1'  # "At 06:00 on Monday."

+permissions: {}
+
 jobs:
  update-dependencies:
    name: Update dependencies
    if: github.repository_owner == 'pypa' || github.event_name != 'schedule'
    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    environment: ${{ github.ref == 'refs/heads/main' && github.repository == 'pypa/cibuildwheel' && 'update-dependencies-workflow' || '' }}
    steps:

    # we use this step to grab a Github App auth token, so that PRs generated by this workflow
    # run the GHA tests.
-    - uses: actions/create-github-app-token@v2
+    - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
      id: generate-token
      if: github.ref == 'refs/heads/main' && github.repository == 'pypa/cibuildwheel'
      with:
-        app-id: ${{ secrets.CIBUILDWHEEL_BOT_APP_ID }}
+        client-id: ${{ secrets.CIBUILDWHEEL_BOT_APP_ID }}
        private-key: ${{ secrets.CIBUILDWHEEL_BOT_APP_PRIVATE_KEY }}
+        permission-contents: write
+        permission-pull-requests: write

-    - uses: actions/checkout@v4
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      with:
+        persist-credentials: false

-    - uses: wntrblm/nox@2025.05.01
+    - uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
+      with:
+        python-version: "3.14"

    - name: "Run update: dependencies"
-      run: nox --force-color -s update_constraints
+      run: uvx nox --force-color -s update_constraints
    - name: "Run update: python configs"
-      run: nox --force-color -s update_pins
+      run: uvx nox --force-color -s update_pins
    - name: "Run update: docs user projects"
-      run: nox --force-color -s update_proj -- --auth=${{ secrets.GITHUB_TOKEN }}
+      run: uvx nox --force-color -s update_proj -- --auth=${{ secrets.GITHUB_TOKEN }}

    - name: Create Pull Request
      if: github.ref == 'refs/heads/main' && github.repository == 'pypa/cibuildwheel'
-      uses: peter-evans/create-pull-request@v7
+      uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
      with:
        commit-message: Update dependencies
        title: '[Bot] Update dependencies'
@@ -58,4 +69,5 @@ jobs:
        labels: |
          CI: GraalPy
          CI: PyPy
+          CI: PyPy EoL
          dependencies
@@ -21,10 +21,12 @@ jobs:
    permissions:
      contents: write
    steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false

      - name: Update the ${{ env.TAG_NAME }} tag
        id: update-major-minor-tag
-        uses: joerick/update-vX.Y-tag-action@v1.0
+        uses: joerick/update-vX.Y-tag-action@c4cefb60c33b82e4aa73a469e4acf30ee48d5812 # v1.0.2
        with:
          source-tag: ${{ env.TAG_NAME }}
@@ -0,0 +1,24 @@
+name: zizmor - GitHub Actions Security Analysis
+
+on:
+  push:
+    branches: ["main"]
+  pull_request:
+    branches: ["**"]
+
+permissions: {}
+
+jobs:
+  zizmor:
+    name: Run zizmor 🌈
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - name: Run zizmor 🌈
+        uses: zizmorcore/zizmor-action@192e21d79ab29983730a13d1382995c2307fbcaa # v0.5.7
@@ -112,3 +112,13 @@ site/

 # PyCharm
 .idea/
+
+# Lockfiles
+*.lock
+*.pylock
+
+# OS files
+.DS_Store
+
+# This file should be a symlink or contain "See @AGENTS.md"
+CLAUDE.md
@@ -1,5 +1,5 @@
 linux:
-  image: python:3.12
+  image: python:3.13
  services:
    - name: docker:dind
      entrypoint: ["env", "-u", "DOCKER_HOST"]
@@ -14,7 +14,7 @@ linux:
    # (comment the below line in a PR to debug a Gitlab-specific issue)
    PYTEST_ADDOPTS: -k "unit_test or test_0_basic" --suppress-no-test-exit-code
  rules:
-    - if: '$CI_COMMIT_BRANCH == "main"'
+    - if: '$CI_COMMIT_BRANCH == "main" || $CI_COMMIT_BRANCH =~ /^gitlab/'
      variables:
        CIBW_ENABLE: "all"
  script:
@@ -25,28 +25,29 @@ linux:
    - python ./bin/run_tests.py

 windows:
-  image: mcr.microsoft.com/windows/servercore:1809
  variables:
    PYTEST_ADDOPTS: -k "unit_test or test_0_basic" --suppress-no-test-exit-code
-  before_script:
-    - choco install python -y --allow-downgrade --version 3.12.4
  rules:
-    - if: '$CI_COMMIT_BRANCH == "main"'
+    - if: '$CI_COMMIT_BRANCH == "main" || $CI_COMMIT_BRANCH =~ /^gitlab/'
      variables:
-        CIBW_ENABLE: "all"
+        # Everything except graalpy. GraalPy is JVM-based and very slow to
+        # start; on the small (2-core) GitLab SaaS Windows runners,
+        # virtualenv's interpreter query for graalpy.exe times out, failing
+        # the build. (Other platforms run the full "all" group.)
+        CIBW_ENABLE: "cpython-prerelease pypy pypy-eol pyodide-eol pyodide-prerelease"
  script:
-    - py -m pip install -U pip
-    - py -m pip install -e. pytest-custom-exit-code --group test
-    - py bin\run_tests.py
+    - python -m pip install -U pip
+    - python -m pip install -e. pytest-custom-exit-code --group test
+    - python bin\run_tests.py
  tags:
    - saas-windows-medium-amd64

 macos:
-  image: macos-14-xcode-15
+  image: macos-15-xcode-16
  variables:
    PYTEST_ADDOPTS: -k "unit_test or test_0_basic" --suppress-no-test-exit-code
  rules:
-    - if: '$CI_COMMIT_BRANCH == "main"'
+    - if: '$CI_COMMIT_BRANCH == "main" || $CI_COMMIT_BRANCH =~ /^gitlab/'
      variables:
        CIBW_ENABLE: "all"
  script:
@@ -1,7 +1,10 @@
-repos:
+ci:
+  autoupdate_schedule: monthly
+exclude: "^cibuildwheel/resources/ios-support/(?!make_cross_venv\\.py)"

+repos:
 - repo: https://github.com/pre-commit/pre-commit-hooks
-  rev: v5.0.0
+  rev: 3e8a8703264a2f4a69428a0aa4dcb512790b2c8c  # frozen: v6.0.0
  hooks:
  - id: check-case-conflict
  - id: check-merge-conflict
@@ -12,25 +15,28 @@ repos:
    exclude: (cibuildwheel/resources/pinned_docker_images.cfg)|(.svg$)
  - id: mixed-line-ending
  - id: trailing-whitespace
+    exclude: ^cibuildwheel/resources/android/android.patch$

 - repo: https://github.com/astral-sh/ruff-pre-commit
-  rev: v0.11.13
+  rev: c59bba8fb259db0fec2bbb77ad8ba51ea7341b56  # frozen: v0.15.20
  hooks:
-  - id: ruff
-    args: ["--fix", "--show-fixes"]
+  - id: ruff-check
+    args: ["--fix"]
  - id: ruff-format

 - repo: https://github.com/pre-commit/mirrors-mypy
-  rev: v1.16.0
+  rev: d2823d321df3af8f878f7ee3414dc94d037145b9  # frozen: v2.1.0
  hooks:
  - id: mypy
    name: mypy 3.11 on cibuildwheel/
    args: ["--python-version=3.11"]
+    exclude: ^cibuildwheel/resources/android/_cross_venv.py$  # Requires Python 3.13 or later
    additional_dependencies: &mypy-dependencies
      - bracex
+      - build
      - dependency-groups>=1.2
+      - humanize
      - nox>=2025.2.9
-      - orjson
      - packaging
      - pygithub
      - pytest
@@ -45,13 +51,12 @@ repos:
      - uv
      - validate-pyproject
  - id: mypy
-    name: mypy 3.13
-    exclude: ^cibuildwheel/resources/.*py$
-    args: ["--python-version=3.13"]
+    name: mypy 3.14
+    args: ["--python-version=3.14"]
    additional_dependencies: *mypy-dependencies

 - repo: https://github.com/shellcheck-py/shellcheck-py
-  rev: v0.10.0.1
+  rev: 745eface02aef23e168a8afb6b5737818efbea95  # frozen: v0.11.0.1
  hooks:
  - id: shellcheck

@@ -71,8 +76,16 @@ repos:
    files: '^(README\.md|docs/changelog\.md|docs/options\.md|bin/readme.*)$'
    additional_dependencies: [cogapp>=3.5]

+- repo: https://github.com/henryiii/flake8-lazy
+  rev: 5fed9a818f2583f0403aed779bf2b6c9aa8d25f4  # frozen: v0.8.5
+  hooks:
+  - id: flake8-lazy
+    args: ["--apply=set"]
+    files: '^cibuildwheel'
+    exclude: "^cibuildwheel/resources/"
+
 - repo: https://github.com/codespell-project/codespell
-  rev: v2.4.1
+  rev: 2ccb47ff45ad361a21071a7eedda4c37e6ae8c5a  # frozen: v2.4.2
  hooks:
  - id: codespell
    args: ["-w"]
@@ -80,15 +93,13 @@ repos:


 - repo: https://github.com/python-jsonschema/check-jsonschema
-  rev: 0.33.0
+  rev: 1a4bb160cab6417b3045e1b37b6b72449243e658  # frozen: 0.37.4
  hooks:
    - id: check-dependabot
    - id: check-github-actions
    - id: check-github-workflows
    - id: check-gitlab-ci
-    # Disabled due to schema issue for now:
-    # - id: check-readthedocs
-    - id: check-travis
+    - id: check-readthedocs
    - id: check-jsonschema
      name: Check projects
      args: [--schemafile, docs/data/projects.schema.json]
@@ -8,4 +8,4 @@ build:
    - asdf plugin add uv
    - asdf install uv latest
    - asdf global uv latest
-    - NO_COLOR=1 uv run --python 3.14 --managed-python --no-dev --group docs mkdocs build --strict --site-dir $READTHEDOCS_OUTPUT/html
+    - NO_COLOR=1 uv run --python 3.14 --managed-python --no-dev --group docs properdocs build --strict --site-dir $READTHEDOCS_OUTPUT/html
@@ -1,79 +0,0 @@
-os: linux
-dist: jammy
-language: python
-
-branches:
-  only:
-  - main
-
-# only build the main branch or PR that explicitely want to test with Travis CI
-if: (type = "push") OR (commit_message =~ /travis-ci/)
-
-jobs:
-  include:
-    - name: Linux | x86_64 + i686 | Python 3.12
-      python: 3.12
-      services: docker
-      env:
-        - PYTHON=python
-        # a build using CIBW_ENABLE=all does not fit into Travis' time limit,
-        # so only the defaults are tested
-
-    - name: Linux | arm64 | Python 3.12
-      python: 3.12
-      services: docker
-      arch: arm64
-      env:
-        - PYTHON=python
-        - CIBW_ENABLE=all
-
-    - name: Linux | ppc64le | Python 3.12
-      python: 3.12
-      services: docker
-      arch: ppc64le
-      allow_failure: True
-      env:
-        - PYTHON=python
-        # skip test_manylinuxXXXX_only, it uses too much disk space
-        # c.f. https://travis-ci.community/t/running-out-of-disk-space-quota-when-using-docker-on-ppc64le/11634
-        - PYTEST_ADDOPTS='-k "not test_manylinuxXXXX_only"'
-        - CIBW_ENABLE=all
-
-    - name: Windows | x86_64 | Python 3.12
-      os: windows
-      language: shell
-      before_install:
-        # http://woshub.com/updating-trusted-root-certificates-in-windows-10
-        - certutil -generateSSTFromWU roots.sst
-        - powershell -Command 'Get-ChildItem -Path roots.sst | Import-Certificate -CertStoreLocation Cert:\LocalMachine\Root'
-        - rm -f roots.sst
-        - choco upgrade python3 -y --version 3.12.8 --limit-output --params "/InstallDir:C:\\Python312"
-      env:
-        - PYTHON=C:\\Python312\\python
-        # a build using CIBW_ENABLE=all does not fit into Travis' time limit,
-        # so only the defaults are tested
-
-    - name: Linux | s390x | Python 3.12
-      python: 3.12
-      services: docker
-      arch: s390x
-      allow_failure: True
-      env:
-        - PYTHON=python
-        - CIBW_ENABLE=all
-
-install:
- if [ "${TRAVIS_OS_NAME}" == "linux" ]; then docker run --rm --privileged docker.io/tonistiigi/binfmt:latest --install all; fi
- $PYTHON -m pip install -U pip
- $PYTHON -m pip install -e. --group test
-
-script: |
-  # travis_wait disable the output while waiting
-  # use the same kind of tricks as in multibuild
-  (while true; do echo "travis_keep_alive"; sleep 300; done) &
-  SPINNER_PID=$!
-  disown
-  result=0
-  $PYTHON ./bin/run_tests.py --num-processes 2 || result=1
-  kill -9 ${SPINNER_PID}
-  test ${result} -eq 0
@@ -0,0 +1,57 @@
+# cibuildwheel — Agent Notes
+
+## Always run
+
+- `prek -a` should be run after changes to reformat, lint, and type check
+
+## Developer commands
+- `uv run pytest unit_test` — Quick run for unit tests
+- `nox -s tests` — run doctests + unit tests + integration tests (slow, >30 min, requires system Python installs on macOS).
+- `nox -s tests -- unit_test` — fast unit tests only.
+- `nox -s tests -- test -k before_build` — single integration test/file via pytest `-k`.
+- `nox -s lint` — run all linters (pre-commit/prek).
+- `nox -s pylint` — run pylint separately (not in pre-commit).
+- `nox -s docs` — properdocs serve (interactive) or build (non-interactive).
+- Set up local dev env at `.venv`: `uv sync` (dependency groups used).
+
+## Project layout
+- `cibuildwheel/` — main package. Entry point: `cibuildwheel.__main__:main`.
+- `test/` — **integration tests** (expensive, run actual wheel builds).
+- `unit_test/` — **unit tests** (fast, no wheel builds).
+- `bin/` — maintainer scripts (update pins, generate README tables, schema, etc.).
+- `docs/` — properdocs (MkDocs fork) source.
+
+## Testing specifics
+- Three test suites exist, run in this order by `bin/run_tests.py`:
+  1. `pytest cibuildwheel` — doctests.
+  2. `pytest unit_test [...]` — unit tests.
+  3. `pytest test [...]` — integration tests (split into `serial` and `not serial` runs).
+- Serial integration tests **must not** run in parallel; non-serial use pytest-xdist by default.
+- Custom pytest options:
+  - `--run-docker` (unit_test + test): run OCI container tests. Linux only.
+  - `--run-podman`: run podman tests (Linux).
+  - `--run-emulation` (test): run QEMU emulation tests (e.g., `--run-emulation aarch64`).
+  - `--platform linux` (test): force integration tests to target Linux container builds even on macOS/Windows.
+  - `--enable` (test): sets `CIBW_ENABLE` env var (e.g., `pypy`, `graalpy`).
+- Integration tests auto-set a default `CIBW_ENABLE` if the env var is absent.
+- The `build_frontend_env` fixture parameterizes over `pip`, `build`, `build[uv]`, `uv` and skips unsupported combos per platform.
+- Some integration tests require system Python.org installs on macOS; missing them prints a download URL in the error.
+- iOS/Android/pyodide tests have dedicated pytest marks (`ios`, `android`, `pyodide`) and need platform-specific runners/simulators.
+
+## Lint / typecheck
+- Ruff (lint + format) and mypy run via pre-commit. Pylint runs separately via `nox -s pylint`.
+- Mypy is strict (`strict = true`) and targets Python 3.11 for the package, 3.14 for a second check in pre-commit.
+- Ruff config in `pyproject.toml` (`line-length = 100`).
+- Python 3.11 is the minimum supported version for the package itself.
+
+## Generated / maintained files
+- `README.md` contains two **cog-generated** tables (options table, changelog preview). Pre-commit runs `cog -c -P -r -I ./bin README.md`. Edit the source scripts (`bin/readme_*.py`) or the upstream files (`docs/options.md`, `docs/changelog.md`) — do not hand-edit the generated blocks. Note the identifier is _not_ cog generated, and can be edited.
+- `cibuildwheel/resources/cibuildwheel.schema.json` is generated by `bin/generate_schema.py` (run via `nox -s generate_schema`).
+- `cibuildwheel/resources/constraints-*.txt` are generated via `nox -s update_constraints`.
+- `cibuildwheel/resources/pinned_docker_images.cfg` and other resource files are updated via `nox -s update_pins`.
+
+## CI / release quirks
+- CI uses `uv sync --no-dev --group test` for test installs, then `uv run --no-sync` to execute.
+- The release workflow uses `hynek/build-and-inspect-python-package` for dist building.
+- `test.yml` skips unrelated paths to avoid burning CI time on docs-only changes.
+- A sample project artifact is built once and downloaded by downstream test jobs to avoid redundant work.
@@ -1,11 +1,9 @@
 This is a summary of the host Python versions and platforms covered by the different CI platforms:

-|         | 3.11                             | 3.12                                        | 3.13           |
-|---------|----------------------------------|---------------------------------------------|----------------|
-| Linux   | Azure Pipelines / GitHub Actions | CircleCI¹ / Cirrus CI / GitLab¹ / Travis CI | GitHub Actions |
-| macOS   | Azure Pipelines                  | CircleCI¹ / Cirrus CI / GitLab¹             | GitHub Actions |
-| Windows | Azure Pipelines                  | Cirrus CI / GitLab¹ / Travis CI             | GitHub Actions |
+|         | 3.11                             | 3.12                    | 3.13           | 3.14           |
+|---------|----------------------------------|-----------------------|----------------|----------------|
+| Linux   | Azure Pipelines / GitHub Actions | CircleCI¹ / GitLab¹   | GitHub Actions | GitHub Actions |
+| macOS   | Azure Pipelines                  | CircleCI¹ / GitLab¹   | GitHub Actions |                |
+| Windows | Azure Pipelines                  | GitLab¹               | GitHub Actions |                |

 > ¹ Runs a reduced set of tests to reduce CI load
-
-Non-x86 architectures are covered on Travis CI using Python 3.12.
@@ -1,24 +1,9 @@
-This project is licensed under the 'BSD 2-clause license'.
+Copyright 2017, Joe Rickerby and contributors. All rights reserved.

-Copyright (c) 2017-2025, Joe Rickerby and contributors. All rights reserved.
+Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:

-Redistribution and use in source and binary forms, with or without
-modification, are permitted provided that the following conditions are met:
+1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.

-1. Redistributions of source code must retain the above copyright notice, this
-list of conditions and the following disclaimer.
+2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.

-2. Redistributions in binary form must reproduce the above copyright notice,
-this list of conditions and the following disclaimer in the documentation
-and/or other materials provided with the distribution.
-
-THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
-AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
-DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
-FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
-DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
-SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
-CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
-OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS “AS IS” AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
@@ -4,7 +4,6 @@ cibuildwheel
 [![PyPI](https://img.shields.io/pypi/v/cibuildwheel.svg)](https://pypi.python.org/pypi/cibuildwheel)
 [![Documentation Status](https://readthedocs.org/projects/cibuildwheel/badge/?version=stable)](https://cibuildwheel.pypa.io/en/stable/?badge=stable)
 [![Actions Status](https://github.com/pypa/cibuildwheel/workflows/Test/badge.svg)](https://github.com/pypa/cibuildwheel/actions)
-[![Travis Status](https://img.shields.io/travis/com/pypa/cibuildwheel/main?logo=travis)](https://travis-ci.com/github/pypa/cibuildwheel)
 [![CircleCI Status](https://img.shields.io/circleci/build/gh/pypa/cibuildwheel/main?logo=circleci)](https://circleci.com/gh/pypa/cibuildwheel)
 [![Azure Status](https://dev.azure.com/joerick0429/cibuildwheel/_apis/build/status/pypa.cibuildwheel?branchName=main)](https://dev.azure.com/joerick0429/cibuildwheel/_build/latest?definitionId=4&branchName=main)

@@ -15,7 +14,7 @@ cibuildwheel

 Python wheels are great. Building them across **Mac, Linux, Windows**, on **multiple versions of Python**, is not.

-`cibuildwheel` is here to help. `cibuildwheel` runs on your CI server - currently it supports GitHub Actions, Azure Pipelines, Travis CI, CircleCI, and GitLab CI - and it builds and tests your wheels across all of your platforms.
+`cibuildwheel` is here to help. `cibuildwheel` runs on your CI server - currently it supports GitHub Actions, Azure Pipelines, CircleCI, and GitLab CI - and it builds and tests your wheels across all of your platforms.


 What does it do?
@@ -23,30 +22,30 @@ What does it do?

 While cibuildwheel itself requires a recent Python version to run (we support the last three releases), it can target the following versions to build wheels:

-|                    | macOS Intel | macOS Apple Silicon | Windows 64bit | Windows 32bit | Windows Arm64 | manylinux<br/>musllinux x86_64 | manylinux<br/>musllinux i686 | manylinux<br/>musllinux aarch64 | manylinux<br/>musllinux ppc64le | manylinux<br/>musllinux s390x | manylinux<br/>musllinux armv7l | iOS | Pyodide |
-|--------------------|----|-----|-----|-----|-----|----|-----|----|-----|-----|---|-----|-----|
-| CPython 3.8        | ✅ | ✅  | ✅  | ✅  | N/A | ✅ | ✅  | ✅ | ✅  | ✅  | ✅⁵ | N/A | N/A |
-| CPython 3.9        | ✅ | ✅  | ✅  | ✅  | ✅² | ✅ | ✅ | ✅ | ✅  | ✅  | ✅⁵ | N/A | N/A |
-| CPython 3.10       | ✅ | ✅  | ✅  | ✅  | ✅² | ✅ | ✅  | ✅ | ✅  | ✅  | ✅⁵ | N/A | N/A |
-| CPython 3.11       | ✅ | ✅  | ✅  | ✅  | ✅² | ✅ | ✅  | ✅ | ✅  | ✅  | ✅⁵ | N/A | N/A |
-| CPython 3.12       | ✅ | ✅  | ✅  | ✅  | ✅² | ✅ | ✅  | ✅ | ✅  | ✅  | ✅⁵  | N/A | ✅⁴ |
-| CPython 3.13³      | ✅ | ✅  | ✅  | ✅  | ✅² | ✅ | ✅  | ✅ | ✅  | ✅  | ✅⁵  | ✅ | N/A |
-| CPython 3.14³      | ✅ | ✅  | ✅  | ✅  | ✅² | ✅ | ✅  | ✅ | ✅  | ✅  | ✅⁵  | ✅ | N/A |
-| PyPy 3.8 v7.3      | ✅ | ✅  | ✅  | N/A | N/A | ✅¹ | ✅¹  | ✅¹ | N/A | N/A | N/A | N/A | N/A |
-| PyPy 3.9 v7.3      | ✅ | ✅  | ✅  | N/A | N/A | ✅¹ | ✅¹  | ✅¹ | N/A | N/A | N/A | N/A | N/A |
-| PyPy 3.10 v7.3     | ✅ | ✅  | ✅  | N/A | N/A | ✅¹ | ✅¹  | ✅¹ | N/A | N/A | N/A | N/A | N/A |
-| PyPy 3.11 v7.3     | ✅ | ✅  | ✅  | N/A | N/A | ✅¹ | ✅¹  | ✅¹ | N/A | N/A | N/A | N/A | N/A |
-| GraalPy 3.11 v24.2 | ✅ | ✅  | ✅  | N/A | N/A | ✅¹ | N/A  | ✅¹ | N/A | N/A | N/A | N/A | N/A |
+|                          | macOS Intel | macOS Apple Silicon | Windows 64bit | Windows 32bit | Windows Arm64  | manylinux<br/>musllinux x86_64 | manylinux<br/>musllinux i686 | manylinux<br/>musllinux aarch64 | manylinux<br/>musllinux ppc64le | manylinux<br/>musllinux s390x | manylinux<br/>musllinux armv7l | Android | iOS | Pyodide        |
+| ------------------------ | ----------- | ------------------- | ------------- | ------------- | -------------- | ------------------------------ | ---------------------------- | ------------------------------- | ------------------------------- | ----------------------------- | ------------------------------ | ------- | --- | -------------- |
+| CPython 3.9              | ✅          | ✅                  | ✅            | ✅            | ✅<sup>2</sup> | ✅                             | ✅                           | ✅                              | ✅                              | ✅                            | ✅<sup>4</sup>                 | N/A     | N/A | N/A            |
+| CPython 3.10             | ✅          | ✅                  | ✅            | ✅            | ✅<sup>2</sup> | ✅                             | ✅                           | ✅                              | ✅                              | ✅                            | ✅<sup>4</sup>                 | N/A     | N/A | N/A            |
+| CPython 3.11             | ✅          | ✅                  | ✅            | ✅            | ✅<sup>2</sup> | ✅                             | ✅                           | ✅                              | ✅                              | ✅                            | ✅<sup>4</sup>                 | N/A     | N/A | N/A            |
+| CPython 3.12             | ✅          | ✅                  | ✅            | ✅            | ✅<sup>2</sup> | ✅                             | ✅                           | ✅                              | ✅                              | ✅                            | ✅<sup>4</sup>                 | N/A     | N/A | ✅<sup>3</sup> |
+| CPython 3.13             | ✅          | ✅                  | ✅            | ✅            | ✅<sup>2</sup> | ✅                             | ✅                           | ✅                              | ✅                              | ✅                            | ✅<sup>4</sup>                 | ✅      | ✅  | ✅             |
+| CPython 3.14             | ✅          | ✅                  | ✅            | ✅            | ✅<sup>2</sup> | ✅                             | ✅                           | ✅                              | ✅                              | ✅                            | ✅<sup>4</sup>                 | ✅      | ✅  | ✅             |
+| CPython 3.15<sup>5</sup> | ✅          | ✅                  | ✅            | ✅            | ✅<sup>2</sup> | ✅                             | ✅                           | ✅                              | ✅                              | ✅                            | ✅<sup>4</sup>                 | ✅      | ✅  | N/A            |
+| PyPy 3.9 v7.3            | ✅          | ✅                  | ✅            | N/A           | N/A            | ✅<sup>1</sup>                 | ✅<sup>1</sup>               | ✅<sup>1</sup>                  | N/A                             | N/A                           | N/A                            | N/A     | N/A | N/A            |
+| PyPy 3.10 v7.3           | ✅          | ✅                  | ✅            | N/A           | N/A            | ✅<sup>1</sup>                 | ✅<sup>1</sup>               | ✅<sup>1</sup>                  | N/A                             | N/A                           | N/A                            | N/A     | N/A | N/A            |
+| PyPy 3.11 v7.3           | ✅          | ✅                  | ✅            | N/A           | N/A            | ✅<sup>1</sup>                 | ✅<sup>1</sup>               | ✅<sup>1</sup>                  | N/A                             | N/A                           | N/A                            | N/A     | N/A | N/A            |
+| GraalPy 3.12 v25.0       | ✅          | ✅                  | ✅            | N/A           | N/A            | ✅<sup>1</sup>                 | N/A                          | ✅<sup>1</sup>                  | N/A                             | N/A                           | N/A                            | N/A     | N/A | N/A            |

-<sup>¹ PyPy & GraalPy are only supported for manylinux wheels.</sup><br>
-<sup>² Windows arm64 support is experimental.</sup><br>
-<sup>³ Free-threaded mode requires opt-in using [`enable`](https://cibuildwheel.pypa.io/en/stable/options/#enable).</sup><br>
-<sup>⁴ Experimental, not yet supported on PyPI, but can be used directly in web deployment. Use `--platform pyodide` to build.</sup><br>
-<sup>⁵ manylinux armv7l support is experimental. As there are no RHEL based image for this architecture, it's using an Ubuntu based image instead.</sup><br>
+<sup>**1** PyPy & GraalPy are only supported for manylinux wheels.</sup><br>
+<sup>**2** Windows arm64 support is experimental.</sup><br>
+<sup>**3** Not supported on PyPI, uses old `pyodide` tag instead of `pyemscripten`. Requires `pyodide-eol` [`enable`](https://cibuildwheel.pypa.io/en/stable/options/#enable).</sup><br>
+<sup>**4** manylinux armv7l support is experimental. As there are no RHEL based image for this architecture, it's using an Ubuntu based image instead.</sup><br>
+<sup>**5** Python 3.15 requires opt-in using [`enable`](https://cibuildwheel.pypa.io/en/stable/options/#enable).</sup><br>

- Builds manylinux, musllinux, macOS 10.9+ (10.13+ for Python 3.12+), and Windows wheels for CPython, PyPy, and GraalPy
- Works on GitHub Actions, Azure Pipelines, Travis CI, CircleCI, GitLab CI, and Cirrus CI
- Bundles shared library dependencies on Linux and macOS through [auditwheel](https://github.com/pypa/auditwheel) and [delocate](https://github.com/matthew-brett/delocate)
+- Builds manylinux, musllinux, macOS, Windows, pyemscripten, iOS, and Android wheels
+- Supports CPython, PyPy, and GraalPy
+- Works on GitHub Actions, Azure Pipelines, CircleCI, and GitLab CI
+- Bundles shared library dependencies on Linux through [auditwheel](https://github.com/pypa/auditwheel), macOS through [delocate](https://github.com/matthew-brett/delocate), and Windows through [delvewheel](https://github.com/adang1345/delvewheel)
 - Runs your library's tests against the wheel-installed version of your library

 See the [cibuildwheel 1 documentation](https://cibuildwheel.pypa.io/en/1.x/) if you need to build unsupported versions of Python, such as Python 2.
@@ -56,18 +55,18 @@ Usage

 `cibuildwheel` runs inside a CI service. Supported platforms depend on which service you're using:

-|                 | Linux | macOS | Windows | Linux ARM | macOS ARM | Windows ARM | iOS |
-|-----------------|-------|-------|---------|-----------|-----------|-------------|-----|
-| GitHub Actions  | ✅    | ✅    | ✅       | ✅        | ✅        | ✅          | ✅³  |
-| Azure Pipelines | ✅    | ✅    | ✅       |           | ✅        | ✅²         | ✅³  |
-| Travis CI       | ✅    |       | ✅      | ✅        |           |             |     |
-| CircleCI        | ✅    | ✅    |         | ✅        | ✅        |             | ✅³  |
-| Gitlab CI       | ✅    | ✅    | ✅      | ✅¹       | ✅        |             | ✅³  |
-| Cirrus CI       | ✅    | ✅    | ✅      | ✅        | ✅        |             |      |
+|                 | Linux | macOS | Windows | Linux ARM      | macOS ARM | Windows ARM    | Android                    | iOS                        | Pyodide        |
+| --------------- | ----- | ----- | ------- | -------------- | --------- | -------------- | -------------------------- | -------------------------- | -------------- |
+| GitHub Actions  | ✅    | ✅    | ✅      | ✅             | ✅        | ✅<sup>2</sup> | ✅<sup>4</sup>             | ✅<sup>3</sup>             | ✅             |
+| Azure Pipelines | ✅    | ✅    | ✅      |                | ✅        | ✅<sup>2</sup> | ✅<sup>4</sup>             | ✅<sup>3</sup>             | ✅<sup>5</sup> |
+| CircleCI        | ✅    | ✅    |         | ✅             | ✅        |                | ✅<sup>4</sup><sup>5</sup> | ✅<sup>3</sup><sup>5</sup> | ✅<sup>5</sup> |
+| GitLab CI       | ✅    | ✅    | ✅      | ✅<sup>1</sup> | ✅        |                | ✅<sup>4</sup><sup>5</sup> | ✅<sup>3</sup><sup>5</sup> | ✅<sup>5</sup> |

-<sup>¹ [Requires emulation](https://cibuildwheel.pypa.io/en/stable/faq/#emulation), distributed separately. Other services may also support Linux ARM through emulation or third-party build hosts, but these are not tested in our CI.</sup><br>
-<sup>² [Uses cross-compilation](https://cibuildwheel.pypa.io/en/stable/faq/#windows-arm64). It is not possible to test `arm64` on this CI platform.</sup><br>
-<sup>³ Requires a macOS runner; runs tests on the simulator for the runner's architecture.</sup>
+<sup>**1** [Requires emulation](https://cibuildwheel.pypa.io/en/stable/faq/#emulation), distributed separately. Other services may also support Linux ARM through emulation or third-party build hosts, but these are not tested in our CI.</sup><br>
+<sup>**2** [Uses cross-compilation](https://cibuildwheel.pypa.io/en/stable/faq/#windows-arm64). It is not possible to test `arm64` on this CI platform.</sup><br>
+<sup>**3** Requires a macOS runner; runs tests on the simulator for the runner's architecture. </sup><br>
+<sup>**4** Building for Android requires the runner to be Linux x86_64, macOS ARM64 or macOS x86_64. Testing has [additional requirements](https://cibuildwheel.pypa.io/en/stable/platforms/#android).</sup><br>
+<sup>**5** Builds may work, but are untested in cibuildwheel's CI.</sup><br>

 <!--intro-end-->

@@ -88,16 +87,18 @@ jobs:
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
-        os: [ubuntu-latest, ubuntu-24.04-arm, windows-latest, macos-13, macos-latest]
+        os: [ubuntu-latest, ubuntu-24.04-arm, windows-latest, windows-11-arm, macos-15-intel, macos-latest]

    steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false

      # Used to host cibuildwheel
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v6

      - name: Install cibuildwheel
-        run: python -m pip install cibuildwheel==3.0.0
+        run: python -m pip install cibuildwheel==4.1.1

      - name: Build wheels
        run: python -m cibuildwheel --output-dir wheelhouse
@@ -106,7 +107,7 @@ jobs:
        #   CIBW_SOME_OPTION: value
        #   ...

-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v6
        with:
          name: cibw-wheels-${{ matrix.os }}-${{ strategy.job-index }}
          path: ./wheelhouse/*.whl
@@ -124,6 +125,11 @@ The following diagram summarises the steps that cibuildwheel takes on each platf

 <sup>Explore an interactive version of this diagram [in the docs](https://cibuildwheel.pypa.io/en/stable/#how-it-works).</sup>

+> [!WARNING]
+> Building and testing wheels executes arbitrary code from your project and its dependencies. Although cibuildwheel uses OCI containers and Pyodide for some builds, these provide no security guarantees - the code you're building and testing has full access to the environment that's invoking cibuildwheel.
+>
+> If you cannot trust all the code that's pulled in, maintain good security hygiene: keep the job that builds distributions separate from the job that uploads them to PyPI, handle secrets and credentials with care and rotate them regularly, and follow the principle of least privilege when granting permissions. Do not store sensitive data on CI runners.
+

 <!--[[[cog from readme_options_table import get_table; print(get_table()) ]]]-->

@@ -144,25 +150,29 @@ The following diagram summarises the steps that cibuildwheel takes on each platf
 |  | [`before-all`](https://cibuildwheel.pypa.io/en/stable/options/#before-all) | Execute a shell command on the build system before any wheels are built. |
 |  | [`before-build`](https://cibuildwheel.pypa.io/en/stable/options/#before-build) | Execute a shell command preparing each wheel's build |
 |  | [`xbuild-tools`](https://cibuildwheel.pypa.io/en/stable/options/#xbuild-tools) | Binaries on the path that should be included in an isolated cross-build environment. |
+|  | [`xbuild-files`](https://cibuildwheel.pypa.io/en/stable/options/#xbuild-files) | Platform-specific files in the build environment |
 |  | [`repair-wheel-command`](https://cibuildwheel.pypa.io/en/stable/options/#repair-wheel-command) | Execute a shell command to repair each built wheel |
 |  | [`manylinux-*-image`<br>`musllinux-*-image`](https://cibuildwheel.pypa.io/en/stable/options/#linux-image) | Specify manylinux / musllinux container images |
 |  | [`container-engine`](https://cibuildwheel.pypa.io/en/stable/options/#container-engine) | Specify the container engine to use when building Linux wheels |
 |  | [`dependency-versions`](https://cibuildwheel.pypa.io/en/stable/options/#dependency-versions) | Control the versions of the tools cibuildwheel uses |
 |  | [`pyodide-version`](https://cibuildwheel.pypa.io/en/stable/options/#pyodide-version) | Specify the Pyodide version to use for `pyodide` platform builds |
+| **Auditing** | [`audit-requires`](https://cibuildwheel.pypa.io/en/stable/options/#audit-requires) | Install Python dependencies for the audit step |
+|  | [`audit-command`](https://cibuildwheel.pypa.io/en/stable/options/#audit-command) | Use a tool to check wheels before the end of the run |
 | **Testing** | [`test-command`](https://cibuildwheel.pypa.io/en/stable/options/#test-command) | The command to test each built wheel |
 |  | [`before-test`](https://cibuildwheel.pypa.io/en/stable/options/#before-test) | Execute a shell command before testing each wheel |
-|  | [`test-sources`](https://cibuildwheel.pypa.io/en/stable/options/#test-sources) | Files and folders from the source tree that are copied into an isolated tree before running the tests |
+|  | [`test-sources`](https://cibuildwheel.pypa.io/en/stable/options/#test-sources) | Paths that are copied into the working directory of the tests |
 |  | [`test-requires`](https://cibuildwheel.pypa.io/en/stable/options/#test-requires) | Install Python dependencies before running the tests |
 |  | [`test-extras`](https://cibuildwheel.pypa.io/en/stable/options/#test-extras) | Install your wheel for testing using `extras_require` |
 |  | [`test-groups`](https://cibuildwheel.pypa.io/en/stable/options/#test-groups) | Specify test dependencies from your project's `dependency-groups` |
 |  | [`test-skip`](https://cibuildwheel.pypa.io/en/stable/options/#test-skip) | Skip running tests on some builds |
 |  | [`test-environment`](https://cibuildwheel.pypa.io/en/stable/options/#test-environment) | Set environment variables for the test environment |
+|  | [`test-runtime`](https://cibuildwheel.pypa.io/en/stable/options/#test-runtime) | Controls how the tests will be executed. |
 | **Debugging** | [`debug-keep-container`](https://cibuildwheel.pypa.io/en/stable/options/#debug-keep-container) | Keep the container after running for debugging. |
 |  | [`debug-traceback`](https://cibuildwheel.pypa.io/en/stable/options/#debug-traceback) | Print full traceback when errors occur. |
 |  | [`build-verbosity`](https://cibuildwheel.pypa.io/en/stable/options/#build-verbosity) | Increase/decrease the output of the build |


-<!--[[[end]]] (sum: TWqEGGMOnt) -->
+<!--[[[end]]] (sum: Of/28Z7Nut) -->

 These options can be specified in a pyproject.toml file, or as environment variables, see [configuration docs](https://cibuildwheel.pypa.io/en/latest/configuration/).

@@ -177,37 +187,39 @@ Here are some repos that use cibuildwheel.

 | Name                              | CI | OS | Notes |
 |-----------------------------------|----|----|:------|
-| [scikit-learn][]                  | ![github icon][] | ![windows icon][] ![apple icon][] ![linux icon][] | The machine learning library. A complex but clean config using many of cibuildwheel's features to build a large project with Cython and C++ extensions.  |
-| [pytorch-fairseq][]               | ![github icon][] | ![apple icon][] ![linux icon][] | Facebook AI Research Sequence-to-Sequence Toolkit written in Python. |
+| [scikit-learn][]                  | ![github icon][] | ![windows icon][] ![apple icon][] ![linux icon][] ![pyodide icon][] | The machine learning library. A complex but clean config using many of cibuildwheel's features to build a large project with Cython and C++ extensions.  |
 | [duckdb][]                        | ![github icon][] | ![apple icon][] ![linux icon][] ![windows icon][] | DuckDB is an analytical in-process SQL database management system |
-| [NumPy][]                         | ![github icon][] ![travisci icon][] | ![windows icon][] ![apple icon][] ![linux icon][] | The fundamental package for scientific computing with Python. |
-| [Tornado][]                       | ![github icon][] | ![linux icon][] ![apple icon][] ![windows icon][] | Tornado is a Python web framework and asynchronous networking library. Uses stable ABI for a small C extension. |
+| [NumPy][]                         | ![github icon][] ![travisci icon][] | ![windows icon][] ![apple icon][] ![linux icon][] ![pyodide icon][] | The fundamental package for scientific computing with Python. |
+| [pytorch-fairseq][]               | ![github icon][] | ![apple icon][] ![linux icon][] | Facebook AI Research Sequence-to-Sequence Toolkit written in Python. |
 | [NCNN][]                          | ![github icon][] | ![windows icon][] ![apple icon][] ![linux icon][] | ncnn is a high-performance neural network inference framework optimized for the mobile platform |
-| [Matplotlib][]                    | ![github icon][] | ![windows icon][] ![apple icon][] ![linux icon][] | The venerable Matplotlib, a Python library with C++ portions |
+| [Matplotlib][]                    | ![github icon][] | ![windows icon][] ![apple icon][] ![linux icon][] ![pyodide icon][] | The venerable Matplotlib, a Python library with C++ portions |
+| [Tornado][]                       | ![github icon][] | ![linux icon][] ![apple icon][] ![windows icon][] | Tornado is a Python web framework and asynchronous networking library. Uses stable ABI for a small C extension. |
 | [MyPy][]                          | ![github icon][] | ![apple icon][] ![linux icon][] ![windows icon][] | The compiled version of MyPy using MyPyC. |
 | [Prophet][]                       | ![github icon][] | ![windows icon][] ![apple icon][] ![linux icon][] | Tool for producing high quality forecasts for time series data that has multiple seasonality with linear or non-linear growth. |
-| [Kivy][]                          | ![github icon][] | ![windows icon][] ![apple icon][] ![linux icon][] | Open source UI framework written in Python, running on Windows, Linux, macOS, Android and iOS |
+| [Triton][]                        | ![github icon][] | ![linux icon][] | Self hosted runners |

 [scikit-learn]: https://github.com/scikit-learn/scikit-learn
-[pytorch-fairseq]: https://github.com/facebookresearch/fairseq
 [duckdb]: https://github.com/duckdb/duckdb
 [NumPy]: https://github.com/numpy/numpy
-[Tornado]: https://github.com/tornadoweb/tornado
+[pytorch-fairseq]: https://github.com/facebookresearch/fairseq
 [NCNN]: https://github.com/Tencent/ncnn
 [Matplotlib]: https://github.com/matplotlib/matplotlib
+[Tornado]: https://github.com/tornadoweb/tornado
 [MyPy]: https://github.com/mypyc/mypy_mypyc-wheels
 [Prophet]: https://github.com/facebook/prophet
-[Kivy]: https://github.com/kivy/kivy
+[Triton]: https://github.com/openai/triton

 [github icon]: docs/data/readme_icons/github.svg
 [azurepipelines icon]: docs/data/readme_icons/azurepipelines.svg
 [circleci icon]: docs/data/readme_icons/circleci.svg
 [gitlab icon]: docs/data/readme_icons/gitlab.svg
 [travisci icon]: docs/data/readme_icons/travisci.svg
-[cirrusci icon]: docs/data/readme_icons/cirrusci.svg
 [windows icon]: docs/data/readme_icons/windows.svg
 [apple icon]: docs/data/readme_icons/apple.svg
 [linux icon]: docs/data/readme_icons/linux.svg
+[android icon]: docs/data/readme_icons/android.svg
+[ios icon]: docs/data/readme_icons/ios.svg
+[pyodide icon]: docs/data/readme_icons/pyodide.svg

 <!-- END bin/projects.py -->

@@ -216,7 +228,7 @@ Here are some repos that use cibuildwheel.
 Legal note
 ----------

-Since `cibuildwheel` repairs the wheel with `delocate` or `auditwheel`, it might automatically bundle dynamically linked libraries from the build machine.
+Since `cibuildwheel` repairs the wheel with `delocate`, `auditwheel`, or `delvewheel`, it might automatically bundle dynamically linked libraries from the build machine.

 It helps ensure that the library can run without any dependencies outside of the pip toolchain.

@@ -227,74 +239,118 @@ Changelog

 <!-- [[[cog from readme_changelog import mini_changelog; print(mini_changelog()) ]]] -->

-### v3.0.0
+### v4.1.1

-_11 June 2025_
+_24 July 2026_

-See @henryiii's [release post](https://iscinumpy.dev/post/cibuildwheel-3-0-0/) for more info on new features!
+- ✨ Adds `pyodide-build` as a separate [`build-frontend`](https://cibuildwheel.pypa.io/en/stable/options/#build-frontend), now the default frontend for Pyodide, with verbosity flags handling. Any other frontend is ignored with a warning on Pyodide. (#2609, #2945)
+- 🔐 Uses digests instead of tags for pinned container images, strengthening supply-chain security. The human-readable tags remain as comments in `pinned_docker_images.cfg`. (#2915)
+- 🐛 Fixes platform-specific [`test-runtime`](https://cibuildwheel.pypa.io/en/stable/options/#test-runtime) environment variables (e.g. `CIBW_TEST_RUNTIME_ANDROID`) not being honored (#2941)
+- 🐛 Fixes quoting of [`test-requires`](https://cibuildwheel.pypa.io/en/stable/options/#test-requires) and [`audit-requires`](https://cibuildwheel.pypa.io/en/stable/options/#audit-requires) so PEP 508 specifiers containing spaces work (#2913)
+- 🐛 Makes [`archs`](https://cibuildwheel.pypa.io/en/stable/options/#archs) parsing case-insensitive and platform-aware, so e.g. `arm64` works on Windows (#2920)
+- 🐛 Uses an absolute path for the `{project}` placeholder in [`config-settings`](https://cibuildwheel.pypa.io/en/stable/options/#config-settings) (#2934)
+- 🐛 Validates the [`pyodide-version`](https://cibuildwheel.pypa.io/en/stable/options/#pyodide-version) option against the build identifier with a clear error (#2925)
+- 🐛 Fixes PyPy installs on macOS after PyPy switched its downloads from `.tar.bz2` to `.tar.gz` (#2939)
+- 🐛 Makes a matching `python3-config` available in the build and test venvs on macOS (#2922)
+- 🛠 Updates dependencies and container pins (#2917, #2935, #2939)
+- 🛠 Updates Android tests to current Python versions and the new test repository URL (#2933)
+- 🛠 Drops the `orjson` dependency, no longer used by mypy 2+ (#2923)
+- 📚 Builds the docs with properdocs, a MkDocs fork (#2946)
+- 📚 Adds the missing `cp314-pyodide_wasm32` entry to the build identifier table (#2947)
+- 📚 Removes outdated notes about the `pip wheel` build frontend and ClearLinux (#2926)
+- 💼 Adds a "CI: PyPy EoL" PR label to run PyPy EoL tests on PRs (#2930)
+- 💼 Updates CI action pins and pre-commit hooks (#2914, #2932, #2938, #2940, #2942, #2943)

- 🌟 Adds the ability to [build wheels for iOS](https://cibuildwheel.pypa.io/en/stable/platforms/#ios)! Set the [`platform` option](https://cibuildwheel.pypa.io/en/stable/options/#platform) to `ios` on a Mac with the iOS toolchain to try it out! (#2286, #2363, #2432)
- 🌟 Adds support for the GraalPy interpreter! Enable for your project using the [`enable` option](https://cibuildwheel.pypa.io/en/stable/options/#enable). (#1538, #2411, #2414)
- ✨ Adds CPython 3.14 support, under the [`enable` option](https://cibuildwheel.pypa.io/en/stable/options/#enable) `cpython-prerelease`. This version of cibuildwheel uses 3.14.0b2. (#2390)
+### v4.1.0

-    _While CPython is in beta, the ABI can change, so your wheels might not be compatible with the final release. For this reason, we don't recommend distributing wheels until RC1, at which point 3.14 will be available in cibuildwheel without the flag._ (#2390)
- ✨ Adds the [test-sources option](https://cibuildwheel.pypa.io/en/stable/options/#test-sources), and changes the working directory for tests. (#2062, #2284, #2437)
+_12 June 2026_

-    - If this option is set, cibuildwheel will copy the files and folders specified in `test-sources` into the temporary directory we run from. This is required for iOS builds, but also useful for other platforms, as it allows you to avoid placeholders.
-    - If this option is not set, behaviour matches v2.x - cibuildwheel will run the tests from a temporary directory, and you can use the `{project}` placeholder in the `test-command` to refer to the project directory. (#2420)
+- ✨ Updates Pyodide to the final 314.0.0 release, so Pyodide 3.14 wheels now build by default without the `pyodide-prerelease` [`enable`](https://cibuildwheel.pypa.io/en/stable/options/#enable) flag. (#2906)
+- 🐛 Raises clear errors when a build produces no wheel, instead of failing later with a confusing message (#2909)
+- 🛠 Speeds up CLI startup through lazy imports on Python 3.15 (#2797)
+- 📚 Adds an FAQ section on caching cibuildwheel's downloaded tools with `CIBW_CACHE_PATH` (#2842)
+- 📚 Documentation improvements: clarifies which shell is used for command options, clarifies environment variable precedence, and fixes a dead Pyodide env info link (#2904, #2905, #2911)

- ✨ Adds [`dependency-versions`](https://cibuildwheel.pypa.io/en/stable/options/#dependency-versions) inline syntax (#2122)
- ✨ Improves support for Pyodide builds and adds the experimental [`pyodide-version`](https://cibuildwheel.pypa.io/en/stable/options/#pyodide-version) option, which allows you to specify the version of Pyodide to use for builds. (#2002)
- ✨ Add `pyodide-prerelease` [enable](https://cibuildwheel.pypa.io/en/stable/options/#enable) option, with an early build of 0.28 (Python 3.13). (#2431)
- ✨ Adds the [`test-environment`](https://cibuildwheel.pypa.io/en/stable/options/#test-environment) option, which allows you to set environment variables for the test command. (#2388)
- ✨ Adds the [`xbuild-tools`](https://cibuildwheel.pypa.io/en/stable/options/#xbuild-tools) option, which allows you to specify tools safe for cross-compilation. Currently only used on iOS; will be useful for Android in the future. (#2317)
- 🛠 The default [manylinux image](https://cibuildwheel.pypa.io/en/stable/options/#linux-image) has changed from `manylinux2014` to `manylinux_2_28`. (#2330)
- 🛠 EOL images `manylinux1`, `manylinux2010`, `manylinux_2_24` and `musllinux_1_1` can no longer be specified by their shortname. The full OCI name can still be used for these images, if you wish. (#2316)
- 🛠 Invokes `build` rather than `pip wheel` to build wheels by default. You can control this via the [`build-frontend`](https://cibuildwheel.pypa.io/en/stable/options/#build-frontend) option. You might notice that you can see your build log output now! (#2321)
- 🛠 Build verbosity settings have been reworked to have consistent meanings between build backends when non-zero. (#2339)
- 🛠 Removed the `CIBW_PRERELEASE_PYTHONS` and `CIBW_FREE_THREADED_SUPPORT` options - these have been folded into the [`enable`](https://cibuildwheel.pypa.io/en/stable/options/#enable) option instead. (#2095)
- 🛠 Build environments no longer have setuptools and wheel preinstalled. (#2329)
- 🛠 Use the standard Schema line for the integrated JSONSchema. (#2433)
- ⚠️ Dropped support for building Python 3.6 and 3.7 wheels. If you need to build wheels for these versions, use cibuildwheel v2.23.3 or earlier. (#2282)
- ⚠️ The minimum Python version required to run cibuildwheel is now Python 3.11. You can still build wheels for Python 3.8 and newer. (#1912)
- ⚠️ 32-bit Linux wheels no longer built by default - the [arch](https://cibuildwheel.pypa.io/en/stable/options/#archs) was removed from `"auto"`. It now requires explicit `"auto32"`. Note that modern manylinux images (like the new default, `manylinux_2_28`) do not have 32-bit versions. (#2458)
- ⚠️ PyPy wheels no longer built by default, due to a change to our options system. To continue building PyPy wheels, you'll now need to set the [`enable` option](https://cibuildwheel.pypa.io/en/stable/options/#enable) to `pypy` or `pypy-eol`. (#2095)
- ⚠️ Dropped official support for Appveyor. If it was working for you before, it will probably continue to do so, but we can't be sure, because our CI doesn't run there anymore. (#2386)
- 📚 A reorganisation of the docs, and numerous updates. (#2280)
- 📚 Use Python 3.14 color output in docs CLI output. (#2407)
- 📚 Docs now primarily use the pyproject.toml name of options, rather than the environment variable name. (#2389)
- 📚 README table now matches docs and auto-updates. (#2427, #2428)
+### v4.0.0

-### v2.23.3
+_7 June 2026_

-_26 April 2025_
+See @henryiii's [release post](https://iscinumpy.dev/post/cibuildwheel-4-0-0/) for more info on new features!

- 🛠 Dependency updates, including Python 3.13.3 (#2371)
+- 🌟 Adds wheel auditing with `abi3audit` as a default after the repair step, with new [`audit-requires`](https://cibuildwheel.pypa.io/en/stable/options/#audit-requires) and [`audit-command`](https://cibuildwheel.pypa.io/en/stable/options/#audit-command) options (#2805)
+- 🌟 Adds `pyemscripten` platform tag support (PEP 783), updates Pyodide to 314.0.0a2, and adds a `pyodide-eol` [`enable`](https://cibuildwheel.pypa.io/en/stable/options/#enable) flag for building end-of-life Pyodide versions (#2812, #2848)
+- 🌟 Sets up `delvewheel` as the default [`repair-wheel-command`](https://cibuildwheel.pypa.io/en/stable/options/#repair-wheel-command) for Windows, so extension module DLLs are now bundled automatically. Skip by setting it to empty if not needed. (#2831)
+- ✨ Adds CPython 3.15 support, under the [`enable` option](https://cibuildwheel.pypa.io/en/stable/options/#enable) `cpython-prerelease`. This version of cibuildwheel uses 3.15.0b2. (#2833, #2850)

-### v2.23.2
+    _While CPython is in beta, the ABI can change, so your wheels might not be compatible with the final release. For this reason, we don't recommend distributing wheels until RC1, at which point 3.15 will be available in cibuildwheel without the flag._

-_24 March 2025_
+- ✨ Adds CPython 3.15 support for iOS and Android (#2857, #2858)
+- ✨ Adds Android improvements for building NumPy and related packages, including auditwheel support, pkg-config and Fortran configuration, and the [`xbuild-files`](https://cibuildwheel.pypa.io/en/stable/options/#xbuild-files) option (#2695)
+- ✨ Adds `CIBUILDWHEEL_BUILD_IDENTIFIER` environment variable set to the current build identifier (e.g. `cp311-manylinux_x86_64`) during per-build steps (#2872)
+- ✨ Adds `{project}` and `{package}` placeholders to [`config-settings`](https://cibuildwheel.pypa.io/en/stable/options/#config-settings) (#2827)
+- ⚠️ Drops support for Python 3.8 (#2686)
+- ⚠️ Removes the experimental CPython 3.13 free-threading builds and the `cpython-freethreading` [`enable`](https://cibuildwheel.pypa.io/en/stable/options/#enable) option. CPython 3.14+ free-threading support remains available without the enable flag. (#2684)
+- ⚠️ Drops support for Cirrus CI, which is shutting down June 1, 2026 (#2817)
+- ⚠️ Drops GraalPy 3.11 (gp311) support, as agreed in #2741, and removes GraalPy 24-only workarounds (#2895)
+- 🔐 Adds SHA256 verification for direct downloads of Python interpreters, virtualenv, and python-build-standalone assets (#2873)
+- 🔐 Adds tarfile extraction filter for safe archive extraction (#2856)
+- 🐛 Fixes `UV_PYTHON` not being set for [`before-build`](https://cibuildwheel.pypa.io/en/stable/options/#before-build) on Linux when using `uv` as the [`build-frontend`](https://cibuildwheel.pypa.io/en/stable/options/#build-frontend) (#2830)
+- 🐛 Fixes detection of musl libc when downloading python-build-standalone, which previously always selected the gnu asset on musl hosts like Alpine (#2889)
+- 🐛 Fixes [`config-settings`](https://cibuildwheel.pypa.io/en/stable/options/#config-settings) expansion when `{project}` or `{package}` contains spaces or backslashes (#2886)
+- 🐛 Prevents deadlock when `linux32` fails and forwards platform args to the sanity check (#2880, #2888)
+- 🐛 Fixes container resource leaks on start failure and during teardown (#2879, #2887)
+- 🐛 Removes potential partial cache-population in case of error (#2892)
+- 🐛 Raises a clear error when `ANDROID_API_LEVEL` is not an integer (#2891)
+- 🐛 Replaces assert with proper exception in python-build-standalone (#2859)
+- 🐛 Uses ConfigurationError when `package_dir` is outside cwd instead of a generic Exception (#2898)
+- 🛠 Updates dependencies and container pins (#2893, #2882, #2874, #2868, #2862, #2884, #2845, #2837, #2818, #2810, #2838, #2813)
+- 🛠 Updates Android to Python 3.13.13 and 3.14.4 (#2821)
+- 🛠 Applies Pyodide-specific patches to the Emscripten toolchain installation (#2800)
+- 🛠 Uses `python -V -V` for Windows build diagnostics (#2832)
+- 🛠 Simplifies pinned container image lookup (#2897)
+- 🛠 Minor fixups across error messages, OCI container, and options (#2860)
+- 💼 Adds PEP 723 metadata for `bin/` scripts and drops the `bin` dependency group (#2819)
+- 💼 Improves Azure test reliability with retries and caching (#2890)
+- 💼 Fixes Windows GitLab CI test running (#2870)
+- 💼 Updates CI action pins and dev dependencies (#2902, #2867, #2851, #2843, #2826, #2823, #2820, #2807)
+- 💼 Adds agent and copilot setup files (#2861)
+- 💼 Uses `if TYPE_CHECKING:` blocks (#2866, #2864)
+- 🧪 Fixes Android tests using the `uv` frontend (#2809)
+- 🧪 Fixes the update-dependencies workflow to use `uv` to run `nox` (#2808)
+- 🧪 Adds unit tests for `OCIContainer._get_platform_args` (#2878)
+- 📚 Updates documentation for delvewheel as the default Windows [`repair-wheel-command`](https://cibuildwheel.pypa.io/en/stable/options/#repair-wheel-command), including the build diagram, schema defaults, and legal note (#2877, #2853, #2891)
+- 📚 Documents platform-specific [`before-build`](https://cibuildwheel.pypa.io/en/stable/options/#before-build) configuration (#2834)
+- 📚 Updates the "How it works" diagram with details of Android, iOS, and Pyodide builds (#2816)
+- 📚 Adds Pyodide icon and regenerates working examples data for Android, iOS, and Pyodide (#2815, #2811)
+- 📚 Adds intersphinx support for external documentation linking (#2871)
+- 📚 Adds instructions for building CUDA wheels and fixes manylinux container references in FAQ (#2896, #2900)
+- 📚 Links back to source in docs (#2806)
+- 📚 Removes outdated numpy info (#2855)

- 🐛 Workaround an issue with pyodide builds when running cibuildwheel with a Python that was installed via UV (#2328 via #2331)
- 🛠 Dependency updates, including a manylinux update that fixes an ['undefined symbol' error](https://github.com/pypa/manylinux/issues/1760) in gcc-toolset (#2334)

-### v2.23.1
+### v3.4.1

-_15 March 2025_
+_2 April 2026_

- ⚠️ Added warnings when the shorthand values `manylinux1`, `manylinux2010`, `manylinux_2_24`, and `musllinux_1_1` are used to specify the images in linux builds. The shorthand to these (unmaintainted) images will be removed in v3.0. If you want to keep using these images, explicitly opt-in using the full image URL, which can be found in [this file](https://github.com/pypa/cibuildwheel/blob/v2.23.1/cibuildwheel/resources/pinned_docker_images.cfg). (#2312)
- 🛠 Dependency updates, including a manylinux update which fixes an [issue with rustup](https://github.com/pypa/cibuildwheel/issues/2303). (#2315)
+- ⚠️ Building for the experimental CPython 3.13 free-threading variant is now deprecated. That functionality will be removed in the next minor release. The [`enable`](https://cibuildwheel.pypa.io/en/stable/options/#enable) option `cpython-freethreading` is therefore also deprecated. Builds specifying `enable = "all"` no longer select `cpython-freethreading`. CPython 3.14 free-threading support remains available without the `enable` flag. (#2787)
+- 🐛 iOS builds will no longer skip `repair-wheel-command` if it's defined in config (#2761)
+- 🐛 Fix bug causing `uv` to fail when environments define PYTHON_VERSION or UV_PYTHON, conflicting with our venvs (#2795)
+- ✨ cibuildwheel prints the selected build identifiers at the start of the build. (#2785)
+- 🔐 The GitHub Action now references other actions with a full SHA (#2744)

-### v2.23.0
+### v3.4.0

-_1 March 2025_
+_5 March 2026_

- ✨ Adds official support for the new GitHub Actions Arm runners. In fact these worked out-of-the-box, now we include them in our tests and example configs. (#2135 via #2281)
- ✨ Adds support for building PyPy 3.11 wheels (#2268 via #2281)
- 🛠 Adopts the beta pypa/manylinux image for armv7l builds (#2269 via #2281)
- 🛠 Dependency updates, including Pyodide 0.27 (#2117 and #2281)
+- 🌟 You can now build wheels using `uv` as a build frontend. This should improve performance, especially if your project has lots of build dependencies. To use, set [`build-frontend`](https://cibuildwheel.pypa.io/en/stable/options/#build-frontend) to `uv`. (#2322)
+- ⚠️ We no longer support running on Travis CI. It may continue working but we don't run tests there anymore so we can't be sure. (#2682)
+- ✨ Improvements to building rust wheels on Android (#2650)
+- 🛠 Update Pyodide to 0.29.3 (#2719, #2733)
+- 🐛 Fix bug with the GitHub Action on Windows, where PATH was getting unnecessarily changed, causing issues with meson builds. (#2723)
+- ✨ Add support for quiet setting on `build` and `uv` from the cibuildwheel `build-verbosity` setting. (#2737)
+- 📚 Docs updates, including guidance on using Meson on Windows (#2718)

-<!-- [[[end]]] (sum: 9FCUvIZ+dy) -->
+<!-- [[[end]]] (sum: kQUcUVgqfM) -->

 ---

@@ -314,11 +370,22 @@ Everyone interacting with the cibuildwheel project via codebase, issue tracker,
 Maintainers
 -----------

+Core:
+
 - Joe Rickerby [@joerick](https://github.com/joerick)
 - Yannick Jadoul [@YannickJadoul](https://github.com/YannickJadoul)
 - Matthieu Darbois [@mayeut](https://github.com/mayeut)
 - Henry Schreiner [@henryiii](https://github.com/henryiii)
 - Grzegorz Bokota [@Czaki](https://github.com/Czaki)
+- Agriya Khetarpal [@agriyakhetarpal](https://github.com/agriyakhetarpal) (also Pyodide)
+
+Platform maintainers:
+
+- Russell Keith-Magee [@freakboy3742](https://github.com/freakboy3742) (iOS)
+- Hood Chatham [@hoodmane](https://github.com/hoodmane) (Pyodide)
+- Gyeongjae Choi [@ryanking13](https://github.com/ryanking13) (Pyodide)
+- Tim Felgentreff [@timfel](https://github.com/timfel) (GraalPy)
+- Malcolm Smith [@mhsmith](https://github.com/mhsmith) (Android)

 Credits
 -------
@@ -17,6 +17,10 @@ inputs:
    description: 'Build a specific wheel only. No need for arch/platform if this is set'
    required: false
    default: ''
+  extras:
+    description: 'Comma-separated list of extras to install'
+    required: false
+    default: ''
 branding:
  icon: package
  color: yellow
@@ -24,17 +28,18 @@ branding:
 runs:
  using: composite
  steps:
-    - uses: actions/setup-python@v5
+    - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
      id: python
      with:
-        python-version: "3.11 - 3.13"
+        python-version: "3.11 - 3.14"
        update-environment: false

    - id: cibw
      run: |
-        # Install cibuildwheel
-        "${{ steps.python.outputs.python-path }}" -u << "EOF"
+        # Install cibuildwheel and build the command line
+        "$PYTHON" -u << "EOF"
        import os
+        import shlex
        import shutil
        import sys
        import venv
@@ -42,6 +47,8 @@ runs:
        from pathlib import Path
        from subprocess import run

+        EXTRAS = set(e.strip() for e in os.environ.get("INPUT_EXTRAS", "").split(",") if e.strip())
+

        class EnvBuilder(venv.EnvBuilder):
            def __init__(self):
@@ -53,39 +60,88 @@ runs:
            def post_setup(self, context):
                super().post_setup(context)
                self.bin_path = Path(context.env_exe).parent
-                run([sys.executable, "-m", "pip", "--python", context.env_exe, "install", r"${{ github.action_path }}"], check=True)
+                install_spec = os.environ["GITHUB_ACTION_PATH"]
+                if EXTRAS:
+                    install_spec += f"[{','.join(sorted(EXTRAS))}]"
+                run([sys.executable, "-m", "pip", "--python", context.env_exe, "install", install_spec], check=True)


        print("::group::Install cibuildwheel")
-        venv_path = Path(r"${{ runner.temp }}") / "cibw"
+        venv_path = Path(os.environ["RUNNER_TEMP"]) / "cibw"
        if venv_path.exists():
            shutil.rmtree(venv_path)
+
        builder = EnvBuilder()
        builder.create(venv_path)
-        cibw_path = [path for path in builder.bin_path.glob("cibuildwheel*") if path.stem == "cibuildwheel"][0]
+        exposed_binaries = {"cibuildwheel"}
+
+        if "uv" in EXTRAS:
+            exposed_binaries.add("uv")
+        clean_bin_path = builder.bin_path.parent / f"{builder.bin_path.name}.clean"
+        clean_bin_path.mkdir()
+
+        for path in list(builder.bin_path.iterdir()):
+            if path.stem in exposed_binaries:
+                try:
+                    os.symlink(path, clean_bin_path / path.name)
+                except OSError:
+                    shutil.copy2(path, clean_bin_path / path.name)
+
+        cibw_bin = [p for p in builder.bin_path.glob("cibuildwheel*") if p.stem == "cibuildwheel"][0]
+
+        # Build the command line
+        cmd_args = [str(cibw_bin), os.environ["INPUT_PACKAGE_DIR"]]
+
+        if output_dir := os.environ.get("INPUT_OUTPUT_DIR"):
+            cmd_args += ["--output-dir", output_dir]
+
+        if config_file := os.environ.get("INPUT_CONFIG_FILE"):
+            cmd_args += ["--config-file", config_file]
+
+        if only := os.environ.get("INPUT_ONLY"):
+            cmd_args += ["--only", only]
+
+        cmd_bash = shlex.join(cmd_args)
+
+        def pwsh_quote(text):
+            # Wrap in single quotes and double-up any existing single quotes
+            return "'" + str(text).replace("'", "''") + "'"
+
+        # Prepend '& ' so PowerShell executes the quoted binary path
+        cmd_pwsh = "& " + " ".join(pwsh_quote(arg) for arg in cmd_args)
+
        with open(os.environ["GITHUB_OUTPUT"], "at") as f:
-            f.write(f"cibw-path={cibw_path}\n")
+            f.write(f"prepend-path={clean_bin_path}\n")
+            f.write(f"cmd-bash={cmd_bash}\n")
+            f.write(f"cmd-pwsh={cmd_pwsh}\n")
+
        print("::endgroup::")
        EOF
      shell: bash
+      env:
+        PYTHON: ${{ steps.python.outputs.python-path }}
+        INPUT_PACKAGE_DIR: ${{ inputs.package-dir }}
+        INPUT_OUTPUT_DIR: ${{ inputs.output-dir }}
+        INPUT_CONFIG_FILE: ${{ inputs.config-file }}
+        INPUT_ONLY: ${{ inputs.only }}
+        INPUT_EXTRAS: ${{ inputs.extras }}

    # Redirecting stderr to stdout to fix interleaving issue in Actions.
-    - run: >
-        "${{ steps.cibw.outputs.cibw-path }}"
-        "${{ inputs.package-dir }}"
-        ${{ inputs.output-dir != ''  && format('--output-dir "{0}"', inputs.output-dir) || ''}}
-        ${{ inputs.config-file != '' && format('--config-file "{0}"', inputs.config-file) || ''}}
-        ${{ inputs.only != ''        && format('--only "{0}"', inputs.only) || ''}}
-        2>&1
+    - run: |
+        export PATH="$CIBW_PREPEND_PATH:$PATH"
+        eval "$CIBW_CMD_BASH" 2>&1
      shell: bash
      if: runner.os != 'Windows'
+      env:
+        CIBW_PREPEND_PATH: ${{ steps.cibw.outputs.prepend-path }}
+        CIBW_CMD_BASH: ${{ steps.cibw.outputs.cmd-bash }}

    # Windows needs powershell to interact nicely with Meson
-    - run: >
-        & "${{ steps.cibw.outputs.cibw-path }}"
-        "${{ inputs.package-dir }}"
-        ${{ inputs.output-dir != ''  && format('--output-dir "{0}"', inputs.output-dir) || ''}}
-        ${{ inputs.config-file != '' && format('--config-file "{0}"', inputs.config-file) || ''}}
-        ${{ inputs.only != ''        && format('--only "{0}"', inputs.only) || ''}}
+    - run: |
+        $env:PATH = "$env:CIBW_PREPEND_PATH;$env:PATH"
+        Invoke-Expression $env:CIBW_CMD_PWSH
      shell: pwsh
      if: runner.os == 'Windows'
+      env:
+        CIBW_PREPEND_PATH: ${{ steps.cibw.outputs.prepend-path }}
+        CIBW_CMD_PWSH: ${{ steps.cibw.outputs.cmd-pwsh }}
@@ -12,61 +12,80 @@ pr:
      - .readthedocs.yml
      - .travis.yml
      - README.md
-      - mkdocs.yml
+      - properdocs.yml
      - noxfile.py

 jobs:
- job: linux_311
+- job: tests
+  strategy:
+    matrix:
+      linux_313:
+        imageName: "ubuntu-latest"
+        pythonVersion: "3.13"
+        testSelect: "native"
+      android_313:
+        imageName: "ubuntu-latest"
+        pythonVersion: "3.13"
+        testSelect: "android"
+      macos_313:
+        imageName: "macos-latest"
+        pythonVersion: "3.13"
+        testSelect: "native"
+      ios_313:
+        imageName: "macos-14"  # See https://github.com/actions/runner-images/issues/12777
+        pythonVersion: "3.13"
+        testSelect: "ios"
+      android_macos_313:
+        imageName: "macos-latest"
+        pythonVersion: "3.13"
+        testSelect: "android"
+      windows_313:
+        imageName: "windows-latest"
+        pythonVersion: "3.13"
+        testSelect: "native"
  timeoutInMinutes: 180
-  pool: {vmImage: 'ubuntu-latest'}
-  steps:
-    - task: UsePythonVersion@0
-      inputs:
-        versionSpec: '3.11'
-    - bash: |
-        docker run --rm --privileged docker.io/tonistiigi/binfmt:latest --install all
-        python -m pip install -U pip
-        python -m pip install -e. --group test
-        if [ "$(Build.SourceBranch)" = "refs/heads/main" ]; then
-          echo "INFO: Exporting CIBW_ENABLE=all for main branch test run."
-          export CIBW_ENABLE=all
-        else
-          echo "INFO: CIBW_ENABLE not set for this branch ($(Build.SourceBranch))."
-        fi
-        python ./bin/run_tests.py
+  pool:
+    vmImage: $(imageName)
+  variables:
+    # Relocate cibuildwheel's download cache (interpreters) and the per-worker
+    # test pip caches (which live under it) to a stable, cacheable path.
+    CIBW_CACHE_PATH: $(Pipeline.Workspace)/.cibw-cache

- job: macos_311
-  pool: {vmImage: 'macOS-latest'}
-  timeoutInMinutes: 120
  steps:
    - task: UsePythonVersion@0
      inputs:
-        versionSpec: '3.11'
-    - bash: |
-        python -m pip install -U pip
-        python -m pip install -e. --group test
-        if [ "$(Build.SourceBranch)" = "refs/heads/main" ]; then
-          echo "INFO: Exporting CIBW_ENABLE=all for main branch test run."
-          export CIBW_ENABLE=all
-        else
-          echo "INFO: CIBW_ENABLE not set for this branch ($(Build.SourceBranch))."
-        fi
-        python ./bin/run_tests.py
+        versionSpec: $(pythonVersion)

- job: windows_311
-  pool: {vmImage: 'windows-latest'}
-  timeoutInMinutes: 180
-  steps:
-    - task: UsePythonVersion@0
+    - task: Cache@2
+      displayName: 'Cache cibuildwheel downloads'
      inputs:
-        versionSpec: '3.11'
+        # build-platforms.toml carries the interpreter pins; bump the version
+        # prefix to force a cold cache. restoreKeys lets a stale cache still seed
+        # a new run (cibuildwheel re-downloads only what's missing).
+        key: 'cibw-cache | v1 | "$(imageName)" | "$(testSelect)" | cibuildwheel/resources/build-platforms.toml'
+        restoreKeys: |
+          cibw-cache | v1 | "$(imageName)" | "$(testSelect)"
+        path: $(CIBW_CACHE_PATH)
+
+    - task: JavaToolInstaller@0
+      condition: and(eq(variables['testSelect'], 'android'), eq(variables['Agent.OS'], 'Linux'))
+      inputs:
+        versionSpec: '17'
+        jdkArchitectureOption: 'x64'
+        jdkSourceOption: 'PreInstalled'
+
+    - bash: docker run --rm --privileged docker.io/tonistiigi/binfmt:latest --install all
+      condition: and(eq(variables['imageName'], 'ubuntu-latest'), eq(variables['testSelect'], 'native'))
+      displayName: 'Install binfmt on Linux'
+
+    - bash: python -m pip install -U pip && python -m pip install -e. --group test
+      displayName: 'Update pip and install cibuildwheel --group test'
+
+    - bash: echo "##vso[task.setvariable variable=CIBW_ENABLE;]all"
+      condition: eq(variables['Build.SourceBranch'], 'refs/heads/main')
+      displayName: Set CIBW_ENABLE to all (main branch)
+
    - bash: |
-        python -m pip install -U pip
-        python -m pip install -e. --group test
-        if [ "$(Build.SourceBranch)" = "refs/heads/main" ]; then
-          echo "INFO: Exporting CIBW_ENABLE=all for main branch test run."
-          export CIBW_ENABLE=all
-        else
-          echo "INFO: CIBW_ENABLE not set for this branch ($(Build.SourceBranch))."
-        fi
-        python ./bin/run_tests.py
+        echo "CIBW_ENABLE = $CIBW_ENABLE"
+        python ./bin/run_tests.py --test-select $(testSelect)
+      displayName: 'Run tests'
@@ -1,7 +1,7 @@
-#!/usr/bin/env python3
+#!/usr/bin/env -S uv run --script

 # /// script
-# dependencies = ["click", "packaging"]
+# dependencies = ["click", "packaging", "prek"]
 # ///


@@ -68,8 +68,8 @@ def bump_version() -> None:
        sys.exit(1)

    # fmt: off
-    print(              'Current version:', current_version)
-    new_version = input('    New version: ').strip()
+    print(              "Current version:", current_version)
+    new_version = input("    New version: ").strip()
    # fmt: on

    try:
@@ -139,7 +139,7 @@ def bump_version() -> None:
    # run pre-commit to update the README changelog
    subprocess.run(
        [
-            "pre-commit",
+            "prek",
            "run",
            "--files=docs/changelog.md",
        ],
@@ -149,7 +149,7 @@ def bump_version() -> None:
    # run pre-commit to check that no errors occurred on the second run
    subprocess.run(
        [
-            "pre-commit",
+            "prek",
            "run",
            "--files=docs/changelog.md",
        ],
@@ -1,4 +1,14 @@
-#!/usr/bin/env python3
+#!/usr/bin/env -S uv run --script
+
+# /// script
+# dependencies = [
+#   "click",
+#   "cibuildwheel",
+# ]
+#
+# [tool.uv.sources]
+# cibuildwheel = { path = ".." }
+# ///

 import sys
 import textwrap
@@ -1,4 +1,4 @@
-#!/usr/bin/env python
+#!/usr/bin/env -S uv run --script

 # /// script
 # dependencies = ["pyyaml"]
@@ -6,20 +6,17 @@

 import argparse
 import copy
-import functools
 import json
-import sys
 from typing import Any

 import yaml

-make_parser = functools.partial(argparse.ArgumentParser, allow_abbrev=False)
-if sys.version_info >= (3, 14):
-    make_parser = functools.partial(make_parser, color=True, suggest_on_error=True)
-parser = make_parser()
+parser = argparse.ArgumentParser(allow_abbrev=False)
 parser.add_argument("--schemastore", action="store_true", help="Generate schema_store version")
 args = parser.parse_args()

+# The defaults in the schema are used by external tools for validation and IDE support. They
+# should match the values in defaults.toml, which are used by cibuildwheel itself.
 starter = """
 $schema: http://json-schema.org/draft-07/schema#
 $id: https://github.com/pypa/cibuildwheel/blob/main/cibuildwheel/resources/cibuildwheel.schema.json
@@ -33,8 +30,6 @@ $defs:
    description: How to inherit the parent's value.
  enable:
    enum:
-      - cpython-experimental-riscv64
-      - cpython-freethreading
      - cpython-prerelease
      - graalpy
      - pyodide-prerelease
@@ -45,6 +40,12 @@ additionalProperties: false
 description: cibuildwheel's settings.
 type: object
 properties:
+  audit-command:
+    description: Execute a shell command to audit each wheel after it is repaired. Use {wheel} for each wheel path, or {abi3_wheel} to only audit abi3 wheels.
+    type: string_array
+  audit-requires:
+    description: Install Python dependencies for the audit step.
+    type: string_array
  archs:
    description: Change the architectures built on your machine by default.
    type: string_array
@@ -63,21 +64,23 @@ properties:
    type: string_array
  build-frontend:
    default: default
-    description: Set the tool to use to build, either "pip" (default for now), "build", or "build[uv]"
+    description: Set the tool to use to build, either "build" (default), "build[uv]", "uv", or "pip"
    oneOf:
-      - enum: [pip, build, "build[uv]", default]
+      - enum: [pip, build, "build[uv]", uv, default]
      - type: string
        pattern: '^pip; ?args:'
      - type: string
        pattern: '^build; ?args:'
      - type: string
        pattern: '^build\\[uv\\]; ?args:'
+      - type: string
+        pattern: '^uv; ?args:'
      - type: object
        additionalProperties: false
        required: [name]
        properties:
          name:
-            enum: [pip, build, "build[uv]"]
+            enum: [pip, build, "build[uv]", uv]
          args:
            type: array
            items:
@@ -199,6 +202,9 @@ properties:
  xbuild-tools:
    description: Binaries on the path that should be included in an isolated cross-build environment
    type: string_array
+  xbuild-files:
+    description: Platform-specific files in the build environment
+    type: string_table_array
  pyodide-version:
    type: string
    description: Specify the version of Pyodide to use
@@ -229,6 +235,24 @@ properties:
  test-environment:
    description: Set environment variables for the test environment
    type: string_table
+  test-runtime:
+    description: Additional configuration for the test runner
+    oneOf:
+      - type: string
+        pattern: '^$'
+      - type: object
+        additionalProperties: false
+      - type: string
+        pattern: 'args:'
+      - type: object
+        additionalProperties: false
+        required: [args]
+        properties:
+          args:
+            type: array
+            items:
+              type: string
+
 """

 schema = yaml.safe_load(starter)
@@ -295,9 +319,12 @@ items:
      type: object
      additionalProperties: false
      properties:
+        audit-command: {"$ref": "#/$defs/inherit"}
+        audit-requires: {"$ref": "#/$defs/inherit"}
        before-all: {"$ref": "#/$defs/inherit"}
        before-build: {"$ref": "#/$defs/inherit"}
        xbuild-tools: {"$ref": "#/$defs/inherit"}
+        xbuild-files: {"$ref": "#/$defs/inherit"}
        before-test: {"$ref": "#/$defs/inherit"}
        config-settings: {"$ref": "#/$defs/inherit"}
        container-engine: {"$ref": "#/$defs/inherit"}
@@ -309,6 +336,7 @@ items:
        test-sources: {"$ref": "#/$defs/inherit"}
        test-requires: {"$ref": "#/$defs/inherit"}
        test-environment: {"$ref": "#/$defs/inherit"}
+        test-runtime: {"$ref": "#/$defs/inherit"}
 """
 )

@@ -348,27 +376,49 @@ oses = {
    "windows": as_object(not_linux),
    "macos": as_object(not_linux),
    "pyodide": as_object(not_linux),
+    "android": as_object(not_linux),
    "ios": as_object(not_linux),
 }

-oses["linux"]["properties"]["repair-wheel-command"] = {
-    **schema["properties"]["repair-wheel-command"],
-    "default": "auditwheel repair -w {dest_dir} {wheel}",
-}
-oses["macos"]["properties"]["repair-wheel-command"] = {
-    **schema["properties"]["repair-wheel-command"],
-    "default": "delocate-wheel --require-archs {delocate_archs} -w {dest_dir} -v {wheel}",
-}
+for os_name, command in [
+    ("linux", "auditwheel repair -w {dest_dir} {wheel}"),
+    ("windows", "delvewheel repair -w {dest_dir} -v {wheel}"),
+    ("macos", "delocate-wheel --require-archs {delocate_archs} -w {dest_dir} -v {wheel}"),
+    ("android", "auditwheel repair --ldpaths {ldpaths} -w {dest_dir} {wheel}"),
+]:
+    oses[os_name]["properties"]["repair-wheel-command"] = {
+        **schema["properties"]["repair-wheel-command"],
+        "default": command,
+    }

 del oses["linux"]["properties"]["dependency-versions"]

+oses["pyodide"]["properties"]["build-frontend"] = {
+    **schema["properties"]["build-frontend"],
+    "default": "pyodide-build",
+    "description": 'On the pyodide platform, the build frontend must be "pyodide-build"',
+    "oneOf": [
+        {"enum": ["pyodide-build"]},
+        {"type": "string", "pattern": "^pyodide-build; ?args:"},
+        {
+            "type": "object",
+            "additionalProperties": False,
+            "required": ["name"],
+            "properties": {
+                "name": {"enum": ["pyodide-build"]},
+                "args": {"type": "array", "items": {"type": "string"}},
+            },
+        },
+    ],
+}
+
 schema["properties"]["overrides"] = overrides
 schema["properties"] |= oses

 if args.schemastore:
    schema["$id"] = "https://json.schemastore.org/partial-cibuildwheel.json"
    schema["description"] = (
-        "cibuildwheel's toml file, generated with ./bin/generate_schema.py --schemastore from cibuildwheel."
+        "cibuildwheel's settings. Generated with ./bin/generate_schema.py --schemastore from cibuildwheel."
    )

 print(json.dumps(schema, indent=2))
@@ -1,4 +1,17 @@
-#!/usr/bin/env python3
+#!/usr/bin/env -S uv run --script
+
+# /// script
+# dependencies = [
+#   "click",
+#   "pygithub",
+#   "pyyaml",
+#   "rich",
+#   "cibuildwheel",
+# ]
+#
+# [tool.uv.sources]
+# cibuildwheel = { path = ".." }
+# ///

 """
 Check known projects for usage of requires-python.
@@ -11,8 +24,9 @@ This will cache the results to all_known_setup.yaml; you can reprint
 the results without the `--online` setting.
 """

+from __future__ import annotations
+
 import ast
-from collections.abc import Iterable, Iterator
 from pathlib import Path

 import click
@@ -22,6 +36,10 @@ from rich import print

 from cibuildwheel.projectfiles import Analyzer

+TYPE_CHECKING = False
+if TYPE_CHECKING:
+    from collections.abc import Iterable, Iterator
+
 DIR = Path(__file__).parent.resolve()


@@ -1,4 +1,10 @@
-#!/usr/bin/env python3
+#!/usr/bin/env -S uv run --script
+
+# /// script
+# dependencies = [
+#   "click",
+# ]
+# ///


 import os
@@ -1,4 +1,4 @@
-#!/usr/bin/env python3
+#!/usr/bin/env -S uv run --script

 # /// script
 # dependencies = [
@@ -17,20 +17,26 @@ Suggested usage:
    git diff
 """

+from __future__ import annotations
+
 import builtins
 import functools
 import textwrap
+import urllib.error
 import urllib.request
 import xml.dom.minidom
-from collections.abc import Iterable, Mapping, Sequence
-from datetime import datetime
+from datetime import UTC, datetime
 from io import StringIO
 from pathlib import Path
 from typing import Any, Self, TextIO

 import click
 import yaml
-from github import Github, GithubException
+from github import Auth, Github, GithubException
+
+TYPE_CHECKING = False
+if TYPE_CHECKING:
+    from collections.abc import Iterable, Mapping, Sequence

 ICONS = (
    "github",
@@ -38,10 +44,12 @@ ICONS = (
    "circleci",
    "gitlab",
    "travisci",
-    "cirrusci",
    "windows",
    "apple",
    "linux",
+    "android",
+    "ios",
+    "pyodide",
 )


@@ -77,7 +85,7 @@ class Project:
                    self.notes = notes
        else:
            self.num_stars = 0
-            self.pushed_at = datetime.utcnow()
+            self.pushed_at = datetime.now(UTC)

        name_len = len(self.name) + 4
        self.__class__.NAME = max(self.__class__.NAME, name_len)
@@ -124,14 +132,19 @@ class Project:
        return f"[{self.name}]: {self.url}"

    def info(self) -> str:
-        days = (datetime.utcnow() - self.pushed_at).days
+        days = (datetime.now(UTC) - self.pushed_at).days
        return f"<!-- {self.name}: {self.num_stars}, last pushed {days} days ago -->"


 def fetch_icon(icon_name: str) -> None:
    url = f"https://cdn.jsdelivr.net/npm/simple-icons@v4/icons/{icon_name}.svg"
-    with urllib.request.urlopen(url) as f:
-        original_svg_data = f.read()
+    try:
+        with urllib.request.urlopen(url) as f:
+            original_svg_data = f.read()
+    except urllib.error.HTTPError as e:
+        if e.code == 404 and path_for_icon(icon_name).exists():
+            return
+        raise

    document = xml.dom.minidom.parseString(original_svg_data)
    svgElement = document.documentElement
@@ -165,7 +178,7 @@ def get_projects(
        for icon in ICONS:
            fetch_icon(icon)

-    github = Github(auth) if online else None
+    github = Github(auth=Auth.Token(auth)) if (online and auth) else None

    return sorted((Project(item, github) for item in config), reverse=online)

@@ -1,4 +1,4 @@
-#!/usr/bin/env python3
+#!/usr/bin/env -S uv run --script

 import re
 from pathlib import Path
@@ -1,4 +1,4 @@
-#!/usr/bin/env python3
+#!/usr/bin/env -S uv run --script

 import dataclasses
 import re
@@ -1,7 +1,15 @@
-#!/usr/bin/env python3
+#!/usr/bin/env -S uv run --script
+
+# /// script
+# dependencies = [
+#   "click",
+#   "jinja2",
+# ]
+# ///


 import os
+import re
 import shutil
 import subprocess
 import sys
@@ -13,7 +21,9 @@ from urllib.parse import quote

 import click

-DIR = Path(__file__).parent.resolve()
+DIR = Path(__file__).parent.parent.resolve()
+
+BuildBackend = typing.Literal["setuptools", "meson"]


 def shell(cmd: str, *, check: bool, **kwargs: object) -> subprocess.CompletedProcess[str]:
@@ -26,11 +36,20 @@ def git_repo_has_changes() -> bool:
    return unstaged_changes or staged_changes


-def generate_basic_project(path: Path) -> None:
+def generate_project(path: Path, build_backend: BuildBackend) -> None:
    sys.path.insert(0, "")
-    from test.test_projects.c import new_c_project
+    match build_backend:
+        case "meson":
+            from test.test_projects.meson import new_meson_project  # noqa: PLC0415
+
+            project = new_meson_project()
+        case "setuptools":
+            from test.test_projects.setuptools import new_c_project  # noqa: PLC0415
+
+            project = new_c_project()
+        case _:
+            typing.assert_never(build_backend)

-    project = new_c_project()
    project.generate(path)


@@ -38,6 +57,45 @@ class CIService(typing.NamedTuple):
    name: str
    dst_config_path: str
    badge_md: str
+    config_file_transform: typing.Callable[[str, str], str] = lambda x, _: x  # identity by default
+
+
+def github_config_file_transform(content: str, git_ref: str) -> str:
+    # one of the the github configs only builds on main, so we need to remove that restriction
+    # so our example build will run on the test branch.
+    #
+    # replace:
+    # """
+    # push:
+    #   branches:
+    #     - main
+    # """
+    # with:
+    # """
+    # push:
+    # """"
+    content = re.sub(
+        r"push:\n\s+branches:\n\s+- main",
+        "push:",
+        content,
+    )
+
+    # use the version of cibuildwheel from the current commit, not the latest
+    # release
+    # replace:
+    # """
+    # uses: pypa/cibuildwheel@v3.3.1
+    # """
+    # with:
+    # """
+    # uses: pypa/cibuildwheel@<latest commit hash>
+    # """
+    content = re.sub(
+        r"uses: pypa/cibuildwheel@v.*",
+        f"uses: pypa/cibuildwheel@{git_ref}",
+        content,
+    )
+    return content


 services = [
@@ -54,7 +112,8 @@ services = [
    CIService(
        name="github",
        dst_config_path=".github/workflows/example.yml",
-        badge_md="[![Build](https://github.com/pypa/cibuildwheel/workflows/Build/badge.svg?branch={branch})](https://github.com/pypa/cibuildwheel/actions)",
+        badge_md="[![Build](https://github.com/pypa/cibuildwheel/actions/workflows/example.yml/badge.svg?branch={branch})](https://github.com/pypa/cibuildwheel/actions?query=branch%3A{branch})",
+        config_file_transform=github_config_file_transform,
    ),
    CIService(
        name="travis-ci",
@@ -66,11 +125,6 @@ services = [
        dst_config_path=".gitlab-ci.yml",
        badge_md="[![Gitlab](https://gitlab.com/joerick/cibuildwheel/badges/{branch}/pipeline.svg)](https://gitlab.com/joerick/cibuildwheel/-/commits/{branch})",
    ),
-    CIService(
-        name="cirrus-ci",
-        dst_config_path=".cirrus.yml",
-        badge_md="[![Cirrus CI](https://api.cirrus-ci.com/github/pypa/cibuildwheel.svg?branch={branch})](https://cirrus-ci.com/github/pypa/cibuildwheel/{branch})",
-    ),
 ]


@@ -85,18 +139,23 @@ def ci_service_for_config_file(config_file: Path) -> CIService:

@click.command()
@click.argument("config_files", nargs=-1, type=click.Path())
-def run_example_ci_configs(config_files=None):
+@click.option("--build-backend", type=click.Choice(["setuptools", "meson"]), default="setuptools")
+def run_example_ci_configs(
+    config_files: list[str], build_backend: BuildBackend = "setuptools"
+) -> None:
    """
    Test the example configs. If no files are specified, will test
    examples/*-minimal.yml
    """

    if len(config_files) == 0:
-        config_files = Path("examples").glob("*-minimal.yml")
+        config_file_paths = list(Path("examples").glob("*-minimal.yml"))
+    else:
+        config_file_paths = [Path(f) for f in config_files]

    # check each CI service has at most 1 config file
    configs_by_service = set()
-    for config_file in config_files:
+    for config_file in config_file_paths:
        service = ci_service_for_config_file(config_file)
        if service.name in configs_by_service:
            msg = "You cannot specify more than one config per CI service"
@@ -110,6 +169,9 @@ def run_example_ci_configs(config_files=None):
    previous_branch = shell(
        "git rev-parse --abbrev-ref HEAD", check=True, capture_output=True, encoding="utf8"
    ).stdout.strip()
+    git_ref = shell(
+        "git rev-parse HEAD", check=True, capture_output=True, encoding="utf8"
+    ).stdout.strip()

    timestamp = time.strftime("%Y-%m-%dT%H-%M-%S", time.gmtime())
    branch_name = f"example-config-test---{previous_branch}-{timestamp}"
@@ -118,19 +180,22 @@ def run_example_ci_configs(config_files=None):
        shell(f"git checkout --orphan {branch_name}", check=True)

        example_project = Path("example_root")
-        generate_basic_project(example_project)
+        generate_project(example_project, build_backend=build_backend)

-        for config_file in config_files:
+        for config_file in config_file_paths:
            service = ci_service_for_config_file(config_file)
            dst_config_file = example_project / service.dst_config_path

            dst_config_file.parent.mkdir(parents=True, exist_ok=True)
-            shutil.copyfile(config_file, dst_config_file)
+
+            contents = config_file.read_text(encoding="utf8")
+            contents = service.config_file_transform(contents, git_ref)
+            dst_config_file.write_text(contents, encoding="utf8")

        subprocess.run(["git", "add", example_project], check=True)
        message = textwrap.dedent(
            f"""\
-            Test example minimal configs
+            Test example CI configs

            Testing files: {[str(f) for f in config_files]}
            Generated from branch: {previous_branch}
@@ -148,14 +213,14 @@ def run_example_ci_configs(config_files=None):
        print("> ")
        print("> | Service | Config | Status |")
        print("> |---|---|---|")
-        for config_file in config_files:
+        for config_file in config_file_paths:
            service = ci_service_for_config_file(config_file)
            badge = service.badge_md.format(
                branch=branch_name, branch_escaped=quote(branch_name, safe="")
            )
            print(f"> | {service.name} | `{config_file}` | {badge} |")
        print("> ")
-        print("> Generated by `bin/run_example_ci_config.py`")
+        print(f"> Generated by `{' '.join(sys.argv)}`")
        print()
        print("---")
    finally:
@@ -1,8 +1,7 @@
-#!/usr/bin/env python3
+#!/usr/bin/env -S uv run --script


 import argparse
-import functools
 import os
 import subprocess
 import sys
@@ -14,10 +13,7 @@ if __name__ == "__main__":
    else:
        default_cpu_count = os.process_cpu_count() or 2

-    make_parser = functools.partial(argparse.ArgumentParser, allow_abbrev=False)
-    if sys.version_info >= (3, 14):
-        make_parser = functools.partial(make_parser, color=True, suggest_on_error=True)
-    parser = make_parser()
+    parser = argparse.ArgumentParser(allow_abbrev=False)
    parser.add_argument(
        "--run-podman", action="store_true", default=False, help="run podman tests (linux only)"
    )
@@ -27,26 +23,66 @@ if __name__ == "__main__":
        default=default_cpu_count,
        help="number of processes to use for testing",
    )
+    parser.add_argument(
+        "--test-select",
+        choices={"all", "native", "android", "ios", "pyodide"},
+        default="all",
+        help="Either 'native' or 'android'/'ios'/'pyodide'",
+    )
    args = parser.parse_args()

    # move cwd to the project root
    os.chdir(Path(__file__).resolve().parents[1])

+    # doc tests
+    doc_test_args = [sys.executable, "-m", "pytest", "cibuildwheel"]
+
+    print(
+        "\n\n================================== DOC TESTS ==================================",
+        flush=True,
+    )
+    result = subprocess.run(doc_test_args, check=False)
+    if result.returncode not in (0, 5):
+        # Allow case where no doctests are collected (returncode 5) because
+        # circleci sets an explicit "-k" filter that disables doctests. There
+        # isn't a pattern that will only select doctests. This can be removed
+        # and have check=True if the circleci PYTEST_ADDOPTS is removed.
+        raise subprocess.CalledProcessError(
+            result.returncode, result.args, output=result.stdout, stderr=result.stderr
+        )
+
    # unit tests
+    print(
+        "\n\n================================== UNIT TESTS ==================================",
+        flush=True,
+    )
    unit_test_args = [sys.executable, "-m", "pytest", "unit_test"]

-    if sys.platform.startswith("linux") and os.environ.get("CIBW_PLATFORM", "linux") == "linux":
+    if (
+        sys.platform.startswith("linux")
+        and os.environ.get("CIBW_PLATFORM", "linux") == "linux"
+        and args.test_select in ["all", "native"]
+    ):
        # run the docker unit tests only on Linux
        unit_test_args += ["--run-docker"]

        if args.run_podman:
            unit_test_args += ["--run-podman"]

+    subprocess.run(unit_test_args, check=True)
+
    print(
-        "\n\n================================== UNIT TESTS ==================================",
+        "\n\n=========================== SERIAL INTEGRATION TESTS ===========================",
        flush=True,
    )
-    subprocess.run(unit_test_args, check=True)
+
+    match args.test_select:
+        case "all":
+            marks = []
+        case "native":
+            marks = ["not pyodide", "not android", "not ios"]
+        case mark:
+            marks = [f"{mark}"]

    # Run the serial integration tests without multiple processes
    serial_integration_test_args = [
@@ -54,7 +90,7 @@ if __name__ == "__main__":
        "-m",
        "pytest",
        "-m",
-        "serial",
+        f"{' and '.join(['serial', *marks])}",
        "-x",
        "--durations",
        "0",
@@ -62,19 +98,19 @@ if __name__ == "__main__":
        "test",
        "-vv",
    ]
-    print(
-        "\n\n=========================== SERIAL INTEGRATION TESTS ===========================",
-        flush=True,
-    )
+
    subprocess.run(serial_integration_test_args, check=True)

-    # Non-serial integration tests
+    print(
+        "\n\n========================= NON-SERIAL INTEGRATION TESTS =========================",
+        flush=True,
+    )
    integration_test_args = [
        sys.executable,
        "-m",
        "pytest",
        "-m",
-        "not serial",
+        f"{' and '.join(['not serial', *marks])}",
        f"--numprocesses={args.num_processes}",
        "-x",
        "--durations",
@@ -87,8 +123,4 @@ if __name__ == "__main__":
    if sys.platform.startswith("linux") and args.run_podman:
        integration_test_args += ["--run-podman"]

-    print(
-        "\n\n========================= NON-SERIAL INTEGRATION TESTS =========================",
-        flush=True,
-    )
    subprocess.run(integration_test_args, check=True)
@@ -1,8 +1,7 @@
-#!/usr/bin/env python3
+#!/usr/bin/env -S uv run --script


 import argparse
-import functools
 import os
 import subprocess
 import sys
@@ -13,10 +12,7 @@ if __name__ == "__main__":
    # move cwd to the project root
    os.chdir(Path(__file__).resolve().parents[1])

-    make_parser = functools.partial(argparse.ArgumentParser, allow_abbrev=False)
-    if sys.version_info >= (3, 14):
-        make_parser = functools.partial(make_parser, color=True, suggest_on_error=True)
-    parser = make_parser(description="Runs a sample build")
+    parser = argparse.ArgumentParser(description="Runs a sample build", allow_abbrev=False)
    parser.add_argument("project_python_path", nargs="?", default="test.test_0_basic.basic_project")

    options = parser.parse_args()
@@ -1,7 +1,15 @@
-#!/usr/bin/env python3
+#!/usr/bin/env -S uv run --script
+
+# /// script
+# dependencies = [
+#   "packaging",
+#   "requests",
+# ]
+# ///

 import configparser
 import dataclasses
+from functools import cache
 from pathlib import Path

 import requests
@@ -26,7 +34,7 @@ class PyPAImage(Image):
        super().__init__(manylinux_version, platforms, image_name, tag, True)


-images = [
+IMAGES = [
    # manylinux2014 images
    PyPAImage(
        "manylinux2014",
@@ -43,61 +51,109 @@ images = [
    ),
    # manylinux_2_28 images
    PyPAImage(
-        "manylinux_2_28", ["x86_64", "aarch64", "ppc64le", "s390x", "pypy_x86_64", "pypy_aarch64"]
+        "manylinux_2_28",
+        [
+            "x86_64",
+            "i686",
+            "aarch64",
+            "ppc64le",
+            "s390x",
+            "pypy_x86_64",
+            "pypy_i686",
+            "pypy_aarch64",
+        ],
    ),
    # manylinux_2_31 images
    PyPAImage("manylinux_2_31", ["armv7l"]),
    # manylinux_2_34 images
    PyPAImage(
-        "manylinux_2_34", ["x86_64", "aarch64", "ppc64le", "s390x", "pypy_x86_64", "pypy_aarch64"]
+        "manylinux_2_34",
+        [
+            "x86_64",
+            "i686",
+            "aarch64",
+            "ppc64le",
+            "s390x",
+            "pypy_x86_64",
+            "pypy_i686",
+            "pypy_aarch64",
+        ],
    ),
+    # manylinux_2_35 images
+    PyPAImage("manylinux_2_35", ["armv7l"]),
+    # manylinux_2_39 images
+    PyPAImage("manylinux_2_39", ["riscv64"]),
    # musllinux_1_2 images
-    PyPAImage("musllinux_1_2", ["x86_64", "i686", "aarch64", "ppc64le", "s390x", "armv7l"]),
+    PyPAImage(
+        "musllinux_1_2", ["x86_64", "i686", "aarch64", "ppc64le", "s390x", "armv7l", "riscv64"]
+    ),
 ]

-config = configparser.ConfigParser()

-for image in images:
-    # get the tag name whose digest matches 'latest'
-    if image.tag is not None:
-        # image has been pinned, do not update
-        tag_name = image.tag
-    elif image.image_name.startswith("quay.io/"):
-        _, _, repository_name = image.image_name.partition("/")
-        response = requests.get(
-            f"https://quay.io/api/v1/repository/{repository_name}?includeTags=true"
-        )
-        response.raise_for_status()
-        repo_info = response.json()
-        tags_dict = repo_info["tags"]
-
-        latest_tag = tags_dict.pop("latest")
+@cache
+def quay_lookup(image_name: str, tag_name: str) -> tuple[str, str]:
+    _, _, repository_name = image_name.partition("/")
+    if tag_name == "latest":
+        url = f"https://quay.io/api/v1/repository/{repository_name}?includeTags=true"
+    else:
+        url = f"https://quay.io/api/v1/repository/{repository_name}/tag?specificTag={tag_name}"
+    response = requests.get(url)
+    response.raise_for_status()
+    info = response.json()
+    if tag_name == "latest":
+        tags_dict = info["tags"]
+        tag_info = tags_dict.pop(tag_name)
        # find the tag whose manifest matches 'latest'
-        tag_name = next(
-            name
+        tag_name, digest = next(
+            (name, info["manifest_digest"])
            for (name, info) in tags_dict.items()
-            if info["manifest_digest"] == latest_tag["manifest_digest"]
+            if info["manifest_digest"] == tag_info["manifest_digest"]
        )
-    elif image.image_name.startswith("ghcr.io/"):
-        repository = image.image_name[8:]
-        response = requests.get(
-            "https://ghcr.io/token", params={"scope": f"repository:{repository}:pull"}
-        )
-        response.raise_for_status()
-        token = response.json()["token"]
+    else:
+        tags_list = info["tags"]
+        tag_info = next(tag for tag in tags_list if tag["name"] == tag_name)
+        digest = tag_info["manifest_digest"]
+
+    return tag_name, digest
+
+
+@cache
+def ghcr_lookup(image_name: str, tag_name: str) -> tuple[str, str]:
+    repository = image_name[8:]
+    response = requests.get(
+        "https://ghcr.io/token", params={"scope": f"repository:{repository}:pull"}
+    )
+    response.raise_for_status()
+    token = response.json()["token"]
+    if tag_name == "latest":
        response = requests.get(
            f"https://ghcr.io/v2/{repository}/tags/list",
            headers={"Authorization": f"Bearer {token}"},
        )
        response.raise_for_status()
-        ghcr_tags = [(Version(tag), tag) for tag in response.json()["tags"] if tag != "latest"]
+        info = response.json()
+        ghcr_tags = [(Version(tag), tag) for tag in info["tags"] if tag != "latest"]
        ghcr_tags.sort(reverse=True)
        tag_name = ghcr_tags[0][1]
-    else:
-        response = requests.get(f"https://hub.docker.com/v2/repositories/{image.image_name}/tags")
-        response.raise_for_status()
-        tags = response.json()["results"]

+    response = requests.head(
+        f"https://ghcr.io/v2/{repository}/manifests/{tag_name}",
+        headers={
+            "Authorization": f"Bearer {token}",
+            "Accept": "application/vnd.docker.distribution.manifest.v2+json, application/vnd.docker.distribution.manifest.list.v2+json, application/vnd.oci.image.manifest.v1+json, application/vnd.oci.image.index.v1+json, application/vnd.oci.artifact.manifest.v1+json",
+        },
+    )
+    response.raise_for_status()
+    digest = response.headers["Docker-Content-Digest"]
+    return tag_name, digest
+
+
+@cache
+def dockerhub_lookup(image_name: str, tag_name: str) -> tuple[str, str]:
+    response = requests.get(f"https://hub.docker.com/v2/repositories/{image_name}/tags")
+    response.raise_for_status()
+    tags = response.json()["results"]
+    if tag_name == "latest":
        latest_tag = next(tag for tag in tags if tag["name"] == "latest")
        # i don't know what it would mean to have multiple images per tag
        assert len(latest_tag["images"]) == 1
@@ -106,18 +162,40 @@ for image in images:
        pinned_tag = next(
            tag for tag in tags if tag != latest_tag and tag["images"][0]["digest"] == digest
        )
-        tag_name = pinned_tag["name"]
+    else:
+        pinned_tag = next(tag for tag in tags if tag["name"] == tag_name)
+        digest = pinned_tag["images"][0]["digest"]
+    tag_name = pinned_tag["name"]
+    return tag_name, digest

-    for platform in image.platforms:
-        if not config.has_section(platform):
-            config[platform] = {}
-        suffix = ""
-        if image.use_platform_suffix:
-            suffix = f"_{platform.removeprefix('pypy_')}"
-        config[platform][image.manylinux_version] = f"{image.image_name}{suffix}:{tag_name}"

-if not config.has_section("riscv64"):
-    config["riscv64"] = {}
+def main() -> None:
+    config = configparser.ConfigParser()
+    for image in IMAGES:
+        # get the tag name whose digest matches 'latest'
+        # if image has been pinned, do not update
+        search_tag = image.tag or "latest"
+        if image.image_name.startswith("quay.io/"):
+            lookup = quay_lookup
+        elif image.image_name.startswith("ghcr.io/"):
+            lookup = ghcr_lookup
+        else:
+            lookup = dockerhub_lookup

-with open(RESOURCES / "pinned_docker_images.cfg", "w") as f:
-    config.write(f)
+        tag_name, digest = lookup(image.image_name, search_tag)
+        for platform in image.platforms:
+            if not config.has_section(platform):
+                config[platform] = {}
+            image_name = image.image_name
+            if image.use_platform_suffix:
+                image_name = f"{image_name}_{platform.removeprefix('pypy_')}"
+                _, digest = lookup(image_name, tag_name)
+            assert digest.startswith("sha256:")
+            config[platform][image.manylinux_version] = f"{image_name}@{digest}  # {tag_name}"
+
+    with open(RESOURCES / "pinned_docker_images.cfg", "w") as f:
+        config.write(f)
+
+
+if __name__ == "__main__":
+    main()
@@ -1,49 +1,60 @@
-#!/usr/bin/env python3
+#!/usr/bin/env -S uv run --script

+# /// script
+# dependencies = [
+#   "playwright",
+# ]
+# ///

 import subprocess
 import sys
+import tempfile
 from pathlib import Path

-try:
-    from html2image import Html2Image  # type: ignore[import-not-found]
-except ImportError:
-    sys.exit(
-        """
-        html2image not found. Ensure you have Chrome (on Mac/Windows) or
-        Chromium (on Linux) installed, and then do:
-            pip install html2image
-        """
-    )
+from playwright.sync_api import sync_playwright  # type: ignore[import-not-found]
+
+CSS = """
+    <link href="https://fonts.googleapis.com/css2?family=Lato&display=swap" rel="stylesheet">
+    <style>
+        html, body {
+          font-family: Lato, "Helvetica Neue", Helvetica, Arial, sans-serif;
+          font-weight: 400;
+          font-size: 16px;
+          color: #404040;
+          background: white;
+          margin: 0;
+          padding: 0;
+        }
+        * {
+          box-sizing: border-box;
+        }
+    </style>
+"""


 def main() -> None:
-    subprocess.run(["mkdocs", "build"], check=True)
+    subprocess.run([sys.executable, "-m", "playwright", "install", "chromium"], check=True)

-    hti = Html2Image(custom_flags=["--force-device-scale-factor=2"])
+    html_str = Path("docs/diagram.html").read_text()
+    html_str = f"<html><head>{CSS}</head><body>{html_str}</body></html>"

-    html_str = Path("docs/diagram.md").read_text()
-    css_tags = f"""
-        <style>{Path("site/css/theme.css").read_text()}</style>
-        <style>{Path("site/css/theme_extra.css").read_text()}</style>
-        <style>{Path("site/extra.css").read_text()}</style>
-        <style>
-            body {{
-                background: white;
-            }}
-        </style>
-    """
-    html_str = css_tags + html_str
+    with tempfile.TemporaryDirectory() as tmp_dir_str:
+        html_path = Path(tmp_dir_str) / "diagram_screenshot.html"
+        html_path.write_text(html_str)

-    [screenshot, *_] = hti.screenshot(
-        html_str=html_str,
-        size=(830, 405),
-    )
+        dest_path = Path("docs/data/how-it-works.png")

-    dest_path = Path("docs/data/how-it-works.png")
-    dest_path.unlink(missing_ok=True)
+        with sync_playwright() as p:
+            browser = p.chromium.launch()
+            page = browser.new_page(device_scale_factor=2, viewport={"width": 830, "height": 600})
+            page.goto(html_path.as_uri())
+            page.wait_for_load_state("networkidle")

-    Path(screenshot).rename(dest_path)
+            height = page.evaluate("document.body.scrollHeight")
+            page.set_viewport_size({"width": 830, "height": height})
+
+            page.screenshot(path=str(dest_path), full_page=True)
+            browser.close()


 if __name__ == "__main__":
@@ -1,4 +1,13 @@
-#!/usr/bin/env python3
+#!/usr/bin/env -S uv run --script
+
+# /// script
+# dependencies = [
+#   "click",
+#   "packaging",
+#   "requests",
+#   "rich",
+# ]
+# ///


 import dataclasses
@@ -1,13 +1,33 @@
-#!/usr/bin/env python3
+#!/usr/bin/env -S uv run --script
+
+# /// script
+# dependencies = [
+#   "cibuildwheel",
+#   "requests",
+# ]
+#
+# [tool.uv.sources]
+# cibuildwheel = { path = ".." }
+# ///

 import json
+from pathlib import Path
+from typing import Final
+
+import requests

 from cibuildwheel.extra import github_api_request
 from cibuildwheel.util.python_build_standalone import (
    PythonBuildStandaloneAsset,
    PythonBuildStandaloneReleaseData,
 )
-from cibuildwheel.util.resources import PYTHON_BUILD_STANDALONE_RELEASES
+
+# Resolve path relative to this script so writes go to the source checkout,
+# not the uv-installed copy of the package.
+DIR: Final[Path] = Path(__file__).parent.parent.resolve()
+PYTHON_BUILD_STANDALONE_RELEASES: Final[Path] = (
+    DIR / "cibuildwheel/resources/python-build-standalone-releases.json"
+)


 def main() -> None:
@@ -25,8 +45,27 @@ def main() -> None:
        f"repos/astral-sh/python-build-standalone/releases/tags/{latest_tag}"
    )["assets"]

+    # Build a sha256 map from the SHA256SUMS file in the release
+    sha256_sums_urls = [
+        ga["browser_download_url"] for ga in github_assets if ga["name"] == "SHA256SUMS"
+    ]
+    name_to_sha256: dict[str, str] = {}
+    if sha256_sums_urls:
+        response = requests.get(sha256_sums_urls[0])
+        response.raise_for_status()
+        for line in response.text.splitlines():
+            parts = line.split()
+            if len(parts) == 2:
+                sha256_hex, filename = parts
+                # The filename may have a leading "./" or spaces - strip it
+                name_to_sha256[filename.lstrip("./")] = sha256_hex
+
    assets = [
-        PythonBuildStandaloneAsset(name=ga["name"], url=ga["browser_download_url"])
+        PythonBuildStandaloneAsset(
+            name=ga["name"],
+            url=ga["browser_download_url"],
+            sha256=name_to_sha256.get(ga["name"], ""),
+        )
        for ga in github_assets
        if ga["name"].endswith("install_only.tar.gz")
    ]
@@ -1,15 +1,28 @@
-#!/usr/bin/env python3
+#!/usr/bin/env -S uv run --script

+# /// script
+# dependencies = [
+#   "click",
+#   "packaging",
+#   "requests",
+#   "rich",
+#   "cibuildwheel",
+# ]
+#
+# [tool.uv.sources]
+# cibuildwheel = { path = ".." }
+# ///
+from __future__ import annotations

-import copy
 import difflib
+import hashlib
 import logging
 import operator
 import re
 import tomllib
-from collections.abc import Mapping, MutableMapping
 from pathlib import Path
-from typing import Any, Final, Literal, TypedDict
+from typing import Any, Final, Literal, NotRequired, TypedDict
+from xml.etree import ElementTree as ET

 import click
 import requests
@@ -20,6 +33,11 @@ from rich.logging import RichHandler
 from rich.syntax import Syntax

 from cibuildwheel.extra import dump_python_configurations, get_pyodide_xbuildenv_info
+from cibuildwheel.platforms.android import android_triplet
+
+TYPE_CHECKING = False
+if TYPE_CHECKING:
+    from collections.abc import Mapping, MutableMapping

 log = logging.getLogger("cibw")

@@ -32,39 +50,20 @@ RESOURCES_DIR: Final[Path] = DIR / "cibuildwheel/resources"
 ArchStr = Literal["32", "64", "ARM64"]


-class ConfigWinCP(TypedDict):
+class Config(TypedDict):
    identifier: str
    version: str
-    arch: str


-class ConfigWinPP(TypedDict):
-    identifier: str
-    version: str
-    arch: str
+class ConfigUrl(Config):
    url: str
+    sha256: NotRequired[str]


-class ConfigWinGP(TypedDict):
-    identifier: str
-    version: str
-    url: str
-
-
-class ConfigApple(TypedDict):
-    identifier: str
-    version: str
-    url: str
-
-
-class ConfigPyodide(TypedDict):
-    identifier: str
-    version: str
+class ConfigPyodide(Config):
    default_pyodide_version: str
    node_version: str
-
-
-AnyConfig = ConfigWinCP | ConfigWinPP | ConfigWinGP | ConfigApple | ConfigPyodide
+    sha256: str


 # The following set of "Versions" classes allow the initial call to the APIs to
@@ -98,7 +97,7 @@ class WindowsVersions:

        self.version_dict = {Version(v): v for v in cp_info["versions"]}

-    def update_version_windows(self, spec: Specifier) -> ConfigWinCP | None:
+    def update_version_windows(self, spec: Specifier) -> Config | None:
        # Specifier.filter selects all non pre-releases that match the spec,
        # unless there are only pre-releases, then it selects pre-releases
        # instead (like pip)
@@ -113,10 +112,9 @@ class WindowsVersions:
        flags = "t" if self.free_threaded else ""
        version = versions[0]
        identifier = f"cp{version.major}{version.minor}{flags}-{self.arch}"
-        return ConfigWinCP(
+        return Config(
            identifier=identifier,
            version=self.version_dict[version],
-            arch=self.arch_str,
        )


@@ -126,19 +124,27 @@ class GraalPyVersions:
        response.raise_for_status()

        releases = response.json()
-        gp_version_re = re.compile(r"-(\d+\.\d+\.\d+)$")
+        gp_asset_re = re.compile(
+            r"^(?P<prefix>graalpy(?P<cpython>\d+\.\d+)?-(?P<graalpy>\d+\.\d+\.\d+))-"
+        )
        cp_version_re = re.compile(r"Python (\d+\.\d+(?:\.\d+)?)")
        for release in releases:
-            m = gp_version_re.search(release["tag_name"])
-            if m:
-                release["graalpy_version"] = Version(m.group(1))
-            m = cp_version_re.search(release["body"])
-            if m:
+            for asset in release["assets"]:
+                m = gp_asset_re.match(asset["name"])
+                if m:
+                    release["asset_prefix"] = m.group("prefix")
+                    release["graalpy_version"] = Version(m.group("graalpy"))
+                    if m.group("cpython"):
+                        release["python_version"] = Version(m.group("cpython"))
+                    break
+            if "python_version" not in release and (
+                m := cp_version_re.search(release["body"] or "")
+            ):
                release["python_version"] = Version(m.group(1))

        self.releases = [r for r in releases if "graalpy_version" in r and "python_version" in r]

-    def update_version(self, identifier: str, spec: Specifier) -> AnyConfig:
+    def update_version(self, identifier: str, spec: Specifier) -> ConfigUrl | None:
        if "x86_64" in identifier or "amd64" in identifier:
            arch = "x86_64"
        elif "arm64" in identifier or "aarch64" in identifier:
@@ -147,28 +153,24 @@ class GraalPyVersions:
            msg = f"{identifier} not supported yet on GraalPy"
            raise RuntimeError(msg)

-        gpspec_str = identifier.split("-")[0].split("_")[1]
-        gpspec = Specifier("==24.2.*") if gpspec_str == "242" else Specifier(f"=={gpspec_str}.*")
+        gpspec_str = identifier.split("-", maxsplit=1)[0].split("_")[1]
+        if "." not in gpspec_str and len(gpspec_str) == 3:
+            gpspec_str = gpspec_str[:2] + "." + gpspec_str[-1]
+        gpspec = Specifier(f"=={gpspec_str}.*")

-        releases = [r for r in self.releases if spec.contains(r["python_version"])]
-        releases = [r for r in self.releases if gpspec.contains(r["graalpy_version"])]
-        releases = sorted(releases, key=lambda r: r["graalpy_version"])
+        releases_tmp = (r for r in self.releases if spec.contains(r["python_version"]))
+        releases_tmp = (r for r in releases_tmp if gpspec.contains(r["graalpy_version"]))
+        releases = sorted(releases_tmp, key=lambda r: r["graalpy_version"])

        if not releases:
            msg = f"GraalPy {arch} not found for {spec}!"
            raise RuntimeError(msg)

-        release = releases[-1]
-        version = release["python_version"]
-        gpversion = release["graalpy_version"]
-
        if "macosx" in identifier:
            arch = "x86_64" if "x86_64" in identifier else "arm64"
-            config = ConfigApple
            platform = "macos"
        elif "win" in identifier:
            arch = "aarch64" if "arm64" in identifier else "x86_64"
-            config = ConfigWinGP
            platform = "windows"
        else:
            msg = "GraalPy provides downloads for macOS and Windows and is included for manylinux"
@@ -176,18 +178,38 @@ class GraalPyVersions:

        arch = "amd64" if arch == "x86_64" else "aarch64"
        ext = "zip" if "win" in identifier else "tar.gz"
-        (url,) = (
-            rf["browser_download_url"]
-            for rf in release["assets"]
-            if rf["name"].endswith(f"{platform}-{arch}.{ext}")
-            and rf["name"].startswith(f"graalpy-{gpversion.major}")
-        )
+        for release in reversed(releases):
+            version = release["python_version"]
+            urls = [
+                rf["browser_download_url"]
+                for rf in release["assets"]
+                if rf["name"].endswith(f"{platform}-{arch}.{ext}")
+                and rf["name"].startswith(release["asset_prefix"])
+            ]
+            if not urls:
+                continue

-        return config(
-            identifier=identifier,
-            version=f"{version.major}.{version.minor}",
-            url=url,
-        )
+            (url,) = urls
+            # Fetch sha256 from the ".sha256" sidecar asset in the same release.
+            sha256 = ""
+            sha256_asset_name = url.rsplit("/", 1)[-1] + ".sha256"
+            sha256_urls = [
+                rf["browser_download_url"]
+                for rf in release["assets"]
+                if rf["name"] == sha256_asset_name
+            ]
+            if sha256_urls:
+                sha256_response = requests.get(sha256_urls[0])
+                sha256_response.raise_for_status()
+                sha256 = sha256_response.text.strip().split()[0]
+            return ConfigUrl(
+                identifier=identifier,
+                version=f"{version.major}.{version.minor}",
+                url=url,
+                sha256=sha256,
+            )
+
+        return None


 class PyPyVersions:
@@ -215,7 +237,7 @@ class PyPyVersions:
        ]
        return urls[0] if urls else ""

-    def update_version_windows(self, spec: Specifier) -> ConfigWinCP:
+    def update_version_windows(self, spec: Specifier) -> ConfigUrl:
        releases = [r for r in self.releases if spec.contains(r["python_version"])]
        releases = sorted(releases, key=operator.itemgetter("pypy_version"))
        releases = [r for r in releases if self.get_arch_file(r)]
@@ -231,14 +253,13 @@ class PyPyVersions:
        identifier = f"pp{version.major}{version.minor}-{version_arch}"
        url = self.get_arch_file(release)

-        return ConfigWinPP(
+        return ConfigUrl(
            identifier=identifier,
            version=f"{version.major}.{version.minor}",
-            arch=self.arch,
            url=url,
        )

-    def update_version_macos(self, spec: Specifier) -> ConfigApple:
+    def update_version_macos(self, spec: Specifier) -> ConfigUrl:
        if self.arch not in {"64", "ARM64"}:
            msg = f"'{self.arch}' arch not supported yet on macOS"
            raise RuntimeError(msg)
@@ -262,7 +283,7 @@ class PyPyVersions:
            if "" in rf["platform"] == "darwin" and rf["arch"] == arch
        )

-        return ConfigApple(
+        return ConfigUrl(
            identifier=identifier,
            version=f"{version.major}.{version.minor}",
            url=url,
@@ -286,39 +307,73 @@ class CPythonVersions:

            # Removing the prefix
            version = Version(release["name"].removeprefix("Python "))
+            self.versions_dict[version] = release["resource_uri"]

-            uri = int(release["resource_uri"].rstrip("/").split("/")[-1])
-            self.versions_dict[version] = uri
+        files_response = requests.get("https://www.python.org/api/v2/downloads/release_file/")
+        files_response.raise_for_status()
+        self.files_info = files_response.json()

-    def update_version_macos(
-        self, identifier: str, version: Version, spec: Specifier
-    ) -> ConfigApple | None:
+    def update_version(self, identifier: str, spec: Specifier, file_ident: str) -> ConfigUrl | None:
        # see note above on Specifier.filter
        unsorted_versions = spec.filter(self.versions_dict)
        sorted_versions = sorted(unsorted_versions, reverse=True)

-        macver = "x10.9" if version <= Version("3.8.9999") else "11"
-        file_ident = f"macos{macver}.pkg"
-
        for new_version in sorted_versions:
            # Find the first patch version that contains the requested file
            uri = self.versions_dict[new_version]
-            response = requests.get(
-                f"https://www.python.org/api/v2/downloads/release_file/?release={uri}"
-            )
-            response.raise_for_status()
-            file_info = response.json()
+            files = [rf for rf in self.files_info if rf["release"] == uri]

-            urls = [rf["url"] for rf in file_info if file_ident in rf["url"]]
-            if urls:
-                return ConfigApple(
+            matching = [rf for rf in files if file_ident in rf["url"]]
+            if matching:
+                rf = matching[0]
+                return ConfigUrl(
                    identifier=identifier,
                    version=f"{new_version.major}.{new_version.minor}",
-                    url=urls[0],
+                    url=rf["url"],
+                    sha256=rf.get("sha256_sum", ""),
                )

        return None

+    def update_version_macos(
+        self, identifier: str, version: Version, spec: Specifier
+    ) -> ConfigUrl | None:
+        macver = "x10.9" if version <= Version("3.8.9999") else "11"
+        return self.update_version(identifier, spec, f"macos{macver}.pkg")
+
+    def update_version_android(self, identifier: str, spec: Specifier) -> ConfigUrl | None:
+        return self.update_version(identifier, spec, android_triplet(identifier))
+
+
+class MavenVersions:
+    MAVEN_URL = "https://repo.maven.apache.org/maven2/com/chaquo/python/python"
+
+    def __init__(self) -> None:
+        response = requests.get(f"{self.MAVEN_URL}/maven-metadata.xml")
+        response.raise_for_status()
+        root = ET.fromstring(response.text)
+
+        self.versions: list[Version] = []
+        for version_elem in root.findall("./versioning/versions/version"):
+            version_str = version_elem.text
+            assert isinstance(version_str, str), version_str
+            self.versions.append(Version(version_str))
+
+    def update_version_android(self, identifier: str, spec: Specifier) -> ConfigUrl | None:
+        sorted_versions = sorted(spec.filter(self.versions), reverse=True)
+
+        # Return a config using the highest version for the given specifier.
+        if sorted_versions:
+            max_version = sorted_versions[0]
+            triplet = android_triplet(identifier)
+            return ConfigUrl(
+                identifier=identifier,
+                version=f"{max_version.major}.{max_version.minor}",
+                url=f"{self.MAVEN_URL}/{max_version}/python-{max_version}-{triplet}.tar.gz",
+            )
+        else:
+            return None
+

 class CPythonIOSVersions:
    def __init__(self) -> None:
@@ -349,11 +404,11 @@ class CPythonIOSVersions:
                if filename.endswith("-iOS-support"):
                    self.versions_dict[version][int(build[1:])] = asset["browser_download_url"]

-    def update_version_ios(self, identifier: str, version: Version) -> ConfigApple | None:
+    def update_version_ios(self, identifier: str, version: Version) -> ConfigUrl | None:
        # Return a config using the highest build number for the given version.
        urls = [url for _, url in sorted(self.versions_dict.get(version, {}).items())]
        if urls:
-            return ConfigApple(
+            return ConfigUrl(
                identifier=identifier,
                version=str(version),
                url=urls[-1],
@@ -392,6 +447,7 @@ class PyodideVersions:
            version=str(version),
            default_pyodide_version=release["version"],
            node_version=node_version,
+            sha256=release["sha256"],
        )


@@ -409,28 +465,38 @@ class AllVersions:
        self.windows_t_arm64 = WindowsVersions("ARM64", True)
        self.windows_pypy_64 = PyPyVersions("64")

-        self.macos_cpython = CPythonVersions()
+        self.cpython = CPythonVersions()
        self.macos_pypy = PyPyVersions("64")
        self.macos_pypy_arm64 = PyPyVersions("ARM64")

+        self.maven = MavenVersions()
        self.ios_cpython = CPythonIOSVersions()

        self.graalpy = GraalPyVersions()

        self.pyodide = PyodideVersions()

+    def _stream_sha256(self, url: str) -> str:
+        """Download a file (streaming) and return its SHA256 hex digest."""
+        log.debug("Computing sha256 for %s by streaming download...", url)
+        response = requests.get(url, stream=True)
+        response.raise_for_status()
+        hasher = hashlib.sha256()
+        for chunk in response.iter_content(65536):
+            hasher.update(chunk)
+        return hasher.hexdigest()
+
    def update_config(self, config: MutableMapping[str, str]) -> None:
        identifier = config["identifier"]
        version = Version(config["version"])
        spec = Specifier(f"=={version.major}.{version.minor}.*")
        log.info("Reading in %r -> %s @ %s", str(identifier), spec, version)
-        orig_config = copy.copy(config)
-        config_update: AnyConfig | None = None
+        config_update: Config | None = None

        # We need to use ** in update due to MyPy (probably a bug)
        if "macosx" in identifier:
            if identifier.startswith("cp"):
-                config_update = self.macos_cpython.update_version_macos(identifier, version, spec)
+                config_update = self.cpython.update_version_macos(identifier, version, spec)
            elif identifier.startswith("pp"):
                if "macosx_x86_64" in identifier:
                    config_update = self.macos_pypy.update_version_macos(spec)
@@ -455,18 +521,46 @@ class AllVersions:
            config_update = self.windows_t_arm64.update_version_windows(spec)
        elif "win_arm64" in identifier and identifier.startswith("cp"):
            config_update = self.windows_arm64.update_version_windows(spec)
+        elif "android" in identifier:
+            # Python 3.13 is released by Chaquopy on Maven Central.
+            # Python 3.14 and newer have official releases on python.org.
+            versions = self.maven if identifier.startswith("cp313") else self.cpython
+            config_update = versions.update_version_android(identifier, spec)
        elif "ios" in identifier:
-            config_update = self.ios_cpython.update_version_ios(identifier, version)
+            # Python 3.13 and 3.14 are released by BeeWare on GitHub.
+            # Python 3.15 and newer have official releases on python.org.
+            if identifier.startswith(("cp313", "cp314")):
+                config_update = self.ios_cpython.update_version_ios(identifier, version)
+            else:
+                config_update = self.cpython.update_version(
+                    identifier, spec, "iOS-XCframework.tar.gz"
+                )
        elif "pyodide" in identifier:
            config_update = self.pyodide.update_version_pyodide(
                identifier, version, spec, config["node_version"]
            )

        assert config_update is not None, f"{identifier} not found!"
-        config.update(**config_update)

-        if config != orig_config:
-            log.info("  Updated %s to %s", orig_config, config)
+        # Fill in sha256 for URL-based configs if not already provided by the
+        # update_version_* method (e.g. PyPy, BeeWare iOS, Maven have no sidecar).
+        # Also fills in sha256 when the CPython API doesn't return a sha256_sum
+        # (e.g. for older releases).
+        # Widen the type to allow arbitrary key access on the underlying dict.
+        config_update_dict: dict[str, str] = config_update  # type: ignore[assignment]
+        if "url" in config_update_dict and not config_update_dict.get("sha256"):
+            url = config_update_dict["url"]
+            existing_sha256 = config.get("sha256", "")
+            if url == config.get("url") and existing_sha256:
+                # URL unchanged — preserve the existing sha256
+                config_update_dict["sha256"] = existing_sha256
+            else:
+                config_update_dict["sha256"] = self._stream_sha256(url)
+
+        if config_update != config:
+            log.info("  Updated %s to %s", config, config_update)
+            config.clear()
+            config.update(**config_update)


@click.command()
@@ -490,17 +584,9 @@ def update_pythons(force: bool, level: str) -> None:
    with toml_file_path.open("rb") as f:
        configs = tomllib.load(f)

-    for config in configs["windows"]["python_configurations"]:
-        all_versions.update_config(config)
-
-    for config in configs["macos"]["python_configurations"]:
-        all_versions.update_config(config)
-
-    for config in configs["ios"]["python_configurations"]:
-        all_versions.update_config(config)
-
-    for config in configs["pyodide"]["python_configurations"]:
-        all_versions.update_config(config)
+    for platform in ["windows", "macos", "android", "ios", "pyodide"]:
+        for config in configs[platform]["python_configurations"]:
+            all_versions.update_config(config)

    result_toml = dump_python_configurations(configs)

@@ -1,20 +1,36 @@
-#!/usr/bin/env python3
+#!/usr/bin/env -S uv run --script
+
+# /// script
+# dependencies = [
+#   "click",
+#   "packaging",
+#   "requests",
+#   "rich",
+#   "cibuildwheel",
+# ]
+#
+# [tool.uv.sources]
+# cibuildwheel = { path = ".." }
+# ///


 import dataclasses
 import difflib
+import hashlib
 import logging
-import subprocess
 import tomllib
 from pathlib import Path
 from typing import Final

 import click
+import requests
 import rich
-from packaging.version import InvalidVersion, Version
+from packaging.version import Version
 from rich.logging import RichHandler
 from rich.syntax import Syntax

+from cibuildwheel.extra import github_api_request
+
 log = logging.getLogger("cibw")

 # Looking up the dir instead of using utils.resources_dir
@@ -30,32 +46,26 @@ GET_VIRTUALENV_URL_TEMPLATE: Final[str] = (

@dataclasses.dataclass(frozen=True, order=True)
 class VersionTuple:
+    name: str
+    download_url: str
    version: Version
-    version_string: str


-def git_ls_remote_versions(url: str) -> list[VersionTuple]:
-    versions: list[VersionTuple] = []
-    tags = subprocess.run(
-        ["git", "ls-remote", "--tags", url], check=True, text=True, capture_output=True
-    ).stdout.splitlines()
-    for tag in tags:
-        _, ref = tag.split()
-        assert ref.startswith("refs/tags/")
-        version_string = ref[10:]
-        try:
-            version = Version(version_string)
-            if version.is_devrelease:
-                log.info("Ignoring development release %r", str(version))
-                continue
-            if version.is_prerelease:
-                log.info("Ignoring pre-release %r", str(version))
-                continue
-            versions.append(VersionTuple(version, version_string))
-        except InvalidVersion:
-            log.warning("Ignoring ref %r", ref)
-    versions.sort(reverse=True)
-    return versions
+def get_latest_virtualenv_release() -> VersionTuple:
+    response = github_api_request("repos/pypa/get-virtualenv/releases/latest")
+    tag_name = response["tag_name"]
+
+    asset = next(
+        (asset for asset in response["assets"] if asset["name"] == "virtualenv.pyz"),
+        None,
+    )
+    if not asset:
+        msg = "No asset named 'virtualenv.pyz' found in the latest release of get-virtualenv."
+        raise RuntimeError(msg)
+
+    return VersionTuple(
+        version=Version(tag_name), name=tag_name, download_url=asset["browser_download_url"]
+    )


@click.command()
@@ -78,17 +88,36 @@ def update_virtualenv(force: bool, level: str) -> None:
    with toml_file_path.open("rb") as f:
        configurations = tomllib.load(f)
    default = configurations.pop("default")
-    version = str(default["version"])
-    versions = git_ls_remote_versions(GET_VIRTUALENV_GITHUB)
-    if versions[0].version > Version(version):
-        version = versions[0].version_string
+    local_version = str(default["version"])
+
+    latest_release = get_latest_virtualenv_release()
+
+    if latest_release.version > Version(local_version):
+        version = latest_release.name
+        url = latest_release.download_url
+        sha256 = ""  # recomputed below
+    else:
+        version = local_version
+        url = default["url"]
+        sha256 = default["sha256"]
+
+    # Compute sha256 if not already stored (new version or first-time population)
+    if not sha256:
+        log.info("Computing sha256 for %s...", url)
+        response = requests.get(url, stream=True)
+        response.raise_for_status()
+        hasher = hashlib.sha256()
+        for chunk in response.iter_content(65536):
+            hasher.update(chunk)
+        sha256 = hasher.hexdigest()

    configurations["default"] = {
        "version": version,
-        "url": GET_VIRTUALENV_URL_TEMPLATE.format(version=version),
+        "url": url,
+        "sha256": sha256,
    }
    result_toml = "".join(
-        f'{key} = {{ version = "{value["version"]}", url = "{value["url"]}" }}\n'
+        f'{key} = {{ version = "{value["version"]}", url = "{value["url"]}", sha256 = "{value["sha256"]}" }}\n'
        for key, value in configurations.items()
    )

@@ -1 +1 @@
-__version__ = "3.0.0"
+__version__ = "4.1.1"
@@ -1,32 +1,62 @@
+from __future__ import annotations
+
+__lazy_modules__ = {
+    "argparse",
+    "cibuildwheel._compat",
+    "cibuildwheel._compat.tarfile",
+    "cibuildwheel.architecture",
+    "cibuildwheel.ci",
+    "cibuildwheel.logger",
+    "cibuildwheel.options",
+    "cibuildwheel.platforms",
+    "cibuildwheel.selector",
+    "cibuildwheel.typing",
+    "cibuildwheel.util",
+    "cibuildwheel.util.file",
+    "cibuildwheel.util.helpers",
+    "cibuildwheel.util.resources",
+    "contextlib",
+    "functools",
+    "io",
+    "pathlib",
+    "shutil",
+    "tempfile",
+    "textwrap",
+    "traceback",
+}
+
 import argparse
 import contextlib
 import dataclasses
 import functools
+import io
 import os
 import shutil
 import sys
-import tarfile
 import textwrap
-import time
 import traceback
 import typing
-from collections.abc import Generator, Iterable, Sequence
 from pathlib import Path
 from tempfile import mkdtemp
-from typing import Any, Literal, TextIO

 import cibuildwheel
-import cibuildwheel.util
 from cibuildwheel import errors
+from cibuildwheel._compat.tarfile import TarFile, safe_extractall
 from cibuildwheel.architecture import Architecture, allowed_architectures_check
 from cibuildwheel.ci import CIProvider, detect_ci_provider, fix_ansi_codes_for_github_actions
 from cibuildwheel.logger import log
 from cibuildwheel.options import CommandLineArguments, Options, compute_options
-from cibuildwheel.platforms import ALL_PLATFORM_MODULES, get_build_identifiers
+from cibuildwheel.platforms import ALL_PLATFORM_MODULES, get_build_identifiers, native_platform
 from cibuildwheel.selector import BuildSelector, EnableGroup, selector_matches
 from cibuildwheel.typing import PLATFORMS, PlatformName
-from cibuildwheel.util.file import CIBW_CACHE_PATH
+from cibuildwheel.util.file import CIBW_CACHE_PATH, ensure_cache_sentinel
 from cibuildwheel.util.helpers import strtobool
+from cibuildwheel.util.resources import read_all_configs
+
+TYPE_CHECKING = False
+if TYPE_CHECKING:
+    from collections.abc import Generator, Iterable, Sequence
+    from typing import Literal


@dataclasses.dataclass
@@ -40,23 +70,6 @@ class FileReport:
    size: str


-# Taken from https://stackoverflow.com/a/107717
-class Unbuffered:
-    def __init__(self, stream: TextIO) -> None:
-        self.stream = stream
-
-    def write(self, data: str) -> None:
-        self.stream.write(data)
-        self.stream.flush()
-
-    def writelines(self, data: Iterable[str]) -> None:
-        self.stream.writelines(data)
-        self.stream.flush()
-
-    def __getattr__(self, attr: str) -> Any:
-        return getattr(self.stream, attr)
-
-
 def main() -> None:
    global_options = GlobalOptions()
    try:
@@ -79,29 +92,32 @@ def main_inner(global_options: GlobalOptions) -> None:
    `main_inner` is the same as `main`, but it raises FatalError exceptions
    rather than exiting directly.
    """
-
-    make_parser = functools.partial(argparse.ArgumentParser, allow_abbrev=False)
+    # Default in 3.15+, only needed on 3.14
    if sys.version_info >= (3, 14):
-        make_parser = functools.partial(make_parser, color=True, suggest_on_error=True)
-    parser = make_parser(
+        arg_parser = functools.partial(argparse.ArgumentParser, suggest_on_error=True)
+    else:
+        arg_parser = argparse.ArgumentParser
+
+    parser = arg_parser(
        description="Build wheels for all the platforms.",
        epilog="""
            Most options are supplied via environment variables or in
            --config-file (pyproject.toml usually). See
            https://github.com/pypa/cibuildwheel#options for info.
        """,
+        allow_abbrev=False,
    )

    parser.add_argument(
        "--platform",
-        choices=["auto", "linux", "macos", "windows", "pyodide", "ios"],
+        choices=["auto", "linux", "macos", "windows", "pyodide", "android", "ios"],
        default=None,
        help="""
            Platform to build for. Use this option to override the auto-detected
            platform. Specifying "macos" or "windows" only works on that
            operating system. "linux" works on any desktop OS, as long as
-            Docker/Podman is installed. "pyodide" only works on linux and macOS.
-            "ios" only work on macOS. Default: auto.
+            Docker/Podman is installed. "pyodide" and "android" only work on
+            Linux and macOS. "ios" only works on macOS. Default: auto.
        """,
    )

@@ -133,6 +149,8 @@ def main_inner(global_options: GlobalOptions) -> None:
    parser.add_argument(
        "--only",
        default=None,
+        choices=[v["identifier"] for vv in read_all_configs().values() for v in vv],
+        metavar="IDENTIFIER",
        help="""
            Force a single wheel build when given an identifier. Overrides
            CIBW_BUILD/CIBW_SKIP. --platform and --arch cannot be specified
@@ -180,6 +198,12 @@ def main_inner(global_options: GlobalOptions) -> None:
        help="Print the build identifiers matched by the current invocation and exit.",
    )

+    parser.add_argument(
+        "--clean-cache",
+        action="store_true",
+        help="Clear the cibuildwheel cache and exit.",
+    )
+
    parser.add_argument(
        "--allow-empty",
        action="store_true",
@@ -197,6 +221,48 @@ def main_inner(global_options: GlobalOptions) -> None:

    global_options.print_traceback_on_error = args.debug_traceback

+    if args.clean_cache:
+        if not CIBW_CACHE_PATH.exists():
+            print(f"Cache directory does not exist: {CIBW_CACHE_PATH}")
+            sys.exit(0)
+
+        sentinel_file = CIBW_CACHE_PATH / "CACHEDIR.TAG"
+        if not sentinel_file.exists():
+            print(
+                f"Error: {CIBW_CACHE_PATH} does not appear to be a cibuildwheel cache directory.",
+                "Only directories with a CACHEDIR.TAG sentinel file can be cleaned.",
+                sep="\n",
+                file=sys.stderr,
+            )
+            sys.exit(1)
+
+        # Verify signature to ensure it's a proper cache dir
+        # See https://bford.info/cachedir/ for more
+        try:
+            sentinel_content = sentinel_file.read_text(encoding="utf-8")
+        except OSError as e:
+            print(f"Error reading cache directory tag: {e}", file=sys.stderr)
+            sys.exit(1)
+
+        if not sentinel_content.startswith("Signature: 8a477f597d28d172789f06886806bc55"):
+            print(
+                f"Error: {sentinel_file} does not contain a valid cache directory signature.",
+                "For safety, only properly signed cache directories can be cleaned.",
+                sep="\n",
+                file=sys.stderr,
+            )
+            sys.exit(1)
+
+        print(f"Clearing cache directory: {CIBW_CACHE_PATH}")
+        try:
+            shutil.rmtree(CIBW_CACHE_PATH)
+            print("Cache cleared successfully.")
+        except OSError as e:
+            print(f"Error clearing cache: {e}", file=sys.stderr)
+            sys.exit(1)
+
+        sys.exit(0)
+
    args.package_dir = args.package_dir.resolve()

    # This are always relative to the base directory, even in SDist builds
@@ -210,8 +276,8 @@ def main_inner(global_options: GlobalOptions) -> None:
    # Tarfile builds require extraction and changing the directory
    temp_dir = Path(mkdtemp(prefix="cibw-sdist-")).resolve(strict=True)
    try:
-        with tarfile.open(args.package_dir) as tar:
-            tar.extractall(path=temp_dir)
+        with TarFile.open(args.package_dir) as tar:
+            safe_extractall(tar, temp_dir)

        # The extract directory is now the project dir
        try:
@@ -242,28 +308,14 @@ def _compute_platform_only(only: str) -> PlatformName:
        return "windows"
    if "pyodide_" in only:
        return "pyodide"
+    if "android_" in only:
+        return "android"
    if "ios_" in only:
        return "ios"
    msg = f"Invalid --only='{only}', must be a build selector with a known platform"
    raise errors.ConfigurationError(msg)


-def _compute_platform_auto() -> PlatformName:
-    if sys.platform.startswith("linux"):
-        return "linux"
-    elif sys.platform == "darwin":
-        return "macos"
-    elif sys.platform == "win32":
-        return "windows"
-    else:
-        msg = (
-            'Unable to detect platform from "sys.platform". cibuildwheel doesn\'t '
-            "support building wheels for this platform. You might be able to build for a different "
-            "platform using the --platform argument. Check --help output for more information."
-        )
-        raise errors.ConfigurationError(msg)
-
-
 def _compute_platform(args: CommandLineArguments) -> PlatformName:
    platform_option_value = args.platform or os.environ.get("CIBW_PLATFORM", "") or "auto"

@@ -281,45 +333,9 @@ def _compute_platform(args: CommandLineArguments) -> PlatformName:
    if args.only:
        return _compute_platform_only(args.only)
    elif platform_option_value != "auto":
-        return typing.cast(PlatformName, platform_option_value)
+        return typing.cast("PlatformName", platform_option_value)

-    return _compute_platform_auto()
-
-
-@contextlib.contextmanager
-def print_new_wheels(msg: str, output_dir: Path) -> Generator[None, None, None]:
-    """
-    Prints the new items in a directory upon exiting. The message to display
-    can include {n} for number of wheels, {s} for total number of seconds,
-    and/or {m} for total number of minutes. Does not print anything if this
-    exits via exception.
-    """
-
-    start_time = time.time()
-    existing_contents = set(output_dir.iterdir())
-    yield
-    final_contents = set(output_dir.iterdir())
-
-    new_contents = [
-        FileReport(wheel.name, f"{(wheel.stat().st_size + 1023) // 1024:,d}")
-        for wheel in final_contents - existing_contents
-    ]
-
-    if not new_contents:
-        return
-
-    max_name_len = max(len(f.name) for f in new_contents)
-    max_size_len = max(len(f.size) for f in new_contents)
-    n = len(new_contents)
-    s = time.time() - start_time
-    m = s / 60
-    print(
-        msg.format(n=n, s=s, m=m),
-        *sorted(
-            f"  {f.name:<{max_name_len}s}   {f.size:>{max_size_len}s} kB" for f in new_contents
-        ),
-        sep="\n",
-    )
+    return native_platform()


 def build_in_directory(args: CommandLineArguments) -> None:
@@ -353,13 +369,15 @@ def build_in_directory(args: CommandLineArguments) -> None:
    # Add CIBUILDWHEEL environment variable
    os.environ["CIBUILDWHEEL"] = "1"

-    # Python is buffering by default when running on the CI platforms, giving
-    # problems interleaving subprocess call output with unflushed calls to
-    # 'print'
-    sys.stdout = Unbuffered(sys.stdout)
+    # Python block-buffers stdout when it isn't a tty, which de-interleaves
+    # `print` output and direct fd-1 writes from subprocesses sharing this
+    # stdout. line_buffering allows each newline to flush all the way to fd-1.
+    if isinstance(sys.stdout, io.TextIOWrapper):
+        sys.stdout.reconfigure(line_buffering=True)

    # create the cache dir before it gets printed & builds performed
    CIBW_CACHE_PATH.mkdir(parents=True, exist_ok=True)
+    ensure_cache_sentinel(CIBW_CACHE_PATH)

    print_preamble(platform=platform, options=options, identifiers=identifiers)

@@ -382,7 +400,7 @@ def build_in_directory(args: CommandLineArguments) -> None:

    tmp_path = Path(mkdtemp(prefix="cibw-run-")).resolve(strict=True)
    try:
-        with print_new_wheels("\n{n} wheels produced in {m:.0f} minutes:", output_dir):
+        with log.print_summary(options=options):
            platform_module.build(options, tmp_path)
    finally:
        # avoid https://github.com/python/cpython/issues/86962 by performing
@@ -417,37 +435,50 @@ def print_preamble(platform: str, options: Options, identifiers: Sequence[str])
    print(f"Cache folder: {CIBW_CACHE_PATH}")
    print()

-    warnings = detect_warnings(options=options, identifiers=identifiers)
+    warnings = detect_warnings(options=options)
    for warning in warnings:
        log.warning(warning)

+    error_list = list(detect_errors(options=options, identifiers=identifiers))
+    if error_list:
+        for error in error_list:
+            log.error(error)
+        msg = "\n".join(error_list)
+        raise errors.ConfigurationError(msg)
+
+    n = len(identifiers)
+    print(f"{n} build{'s' if n != 1 else ''} selected:")
+    print(", ".join(identifiers))
+    print()
    print("Here we go!\n")


-def detect_warnings(*, options: Options, identifiers: Iterable[str]) -> list[str]:
-    warnings = []
+def detect_errors(*, options: Options, identifiers: Iterable[str]) -> Generator[str, None, None]:
+    # Check for deprecated CIBW_FREE_THREADED_SUPPORT environment variable
+    if "CIBW_FREE_THREADED_SUPPORT" in os.environ:
+        yield "CIBW_FREE_THREADED_SUPPORT environment variable is no longer supported."

-    python_version_deprecation = ((3, 11), 3)
-    if sys.version_info[:2] < python_version_deprecation[0]:
-        python_version = ".".join(map(str, python_version_deprecation[0]))
-        msg = (
-            f"cibuildwheel {python_version_deprecation[1]} will require Python {python_version}+, "
-            "please upgrade the Python version used to run cibuildwheel. "
-            "This does not affect the versions you can target when building wheels. See: https://cibuildwheel.pypa.io/en/stable/#what-does-it-do"
-        )
-        warnings.append(msg)
-
-    # warn about deprecated {python} and {pip}
+    # Deprecated {python} and {pip}
    for option_name in ["test_command", "before_build"]:
        option_values = [getattr(options.build_options(i), option_name) for i in identifiers]

        if any(o and ("{python}" in o or "{pip}" in o) for o in option_values):
            # Reminder: in an f-string, double braces means literal single brace
-            msg = (
+            yield (
                f"{option_name}: '{{python}}' and '{{pip}}' are no longer supported "
                "and have been removed in cibuildwheel 3. Simply use 'python' or 'pip' instead."
            )
-            raise errors.ConfigurationError(msg)
+
+
+def detect_warnings(*, options: Options) -> Generator[str, None, None]:
+    python_version_deprecation = ((3, 11), 3)
+    if sys.version_info[:2] < python_version_deprecation[0]:
+        python_version = ".".join(map(str, python_version_deprecation[0]))
+        yield (
+            f"cibuildwheel {python_version_deprecation[1]} will require Python {python_version}+, "
+            "please upgrade the Python version used to run cibuildwheel. "
+            "This does not affect the versions you can target when building wheels. See: https://cibuildwheel.pypa.io/en/stable/#what-does-it-do"
+        )

    build_selector = options.globals.build_selector
    test_selector = options.globals.test_selector
@@ -465,27 +496,25 @@ def detect_warnings(*, options: Options, identifiers: Iterable[str]) -> list[str
        identifier for identifier in all_valid_identifiers if enabled_selector(identifier)
    ]

-    warnings += check_for_invalid_selectors(
+    yield from check_for_invalid_selectors(
        selector_name="build",
        selector_value=build_selector.build_config,
        all_valid_identifiers=all_valid_identifiers,
        all_enabled_identifiers=all_enabled_identifiers,
    )
-    warnings += check_for_invalid_selectors(
+    yield from check_for_invalid_selectors(
        selector_name="skip",
        selector_value=build_selector.skip_config,
        all_valid_identifiers=all_valid_identifiers,
        all_enabled_identifiers=all_enabled_identifiers,
    )
-    warnings += check_for_invalid_selectors(
+    yield from check_for_invalid_selectors(
        selector_name="test_skip",
        selector_value=test_selector.skip_config,
        all_valid_identifiers=all_valid_identifiers,
        all_enabled_identifiers=all_enabled_identifiers,
    )

-    return warnings
-

 def check_for_invalid_selectors(
    *,
@@ -497,18 +526,38 @@ def check_for_invalid_selectors(
    warnings = []

    for selector in selector_value.split():
-        if not any(selector_matches(selector, i) for i in all_enabled_identifiers):
+        selector_ = selector
+        if selector_name == "test_skip":
+            # macosx_universal2 uses an additional identifier for tests which ends with ":{arch}"
+            values = selector.split(":")
+            universal2_identifiers = filter(
+                lambda x: x.endswith("-macosx_universal2"), all_valid_identifiers
+            )
+            if len(values) == 2 and any(
+                selector_matches(selector_, f"{i}:{arch}")
+                for i in universal2_identifiers
+                for arch in ["arm64", "x86_64"]
+            ):
+                # just ignore the arch part in the rest of the check
+                selector_ = values[0]
+        if not any(selector_matches(selector_, i) for i in all_enabled_identifiers):
            msg = f"Invalid {selector_name} selector: {selector!r}. "
            error_type: type = errors.ConfigurationError

-            if any(selector_matches(selector, i) for i in all_valid_identifiers):
+            if any(selector_matches(selector_, i) for i in all_valid_identifiers):
                msg += "This selector matches a group that wasn't enabled. Enable it using the `enable` option or remove this selector. "

-            if "p2" in selector or "p35" in selector:
-                msg += f"cibuildwheel 3.x no longer supports Python < 3.8. Please use the 1.x series or update `{selector_name}`. "
+            if "p2" in selector_ or "p35" in selector_:
+                msg += f"cibuildwheel 4.x no longer supports Python < 3.9. Please use the 1.x series or update `{selector_name}`. "
                error_type = errors.DeprecationError
-            if "p36" in selector or "p37" in selector:
-                msg += f"cibuildwheel 3.x no longer supports Python < 3.8. Please use the 2.x series or update `{selector_name}`. "
+            if "p36" in selector_ or "p37" in selector_:
+                msg += f"cibuildwheel 4.x no longer supports Python < 3.9. Please use the 2.x series or update `{selector_name}`. "
+                error_type = errors.DeprecationError
+            if "p38" in selector_:
+                msg += f"cibuildwheel 4.x no longer supports Python < 3.9. Please use the 3.x series or update `{selector_name}`. "
+                error_type = errors.DeprecationError
+            if "cp313t" in selector_:
+                msg += f"cibuildwheel 4.x no longer supports Python 3.13 free-threading. Please use the 3.x series or update `{selector_name}`. "
                error_type = errors.DeprecationError

            if selector_name == "build":
@@ -0,0 +1,71 @@
+# Based on https://github.com/pypa/build/blob/f4ebd495cc0c2c74155bd4fe48b76399fb7927ac/src/build/_compat/tarfile.py
+
+from __future__ import annotations
+
+import sys
+import tarfile
+
+TYPE_CHECKING = False
+if TYPE_CHECKING:
+    from pathlib import Path
+
+    TarFile = tarfile.TarFile
+
+# Per https://peps.python.org/pep-0706/, the "data" filter will become
+# the default in Python 3.14. The first series of releases with the filter
+# had a broken filter that could not process symlinks correctly.
+elif (3, 11, 5) <= sys.version_info < (3, 14):
+
+    class TarFile(tarfile.TarFile):  # pragma: no cover
+        extraction_filter = staticmethod(tarfile.data_filter)
+
+else:
+    TarFile = tarfile.TarFile  # pragma: no cover
+
+
+# Same availability matrix as the TarFile subclass above. On runtimes that
+# ship the stdlib ``data`` filter we delegate to it; the fallback branch is
+# only reached on 3.10.0-3.10.12 / 3.11.0-3.11.4 and validates each member
+# manually before extraction.
+if sys.version_info >= (3, 11, 5):
+
+    def safe_extractall(tar: tarfile.TarFile, path: Path) -> None:  # pragma: no cover
+        """Extract every member of ``tar`` into ``path`` via the PEP 706 ``data`` filter."""
+        tar.extractall(path, filter="data")
+
+else:
+
+    def safe_extractall(tar: tarfile.TarFile, path: Path) -> None:  # pragma: no cover
+        """Validate every member of ``tar``, then extract into ``path``.
+
+        Reached on 3.10.0-3.10.12 / 3.11.0-3.11.4 where the stdlib ``data`` filter is missing. Device or special files,
+        paths that escape ``path``, and symlinks/hardlinks whose targets resolve outside ``path`` are rejected before
+        any write hits the disk.
+
+        """
+        base = path.resolve()
+        for member in tar.getmembers():
+            _validate_safe_member(member, base)
+        tar.extractall(path)
+
+
+def _validate_safe_member(member: tarfile.TarInfo, base: Path) -> None:
+    if member.ischr() or member.isblk() or member.isfifo():
+        msg = f"refusing to extract special device file {member.name!r}"
+        raise tarfile.TarError(msg)
+    target = (base / member.name).resolve(strict=False)
+    if not target.is_relative_to(base):
+        msg = f"refusing to extract {member.name!r}: path escapes destination"
+        raise tarfile.TarError(msg)
+    if member.issym() or member.islnk():
+        link_base = target.parent if member.issym() else base
+        link_target = (link_base / member.linkname).resolve(strict=False)
+        if not link_target.is_relative_to(base):
+            msg = f"refusing to extract {member.name!r}: link target escapes destination"
+            raise tarfile.TarError(msg)
+
+
+__all__ = [
+    "TarFile",
+    "safe_extractall",
+]
@@ -1,32 +1,48 @@
+from __future__ import annotations
+
+__lazy_modules__ = {"platform", "re", "shutil", "subprocess"}
+
 import platform as platform_module
 import re
 import shutil
 import subprocess
 import sys
 import typing
-from collections.abc import Set
 from enum import StrEnum, auto
-from typing import Final, Literal

 from cibuildwheel import errors

-from .typing import PlatformName
+TYPE_CHECKING = False
+if TYPE_CHECKING:
+    from collections.abc import Set
+    from typing import Final, Literal, Self
+
+    from cibuildwheel.typing import PlatformName

 PRETTY_NAMES: Final[dict[PlatformName, str]] = {
    "linux": "Linux",
    "macos": "macOS",
    "windows": "Windows",
    "pyodide": "Pyodide",
+    "android": "Android",
    "ios": "iOS",
 }

 ARCH_SYNONYMS: Final[list[dict[PlatformName, str | None]]] = [
-    {"linux": "x86_64", "macos": "x86_64", "windows": "AMD64"},
+    {"linux": "x86_64", "macos": "x86_64", "windows": "AMD64", "android": "x86_64"},
    {"linux": "i686", "macos": None, "windows": "x86"},
-    {"linux": "aarch64", "macos": "arm64", "windows": "ARM64"},
+    {"linux": "aarch64", "macos": "arm64", "windows": "ARM64", "android": "arm64_v8a"},
 ]


+def arch_synonym(arch: str, from_platform: PlatformName, to_platform: PlatformName) -> str | None:
+    for arch_synonym_ in ARCH_SYNONYMS:
+        if arch == arch_synonym_.get(from_platform):
+            return arch_synonym_.get(to_platform, arch)
+
+    return arch
+
+
 def _check_aarch32_el0() -> bool:
    """Check if running armv7l natively on aarch64 is supported"""
    if not sys.platform.startswith("linux"):
@@ -42,7 +58,7 @@ def _check_aarch32_el0() -> bool:

@typing.final
 class Architecture(StrEnum):
-    # mac/linux archs
+    # mac/linux/android archs
    x86_64 = auto()

    # linux archs
@@ -65,40 +81,59 @@ class Architecture(StrEnum):
    # WebAssembly
    wasm32 = auto()

+    # android archs
+    arm64_v8a = auto()
+
    # iOS "multiarch" architectures that include both
    # the CPU architecture and the ABI.
    arm64_iphoneos = auto()
    arm64_iphonesimulator = auto()
    x86_64_iphonesimulator = auto()

-    @staticmethod
-    def parse_config(config: str, platform: PlatformName) -> "set[Architecture]":
+    @classmethod
+    def parse_config(cls, config: str, platform: PlatformName) -> set[Self]:
        result = set()
        for arch_str in re.split(r"[\s,]+", config):
            match arch_str:
                case "auto":
-                    result |= Architecture.auto_archs(platform=platform)
+                    result |= cls.auto_archs(platform=platform)
                case "native":
-                    if native_arch := Architecture.native_arch(platform=platform):
+                    if native_arch := cls.native_arch(platform=platform):
                        result.add(native_arch)
                case "all":
-                    result |= Architecture.all_archs(platform=platform)
+                    result |= cls.all_archs(platform=platform)
                case "auto64":
-                    result |= Architecture.bitness_archs(platform=platform, bitness="64")
+                    result |= cls.bitness_archs(platform=platform, bitness="64")
                case "auto32":
-                    result |= Architecture.bitness_archs(platform=platform, bitness="32")
+                    result |= cls.bitness_archs(platform=platform, bitness="32")
                case _:
-                    try:
-                        result.add(Architecture(arch_str))
-                    except ValueError as e:
+                    if arch := cls._parse_arch_name(arch_str, platform=platform):
+                        result.add(arch)
+                    else:
                        msg = f"Invalid architecture '{arch_str}'"
-                        raise errors.ConfigurationError(msg) from e
+                        raise errors.ConfigurationError(msg)
        return result

-    @staticmethod
-    def native_arch(platform: PlatformName) -> "Architecture | None":
+    @classmethod
+    def _parse_arch_name(cls, arch_str: str, platform: PlatformName) -> Self | None:
+        """Resolve an architecture name case-insensitively.
+
+        The same value (e.g. "arm64"/"ARM64") can map to different members
+        depending on the platform, so prefer a member valid for ``platform``
+        before falling back to any case-insensitive match.
+        """
+        for arch in cls.all_archs(platform):
+            if arch.value.lower() == arch_str.lower():
+                return arch
+        for arch in cls:
+            if arch.value.lower() == arch_str.lower():
+                return arch
+        return None
+
+    @classmethod
+    def native_arch(cls, platform: PlatformName) -> Self | None:
        native_machine = platform_module.machine()
-        native_architecture = Architecture(native_machine)
+        native_architecture = cls(native_machine)

        # Cross-platform support. Used for --print-build-identifiers or docker builds.
        host_platform: PlatformName = (
@@ -108,86 +143,84 @@ class Architecture(StrEnum):
        )

        if platform == "pyodide":
-            return Architecture.wasm32
+            return cls.wasm32
        elif platform == "ios":
            # Can only build for iOS on macOS. The "native" architecture is the
            # simulator for the macOS native platform.
            if host_platform == "macos":
-                if native_architecture == Architecture.x86_64:
-                    return Architecture.x86_64_iphonesimulator
+                if native_architecture == cls.x86_64:
+                    return cls.x86_64_iphonesimulator
                else:
-                    return Architecture.arm64_iphonesimulator
+                    return cls.arm64_iphonesimulator
            else:
                return None

        # we might need to rename the native arch to the machine we're running
        # on, as the same arch can have different names on different platforms
        if host_platform != platform:
-            for arch_synonym in ARCH_SYNONYMS:
-                if native_machine == arch_synonym.get(host_platform):
-                    synonym = arch_synonym[platform]
+            synonym = arch_synonym(native_machine, host_platform, platform)
+            if synonym is None:
+                # can't build anything on this platform
+                return None

-                    if synonym is None:
-                        # can't build anything on this platform
-                        return None
-
-                    native_architecture = Architecture(synonym)
+            native_architecture = cls(synonym)

        return native_architecture

-    @staticmethod
-    def auto_archs(platform: PlatformName) -> "set[Architecture]":
-        native_arch = Architecture.native_arch(platform)
+    @classmethod
+    def auto_archs(cls, platform: PlatformName) -> set[Self]:
+        native_arch = cls.native_arch(platform)
        if native_arch is None:
            return set()  # can't build anything on this platform
        result = {native_arch}

        match platform:
-            case "windows" if Architecture.AMD64 in result:
-                result.add(Architecture.x86)
-            case "ios" if native_arch == Architecture.arm64_iphonesimulator:
+            case "windows" if cls.AMD64 in result:
+                result.add(cls.x86)
+            case "ios" if native_arch == cls.arm64_iphonesimulator:
                # Also build the device wheel if we're on ARM64.
-                result.add(Architecture.arm64_iphoneos)
+                result.add(cls.arm64_iphoneos)

        return result

-    @staticmethod
-    def all_archs(platform: PlatformName) -> "set[Architecture]":
+    @classmethod
+    def all_archs(cls, platform: PlatformName) -> set[Self]:
        all_archs_map = {
            "linux": {
-                Architecture.x86_64,
-                Architecture.i686,
-                Architecture.aarch64,
-                Architecture.ppc64le,
-                Architecture.s390x,
-                Architecture.armv7l,
-                Architecture.riscv64,
+                cls.x86_64,
+                cls.i686,
+                cls.aarch64,
+                cls.ppc64le,
+                cls.s390x,
+                cls.armv7l,
+                cls.riscv64,
            },
-            "macos": {Architecture.x86_64, Architecture.arm64, Architecture.universal2},
-            "windows": {Architecture.x86, Architecture.AMD64, Architecture.ARM64},
-            "pyodide": {Architecture.wasm32},
+            "macos": {cls.x86_64, cls.arm64, cls.universal2},
+            "windows": {cls.x86, cls.AMD64, cls.ARM64},
+            "pyodide": {cls.wasm32},
+            "android": {cls.x86_64, cls.arm64_v8a},
            "ios": {
-                Architecture.x86_64_iphonesimulator,
-                Architecture.arm64_iphonesimulator,
-                Architecture.arm64_iphoneos,
+                cls.x86_64_iphonesimulator,
+                cls.arm64_iphonesimulator,
+                cls.arm64_iphoneos,
            },
        }
        return all_archs_map[platform]

-    @staticmethod
-    def bitness_archs(platform: PlatformName, bitness: Literal["64", "32"]) -> "set[Architecture]":
+    @classmethod
+    def bitness_archs(cls, platform: PlatformName, bitness: Literal["64", "32"]) -> set[Self]:
        # This map maps 64-bit architectures to their 32-bit equivalents.
        archs_map = {
-            Architecture.x86_64: Architecture.i686,
-            Architecture.AMD64: Architecture.x86,
-            Architecture.aarch64: Architecture.armv7l,
+            cls.x86_64: cls.i686,
+            cls.AMD64: cls.x86,
+            cls.aarch64: cls.armv7l,
        }
-        native_arch = Architecture.native_arch(platform)
+        native_arch = cls.native_arch(platform)

        if native_arch is None:
            return set()  # can't build anything on this platform

-        if native_arch == Architecture.wasm32:
+        if native_arch == cls.wasm32:
            return {native_arch} if bitness == "32" else set()

        match bitness:
@@ -197,7 +230,7 @@ class Architecture(StrEnum):
                if native_arch in archs_map.values():
                    return {native_arch}
                elif native_arch in archs_map and platform in {"linux", "windows"}:
-                    if native_arch == Architecture.aarch64 and not _check_aarch32_el0():
+                    if native_arch == cls.aarch64 and not _check_aarch32_el0():
                        # If we're on aarch64, skip if we cannot build armv7l wheels.
                        return set()
                    return {archs_map[native_arch]}
@@ -0,0 +1,148 @@
+from __future__ import annotations
+
+__lazy_modules__ = {
+    "cibuildwheel.logger",
+    "cibuildwheel.util",
+    "cibuildwheel.util.cmd",
+    "cibuildwheel.util.helpers",
+    "cibuildwheel.util.packaging",
+    "cibuildwheel.venv",
+    "pathlib",
+    "subprocess",
+}
+
+import subprocess
+import sys
+from pathlib import Path
+
+from cibuildwheel import errors
+from cibuildwheel.logger import log
+from cibuildwheel.util.cmd import call, shell
+from cibuildwheel.util.helpers import prepare_command
+from cibuildwheel.util.packaging import is_abi3_wheel
+from cibuildwheel.venv import activate_virtualenv, find_uv, virtualenv
+
+TYPE_CHECKING = False
+if TYPE_CHECKING:
+    from cibuildwheel.options import BuildOptions
+
+
+def run_audit(
+    *,
+    tmp_dir: Path,
+    build_options: BuildOptions,
+    wheel: Path,
+) -> None:
+    """
+    Run the audit commands on a single wheel.
+
+    Creates a virtualenv (or reuses an existing one) and installs any
+    audit requirements, then runs each audit command template against
+    the wheel. Commands containing {abi3_wheel} are skipped for
+    non-abi3 wheels.
+    """
+
+    if not needs_audit(build_options.audit_command, wheel.name):
+        return
+
+    log.step("Auditing wheel...")
+
+    use_uv = build_options.build_frontend.name in {"build[uv]", "uv"}
+    version = f"{sys.version_info.major}.{sys.version_info.minor}.{sys.version_info.micro}"
+    dependency_constraint = build_options.dependency_constraints.get_for_python_version(
+        version=version, tmp_dir=tmp_dir
+    )
+
+    # Use the base interpreter, not the venv python, to avoid nested-venv
+    # issues where pip can't be found (seen on Windows + Python 3.13).
+    host_python = Path(getattr(sys, "_base_executable", sys.executable))
+
+    audit_venv_dir = tmp_dir / "audit_venv"
+    if not (audit_venv_dir / "pyvenv.cfg").exists():
+        env = virtualenv(
+            version,
+            host_python,
+            audit_venv_dir,
+            dependency_constraint=dependency_constraint,
+            use_uv=use_uv,
+        )
+    else:
+        env = activate_virtualenv(audit_venv_dir)
+
+    # install audit requirements. This is run every time in case the user has
+    # defined overrides.
+    audit_requires = build_options.audit_requires
+    if audit_requires:
+        print(f"Installing audit dependencies: {', '.join(audit_requires)}")
+
+        pip: list[str]
+        if use_uv:
+            uv_path = find_uv()
+            assert uv_path is not None
+            pip = [str(uv_path), "pip"]
+        else:
+            pip = ["pip"]
+        # we pin if the audit-requires is left as the default "abi3audit"
+        should_pin = audit_requires == ["abi3audit"] and dependency_constraint
+
+        call(
+            *pip,
+            "install",
+            *(["--constraint", str(dependency_constraint)] if should_pin else []),
+            *audit_requires,
+            env=env,
+        )
+
+    audit_command = build_options.audit_command
+
+    for command_template in audit_command:
+        if "{abi3_wheel}" in command_template and "{wheel}" in command_template:
+            msg = (
+                f"Invalid audit command {command_template!r}: cannot contain both {{abi3_wheel}} "
+                "and {{wheel}} placeholders"
+            )
+            raise errors.ConfigurationError(msg)
+
+        if "{abi3_wheel}" in command_template and not is_abi3_wheel(wheel.name):
+            continue
+
+        prepared_command = prepare_command(
+            command_template,
+            abi3_wheel=wheel,
+            wheel=wheel,
+            project=".",
+            package=build_options.package_dir,
+        )
+
+        print(f"Running audit command: {prepared_command}")
+        try:
+            shell(prepared_command, env=env)
+        except subprocess.CalledProcessError as e:
+            print(f"Audit command failed with exit code {e.returncode}")
+            msg = f"Audit command failed: {prepared_command}"
+            raise errors.AuditCommandFailedError(msg) from e
+
+
+def needs_audit(audit_commands: list[str], wheel_name: str) -> bool:
+    saw_abi3_placeholder = False
+    for audit_command in audit_commands:
+        if "{abi3_wheel}" not in audit_command and "{wheel}" not in audit_command:
+            msg = (
+                f"Invalid audit command {audit_command!r}: must contain either "
+                "{{abi3_wheel}} or {{wheel}} placeholder"
+            )
+            raise errors.ConfigurationError(msg)
+
+        if "{abi3_wheel}" in audit_command:
+            saw_abi3_placeholder = True
+            if is_abi3_wheel(wheel_name):
+                return True
+        elif "{wheel}" in audit_command:
+            return True
+
+    if saw_abi3_placeholder:
+        print("No audit required for this wheel, as it is not abi3")
+    else:
+        print("No audit configured")
+
+    return False
@@ -1,16 +1,23 @@
+from __future__ import annotations
+
+__lazy_modules__ = {"bashlex", "subprocess"}
+
 import dataclasses
 import subprocess
-from collections.abc import (
-    Callable,
-    Iterable,
-    Mapping,
-    Sequence,
-)

 import bashlex

-# a function that takes a command and the environment, and returns the result
-EnvironmentExecutor = Callable[[list[str], dict[str, str]], str]
+TYPE_CHECKING = False
+if TYPE_CHECKING:
+    from collections.abc import (
+        Callable,
+        Iterable,
+        Mapping,
+        Sequence,
+    )
+
+    # a function that takes a command and the environment, and returns the result
+    EnvironmentExecutor = Callable[[list[str], dict[str, str]], str]


 def local_environment_executor(command: Sequence[str], env: Mapping[str, str]) -> str:
@@ -1,8 +1,12 @@
+__lazy_modules__ = {"cibuildwheel.util", "cibuildwheel.util.helpers"}
+
 import os
 import re
 from enum import Enum

-from .util.helpers import strtobool
+from cibuildwheel.util.helpers import strtobool
+
+ANSI_CODE_REGEX = re.compile(r"(\033\[[0-9;]*m)")


 class CIProvider(Enum):
@@ -12,7 +16,6 @@ class CIProvider(Enum):
    azure_pipelines = "azure_pipelines"
    github_actions = "github_actions"
    gitlab = "gitlab"
-    cirrus_ci = "cirrus_ci"

    # unofficial support
    appveyor = "appveyor"
@@ -33,8 +36,6 @@ def detect_ci_provider() -> CIProvider | None:
        return CIProvider.github_actions
    elif "GITLAB_CI" in os.environ:
        return CIProvider.gitlab
-    elif "CIRRUS_CI" in os.environ:
-        return CIProvider.cirrus_ci
    elif strtobool(os.environ.get("CI", "false")):
        return CIProvider.other
    else:
@@ -46,7 +47,7 @@ def fix_ansi_codes_for_github_actions(text: str) -> str:
    Github Actions forgets the current ANSI style on every new line. This
    function repeats the current ANSI style on every new line.
    """
-    ansi_code_regex = re.compile(r"(\033\[[0-9;]*m)")
+
    ansi_codes: list[str] = []
    output = ""

@@ -55,7 +56,7 @@ def fix_ansi_codes_for_github_actions(text: str) -> str:
        output += "".join(ansi_codes) + line

        # split the line at each ANSI code
-        parts = ansi_code_regex.split(line)
+        parts = ANSI_CODE_REGEX.split(line)
        # if there are any ANSI codes, save them
        if len(parts) > 1:
            # iterate over the ANSI codes in this line
@@ -67,3 +68,11 @@ def fix_ansi_codes_for_github_actions(text: str) -> str:
                    ansi_codes.append(code)

    return output
+
+
+def filter_ansi_codes(text: str, /) -> str:
+    """
+    Remove ANSI codes from text.
+    """
+
+    return ANSI_CODE_REGEX.sub("", text)
@@ -1,11 +1,19 @@
+from __future__ import annotations
+
+__lazy_modules__ = {"bashlex", "bashlex.errors"}
+
 import dataclasses
-from collections.abc import Mapping, Sequence
-from typing import Any, Protocol
+from typing import Protocol

 import bashlex
 import bashlex.errors

-from . import bashlex_eval
+from cibuildwheel import bashlex_eval
+
+TYPE_CHECKING = False
+if TYPE_CHECKING:
+    from collections.abc import Mapping, Sequence
+    from typing import Any


 class EnvironmentParseError(Exception):
@@ -73,12 +81,16 @@ class EnvironmentAssignmentRaw:
        return self.value


+@dataclasses.dataclass
 class EnvironmentAssignmentBash:
    """
    An environment variable, in bash syntax. The value can use bash constructs
    like "$OTHER_VAR" and "$(command arg1 arg2)".
    """

+    name: str
+    value: str
+
    def __init__(self, assignment: str):
        name, equals, value = assignment.partition("=")
        if not equals:
@@ -96,11 +108,6 @@ class EnvironmentAssignmentBash:
    def __repr__(self) -> str:
        return f"{self.name}={self.value}"

-    def __eq__(self, other: object) -> bool:
-        if isinstance(other, EnvironmentAssignmentBash):
-            return self.name == other.name and self.value == other.value
-        return False
-

@dataclasses.dataclass(kw_only=True)
 class ParsedEnvironment:
@@ -132,7 +139,7 @@ class ParsedEnvironment:
    def __repr__(self) -> str:
        return f"{self.__class__.__name__}({[repr(a) for a in self.assignments]!r})"

-    def options_summary(self) -> Any:
+    def options_summary(self) -> list[EnvironmentAssignment]:
        return self.assignments


@@ -4,6 +4,8 @@ a different return code, by defining them all here, we can ensure that they're
 semantically clear and unique.
 """

+__lazy_modules__ = {"textwrap"}
+
 import textwrap


@@ -76,7 +78,7 @@ class RepairStepProducedNoWheelError(FatalError):
            Build failed because the repair step completed successfully but
            did not produce a wheel.

-            Your `repair-wheel-command` is expected to place the repaired
+            Your `repair-wheel-command` must place the repaired
            wheel in the {dest_dir} directory. See the documentation for
            example configurations:

@@ -85,3 +87,43 @@ class RepairStepProducedNoWheelError(FatalError):
        )
        super().__init__(message)
        self.return_code = 8
+
+
+class RepairStepProducedMultipleWheelsError(FatalError):
+    def __init__(self, wheels: list[str]) -> None:
+        message = textwrap.dedent(
+            f"""
+            Build failed because the repair step completed successfully but
+            produced multiple wheels: {wheels}
+
+            Your `repair-wheel-command` must place exactly one repaired
+            wheel in the {{dest_dir}} directory. See the documentation for
+            example configurations:
+
+            https://cibuildwheel.pypa.io/en/stable/options/#repair-wheel-command
+            """
+        )
+        super().__init__(message)
+        self.return_code = 8
+
+
+class AuditCommandFailedError(FatalError):
+    def __init__(self, message: str) -> None:
+        super().__init__(message)
+        self.return_code = 9
+
+
+class BuildProducedNoWheelError(FatalError):
+    def __init__(self) -> None:
+        message = textwrap.dedent(
+            """
+            Build failed because the build frontend completed successfully but
+            did not produce a wheel.
+
+            This usually indicates a problem with your project configuration or
+            build backend. Check your project configuration, or run cibuildwheel
+            with CIBW_BUILD_VERBOSITY=1 to view build logs.
+            """
+        )
+        super().__init__(message)
+        self.return_code = 10
@@ -2,17 +2,26 @@
 These are utilities for the `/bin` scripts, not for the `cibuildwheel` program.
 """

+from __future__ import annotations
+
+__lazy_modules__ = {"io", "json", "urllib", "urllib.error", "urllib.request"}
+
 import json
 import time
 import typing
 import urllib.error
 import urllib.request
-from collections.abc import Mapping, Sequence
 from io import StringIO
-from typing import Any, NotRequired, Protocol
+from typing import NotRequired, Protocol

 from cibuildwheel import __version__ as cibw_version

+TYPE_CHECKING = False
+if TYPE_CHECKING:
+    from collections.abc import Mapping, Sequence
+    from typing import Any
+
+
 __all__ = ("Printable", "dump_python_configurations")


@@ -41,7 +50,7 @@ def dump_python_configurations(

 def _json_request(request: urllib.request.Request, timeout: int = 30) -> dict[str, Any]:
    with urllib.request.urlopen(request, timeout=timeout) as response:
-        return typing.cast(dict[str, Any], json.load(response))
+        return typing.cast("dict[str, Any]", json.load(response))


 def github_api_request(path: str, *, max_retries: int = 3) -> dict[str, Any]:
@@ -62,7 +71,7 @@ def github_api_request(path: str, *, max_retries: int = 3) -> dict[str, Any]:
            # pylint: disable=E1101
            if (
                isinstance(e, urllib.error.HTTPError)
-                and (e.code == 403 or e.code == 429)
+                and (e.code in {403, 429})
                and e.headers.get("x-ratelimit-remaining") == "0"
            ):
                reset_time = int(e.headers.get("x-ratelimit-reset", 0))
@@ -83,6 +92,7 @@ def github_api_request(path: str, *, max_retries: int = 3) -> dict[str, Any]:

 class PyodideXBuildEnvRelease(typing.TypedDict):
    version: str
+    sha256: str
    python_version: str
    emscripten_version: str
    min_pyodide_build_version: NotRequired[str]
@@ -95,7 +105,7 @@ class PyodideXBuildEnvInfo(typing.TypedDict):

 def get_pyodide_xbuildenv_info() -> PyodideXBuildEnvInfo:
    xbuildenv_info_url = (
-        "https://pyodide.github.io/pyodide/api/pyodide-cross-build-environments.json"
+        "https://pyodide.github.io/pyodide/api/v2/pyodide-cross-build-environments.json"
    )
    with urllib.request.urlopen(xbuildenv_info_url) as response:
-        return typing.cast(PyodideXBuildEnvInfo, json.loads(response.read().decode("utf-8")))
+        return typing.cast("PyodideXBuildEnvInfo", json.loads(response.read().decode("utf-8")))
@@ -1,13 +1,22 @@
+from __future__ import annotations
+
+__lazy_modules__ = {"cibuildwheel.util", "cibuildwheel.util.helpers", "shlex"}
+
 import dataclasses
 import shlex
 import typing
-from collections.abc import Sequence
-from typing import Literal, Self, get_args
+from typing import Literal, get_args

-from .logger import log
-from .util.helpers import parse_key_value_string
+from cibuildwheel.util.helpers import parse_key_value_string, prepare_command

-BuildFrontendName = Literal["pip", "build", "build[uv]"]
+TYPE_CHECKING = False
+if TYPE_CHECKING:
+    from collections.abc import Sequence
+    from typing import Self
+
+    from cibuildwheel.typing import PathOrStr
+
+BuildFrontendName = Literal["pip", "build", "build[uv]", "uv", "pyodide-build"]


@dataclasses.dataclass(frozen=True)
@@ -24,7 +33,7 @@ class BuildFrontendConfig:
            msg = f"Unrecognised build frontend {name!r}, must be one of {names}"
            raise ValueError(msg)

-        name = typing.cast(BuildFrontendName, name)
+        name = typing.cast("BuildFrontendName", name)

        args = config_dict.get("args") or []
        return cls(name=name, args=args)
@@ -37,12 +46,13 @@ class BuildFrontendConfig:


 def _get_verbosity_flags(level: int, frontend: BuildFrontendName) -> list[str]:
-    if level < 0:
-        if frontend == "pip":
-            return ["-" + -level * "q"]
+    if frontend == "pyodide-build":
+        if level > 0:
+            return ["-" + min(level, 2) * "v"]
+        return []

-        msg = f"build_verbosity {level} is not supported for {frontend} frontend. Ignoring."
-        log.warning(msg)
+    if level < 0:
+        return ["-" + -level * "q"]

    if level > 0:
        if frontend == "pip":
@@ -58,6 +68,36 @@ def _split_config_settings(config_settings: str) -> list[str]:
    return [f"-C{setting}" for setting in config_settings_list]


+def prepare_config_settings(config_settings: str, *, project: PathOrStr, package: PathOrStr) -> str:
+    # Substitute the {project}/{package} placeholders on each already-split
+    # token rather than on the raw string. A substituted path may contain
+    # spaces or backslashes (e.g. a Windows `{package}` path), and the result
+    # is later re-parsed with shlex.split (in _split_config_settings /
+    # parse_config_settings) — substituting on the whole string would let
+    # those characters be reinterpreted, splitting one setting into several or
+    # eating backslashes. shlex.join re-quotes each token so the round-trip is
+    # lossless.
+    settings = shlex.split(config_settings)
+    prepared = [prepare_command(setting, project=project, package=package) for setting in settings]
+    return shlex.join(prepared)
+
+
+# Based on build.__main__.main.
+def parse_config_settings(config_settings_str: str) -> dict[str, str | list[str]]:
+    config_settings: dict[str, str | list[str]] = {}
+    for arg in shlex.split(config_settings_str):
+        setting, _, value = arg.partition("=")
+        existing_value = config_settings.get(setting)
+        if existing_value is None:
+            config_settings[setting] = value
+        elif isinstance(existing_value, str):
+            config_settings[setting] = [existing_value, value]
+        else:
+            existing_value.append(value)
+
+    return config_settings
+
+
 def get_build_frontend_extra_flags(
    build_frontend: BuildFrontendConfig, verbosity_level: int, config_settings: str
 ) -> list[str]:
@@ -1,13 +1,43 @@
+from __future__ import annotations
+
+__lazy_modules__ = {
+    "cibuildwheel.ci",
+    "contextlib",
+    "functools",
+    "hashlib",
+    "humanize",
+    "io",
+    "pathlib",
+    "re",
+    "textwrap",
+}
+
 import codecs
+import contextlib
+import dataclasses
+import functools
+import hashlib
+import io
 import os
 import re
 import sys
+import textwrap
 import time
-from typing import IO, AnyStr, Final
+from pathlib import Path

-from .ci import CIProvider, detect_ci_provider
+import humanize
+
+from cibuildwheel.ci import CIProvider, detect_ci_provider, filter_ansi_codes
+
+TYPE_CHECKING = False
+if TYPE_CHECKING:
+    from collections.abc import Generator
+    from typing import IO, AnyStr, Final, Literal
+
+    from cibuildwheel.options import Options
+
+    FoldPattern = tuple[str, str]

-FoldPattern = tuple[str, str]
 DEFAULT_FOLD_PATTERN: Final[FoldPattern] = ("{name}", "")
 FOLD_PATTERNS: Final[dict[str, FoldPattern]] = {
    "azure": ("##[group]{name}", "##[endgroup]"),
@@ -37,6 +67,8 @@ PLATFORM_IDENTIFIER_DESCRIPTIONS: Final[dict[str, str]] = {
    "macosx_universal2": "macOS Universal 2 - x86_64 and arm64",
    "macosx_arm64": "macOS arm64 - Apple Silicon",
    "pyodide_wasm32": "Pyodide",
+    "android_arm64_v8a": "Android arm64_v8a",
+    "android_x86_64": "Android x86_64",
    "ios_arm64_iphoneos": "iOS Device (ARM64)",
    "ios_arm64_iphonesimulator": "iOS Simulator (ARM64)",
    "ios_x86_64_iphonesimulator": "iOS Simulator (x86_64)",
@@ -69,14 +101,42 @@ class Symbols:
        self.error = "✕" if unicode else "failed"


+@dataclasses.dataclass(kw_only=True, frozen=True)
+class BuildInfo:
+    identifier: str
+    filename: Path | None
+    duration: float
+
+    @functools.cached_property
+    def size(self) -> str | None:
+        if self.filename is None:
+            return None
+        return humanize.naturalsize(self.filename.stat().st_size)
+
+    @functools.cached_property
+    def sha256(self) -> str | None:
+        if self.filename is None:
+            return None
+        with self.filename.open("rb") as f:
+            digest = hashlib.file_digest(f, "sha256")
+        return digest.hexdigest()
+
+    def __str__(self) -> str:
+        duration = humanize.naturaldelta(self.duration)
+        if self.filename:
+            return f"{self.identifier}: {self.filename.name} {self.size} in {duration}, SHA256={self.sha256}"
+        return f"{self.identifier}: {duration} (test only)"
+
+
 class Logger:
-    fold_mode: str
+    fold_mode: Literal["azure", "github", "travis", "disabled"]
    colors_enabled: bool
    unicode_enabled: bool
    active_build_identifier: str | None = None
    build_start_time: float | None = None
    step_start_time: float | None = None
    active_fold_group_name: str | None = None
+    summary: list[BuildInfo]

    def __init__(self) -> None:
        if sys.platform == "win32" and hasattr(sys.stdout, "reconfigure"):
@@ -88,25 +148,28 @@ class Logger:

        ci_provider = detect_ci_provider()

-        if ci_provider == CIProvider.azure_pipelines:
-            self.fold_mode = "azure"
-            self.colors_enabled = True
+        match ci_provider:
+            case CIProvider.azure_pipelines:
+                self.fold_mode = "azure"
+                self.colors_enabled = True

-        elif ci_provider == CIProvider.github_actions:
-            self.fold_mode = "github"
-            self.colors_enabled = True
+            case CIProvider.github_actions:
+                self.fold_mode = "github"
+                self.colors_enabled = True

-        elif ci_provider == CIProvider.travis_ci:
-            self.fold_mode = "travis"
-            self.colors_enabled = True
+            case CIProvider.travis_ci:
+                self.fold_mode = "travis"
+                self.colors_enabled = True

-        elif ci_provider == CIProvider.appveyor:
-            self.fold_mode = "disabled"
-            self.colors_enabled = True
+            case CIProvider.appveyor:
+                self.fold_mode = "disabled"
+                self.colors_enabled = True

-        else:
-            self.fold_mode = "disabled"
-            self.colors_enabled = file_supports_color(sys.stdout)
+            case _:
+                self.fold_mode = "disabled"
+                self.colors_enabled = file_supports_color(sys.stdout)
+
+        self.summary = []

    def build_start(self, identifier: str) -> None:
        self.step_end()
@@ -120,7 +183,7 @@ class Logger:
        self.build_start_time = time.time()
        self.active_build_identifier = identifier

-    def build_end(self) -> None:
+    def build_end(self, filename: Path | None) -> None:
        assert self.build_start_time is not None
        assert self.active_build_identifier is not None
        self.step_end()
@@ -128,11 +191,14 @@ class Logger:
        c = self.colors
        s = self.symbols
        duration = time.time() - self.build_start_time
+        duration_str = humanize.naturaldelta(duration, minimum_unit="milliseconds")

        print()
-        print(
-            f"{c.green}{s.done} {c.end}{self.active_build_identifier} finished in {duration:.2f}s"
+        print(f"{c.green}{s.done} {c.end}{self.active_build_identifier} finished in {duration_str}")
+        self.summary.append(
+            BuildInfo(identifier=self.active_build_identifier, filename=filename, duration=duration)
        )
+
        self.build_start_time = None
        self.active_build_identifier = None

@@ -147,6 +213,7 @@ class Logger:
            c = self.colors
            s = self.symbols
            duration = time.time() - self.step_start_time
+
            if success:
                print(f"{c.green}{s.done} {c.end}{duration:.2f}s".rjust(78))
            else:
@@ -183,6 +250,26 @@ class Logger:
            c = self.colors
            print(f"cibuildwheel: {c.bright_red}error{c.end}: {error}\n", file=sys.stderr)

+    @contextlib.contextmanager
+    def print_summary(self, *, options: Options) -> Generator[None, None, None]:
+        start = time.time()
+        yield
+        duration = time.time() - start
+        if summary_path := os.environ.get("GITHUB_STEP_SUMMARY"):
+            github_summary = self._github_step_summary(duration=duration, options=options)
+            Path(summary_path).write_text(filter_ansi_codes(github_summary), encoding="utf-8")
+
+        n_wheels = len([info for info in self.summary if info.filename])
+        s = "s" if n_wheels > 1 else ""
+        duration_str = humanize.naturaldelta(duration)
+        print()
+        self._start_fold_group(f"{n_wheels} wheel{s} produced in {duration_str}")
+        for build_info in self.summary:
+            print(" ", build_info)
+        self._end_fold_group()
+
+        self.summary = []
+
    @property
    def step_active(self) -> bool:
        return self.step_start_time is not None
@@ -222,11 +309,77 @@ class Logger:
        # lowercase, shorten
        return identifier.lower()[:20]

-    @property
+    def _github_step_summary(self, duration: float, options: Options) -> str:
+        """
+        Returns the GitHub step summary, in markdown format.
+        """
+        out = io.StringIO()
+        options_summary = options.summary(
+            identifiers=[bi.identifier for bi in self.summary], skip_unset=True
+        )
+        out.write(
+            textwrap.dedent("""\
+                ### 🎡 cibuildwheel
+
+                <details>
+                <summary>
+                Build options
+                </summary>
+
+                ```yaml
+                {options_summary}
+                ```
+
+                </details>
+
+            """).format(options_summary=options_summary)
+        )
+        n_wheels = len([b for b in self.summary if b.filename])
+        wheel_rows = "\n".join(
+            "<tr>"
+            f"<td nowrap>{'<samp>' + b.filename.name + '</samp>' if b.filename else '*Test only*'}</td>"
+            f"<td nowrap>{b.size or 'N/A'}</td>"
+            f"<td nowrap><samp>{b.identifier}</samp></td>"
+            f"<td nowrap>{humanize.naturaldelta(b.duration)}</td>"
+            f"<td nowrap><samp>{b.sha256 or 'N/A'}</samp></td>"
+            "</tr>"
+            for b in self.summary
+        )
+        out.write(
+            textwrap.dedent("""\
+                <table>
+                <thead>
+                <tr>
+                <th align="left">Wheel</th>
+                <th align="left">Size</th>
+                <th align="left">Build identifier</th>
+                <th align="left">Time</th>
+                <th align="left">SHA256</th>
+                </tr>
+                </thead>
+                <tbody>
+                {wheel_rows}
+                </tbody>
+                </table>
+                <div align="right"><sup>{n} wheel{s} created in {duration_str}</sup></div>
+            """).format(
+                wheel_rows=wheel_rows,
+                n=n_wheels,
+                duration_str=humanize.naturaldelta(duration),
+                s="s" if n_wheels > 1 else "",
+            )
+        )
+
+        out.write("\n")
+        out.write("---")
+        out.write("\n")
+        return out.getvalue()
+
+    @functools.cached_property
    def colors(self) -> Colors:
        return Colors(enabled=self.colors_enabled)

-    @property
+    @functools.cached_property
    def symbols(self) -> Symbols:
        return Symbols(unicode=self.unicode_enabled)

@@ -1,3 +1,24 @@
+from __future__ import annotations
+
+__lazy_modules__ = {
+    "cibuildwheel.ci",
+    "cibuildwheel.errors",
+    "cibuildwheel.logger",
+    "cibuildwheel.util",
+    "cibuildwheel.util.cmd",
+    "cibuildwheel.util.helpers",
+    "contextlib",
+    "io",
+    "json",
+    "platform",
+    "shlex",
+    "shutil",
+    "subprocess",
+    "textwrap",
+    "uuid",
+}
+
+import contextlib
 import dataclasses
 import io
 import json
@@ -10,18 +31,24 @@ import sys
 import textwrap
 import typing
 import uuid
-from collections.abc import Mapping, Sequence
 from enum import Enum
-from pathlib import Path, PurePath, PurePosixPath
-from types import TracebackType
-from typing import IO, Literal, Self, assert_never
+from pathlib import PurePosixPath
+from typing import Literal, assert_never

-from .ci import CIProvider, detect_ci_provider
-from .errors import OCIEngineTooOldError
-from .logger import log
-from .typing import PathOrStr
-from .util.cmd import call
-from .util.helpers import FlexibleVersion, parse_key_value_string, strtobool
+from cibuildwheel.ci import CIProvider, detect_ci_provider
+from cibuildwheel.errors import OCIEngineTooOldError
+from cibuildwheel.logger import log
+from cibuildwheel.util.cmd import call
+from cibuildwheel.util.helpers import FlexibleVersion, parse_key_value_string, strtobool
+
+TYPE_CHECKING = False
+if TYPE_CHECKING:
+    from collections.abc import Mapping, Sequence
+    from pathlib import Path, PurePath
+    from types import TracebackType
+    from typing import IO, Self
+
+    from cibuildwheel.typing import PathOrStr

 ContainerEngineName = Literal["docker", "podman"]

@@ -36,6 +63,28 @@ class OCIPlatform(Enum):
    RISCV64 = "linux/riscv64"
    S390X = "linux/s390x"

+    @classmethod
+    def native(cls) -> Self:
+        """Return the current OCI platform, or raise ValueError if unknown."""
+        arch = platform.machine().lower()
+        mapping = {
+            "i386": cls.i386,
+            "i686": cls.i386,
+            "x86_64": cls.AMD64,
+            "amd64": cls.AMD64,
+            "armv7l": cls.ARMV7,
+            "aarch64": cls.ARM64,
+            "arm64": cls.ARM64,
+            "ppc64le": cls.PPC64LE,
+            "riscv64": cls.RISCV64,
+            "s390x": cls.S390X,
+        }
+        try:
+            return mapping[arch]
+        except KeyError as ex:
+            msg = f"Unsupported platform architecture: {arch}"
+            raise OSError(msg) from ex
+

@dataclasses.dataclass(frozen=True)
 class OCIContainerEngineConfig:
@@ -56,7 +105,7 @@ class OCIContainerEngineConfig:
            msg = f"unknown container engine {name}"
            raise ValueError(msg)

-        name = typing.cast(ContainerEngineName, name)
+        name = typing.cast("ContainerEngineName", name)
        # some flexibility in the option names to cope with TOML conventions
        create_args = config_dict.get("create_args") or config_dict.get("create-args") or []
        disable_host_mount_options = (
@@ -94,44 +143,50 @@ DEFAULT_ENGINE = OCIContainerEngineConfig("docker")
 def _check_engine_version(engine: OCIContainerEngineConfig) -> None:
    try:
        version_string = call(engine.name, "version", "-f", "{{json .}}", capture_stdout=True)
-        version_info = json.loads(version_string.strip())
-        if engine.name == "docker":
-            client_api_version = FlexibleVersion(version_info["Client"]["ApiVersion"])
-            server_api_version = FlexibleVersion(version_info["Server"]["ApiVersion"])
-            # --platform support was introduced in 1.32 as experimental, 1.41 removed the experimental flag
-            version = min(client_api_version, server_api_version)
-            minimum_version = FlexibleVersion("1.41")
-            minimum_version_str = "20.10.0"  # docker version
-            error_msg = textwrap.dedent(
-                f"""
-                Build failed because {engine.name} is too old.
+        # We are using lowercase keys for all dicts so we are not affected by casing of keys
+        version_info = json.loads(
+            version_string.strip(), object_pairs_hook=lambda inp: {k.lower(): v for k, v in inp}
+        )
+        match engine.name:
+            case "docker":
+                client_api_version = FlexibleVersion(version_info["client"]["apiversion"])
+                server_api_version = FlexibleVersion(version_info["server"]["apiversion"])
+                # --platform support was introduced in 1.32 as experimental, 1.41 removed the experimental flag
+                version = min(client_api_version, server_api_version)
+                minimum_version = FlexibleVersion("1.41")
+                minimum_version_str = "20.10.0"  # docker version
+                error_msg = textwrap.dedent(
+                    f"""
+                    Build failed because {engine.name} is too old.

-                cibuildwheel requires {engine.name}>={minimum_version_str} running API version {minimum_version}.
-                The API version found by cibuildwheel is {version}.
-                """
-            )
-        elif engine.name == "podman":
-            # podman uses the same version string for "Version" & "ApiVersion"
-            client_version = FlexibleVersion(version_info["Client"]["Version"])
-            if "Server" in version_info:
-                server_version = FlexibleVersion(version_info["Server"]["Version"])
-            else:
-                server_version = client_version
-            # --platform support was introduced in v3
-            version = min(client_version, server_version)
-            minimum_version = FlexibleVersion("3")
-            error_msg = textwrap.dedent(
-                f"""
-                Build failed because {engine.name} is too old.
+                    cibuildwheel requires {engine.name}>={minimum_version_str} running API version {minimum_version}.
+                    The API version found by cibuildwheel is {version}.
+                    """
+                )
+            case "podman":
+                # podman uses the same version string for "Version" & "ApiVersion"
+                client_version = FlexibleVersion(version_info["client"]["version"])
+                if "server" in version_info:
+                    server_version = FlexibleVersion(version_info["server"]["version"])
+                else:
+                    server_version = client_version
+                # --platform support was introduced in v3
+                version = min(client_version, server_version)
+                minimum_version = FlexibleVersion("3")
+                error_msg = textwrap.dedent(
+                    f"""
+                    Build failed because {engine.name} is too old.
+
+                    cibuildwheel requires {engine.name}>={minimum_version}.
+                    The version found by cibuildwheel is {version}.
+                    """
+                )
+            case _:
+                assert_never(engine.name)

-                cibuildwheel requires {engine.name}>={minimum_version}.
-                The version found by cibuildwheel is {version}.
-                """
-            )
-        else:
-            assert_never(engine.name)
        if version < minimum_version:
            raise OCIEngineTooOldError(error_msg) from None
+
    except (subprocess.CalledProcessError, KeyError, ValueError) as e:
        msg = f"Build failed because {engine.name} is too old or is not working properly."
        raise OCIEngineTooOldError(msg) from e
@@ -149,11 +204,19 @@ class OCIContainer:
    back to cibuildwheel.

    Example:
+        >>> # xdoctest: +REQUIRES(LINUX)
        >>> from cibuildwheel.oci_container import *  # NOQA
        >>> from cibuildwheel.options import _get_pinned_container_images
+        >>> import pytest
+        >>> try:
+        ...     oci_platform = OCIPlatform.native()
+        ... except OSError as ex:
+        ...     pytest.skip(str(ex))
+        >>> if oci_platform != OCIPlatform.AMD64:
+        ...     pytest.skip('only runs on amd64')
        >>> image = _get_pinned_container_images()['x86_64']['manylinux2014']
        >>> # Test the default container
-        >>> with OCIContainer(image=image) as self:
+        >>> with OCIContainer(image=image, oci_platform=oci_platform) as self:
        ...     self.call(["echo", "hello world"])
        ...     self.call(["cat", "/proc/1/cgroup"])
        ...     print(self.get_environment())
@@ -162,7 +225,6 @@ class OCIContainer:

    UTILITY_PYTHON = "/opt/python/cp39-cp39/bin/python"

-    process: subprocess.Popen[bytes]
    bash_stdin: IO[bytes]
    bash_stdout: IO[bytes]

@@ -182,6 +244,7 @@ class OCIContainer:
        self.oci_platform = oci_platform
        self.cwd = cwd
        self.name: str | None = None
+        self.process: subprocess.Popen[bytes] | None = None
        self.engine = engine
        self.host_tar_format = ""
        if sys.platform.startswith("darwin"):
@@ -213,10 +276,12 @@ class OCIContainer:
                # this allows to run local only images
                pull = "never"
        except subprocess.CalledProcessError:
+            # silently fallback to "--pull=always"
            pass
        return f"--platform={oci_platform.value}", f"--pull={pull}"

    def __enter__(self) -> Self:
+        assert self.process is None
        self.name = f"cibuildwheel-{uuid.uuid4()}"

        _check_engine_version(self.engine)
@@ -252,7 +317,17 @@ class OCIContainer:
                    ).strip()
                else:
                    raise
-            simulate_32_bit = container_machine not in {"i686", "armv7l", "armv8l"}
+            if container_machine not in {"i686", "armv7l", "armv8l"}:
+                simulate_32_bit = True
+                # sanity check to ensure no deadlock waiting for container to start
+                call(
+                    *run_cmd,
+                    *platform_args,
+                    self.image,
+                    "linux32",
+                    "/bin/true",
+                    capture_stdout=True,
+                )

        shell_args = ["linux32", "/bin/bash"] if simulate_32_bit else ["/bin/bash"]

@@ -274,32 +349,41 @@ class OCIContainer:
            check=True,
        )

-        self.process = subprocess.Popen(
-            [
-                self.engine.name,
-                "start",
-                "--attach",
-                "--interactive",
-                self.name,
-            ],
-            stdin=subprocess.PIPE,
-            stdout=subprocess.PIPE,
-        )
+        try:
+            self.process = subprocess.Popen(
+                [
+                    self.engine.name,
+                    "start",
+                    "--attach",
+                    "--interactive",
+                    self.name,
+                ],
+                stdin=subprocess.PIPE,
+                stdout=subprocess.PIPE,
+            )

-        assert self.process.stdin
-        assert self.process.stdout
-        self.bash_stdin = self.process.stdin
-        self.bash_stdout = self.process.stdout
+            assert self.process.stdin
+            assert self.process.stdout
+            self.bash_stdin = self.process.stdin
+            self.bash_stdout = self.process.stdout

-        # run a noop command to block until the container is responding
-        self.call(["/bin/true"], cwd="/")
-
-        if self.cwd:
-            # Although `docker create -w` does create the working dir if it
-            # does not exist, podman does not. There does not seem to be a way
-            # to setup a workdir for a container running in podman.
-            self.call(["mkdir", "-p", os.fspath(self.cwd)], cwd="/")
+            # run a noop command to block until the container is responding
+            self.call(["/bin/true"], cwd="/")

+            if self.cwd:
+                # Although `docker create -w` does create the working dir if it
+                # does not exist, podman does not. There does not seem to be a way
+                # to setup a workdir for a container running in podman.
+                self.call(["mkdir", "-p", os.fspath(self.cwd)], cwd="/")
+        except BaseException:
+            # clean-up
+            if self.process is not None:
+                if self.process.poll() is None:
+                    self.process.kill()
+                self.process.communicate()
+            self.process = None
+            self._remove_container()
+            raise
        return self

    def __exit__(
@@ -308,29 +392,52 @@ class OCIContainer:
        exc_val: BaseException | None,
        exc_tb: TracebackType | None,
    ) -> None:
-        self.bash_stdin.write(b"exit 0\n")
-        self.bash_stdin.flush()
-        self.process.wait(timeout=30)
-        self.bash_stdin.close()
-        self.bash_stdout.close()
+        assert self.process is not None
+        try:
+            # Ask bash to exit cleanly and wait for the `start` process to finish.
+            # If the container/bash has already died, the write raises
+            # BrokenPipeError; if bash refuses to exit, `wait` raises
+            # TimeoutExpired. Both are handled below so we always reach the
+            # cleanup in `finally` rather than leaking the process or container.
+            self.bash_stdin.write(b"exit 0\n")
+            self.bash_stdin.flush()
+            self.process.wait(timeout=30)

-        if self.engine.name == "podman":
-            # This works around what seems to be a race condition in the podman
-            # backend. The full reason is not understood. See PR #966 for a
-            # discussion on possible causes and attempts to remove this line.
-            # For now, this seems to work "well enough".
-            self.process.wait()
+            if self.engine.name == "podman":
+                # This works around what seems to be a race condition in the
+                # podman backend. The full reason is not understood. See PR #966
+                # for a discussion on possible causes and attempts to remove this
+                # line. For now, this seems to work "well enough".
+                self.process.wait()
+        except (OSError, subprocess.TimeoutExpired):
+            # bash didn't shut down cleanly; force the process down so it isn't
+            # leaked, then continue to cleanup.
+            if self.process.poll() is None:
+                self.process.kill()
+                self.process.wait()
+        finally:
+            with contextlib.suppress(OSError):
+                self.bash_stdin.close()
+            with contextlib.suppress(OSError):
+                self.bash_stdout.close()
+            self.process = None

-        assert isinstance(self.name, str)
+            keep_container = strtobool(os.environ.get("CIBW_DEBUG_KEEP_CONTAINER", ""))
+            if not keep_container:
+                self._remove_container()

-        keep_container = strtobool(os.environ.get("CIBW_DEBUG_KEEP_CONTAINER", ""))
-        if not keep_container:
-            subprocess.run(
-                [self.engine.name, "rm", "--force", "-v", self.name],
-                stdout=subprocess.DEVNULL,
-                check=False,
-            )
-            self.name = None
+    def _remove_container(self) -> None:
+        assert self.name is not None
+        result = subprocess.run(
+            [self.engine.name, "rm", "--force", "-v", self.name],
+            stdout=subprocess.DEVNULL,
+            check=False,
+        )
+        # only warn when not running in CI
+        if result.returncode != 0 and detect_ci_provider() is None:
+            msg = f"Failed to remove {self.name!r} container."
+            log.warning(msg)
+        self.name = None

    def copy_into(self, from_path: Path, to_path: PurePath) -> None:
        if from_path.is_dir():
@@ -482,20 +589,19 @@ class OCIContainer:
                capture_output=True,
            )
        )
-        return typing.cast(dict[str, str], env)
+        return typing.cast("dict[str, str]", env)

    def environment_executor(self, command: Sequence[str], environment: dict[str, str]) -> str:
        # used as an EnvironmentExecutor to evaluate commands and capture output
        return self.call(command, env=environment, capture_output=True)

    def debug_info(self) -> str:
+        command = [self.engine.name, "info"]
        if self.engine.name == "podman":
-            command = f"{self.engine.name} info --debug"
-        else:
-            command = f"{self.engine.name} info"
+            command.append("--debug")
+
        completed = subprocess.run(
            command,
-            shell=True,
            check=True,
            cwd=self.cwd,
            stdin=subprocess.PIPE,
@@ -1,3 +1,29 @@
+from __future__ import annotations
+
+__lazy_modules__ = {
+    "cibuildwheel.architecture",
+    "cibuildwheel.environment",
+    "cibuildwheel.frontend",
+    "cibuildwheel.logger",
+    "cibuildwheel.oci_container",
+    "cibuildwheel.projectfiles",
+    "cibuildwheel.selector",
+    "cibuildwheel.typing",
+    "cibuildwheel.util",
+    "cibuildwheel.util.helpers",
+    "cibuildwheel.util.packaging",
+    "collections",
+    "configparser",
+    "contextlib",
+    "difflib",
+    "packaging",
+    "packaging.specifiers",
+    "pathlib",
+    "shlex",
+    "textwrap",
+    "tomllib",
+}
+
 import collections
 import configparser
 import contextlib
@@ -8,24 +34,29 @@ import functools
 import shlex
 import textwrap
 import tomllib
-from collections.abc import Callable, Generator, Iterable, Mapping, Sequence, Set
+from collections.abc import Mapping, Sequence
 from pathlib import Path
-from typing import Any, Final, Literal, Self, assert_never
+from typing import assert_never

 from packaging.specifiers import SpecifierSet

-from . import errors
-from .architecture import Architecture
-from .environment import EnvironmentParseError, ParsedEnvironment, parse_environment
-from .frontend import BuildFrontendConfig
-from .logger import log
-from .oci_container import OCIContainerEngineConfig
-from .projectfiles import get_requires_python_str, resolve_dependency_groups
-from .selector import BuildSelector, EnableGroup, TestSelector, selector_matches
-from .typing import PLATFORMS, PlatformName
-from .util import resources
-from .util.helpers import format_safe, strtobool, unwrap
-from .util.packaging import DependencyConstraints
+from cibuildwheel import errors
+from cibuildwheel.architecture import Architecture
+from cibuildwheel.environment import EnvironmentParseError, ParsedEnvironment, parse_environment
+from cibuildwheel.frontend import BuildFrontendConfig, BuildFrontendName
+from cibuildwheel.logger import log
+from cibuildwheel.oci_container import OCIContainerEngineConfig
+from cibuildwheel.projectfiles import get_requires_python_str, resolve_dependency_groups
+from cibuildwheel.selector import BuildSelector, EnableGroup, TestSelector, selector_matches
+from cibuildwheel.typing import PLATFORMS, PlatformName
+from cibuildwheel.util import resources
+from cibuildwheel.util.helpers import format_safe, parse_key_value_string, strtobool, unwrap
+from cibuildwheel.util.packaging import DependencyConstraints
+
+TYPE_CHECKING = False
+if TYPE_CHECKING:
+    from collections.abc import Callable, Generator, Iterable, Set
+    from typing import Any, Final, Literal, Self

 MANYLINUX_ARCHS: Final[tuple[str, ...]] = (
    "x86_64",
@@ -63,6 +94,7 @@ class CommandLineArguments:
    allow_empty: bool
    debug_traceback: bool
    enable: list[str]
+    clean_cache: bool

    @classmethod
    def defaults(cls) -> Self:
@@ -77,6 +109,7 @@ class CommandLineArguments:
            print_build_identifiers=False,
            debug_traceback=False,
            enable=[],
+            clean_cache=False,
        )


@@ -90,6 +123,20 @@ class GlobalOptions:
    allow_empty: bool


+@dataclasses.dataclass(frozen=True)
+class TestRuntimeConfig:
+    args: Sequence[str] = ()
+
+    @classmethod
+    def from_config_string(cls, config_string: str) -> Self:
+        config_dict = parse_key_value_string(config_string, [], ["args"])
+        args = config_dict.get("args") or []
+        return cls(args=args)
+
+    def options_summary(self) -> str | dict[str, str]:
+        return {"args": repr(self.args)}
+
+
@dataclasses.dataclass(frozen=True, kw_only=True)
 class BuildOptions:
    globals: GlobalOptions
@@ -97,6 +144,7 @@ class BuildOptions:
    before_all: str
    before_build: str | None
    xbuild_tools: list[str] | None
+    xbuild_files: dict[str, list[str]]
    repair_command: str
    manylinux_images: dict[str, str] | None
    musllinux_images: dict[str, str] | None
@@ -108,8 +156,11 @@ class BuildOptions:
    test_extras: str
    test_groups: list[str]
    test_environment: ParsedEnvironment
+    test_runtime: TestRuntimeConfig
+    audit_requires: list[str]
+    audit_command: list[str]
    build_verbosity: int
-    build_frontend: BuildFrontendConfig | None
+    build_frontend: BuildFrontendConfig
    config_settings: str
    container_engine: OCIContainerEngineConfig
    pyodide_version: str | None
@@ -343,40 +394,46 @@ def _apply_inherit_rule(
        msg = f"Don't know how to merge {before!r} and {after!r} with {rule}"
        raise OptionsReaderError(msg)

-    if rule == InheritRule.APPEND:
-        return option_format.merge_values(before, after)
-    if rule == InheritRule.PREPEND:
-        return option_format.merge_values(after, before)
-
-    assert_never(rule)
+    match rule:
+        case InheritRule.APPEND:
+            return option_format.merge_values(before, after)
+        case InheritRule.PREPEND:
+            return option_format.merge_values(after, before)
+        case _:
+            assert_never(rule)


 def _stringify_setting(
    setting: SettingValue,
    option_format: OptionFormat | None,
 ) -> str:
-    if isinstance(setting, Mapping):
-        try:
-            if option_format is None:
-                raise OptionFormat.NotSupported
-            return option_format.format_table(setting)
-        except OptionFormat.NotSupported:
-            msg = f"Error converting {setting!r} to a string: this setting doesn't accept a table"
-            raise OptionsReaderError(msg) from None
-
-    if not isinstance(setting, str) and isinstance(setting, Sequence):
-        try:
-            if option_format is None:
-                raise OptionFormat.NotSupported
-            return option_format.format_list(setting)
-        except OptionFormat.NotSupported:
-            msg = f"Error converting {setting!r} to a string: this setting doesn't accept a list"
-            raise OptionsReaderError(msg) from None
-
-    if isinstance(setting, bool | int):
-        return str(setting)
-
-    return setting
+    match setting:
+        case {}:
+            assert isinstance(setting, Mapping)  # MyPy 1.15 doesn't narrow this for us
+            try:
+                if option_format is None:
+                    raise OptionFormat.NotSupported
+                return option_format.format_table(setting)
+            except OptionFormat.NotSupported:
+                msg = (
+                    f"Error converting {setting!r} to a string: this setting doesn't accept a table"
+                )
+                raise OptionsReaderError(msg) from None
+        case bool() | int():
+            return str(setting)
+        case [*_]:
+            try:
+                if option_format is None:
+                    raise OptionFormat.NotSupported
+                return option_format.format_list(setting)
+            except OptionFormat.NotSupported:
+                msg = (
+                    f"Error converting {setting!r} to a string: this setting doesn't accept a list"
+                )
+                raise OptionsReaderError(msg) from None
+        case _:
+            assert isinstance(setting, str)  # MyPy 1.15 doesn't narrow this for us
+            return setting


 class OptionsReader:
@@ -385,6 +442,7 @@ class OptionsReader:
    by the platform.

    Example:
+      >>> # xdoctest: +SKIP
      >>> options_reader = OptionsReader(config_file, platform='macos')
      >>> options_reader.get('cool-color')

@@ -651,7 +709,9 @@ class Options:
        )
        requires_python = None if requires_python_str is None else SpecifierSet(requires_python_str)

-        archs_config_str = args.archs or self.reader.get("archs", option_format=ListFormat(sep=" "))
+        archs_config_str = args.archs or self.reader.get(
+            "archs", option_format=ListFormat(sep=" "), ignore_empty=True
+        )
        architectures = Architecture.parse_config(archs_config_str, platform=self.platform)

        # Process `--only`
@@ -659,7 +719,7 @@ class Options:
            build_config = args.only
            skip_config = ""
            architectures = Architecture.all_archs(self.platform)
-            enable = set(EnableGroup)
+            enable |= EnableGroup.all_groups()

        build_selector = BuildSelector(
            build_config=build_config,
@@ -680,11 +740,12 @@ class Options:

    def _check_pinned_image(self, value: str, pinned_images: Mapping[str, str]) -> None:
        error_set = {"manylinux1", "manylinux2010", "manylinux_2_24", "musllinux_1_1"}
+        # Currently no warnings, next: https://github.com/pypa/manylinux/issues/1925
        warning_set: set[str] = set()

        if value in error_set:
            msg = (
-                f"cibuildwheel 3.x does not support the image {value!r}. Either upgrade to a "
+                f"cibuildwheel 4.x does not support the image {value!r}. Either upgrade to a "
                "supported image or continue using the image by pinning it directly with"
                " its full OCI registry '<name>{:<tag>|@<digest>}'."
            )
@@ -736,6 +797,14 @@ class Options:
            if xbuild_tools == ["\u0000"]:
                xbuild_tools = None

+            xbuild_files = parse_key_value_string(
+                self.reader.get(
+                    "xbuild-files",
+                    option_format=ShlexTableFormat(sep="; ", pair_sep=":", allow_merge=False),
+                ),
+                kw_arg_names=["*"],
+            )
+
            test_sources = shlex.split(
                self.reader.get(
                    "test-sources", option_format=ListFormat(sep=" ", quote=shlex.quote)
@@ -750,9 +819,24 @@ class Options:
                msg = f"Malformed environment option {test_environment_config!r}"
                raise errors.ConfigurationError(msg) from e

-            test_requires = self.reader.get(
-                "test-requires", option_format=ListFormat(sep=" ")
-            ).split()
+            test_runtime_str = self.reader.get(
+                "test-runtime",
+                option_format=ShlexTableFormat(sep="; ", pair_sep=":", allow_merge=False),
+            )
+            if not test_runtime_str:
+                test_runtime = TestRuntimeConfig()
+            else:
+                try:
+                    test_runtime = TestRuntimeConfig.from_config_string(test_runtime_str)
+                except ValueError as e:
+                    msg = f"Failed to parse test runtime config. {e}"
+                    raise errors.ConfigurationError(msg) from e
+
+            test_requires = shlex.split(
+                self.reader.get(
+                    "test-requires", option_format=ListFormat(sep=" ", quote=shlex.quote)
+                )
+            )
            test_extras = self.reader.get("test-extras", option_format=ListFormat(sep=","))
            test_groups_str = self.reader.get("test-groups", option_format=ListFormat(sep=" "))
            test_groups = [x for x in test_groups_str.split() if x]
@@ -766,9 +850,11 @@ class Options:
                env_plat=False,
                option_format=ShlexTableFormat(sep="; ", pair_sep=":", allow_merge=False),
            )
-            build_frontend: BuildFrontendConfig | None
+            default_frontend: BuildFrontendName = (
+                "pyodide-build" if self.platform == "pyodide" else "build"
+            )
            if not build_frontend_str or build_frontend_str == "default":
-                build_frontend = None
+                build_frontend = BuildFrontendConfig(default_frontend)
            else:
                try:
                    build_frontend = BuildFrontendConfig.from_config_string(build_frontend_str)
@@ -776,6 +862,18 @@ class Options:
                    msg = f"Failed to parse build frontend. {e}"
                    raise errors.ConfigurationError(msg) from e

+            if self.platform == "pyodide" and build_frontend.name != "pyodide-build":
+                # pip and uv could become an error, eventually. build -> pyodide-build is
+                # probably fine to keep as a warning
+                log.warning(
+                    f"The pyodide platform ignores the {build_frontend.name!r} build "
+                    "frontend; using 'pyodide-build' instead"
+                )
+                build_frontend = BuildFrontendConfig("pyodide-build", build_frontend.args)
+            if self.platform != "pyodide" and build_frontend.name == "pyodide-build":
+                msg = "The 'pyodide-build' build frontend is only supported on the pyodide platform"
+                raise errors.ConfigurationError(msg)
+
            try:
                environment = parse_environment(environment_config)
            except (EnvironmentParseError, ValueError) as e:
@@ -822,11 +920,7 @@ class Options:
                        f"manylinux-{build_platform}-image", ignore_empty=True
                    )
                    self._check_pinned_image(config_value, pinned_images)
-                    if config_value in pinned_images:
-                        image = pinned_images[config_value]
-                    else:
-                        image = config_value
-                    manylinux_images[build_platform] = image
+                    manylinux_images[build_platform] = pinned_images.get(config_value, config_value)

                for build_platform in MUSLLINUX_ARCHS:
                    pinned_images = all_pinned_container_images[build_platform]
@@ -834,11 +928,7 @@ class Options:
                        f"musllinux-{build_platform}-image", ignore_empty=True
                    )
                    self._check_pinned_image(config_value, pinned_images)
-                    if config_value in pinned_images:
-                        image = pinned_images[config_value]
-                    else:
-                        image = config_value
-                    musllinux_images[build_platform] = image
+                    musllinux_images[build_platform] = pinned_images.get(config_value, config_value)

            container_engine_str = self.reader.get(
                "container-engine",
@@ -853,11 +943,23 @@ class Options:

            pyodide_version = self.reader.get("pyodide-version", env_plat=False)

+            audit_command_str = self.reader.get(
+                "audit-command", option_format=ListFormat(sep=" && ")
+            )
+            audit_command = audit_command_str.split(" && ") if audit_command_str else []
+
+            audit_requires = shlex.split(
+                self.reader.get(
+                    "audit-requires", option_format=ListFormat(sep=" ", quote=shlex.quote)
+                )
+            )
+
            return BuildOptions(
                globals=self.globals,
                test_command=test_command,
                test_sources=test_sources,
                test_environment=test_environment,
+                test_runtime=test_runtime,
                test_requires=[*test_requires, *test_requirements_from_groups],
                test_extras=test_extras,
                test_groups=test_groups,
@@ -866,6 +968,7 @@ class Options:
                before_all=before_all,
                build_verbosity=build_verbosity,
                xbuild_tools=xbuild_tools,
+                xbuild_files=xbuild_files,
                repair_command=repair_command,
                environment=environment,
                dependency_constraints=dependency_constraints,
@@ -875,6 +978,8 @@ class Options:
                config_settings=config_settings,
                container_engine=container_engine,
                pyodide_version=pyodide_version or None,
+                audit_command=audit_command,
+                audit_requires=audit_requires,
            )

    def check_for_invalid_configuration(self, identifiers: Iterable[str]) -> None:
@@ -901,14 +1006,18 @@ class Options:
            defaults=True,
        )

-    def summary(self, identifiers: Iterable[str]) -> str:
+    def summary(self, identifiers: Iterable[str], skip_unset: bool = False) -> str:
        lines = []
        global_option_names = sorted(f.name for f in dataclasses.fields(self.globals))

        for option_name in global_option_names:
            option_value = getattr(self.globals, option_name)
            default_value = getattr(self.defaults.globals, option_name)
-            lines.append(self.option_summary(option_name, option_value, default_value))
+            line = self.option_summary(
+                option_name, option_value, default_value, skip_unset=skip_unset
+            )
+            if line is not None:
+                lines.append(line)

        build_options = self.build_options(identifier=None)
        build_options_defaults = self.defaults.build_options(identifier=None)
@@ -928,19 +1037,26 @@ class Options:
                i: getattr(build_options_for_identifier[i], option_name) for i in identifiers
            }

-            lines.append(
-                self.option_summary(option_name, option_value, default_value, overrides=overrides)
+            line = self.option_summary(
+                option_name,
+                option_value,
+                default_value,
+                overrides=overrides,
+                skip_unset=skip_unset,
            )
+            if line is not None:
+                lines.append(line)

        return "\n".join(lines)

    def option_summary(
        self,
        option_name: str,
-        option_value: Any,
-        default_value: Any,
+        option_value: Any,  # noqa: ANN401
+        default_value: Any,  # noqa: ANN401
        overrides: Mapping[str, Any] | None = None,
-    ) -> str:
+        skip_unset: bool = False,
+    ) -> str | None:
        """
        Return a summary of the option value, including any overrides, with
        ANSI 'dim' color if it's the default.
@@ -954,6 +1070,10 @@ class Options:
        overrides_value_strs = {k: v for k, v in overrides_value_strs.items() if v != value_str}

        has_been_set = (value_str != default_value_str) or overrides_value_strs
+
+        if skip_unset and not has_been_set:
+            return None
+
        c = log.colors

        result = c.gray if not has_been_set else ""
@@ -985,7 +1105,7 @@ class Options:
            return value

    @staticmethod
-    def option_summary_value(option_value: Any) -> str:
+    def option_summary_value(option_value: Any) -> str:  # noqa: ANN401
        if hasattr(option_value, "options_summary"):
            option_value = option_value.options_summary()

@@ -1018,6 +1138,6 @@ def _get_pinned_container_images() -> Mapping[str, Mapping[str, str]]:
      'pypy_x86_64': {'manylinux2010': '...' }
      ... }
    """
-    all_pinned_images = configparser.ConfigParser()
+    all_pinned_images = configparser.ConfigParser(inline_comment_prefixes="#")
    all_pinned_images.read(resources.PINNED_DOCKER_IMAGES)
    return all_pinned_images
@@ -1,14 +1,21 @@
 from __future__ import annotations

-from collections.abc import Sequence
-from pathlib import Path
-from typing import Final, Protocol
+import sys
+from typing import Protocol

-from cibuildwheel.architecture import Architecture
-from cibuildwheel.options import Options
-from cibuildwheel.platforms import ios, linux, macos, pyodide, windows
-from cibuildwheel.selector import BuildSelector
-from cibuildwheel.typing import GenericPythonConfiguration, PlatformName
+from cibuildwheel import errors
+from cibuildwheel.platforms import android, ios, linux, macos, pyodide, windows
+
+TYPE_CHECKING = False
+if TYPE_CHECKING:
+    from collections.abc import Sequence
+    from pathlib import Path
+    from typing import Final
+
+    from cibuildwheel.architecture import Architecture
+    from cibuildwheel.options import Options
+    from cibuildwheel.selector import BuildSelector
+    from cibuildwheel.typing import GenericPythonConfiguration, PlatformName


 class PlatformModule(Protocol):
@@ -28,10 +35,27 @@ ALL_PLATFORM_MODULES: Final[dict[PlatformName, PlatformModule]] = {
    "windows": windows,
    "macos": macos,
    "pyodide": pyodide,
+    "android": android,
    "ios": ios,
 }


+def native_platform() -> PlatformName:
+    if sys.platform.startswith("linux"):
+        return "linux"
+    elif sys.platform == "darwin":
+        return "macos"
+    elif sys.platform == "win32":
+        return "windows"
+    else:
+        msg = (
+            'Unable to detect platform from "sys.platform". cibuildwheel doesn\'t '
+            "support building wheels for this platform. You might be able to build for a different "
+            "platform using the --platform argument. Check --help output for more information."
+        )
+        raise errors.ConfigurationError(msg)
+
+
 def get_build_identifiers(
    platform_module: PlatformModule,
    build_selector: BuildSelector,
@@ -0,0 +1,783 @@
+from __future__ import annotations
+
+__lazy_modules__ = {
+    "build",
+    "build.env",
+    "cibuildwheel.architecture",
+    "cibuildwheel.audit",
+    "cibuildwheel.frontend",
+    "cibuildwheel.logger",
+    "cibuildwheel.util.cmd",
+    "cibuildwheel.util.file",
+    "cibuildwheel.util.helpers",
+    "cibuildwheel.util.packaging",
+    "cibuildwheel.util.python_build_standalone",
+    "cibuildwheel.venv",
+    "filelock",
+    "packaging",
+    "packaging.utils",
+    "pathlib",
+    "platform",
+    "pprint",
+    "re",
+    "runpy",
+    "shlex",
+    "shutil",
+    "subprocess",
+    "textwrap",
+    "typing",
+}
+
+import os
+import platform
+import re
+import shlex
+import shutil
+import subprocess
+import sys
+from dataclasses import dataclass
+from pathlib import Path
+from pprint import pprint
+from runpy import run_path
+from textwrap import dedent
+from typing import Any
+
+from build import ProjectBuilder
+from build.env import IsolatedEnv
+from filelock import FileLock
+from packaging.utils import canonicalize_name
+
+from cibuildwheel import errors, platforms  # pylint: disable=cyclic-import
+from cibuildwheel.architecture import Architecture, arch_synonym
+from cibuildwheel.audit import run_audit
+from cibuildwheel.frontend import (
+    get_build_frontend_extra_flags,
+    parse_config_settings,
+    prepare_config_settings,
+)
+from cibuildwheel.logger import log
+from cibuildwheel.util import resources
+from cibuildwheel.util.cmd import call, shell
+from cibuildwheel.util.file import (
+    CIBW_CACHE_PATH,
+    copy_test_sources,
+    download,
+    move_file,
+    remove_on_error,
+)
+from cibuildwheel.util.helpers import prepare_command
+from cibuildwheel.util.packaging import find_compatible_wheel
+from cibuildwheel.util.python_build_standalone import create_python_build_standalone_environment
+from cibuildwheel.venv import constraint_flags, find_uv, virtualenv
+
+TYPE_CHECKING = False
+if TYPE_CHECKING:
+    from cibuildwheel.options import BuildOptions, Options
+    from cibuildwheel.selector import BuildSelector
+    from cibuildwheel.typing import PathOrStr
+
+RESOURCES_ANDROID = resources.PATH / "android"
+ANDROID_TRIPLET = {
+    "arm64_v8a": "aarch64-linux-android",
+    "x86_64": "x86_64-linux-android",
+}
+
+
+def parse_identifier(identifier: str) -> tuple[str, str]:
+    match = re.fullmatch(r"cp(\d)(\d+)-android_(.+)", identifier)
+    if not match:
+        msg = f"invalid Android identifier: '{identifier}'"
+        raise ValueError(msg)
+    major, minor, arch = match.groups()
+    return (f"{major}.{minor}", arch)
+
+
+def android_triplet(identifier: str) -> str:
+    return ANDROID_TRIPLET[parse_identifier(identifier)[1]]
+
+
+@dataclass(frozen=True)
+class PythonConfiguration:
+    version: str
+    identifier: str
+    url: str
+    sha256: str
+
+    @property
+    def arch(self) -> str:
+        return parse_identifier(self.identifier)[1]
+
+
+def all_python_configurations() -> list[PythonConfiguration]:
+    return [PythonConfiguration(**item) for item in resources.read_python_configs("android")]
+
+
+def get_python_configurations(
+    build_selector: BuildSelector, architectures: set[Architecture]
+) -> list[PythonConfiguration]:
+    return [
+        c
+        for c in all_python_configurations()
+        if c.arch in architectures and build_selector(c.identifier)
+    ]
+
+
+def shell_prepared(command: str, *, build_options: BuildOptions, env: dict[str, str]) -> None:
+    shell(
+        prepare_command(command, project=".", package=build_options.package_dir),
+        env=env,
+    )
+
+
+def before_all(options: Options, python_configurations: list[PythonConfiguration]) -> None:
+    before_all_options = options.build_options(python_configurations[0].identifier)
+    if before_all_options.before_all:
+        log.step("Running before_all...")
+        shell_prepared(
+            before_all_options.before_all,
+            build_options=before_all_options,
+            env=before_all_options.environment.as_dictionary(os.environ),
+        )
+
+
+@dataclass(frozen=True)
+class BuildState:
+    config: PythonConfiguration
+    options: BuildOptions
+    build_path: Path
+    python_dir: Path
+    build_env: dict[str, str]
+    android_env: dict[str, str]
+
+
+def build(options: Options, tmp_path: Path) -> None:
+    if "ANDROID_HOME" not in os.environ:
+        msg = (
+            "ANDROID_HOME environment variable is not set. For instructions, see "
+            "https://cibuildwheel.pypa.io/en/stable/platforms/#android"
+        )
+        raise errors.FatalError(msg)
+
+    configs = get_python_configurations(
+        options.globals.build_selector, options.globals.architectures
+    )
+    if not configs:
+        return
+
+    try:
+        before_all(options, configs)
+
+        built_wheels: list[Path] = []
+        for config in configs:
+            log.build_start(config.identifier)
+            build_options = options.build_options(config.identifier)
+            build_path = tmp_path / config.identifier
+            build_path.mkdir()
+            python_dir = setup_target_python(config, build_path)
+            build_env, android_env = setup_env(config, build_options, build_path, python_dir)
+
+            state = BuildState(
+                config, build_options, build_path, python_dir, build_env, android_env
+            )
+            setup_xbuild_files(state)
+
+            compatible_wheel = find_compatible_wheel(built_wheels, config.identifier)
+            if compatible_wheel:
+                print(
+                    f"\nFound previously built wheel {compatible_wheel.name} that is "
+                    f"compatible with {config.identifier}. Skipping build step..."
+                )
+                repaired_wheel = compatible_wheel
+            else:
+                before_build(state)
+                built_wheel = build_wheel(state)
+                repaired_wheel = repair_wheel(state, built_wheel)
+                run_audit(tmp_dir=tmp_path, build_options=build_options, wheel=repaired_wheel)
+
+            test_wheel(state, repaired_wheel)
+
+            output_wheel: Path | None = None
+            if compatible_wheel is None:
+                output_wheel = move_file(
+                    repaired_wheel, build_options.output_dir / repaired_wheel.name
+                )
+                built_wheels.append(output_wheel)
+
+            shutil.rmtree(build_path)
+            log.build_end(output_wheel)
+
+    except subprocess.CalledProcessError as error:
+        msg = f"Command {error.cmd} failed with code {error.returncode}. {error.stdout or ''}"
+        raise errors.FatalError(msg) from error
+
+
+def setup_target_python(config: PythonConfiguration, build_path: Path) -> Path:
+    log.step("Installing target Python...")
+    python_tgz = CIBW_CACHE_PATH / config.url.rpartition("/")[-1]
+    with FileLock(f"{python_tgz}.lock"):
+        if not python_tgz.exists():
+            with remove_on_error(python_tgz):
+                download(config.url, python_tgz, sha256=config.sha256)
+
+    python_dir = build_path / "python"
+    python_dir.mkdir()
+    shutil.unpack_archive(python_tgz, python_dir)
+
+    # Work around https://github.com/python/cpython/issues/138800. This can be removed
+    # once we've updated to Python versions that include the fix.
+    pc_path = python_dir / f"prefix/lib/pkgconfig/python-{config.version}.pc"
+    pc_path.write_text(pc_path.read_text().replace("$(BLDLIBRARY)", f"-lpython{config.version}"))
+
+    return python_dir
+
+
+def setup_env(
+    config: PythonConfiguration, build_options: BuildOptions, build_path: Path, python_dir: Path
+) -> tuple[dict[str, str], dict[str, str]]:
+    """
+    Returns two environment dicts, both pointing at the same virtual environment:
+
+    * build_env, which uses the environment normally.
+    * android_env, which uses the environment while simulating running on Android.
+    """
+    log.step("Setting up build environment...")
+    use_uv, pip = find_pip(build_options)
+
+    # Create virtual environment
+    python_exe = create_python_build_standalone_environment(
+        config.version, build_path, CIBW_CACHE_PATH
+    )
+    venv_dir = build_path / "venv"
+    dependency_constraint = build_options.dependency_constraints.get_for_python_version(
+        version=config.version, tmp_dir=build_path
+    )
+    build_env = virtualenv(
+        config.version, python_exe, venv_dir, dependency_constraint, use_uv=use_uv
+    )
+    create_cmake_toolchain(config, build_path, python_dir, build_env)
+
+    # See platforms.md for the reason why we use this default API level.
+    build_env.setdefault("ANDROID_API_LEVEL", "24")
+
+    # Apply custom environment variables, and check environment is still valid
+    build_env = build_options.environment.as_dictionary(build_env)
+    build_env["CIBUILDWHEEL_BUILD_IDENTIFIER"] = config.identifier
+    build_env["PIP_DISABLE_PIP_VERSION_CHECK"] = "1"
+    for command in ["python"] if use_uv else ["python", "pip"]:
+        command_path = call("which", command, env=build_env, capture_stdout=True).strip()
+        if command_path != f"{venv_dir}/bin/{command}":
+            msg = (
+                f"{command} available on PATH doesn't match our installed instance. If you "
+                f"have modified PATH, ensure that you don't overwrite cibuildwheel's entry "
+                f"or insert {command} above it."
+            )
+            raise errors.FatalError(msg)
+        if command == "python":
+            call(command, "-V", "-V", env=build_env)
+        else:
+            call(command, "--version", env=build_env)
+
+    # Install build tools
+    tools = ["auditwheel", "patchelf", "pkgconf"]
+    if build_options.build_frontend.name in {"build", "build[uv]"}:
+        tools.append("build")
+    call(*pip, "install", *tools, *constraint_flags(dependency_constraint), env=build_env)
+
+    # Construct an altered environment which simulates running on Android.
+    android_env = setup_android_env(config, python_dir, build_env)
+
+    # Build-time requirements must be queried within android_env, because
+    # `get_requires_for_build` can run arbitrary code in setup.py scripts, which may be
+    # affected by the target platform. However, the requirements must be installed
+    # within build_env, because they're going to run on the build machine.
+    #
+    # The `build` CLI doesn't support this combination, so we use its API to query the
+    # requirements, and then install them ourselves with pip. We'll later run `build` in
+    # the same environment, passing the `--no-isolation` option.
+    class AndroidEnv(IsolatedEnv):
+        @property
+        def python_executable(self) -> str:
+            return f"{venv_dir}/bin/python"
+
+        def make_extra_environ(self) -> dict[str, str]:
+            return android_env
+
+    pb = ProjectBuilder.from_isolated_env(AndroidEnv(), build_options.package_dir)
+    if pb.build_system_requires:
+        call(*pip, "install", *pb.build_system_requires, env=build_env)
+
+    requires_for_build = pb.get_requires_for_build(
+        "wheel",
+        parse_config_settings(
+            prepare_config_settings(
+                build_options.config_settings,
+                project=Path.cwd(),
+                package=build_options.package_dir,
+            )
+        ),
+    )
+    if requires_for_build:
+        call(*pip, "install", *requires_for_build, env=build_env)
+
+    return build_env, android_env
+
+
+def create_cmake_toolchain(
+    config: PythonConfiguration, build_path: Path, python_dir: Path, build_env: dict[str, str]
+) -> None:
+    toolchain_path = build_path / "toolchain.cmake"
+    build_env["CMAKE_TOOLCHAIN_FILE"] = str(toolchain_path)
+    with open(toolchain_path, "w", encoding="UTF-8") as toolchain_file:
+        print(
+            dedent(
+                f"""\
+                # To support as many build systems as possible, we use environment
+                # variables as the single source of truth for compiler flags and paths,
+                # so they don't need to be specified here.
+
+                set(CMAKE_SYSTEM_NAME Android)
+                set(CMAKE_SYSTEM_PROCESSOR {android_triplet(config.identifier).split("-")[0]})
+
+                # Inhibit all of CMake's own NDK handling code.
+                set(CMAKE_SYSTEM_VERSION 1)
+
+                # Tell CMake where to look for headers and libraries.
+                set(CMAKE_FIND_ROOT_PATH "{python_dir}/prefix")
+                set(CMAKE_FIND_ROOT_PATH_MODE_PROGRAM NEVER)
+                set(CMAKE_FIND_ROOT_PATH_MODE_LIBRARY ONLY)
+                set(CMAKE_FIND_ROOT_PATH_MODE_INCLUDE ONLY)
+                set(CMAKE_FIND_ROOT_PATH_MODE_PACKAGE BOTH)
+
+                # Allow CMake to run Python in the simulated Android environment when
+                # policy CMP0190 is active.
+                set(CMAKE_CROSSCOMPILING_EMULATOR /bin/sh -c [["$0" "$@"]])
+                """
+            ),
+            file=toolchain_file,
+        )
+
+
+def localize_sysconfigdata(
+    python_dir: Path, build_env: dict[str, str], sysconfigdata_path: Path
+) -> dict[str, Any]:
+    sysconfigdata: dict[str, Any] = run_path(str(sysconfigdata_path))["build_time_vars"]
+    with sysconfigdata_path.open("w", encoding="UTF-8") as f:
+        f.write("# Generated by cibuildwheel\n")
+        f.write("build_time_vars = ")
+        sysconfigdata = localized_vars(build_env, sysconfigdata, python_dir / "prefix")
+        pprint(sysconfigdata, stream=f, compact=True)
+        return sysconfigdata
+
+
+def localized_vars(
+    build_env: dict[str, str], orig_vars: dict[str, Any], prefix: Path
+) -> dict[str, Any]:
+    orig_prefix = orig_vars["prefix"]
+    localized_vars_ = {}
+    for key, value in orig_vars.items():
+        # The host's sysconfigdata will include references to build-time paths.
+        # Update these to refer to the current prefix.
+        final = value
+        if isinstance(final, str):
+            final = final.replace(orig_prefix, str(prefix))
+
+        if key == "ANDROID_API_LEVEL":
+            try:
+                final = int(build_env[key])
+            except ValueError as e:
+                msg = f"ANDROID_API_LEVEL: {e}. This variable must be an integer."
+                raise errors.FatalError(msg) from e
+
+        # Build systems vary in whether FLAGS variables are read from sysconfig, and if so,
+        # whether they're replaced by environment variables or combined with them. Even
+        # setuptools has changed its behavior here
+        # (https://github.com/pypa/setuptools/issues/4836).
+        #
+        # Ensure consistency by clearing the sysconfig variables and letting the environment
+        # variables take effect alone. This will also work for any non-Python build systems
+        # which the build script may call.
+        elif key in ["CFLAGS", "CXXFLAGS", "LDFLAGS"]:
+            final = ""
+
+        # These variables contain an embedded copy of LDFLAGS.
+        elif key in ["LDSHARED", "LDCXXSHARED"]:
+            final = final.removesuffix(" " + orig_vars["LDFLAGS"])
+
+        localized_vars_[key] = final
+
+    return localized_vars_
+
+
+def setup_android_env(
+    config: PythonConfiguration, python_dir: Path, build_env: dict[str, str]
+) -> dict[str, str]:
+    site_packages = find_site_packages(build_env)
+    for suffix in ["pth", "py"]:
+        shutil.copy(RESOURCES_ANDROID / f"_cross_venv.{suffix}", site_packages)
+
+    sysconfigdata_path = Path(
+        shutil.copy(
+            glob1(python_dir, "prefix/lib/python*/_sysconfigdata_*.py"),
+            site_packages,
+        )
+    )
+    sysconfigdata = localize_sysconfigdata(python_dir, build_env, sysconfigdata_path)
+
+    # Activate the code in _cross_venv.py.
+    android_env = build_env.copy()
+    android_env["CIBW_HOST_TRIPLET"] = android_triplet(config.identifier)
+
+    # Get the environment variables needed to build for Android (CC, CFLAGS, etc). These are
+    # generated by https://github.com/python/cpython/blob/main/Android/android-env.sh.
+    env_output = call(python_dir / "android.py", "env", env=build_env, capture_stdout=True)
+
+    # shlex.split should produce a sequence alternating between:
+    #   * the word "export"
+    #   * a key=value string, without quotes
+    for i, token in enumerate(shlex.split(env_output)):
+        if i % 2 == 0:
+            if token != "export":
+                msg = f"Unexpected output from android.py env: expected 'export', got {token!r}"
+                raise errors.FatalError(msg)
+        else:
+            key, sep, value = token.partition("=")
+            if sep != "=":
+                msg = f"Unexpected output from android.py env: expected 'key=value', got {token!r}"
+                raise errors.FatalError(msg)
+            android_env[key] = value
+
+    # localized_vars cleared the CFLAGS and CXXFLAGS in the sysconfigdata, but most
+    # packages take their optimization flags from these variables. Pass these flags via
+    # environment variables instead.
+    #
+    # We don't enable debug information, because it significantly increases binary size,
+    # and most Android app developers don't have the NDK installed, so they would have no
+    # way to strip it.
+    opt = " ".join(word for word in sysconfigdata["OPT"].split() if not word.startswith("-g"))
+    for key in ["CFLAGS", "CXXFLAGS"]:
+        android_env[key] += " " + opt
+
+    # Cargo target linker needs to be specified after CC is set
+    setup_rust(config, python_dir, android_env)
+
+    # Create shims which install additional build tools on first use.
+    setup_fortran(android_env)
+
+    # `android.py env` returns PKG_CONFIG="pkg-config --define-prefix", but some build
+    # systems can't handle arguments in that variable. Since we have a known version
+    # of pkgconf, it's safe to use PKG_CONFIG_RELOCATE_PATHS instead.
+    android_env["PKG_CONFIG"] = call(
+        "which", "pkgconf-pypi", env=build_env, capture_stdout=True
+    ).strip()
+    android_env["PKG_CONFIG_RELOCATE_PATHS"] = "1"
+
+    # Format the environment so it can be pasted into a shell when debugging.
+    for key, value in sorted(android_env.items()):
+        if os.environ.get(key) != value:
+            print(f"export {key}={shlex.quote(value)}")
+
+    return android_env
+
+
+def setup_rust(config: PythonConfiguration, python_dir: Path, env: dict[str, str]) -> None:
+    cargo_target = android_triplet(config.identifier)
+
+    # CARGO_BUILD_TARGET is the variable used by Cargo and setuptools_rust
+    env["CARGO_BUILD_TARGET"] = cargo_target
+
+    # The linker needs to be specified after CC is set by android-env.sh
+    cargo_target_linker_env_name = f"CARGO_TARGET_{cargo_target.upper().replace('-', '_')}_LINKER"
+    # CC has already been set by calling android.py (it calls android-env.sh)
+    env[cargo_target_linker_env_name] = env["CC"]
+
+    # All Python extension modules must be explicitly linked against libpython3.x.so when building for Android.
+    # See: https://peps.python.org/pep-0738/#linkage
+    # For projects using PyO3, this requires setting PYO3_CROSS_LIB_DIR to the directory containing libpython3.x.so.
+    # See: https://pyo3.rs/v0.27.1/building-and-distribution.html#cross-compiling
+    env["PYO3_CROSS_LIB_DIR"] = str(python_dir / "prefix" / "lib")
+
+    venv_bin = Path(env["VIRTUAL_ENV"]) / "bin"
+    for tool in ["cargo", "rustup"]:
+        shim_path = venv_bin / tool
+        shutil.copy(RESOURCES_ANDROID / "rust_shim.py", shim_path)
+        shim_path.chmod(0o755)
+
+
+def setup_fortran(env: dict[str, str]) -> None:
+    # In case there's any autodetection based on the executable name, use the same name
+    # as the real executable (see fortran_shim.run_flang)
+    shim_in = RESOURCES_ANDROID / "fortran_shim.py"
+    shim_out = Path(env["VIRTUAL_ENV"]) / "bin/flang-new"
+
+    # The hashbang line runs the shim in cibuildwheel's own virtual environment, so it
+    # has access to utility functions for downloading and caching files.
+    shim_out.write_text(f"#!{sys.executable}\n\n" + shim_in.read_text())
+    shim_out.chmod(0o755)
+    env["FC"] = str(shim_out)
+
+
+def setup_xbuild_files(state: BuildState) -> None:
+    _, pip = find_pip(state.options)
+    xbf_dir = state.build_path / "xbuild_files"
+    xbf_dir.mkdir()
+
+    for requirement in call(*pip, "freeze", env=state.build_env, capture_stdout=True).splitlines():
+        name, _, _ = requirement.strip().partition("==")
+        xbuild_files = state.options.xbuild_files.get(canonicalize_name(name), [])
+        if xbuild_files:
+            log.step(f"Installing xbuild-files for {name}...")
+            pip_install_android(state, xbf_dir, "--no-deps", requirement)
+            for xbf in xbuild_files:
+                if (xbf_dir / xbf).exists():
+                    shutil.copy(
+                        xbf_dir / xbf,
+                        find_site_packages(state.build_env) / xbf,
+                    )
+                else:
+                    log.warning(f"{xbf_dir / xbf} does not exist")
+
+
+def pip_install_android(state: BuildState, target: Path, *args: PathOrStr) -> None:
+    use_uv, pip = find_pip(state.options)
+    call(
+        *pip,
+        "install",
+        "--only-binary=:all:",
+        *(["--python-platform", android_triplet(state.config.identifier)] if use_uv else []),
+        "--target",
+        target,
+        *args,
+        env=state.android_env,
+    )
+
+
+def find_site_packages(env: dict[str, str]) -> Path:
+    return glob1(Path(env["VIRTUAL_ENV"]), "lib/python*/site-packages")
+
+
+def glob1(base: Path, pattern: str) -> Path:
+    results = list(base.glob(pattern))
+    if len(results) != 1:
+        msg = f"{base} contains {len(results)} paths matching '{pattern}'; expected 1"
+        raise errors.FatalError(msg)
+    return results[0]
+
+
+def find_pip(build_options: BuildOptions) -> tuple[bool, list[str]]:
+    use_uv = build_options.build_frontend.name in {"build[uv]", "uv"}
+    uv_path = find_uv()
+    if use_uv and uv_path is None:
+        msg = "uv not found"
+        raise AssertionError(msg)
+    pip = ["pip"] if not use_uv else [str(uv_path), "pip"]
+    return use_uv, pip
+
+
+def before_build(state: BuildState) -> None:
+    if state.options.before_build:
+        log.step("Running before_build...")
+        shell_prepared(
+            state.options.before_build,
+            build_options=state.options,
+            env=state.android_env,
+        )
+
+
+def build_wheel(state: BuildState) -> Path:
+    log.step("Building wheel...")
+    built_wheel_dir = state.build_path / "built_wheel"
+    match state.options.build_frontend.name:
+        case "build" | "build[uv]":
+            call(
+                "python",
+                "-m",
+                "build",
+                state.options.package_dir,
+                "--wheel",
+                "--no-isolation",
+                "--skip-dependency-check",
+                f"--outdir={built_wheel_dir}",
+                *get_build_frontend_extra_flags(
+                    state.options.build_frontend,
+                    state.options.build_verbosity,
+                    prepare_config_settings(
+                        state.options.config_settings,
+                        project=Path.cwd(),
+                        package=state.options.package_dir,
+                    ),
+                ),
+                env=state.android_env,
+            )
+        case "uv":
+            uv_path = find_uv()
+            assert uv_path is not None
+            call(
+                uv_path,
+                "build",
+                state.options.package_dir,
+                "--wheel",
+                "--no-build-isolation",
+                f"--out-dir={built_wheel_dir}",
+                *get_build_frontend_extra_flags(
+                    state.options.build_frontend,
+                    state.options.build_verbosity,
+                    prepare_config_settings(
+                        state.options.config_settings,
+                        project=Path.cwd(),
+                        package=state.options.package_dir,
+                    ),
+                ),
+                env=state.android_env,
+            )
+        case x:
+            msg = f"Android requires the build frontend to be 'build' or 'uv', not {x!r}"
+            raise errors.FatalError(msg)
+
+    built_wheel = glob1(built_wheel_dir, "*.whl")
+    if built_wheel.name.endswith("none-any.whl"):
+        raise errors.NonPlatformWheelError()
+    return built_wheel
+
+
+def repair_wheel(state: BuildState, built_wheel: Path) -> Path:
+    log.step("Repairing wheel...")
+    repaired_wheel_dir = state.build_path / "repaired_wheel"
+    repaired_wheel_dir.mkdir()
+
+    if state.options.repair_command:
+        # Tell auditwheel the locations of compiler libraries.
+        toolchain = Path(state.android_env["CC"]).parent.parent
+        triplet = android_triplet(state.config.identifier)
+        ldpaths = ":".join(
+            str(glob1(toolchain, pattern))
+            for pattern in [
+                f"lib/clang/*/lib/linux/{triplet.split('-')[0]}",  # libomp
+                f"sysroot/usr/lib/{triplet}",  # libc++_shared
+            ]
+        )
+        shell(
+            prepare_command(
+                state.options.repair_command,
+                ldpaths=ldpaths,
+                wheel=built_wheel,
+                dest_dir=repaired_wheel_dir,
+                package=state.options.package_dir,
+                project=".",
+            ),
+            env=state.build_env,
+        )
+    else:
+        shutil.move(built_wheel, repaired_wheel_dir)
+
+    repaired_wheels = list(repaired_wheel_dir.glob("*.whl"))
+    if len(repaired_wheels) == 0:
+        raise errors.RepairStepProducedNoWheelError()
+    if len(repaired_wheels) != 1:
+        raise errors.RepairStepProducedMultipleWheelsError(
+            [rw.name for rw in repaired_wheels],
+        )
+    repaired_wheel = repaired_wheels[0]
+
+    if repaired_wheel.name.endswith("none-any.whl"):
+        raise errors.NonPlatformWheelError()
+    return repaired_wheel
+
+
+def test_wheel(state: BuildState, wheel: Path) -> None:
+    test_command = state.options.test_command
+    if not (test_command and state.options.test_selector(state.config.identifier)):
+        return
+
+    log.step("Testing wheel...")
+    native_arch = arch_synonym(platform.machine(), platforms.native_platform(), "android")
+    if state.config.arch != native_arch:
+        log.warning(
+            f"Skipping tests for {state.config.arch}, as the build machine only "
+            f"supports {native_arch}"
+        )
+        return
+
+    if state.options.before_test:
+        shell_prepared(
+            state.options.before_test,
+            build_options=state.options,
+            env=state.android_env,
+        )
+
+    # Install the wheel and test-requires.
+    site_packages_dir = state.build_path / "site-packages"
+    site_packages_dir.mkdir()
+    pip_install_android(
+        state,
+        site_packages_dir,
+        f"{wheel}{state.options.test_extras}",
+        *state.options.test_requires,
+    )
+
+    # Copy test-sources.
+    cwd_dir = state.build_path / "cwd"
+    cwd_dir.mkdir()
+    if state.options.test_sources:
+        copy_test_sources(state.options.test_sources, Path.cwd(), cwd_dir)
+    else:
+        (cwd_dir / "test_fail.py").write_text(
+            resources.TEST_FAIL_CWD_FILE.read_text(),
+        )
+
+    # Android doesn't support placeholders in the test command.
+    if any(("{" + placeholder + "}") in test_command for placeholder in ("project", "package")):
+        msg = (
+            f"Test command {test_command!r} with a "
+            "'{project}' or '{package}' placeholder is not supported on Android, "
+            "because the source directory is not visible on the emulator."
+        )
+        raise errors.FatalError(msg)
+
+    # Parse test-command.
+    test_args = shlex.split(test_command)
+    if test_args[0] in {"python", "python3"} and any(arg in test_args for arg in ("-c", "-m")):
+        # Forward the args to the CPython testbed script. We require '-c' or '-m'
+        # to be in the command, because without those flags, the testbed script
+        # will prepend '-m test', which will run Python's own test suite.
+        del test_args[0]
+    elif test_args[0] == "pytest":
+        # We transform some commands into the `python -m` form, but this is deprecated.
+        msg = (
+            f"Test command {test_command!r} is not supported on Android. "
+            "cibuildwheel will try to execute it as if it started with 'python -m'. "
+            "If this works, all you need to do is add that to your test command."
+        )
+        log.warning(msg)
+        test_args.insert(0, "-m")
+    else:
+        msg = (
+            f"Test command {test_command!r} is not supported on Android. "
+            f"Command must begin with 'python' or 'python3', and contain '-m' or '-c'."
+        )
+        raise errors.FatalError(msg)
+
+    # By default, run on a testbed managed emulator running the newest supported
+    # Android version. However, if the user specifies a --managed or --connected
+    # test execution argument, that argument takes precedence.
+    test_runtime_args = state.options.test_runtime.args
+
+    if any(arg.startswith(("--managed", "--connected")) for arg in test_runtime_args):
+        emulator_args = []
+    else:
+        emulator_args = ["--managed", "maxVersion"]
+
+    # Run the test app.
+    call(
+        state.python_dir / "android.py",
+        "test",
+        "--site-packages",
+        site_packages_dir,
+        "--cwd",
+        cwd_dir,
+        *emulator_args,
+        *(["-v"] if state.options.build_verbosity > 0 else []),
+        *test_runtime_args,
+        "--",
+        *test_args,
+        env=state.build_env,
+    )
@@ -1,45 +1,72 @@
 from __future__ import annotations

+__lazy_modules__ = {
+    "cibuildwheel.audit",
+    "cibuildwheel.frontend",
+    "cibuildwheel.logger",
+    "cibuildwheel.platforms.macos",
+    "cibuildwheel.util",
+    "cibuildwheel.util.cmd",
+    "cibuildwheel.util.file",
+    "cibuildwheel.util.helpers",
+    "cibuildwheel.util.packaging",
+    "cibuildwheel.venv",
+    "filelock",
+    "packaging",
+    "packaging.version",
+    "pathlib",
+    "platform",
+    "shlex",
+    "shutil",
+    "subprocess",
+    "textwrap",
+    "typing",
+}
+
 import dataclasses
 import os
+import platform
 import shlex
 import shutil
 import subprocess
 import sys
 import textwrap
-from collections.abc import Sequence, Set
 from pathlib import Path
 from typing import assert_never

 from filelock import FileLock
+from packaging.version import Version

-from .. import errors
-from ..architecture import Architecture
-from ..environment import ParsedEnvironment
-from ..frontend import (
-    BuildFrontendConfig,
+from cibuildwheel import errors
+from cibuildwheel.audit import run_audit
+from cibuildwheel.frontend import (
    BuildFrontendName,
    get_build_frontend_extra_flags,
+    prepare_config_settings,
 )
-from ..logger import log
-from ..options import Options
-from ..selector import BuildSelector
-from ..util import resources
-from ..util.cmd import call, shell, split_command
-from ..util.file import (
+from cibuildwheel.logger import log
+from cibuildwheel.platforms.macos import install_cpython as install_build_cpython
+from cibuildwheel.util import resources
+from cibuildwheel.util.cmd import call, shell, split_command
+from cibuildwheel.util.file import (
    CIBW_CACHE_PATH,
    copy_test_sources,
    download,
    move_file,
+    remove_on_error,
 )
-from ..util.helpers import prepare_command, unwrap_preserving_paragraphs
-from ..util.packaging import (
-    combine_constraints,
-    find_compatible_wheel,
-    get_pip_version,
-)
-from ..venv import constraint_flags, virtualenv
-from .macos import install_cpython as install_build_cpython
+from cibuildwheel.util.helpers import prepare_command, unwrap_preserving_paragraphs
+from cibuildwheel.util.packaging import find_compatible_wheel
+from cibuildwheel.venv import constraint_flags, virtualenv
+
+TYPE_CHECKING = False
+if TYPE_CHECKING:
+    from collections.abc import Sequence, Set
+
+    from cibuildwheel.architecture import Architecture
+    from cibuildwheel.environment import ParsedEnvironment
+    from cibuildwheel.options import Options
+    from cibuildwheel.selector import BuildSelector


@dataclasses.dataclass(frozen=True, kw_only=True)
@@ -48,6 +75,8 @@ class PythonConfiguration:
    identifier: str
    url: str
    build_url: str
+    build_sha256: str
+    sha256: str

    @property
    def sdk(self) -> str:
@@ -80,7 +109,7 @@ def all_python_configurations() -> list[PythonConfiguration]:
    # configuration.
    macos_python_configs = resources.read_python_configs("macos")

-    def build_url(config_dict: dict[str, str]) -> str:
+    def build_python_config(config_dict: dict[str, str]) -> dict[str, str]:
        # The iOS identifier will be something like cp313-ios_arm64_iphoneos.
        # Drop the iphoneos suffix, then replace ios with macosx to yield
        # cp313-macosx_arm64, which will be a macOS build identifier.
@@ -89,18 +118,30 @@ def all_python_configurations() -> list[PythonConfiguration]:
        matching = [
            config for config in macos_python_configs if config["identifier"] == macos_identifier
        ]
-        return matching[0]["url"]
+        if not matching:
+            msg = (
+                f"Internal error: no macOS configuration found matching "
+                f"{macos_identifier!r}, needed to build the iOS configuration "
+                f"{config_dict['identifier']!r}. The bundled build-platforms.toml "
+                f"resources are inconsistent."
+            )
+            raise errors.FatalError(msg)
+        return matching[0]

    # Load the platform configuration
    full_python_configs = resources.read_python_configs("ios")
    # Build the configurations, annotating with macOS URL details.
-    return [
-        PythonConfiguration(
-            **item,
-            build_url=build_url(item),
+    python_configurations = []
+    for item in full_python_configs:
+        build_config = build_python_config(item)
+        python_configurations.append(
+            PythonConfiguration(
+                **item,
+                build_url=build_config["url"],
+                build_sha256=build_config["sha256"],
+            )
        )
-        for item in full_python_configs
-    ]
+    return python_configurations


 def get_python_configurations(
@@ -135,9 +176,10 @@ def install_target_cpython(tmp: Path, config: PythonConfiguration, free_threadin
    with FileLock(str(installation_path) + ".lock"):
        if not installation_path.exists():
            downloaded_tar_gz = tmp / ios_python_tar_gz
-            download(config.url, downloaded_tar_gz)
-            installation_path.mkdir(parents=True, exist_ok=True)
-            call("tar", "-C", installation_path, "-xf", downloaded_tar_gz)
+            download(config.url, downloaded_tar_gz, sha256=config.sha256)
+            with remove_on_error(installation_path):
+                installation_path.mkdir(parents=True)
+                call("tar", "-C", installation_path, "-xf", downloaded_tar_gz)
            downloaded_tar_gz.unlink()

    return installation_path
@@ -192,18 +234,37 @@ def cross_virtualenv(
    )

    # Convert the macOS virtual environment into an iOS virtual environment
-    # using the cross-platform conversion script in the iOS distribution.
+    # using make_cross_venv.py.

    # target_python is the path to the Python binary;
    # determine the root of the XCframework slice that is being used.
    slice_path = target_python.parent.parent
-    call(
-        "python",
-        str(slice_path / f"platform-config/{multiarch}/make_cross_venv.py"),
-        str(venv_path),
-        env=env,
-        cwd=venv_path,
-    )
+    if Version(py_version) >= Version("3.15"):
+        # python.org 3.15+ distributions: sysconfig data lives in the
+        # stdlib directory (lib-<arch>/python<version>); cross-venv scripts
+        # come from cibuildwheel resources.
+        arch = multiarch.split("-", maxsplit=1)[0]
+        stdlib_path = slice_path / f"lib-{arch}" / f"python{py_version}"
+        call(
+            "python",
+            str(resources.IOS_SUPPORT_FILES / "make_cross_venv.py"),
+            str(venv_path),
+            str(stdlib_path),
+            str(resources.IOS_SUPPORT_FILES),
+            env=env,
+            cwd=venv_path,
+        )
+    else:
+        # BeeWare distributions: platform-config already contains both
+        # sysconfig data and the make_cross_venv.py script.
+        platform_config_path = slice_path / f"platform-config/{multiarch}"
+        call(
+            "python",
+            str(platform_config_path / "make_cross_venv.py"),
+            str(venv_path),
+            env=env,
+            cwd=venv_path,
+        )

    # When running on macOS, it's easy for the build environment to leak into
    # the target environment, especially when building for ARM64 (because the
@@ -283,7 +344,8 @@ def setup_python(
    build_frontend: BuildFrontendName,
    xbuild_tools: Sequence[str] | None,
 ) -> tuple[Path, dict[str, str]]:
-    if build_frontend == "build[uv]":
+    # Not using set because mypy can't narrow it
+    if build_frontend == "build[uv]" or build_frontend == "uv":  # noqa: PLR1714
        msg = "uv doesn't support iOS"
        raise errors.FatalError(msg)

@@ -301,6 +363,7 @@ def setup_python(
            python_configuration.version,
            python_configuration.build_url,
            free_threading,
+            python_configuration.build_sha256,
        )
    else:
        msg = f"Unknown Python implementation: {implementation_id}"
@@ -320,8 +383,8 @@ def setup_python(
        / f"python{python_configuration.version}"
    )

-    assert target_python.exists(), (
-        f"{target_python.name} not found, has {list(target_install_path.iterdir())}"
+    assert target_python.parent.exists(), (
+        f"{target_python.parent} not found, has {list(target_install_path.iterdir())}"
    )

    log.step("Creating cross build environment...")
@@ -368,7 +431,7 @@ def setup_python(
            "entry or insert python above it."
        )
        raise errors.FatalError(msg)
-    call("python", "--version", env=env)
+    call("python", "-V", "-V", env=env)

    # Check what pip version we're on
    assert (venv_bin_path / "pip").exists()
@@ -387,20 +450,24 @@ def setup_python(
    env.setdefault("IPHONEOS_DEPLOYMENT_TARGET", "13.0")

    log.step("Installing build tools...")
-    if build_frontend == "pip":
-        # No additional build tools required
-        pass
-    elif build_frontend == "build":
-        call(
-            "pip",
-            "install",
-            "--upgrade",
-            "build[virtualenv]",
-            *constraint_flags(dependency_constraint),
-            env=env,
-        )
-    else:
-        assert_never(build_frontend)
+    match build_frontend:
+        case "pip":
+            # No additional build tools required
+            pass
+        case "build":
+            call(
+                "pip",
+                "install",
+                "--upgrade",
+                "build[virtualenv]",
+                *constraint_flags(dependency_constraint),
+                env=env,
+            )
+        case "pyodide-build":
+            msg = "The 'pyodide-build' build frontend is not supported on this platform"
+            raise errors.FatalError(msg)
+        case _:
+            assert_never(build_frontend)

    return target_install_path, env

@@ -437,9 +504,10 @@ def build(options: Options, tmp_path: Path) -> None:

        for config in python_configurations:
            build_options = options.build_options(config.identifier)
-            build_frontend = build_options.build_frontend or BuildFrontendConfig("build")
+            build_frontend = build_options.build_frontend
            # uv doesn't support iOS
-            if build_frontend.name == "build[uv]":
+            # Not using set because mypy can't narrow it
+            if build_frontend.name == "build[uv]" or build_frontend.name == "uv":  # noqa: PLR1714
                msg = "uv doesn't support iOS"
                raise errors.FatalError(msg)

@@ -448,6 +516,7 @@ def build(options: Options, tmp_path: Path) -> None:
            identifier_tmp_dir = tmp_path / config.identifier
            identifier_tmp_dir.mkdir()
            built_wheel_dir = identifier_tmp_dir / "built_wheel"
+            repaired_wheel_dir = identifier_tmp_dir / "repaired_wheel"

            constraints_path = build_options.dependency_constraints.get_for_python_version(
                version=config.version, tmp_dir=identifier_tmp_dir
@@ -461,7 +530,7 @@ def build(options: Options, tmp_path: Path) -> None:
                build_frontend=build_frontend.name,
                xbuild_tools=build_options.xbuild_tools,
            )
-            pip_version = get_pip_version(env)
+            env["CIBUILDWHEEL_BUILD_IDENTIFIER"] = config.identifier

            compatible_wheel = find_compatible_wheel(built_wheels, config.identifier)
            if compatible_wheel:
@@ -486,59 +555,92 @@ def build(options: Options, tmp_path: Path) -> None:
                built_wheel_dir.mkdir()

                extra_flags = get_build_frontend_extra_flags(
-                    build_frontend, build_options.build_verbosity, build_options.config_settings
+                    build_frontend,
+                    build_options.build_verbosity,
+                    prepare_config_settings(
+                        build_options.config_settings,
+                        project=Path.cwd(),
+                        package=build_options.package_dir,
+                    ),
                )

-                build_env = env.copy()
-                build_env["VIRTUALENV_PIP"] = pip_version
-                if constraints_path:
-                    combine_constraints(build_env, constraints_path, None)
+                match build_frontend.name:
+                    case "pip":
+                        # Path.resolve() is needed. Without it pip wheel may try to
+                        # fetch package from pypi.org. See
+                        # https://github.com/pypa/cibuildwheel/pull/369
+                        call(
+                            "python",
+                            "-m",
+                            "pip",
+                            "wheel",
+                            build_options.package_dir.resolve(),
+                            f"--wheel-dir={built_wheel_dir}",
+                            "--no-deps",
+                            *extra_flags,
+                            env=env,
+                        )
+                    case "build":
+                        call(
+                            "python",
+                            "-m",
+                            "build",
+                            build_options.package_dir,
+                            "--wheel",
+                            f"--outdir={built_wheel_dir}",
+                            *extra_flags,
+                            env=env,
+                        )
+                    case "pyodide-build":
+                        msg = "The 'pyodide-build' build frontend is not supported on this platform"
+                        raise errors.FatalError(msg)
+                    case _:
+                        assert_never(build_frontend)

-                if build_frontend.name == "pip":
-                    # Path.resolve() is needed. Without it pip wheel may try to
-                    # fetch package from pypi.org. See
-                    # https://github.com/pypa/cibuildwheel/pull/369
-                    call(
-                        "python",
-                        "-m",
-                        "pip",
-                        "wheel",
-                        build_options.package_dir.resolve(),
-                        f"--wheel-dir={built_wheel_dir}",
-                        "--no-deps",
-                        *extra_flags,
-                        env=build_env,
-                    )
-                elif build_frontend.name == "build":
-                    call(
-                        "python",
-                        "-m",
-                        "build",
-                        build_options.package_dir,
-                        "--wheel",
-                        f"--outdir={built_wheel_dir}",
-                        *extra_flags,
-                        env=build_env,
-                    )
-                else:
-                    assert_never(build_frontend)
-
-                test_wheel = built_wheel = next(built_wheel_dir.glob("*.whl"))
+                try:
+                    built_wheel = next(built_wheel_dir.glob("*.whl"))
+                except StopIteration:
+                    raise errors.BuildProducedNoWheelError() from None

                if built_wheel.name.endswith("none-any.whl"):
                    raise errors.NonPlatformWheelError()

+                repaired_wheel_dir.mkdir()
+                if build_options.repair_command:
+                    log.step("Repairing wheel...")
+
+                    repair_command_prepared = prepare_command(
+                        build_options.repair_command,
+                        wheel=built_wheel,
+                        dest_dir=repaired_wheel_dir,
+                        package=build_options.package_dir,
+                        project=".",
+                    )
+                    shell(repair_command_prepared, env=env)
+                else:
+                    shutil.move(str(built_wheel), repaired_wheel_dir)
+
+                try:
+                    repaired_wheel = next(repaired_wheel_dir.glob("*.whl"))
+                except StopIteration:
+                    raise errors.RepairStepProducedNoWheelError() from None
+
+                if repaired_wheel.name in {wheel.name for wheel in built_wheels}:
+                    raise errors.AlreadyBuiltWheelError(repaired_wheel.name)
+
                log.step_end()

+                run_audit(tmp_dir=tmp_path, build_options=build_options, wheel=repaired_wheel)
+
+                test_wheel = repaired_wheel
+
            if build_options.test_command and build_options.test_selector(config.identifier):
                if not config.is_simulator:
                    log.step("Skipping tests on non-simulator SDK")
                elif config.arch != os.uname().machine:
                    log.step("Skipping tests on non-native simulator architecture")
                else:
-                    test_env = build_options.test_environment.as_dictionary(
-                        prev_environment=build_env
-                    )
+                    test_env = build_options.test_environment.as_dictionary(prev_environment=env)

                    if build_options.before_test:
                        before_test_prepared = prepare_command(
@@ -652,11 +754,35 @@ def build(options: Options, tmp_path: Path) -> None:
                                    )
                                    raise errors.FatalError(msg)

+                            test_runtime_args = build_options.test_runtime.args
+
+                            # 2025-10: The GitHub Actions macos-15 runner has a known issue where
+                            # the default simulator won't start due to a disk performance issue;
+                            # see https://github.com/actions/runner-images/issues/12777 for details.
+                            # In the meantime, if it looks like we're running on a GitHub Actions
+                            # macos-15 runner, use a simulator that is known to work, unless the
+                            # user explicitly specifies a simulator.
+                            os_version, _, arch = platform.mac_ver()
+                            if (
+                                "GITHUB_ACTIONS" in os.environ
+                                and os_version.startswith("15.")
+                                and arch == "arm64"
+                                and not any(
+                                    arg.startswith("--simulator") for arg in test_runtime_args
+                                )
+                            ):
+                                test_runtime_args = [
+                                    "--simulator",
+                                    "iPhone 16e,OS=18.5",
+                                    *test_runtime_args,
+                                ]
+
                            call(
                                "python",
                                testbed_path,
                                "run",
                                *(["--verbose"] if build_options.build_verbosity > 0 else []),
+                                *test_runtime_args,
                                "--",
                                *final_command,
                                env=test_env,
@@ -671,19 +797,20 @@ def build(options: Options, tmp_path: Path) -> None:
                    log.step_end()

            # We're all done here; move it to output (overwrite existing)
+            output_wheel: Path | None = None
            if compatible_wheel is None:
-                output_wheel = build_options.output_dir.joinpath(built_wheel.name)
-                moved_wheel = move_file(built_wheel, output_wheel)
+                output_wheel = build_options.output_dir.joinpath(repaired_wheel.name)
+                moved_wheel = move_file(repaired_wheel, output_wheel)
                if moved_wheel != output_wheel.resolve():
                    log.warning(
-                        f"{built_wheel} was moved to {moved_wheel} instead of {output_wheel}"
+                        f"{repaired_wheel} was moved to {moved_wheel} instead of {output_wheel}"
                    )
                built_wheels.append(output_wheel)

            # Clean up
            shutil.rmtree(identifier_tmp_dir)

-            log.build_end()
+            log.build_end(output_wheel)
    except subprocess.CalledProcessError as error:
        msg = f"Command {error.cmd} failed with code {error.returncode}. {error.stdout or ''}"
        raise errors.FatalError(msg) from error
@@ -1,25 +1,50 @@
+from __future__ import annotations
+
+__lazy_modules__ = {
+    "cibuildwheel.audit",
+    "cibuildwheel.frontend",
+    "cibuildwheel.logger",
+    "cibuildwheel.util",
+    "cibuildwheel.util.file",
+    "cibuildwheel.util.helpers",
+    "cibuildwheel.util.packaging",
+    "collections",
+    "contextlib",
+    "pathlib",
+    "shutil",
+    "subprocess",
+    "textwrap",
+    "typing",
+}
+
 import contextlib
 import dataclasses
+import shutil
 import subprocess
 import sys
 import textwrap
 from collections import OrderedDict
-from collections.abc import Iterable, Iterator, Sequence, Set
 from pathlib import Path, PurePath, PurePosixPath
 from typing import assert_never

-from .. import errors
-from ..architecture import Architecture
-from ..frontend import BuildFrontendConfig, get_build_frontend_extra_flags
-from ..logger import log
-from ..oci_container import OCIContainer, OCIContainerEngineConfig, OCIPlatform
-from ..options import BuildOptions, Options
-from ..selector import BuildSelector
-from ..typing import PathOrStr
-from ..util import resources
-from ..util.file import copy_test_sources
-from ..util.helpers import prepare_command, unwrap
-from ..util.packaging import find_compatible_wheel
+from cibuildwheel import errors
+from cibuildwheel.architecture import Architecture
+from cibuildwheel.audit import needs_audit, run_audit
+from cibuildwheel.frontend import get_build_frontend_extra_flags, prepare_config_settings
+from cibuildwheel.logger import log
+from cibuildwheel.oci_container import OCIContainer, OCIContainerEngineConfig, OCIPlatform
+from cibuildwheel.util import resources
+from cibuildwheel.util.file import copy_test_sources
+from cibuildwheel.util.helpers import prepare_command, unwrap
+from cibuildwheel.util.packaging import find_compatible_wheel
+
+TYPE_CHECKING = False
+if TYPE_CHECKING:
+    from collections.abc import Iterable, Iterator, Sequence, Set
+
+    from cibuildwheel.options import BuildOptions, Options
+    from cibuildwheel.selector import BuildSelector
+    from cibuildwheel.typing import PathOrStr

 ARCHITECTURE_OCI_PLATFORM_MAP = {
    Architecture.x86_64: OCIPlatform.AMD64,
@@ -204,8 +229,8 @@ def build_in_container(
        log.build_start(config.identifier)
        local_identifier_tmp_dir = local_tmp_dir / config.identifier
        build_options = options.build_options(config.identifier)
-        build_frontend = build_options.build_frontend or BuildFrontendConfig("build")
-        use_uv = build_frontend.name == "build[uv]"
+        build_frontend = build_options.build_frontend
+        use_uv = build_frontend.name in {"build[uv]", "uv"}
        pip = ["uv", "pip"] if use_uv else ["pip"]

        log.step("Setting up build environment...")
@@ -229,12 +254,14 @@ def build_in_container(
        env["PATH"] = f"{python_bin}:{env['PATH']}"

        env = build_options.environment.as_dictionary(env, executor=container.environment_executor)
+        env["CIBUILDWHEEL_BUILD_IDENTIFIER"] = config.identifier

        # check config python is still on PATH
        which_python = container.call(["which", "python"], env=env, capture_output=True).strip()
        if PurePosixPath(which_python) != python_bin / "python":
            msg = "python available on PATH doesn't match our installed instance. If you have modified PATH, ensure that you don't overwrite cibuildwheel's entry or insert python above it."
            raise errors.FatalError(msg)
+        container.call(["python", "-V", "-V"], env=env)

        if use_uv:
            which_uv = container.call(["which", "uv"], env=env, capture_output=True).strip()
@@ -253,7 +280,7 @@ def build_in_container(
            print(
                f"\nFound previously built wheel {compatible_wheel.name}, that's compatible with {config.identifier}. Skipping build step..."
            )
-            repaired_wheels = [compatible_wheel]
+            repaired_wheel = compatible_wheel
        else:
            if build_options.before_build:
                log.step("Running before_build...")
@@ -262,7 +289,16 @@ def build_in_container(
                    project=container_project_path,
                    package=container_package_dir,
                )
-                container.call(["sh", "-c", before_build_prepared], env=env)
+                before_build_env = env.copy()
+                if use_uv:
+                    # On Linux, no virtualenv is created for the build environment
+                    # (unlike macOS/Windows, where one is set up before before_build
+                    # runs). uv requires either an active venv or an explicit Python
+                    # target to install packages. Pin UV_PYTHON to the exact interpreter
+                    # for this build so that `uv pip install` works in before_build
+                    # without requiring users to pass --system.
+                    before_build_env["UV_PYTHON"] = str(python_bin / "python")
+                container.call(["sh", "-c", before_build_prepared], env=before_build_env)

            log.step("Building wheel...")

@@ -272,42 +308,68 @@ def build_in_container(
            container.call(["mkdir", "-p", built_wheel_dir])

            extra_flags = get_build_frontend_extra_flags(
-                build_frontend, build_options.build_verbosity, build_options.config_settings
+                build_frontend,
+                build_options.build_verbosity,
+                prepare_config_settings(
+                    build_options.config_settings,
+                    project=container_project_path,
+                    package=container_package_dir,
+                ),
            )

-            if build_frontend.name == "pip":
-                container.call(
-                    [
-                        "python",
-                        "-m",
-                        "pip",
-                        "wheel",
-                        container_package_dir,
-                        f"--wheel-dir={built_wheel_dir}",
-                        "--no-deps",
-                        *extra_flags,
-                    ],
-                    env=env,
-                )
-            elif build_frontend.name == "build" or build_frontend.name == "build[uv]":
-                if use_uv and "--no-isolation" not in extra_flags and "-n" not in extra_flags:
-                    extra_flags += ["--installer=uv"]
-                container.call(
-                    [
-                        "python",
-                        "-m",
-                        "build",
-                        container_package_dir,
-                        "--wheel",
-                        f"--outdir={built_wheel_dir}",
-                        *extra_flags,
-                    ],
-                    env=env,
-                )
-            else:
-                assert_never(build_frontend)
+            match build_frontend.name:
+                case "pip":
+                    container.call(
+                        [
+                            "python",
+                            "-m",
+                            "pip",
+                            "wheel",
+                            container_package_dir,
+                            f"--wheel-dir={built_wheel_dir}",
+                            "--no-deps",
+                            *extra_flags,
+                        ],
+                        env=env,
+                    )
+                case "build" | "build[uv]":
+                    if use_uv and "--no-isolation" not in extra_flags and "-n" not in extra_flags:
+                        extra_flags += ["--installer=uv"]
+                    container.call(
+                        [
+                            "python",
+                            "-m",
+                            "build",
+                            container_package_dir,
+                            "--wheel",
+                            f"--outdir={built_wheel_dir}",
+                            *extra_flags,
+                        ],
+                        env=env,
+                    )
+                case "uv":
+                    container.call(
+                        [
+                            "uv",
+                            "build",
+                            f"--python={python_bin / 'python'}",
+                            container_package_dir,
+                            "--wheel",
+                            f"--out-dir={built_wheel_dir}",
+                            *extra_flags,
+                        ],
+                        env=env,
+                    )
+                case "pyodide-build":
+                    msg = "The 'pyodide-build' build frontend is not supported on this platform"
+                    raise errors.FatalError(msg)
+                case _:
+                    assert_never(build_frontend)

-            built_wheel = container.glob(built_wheel_dir, "*.whl")[0]
+            try:
+                built_wheel = container.glob(built_wheel_dir, "*.whl")[0]
+            except IndexError:
+                raise errors.BuildProducedNoWheelError() from None

            repaired_wheel_dir = temp_dir / "repaired_wheel"
            container.call(["rm", "-rf", repaired_wheel_dir])
@@ -319,20 +381,38 @@ def build_in_container(
            if build_options.repair_command:
                log.step("Repairing wheel...")
                repair_command_prepared = prepare_command(
-                    build_options.repair_command, wheel=built_wheel, dest_dir=repaired_wheel_dir
+                    build_options.repair_command,
+                    wheel=built_wheel,
+                    dest_dir=repaired_wheel_dir,
+                    package=container_package_dir,
+                    project=container_project_path,
                )
                container.call(["sh", "-c", repair_command_prepared], env=env)
            else:
                container.call(["mv", built_wheel, repaired_wheel_dir])

-            repaired_wheels = container.glob(repaired_wheel_dir, "*.whl")
+            match container.glob(repaired_wheel_dir, "*.whl"):
+                case []:
+                    raise errors.RepairStepProducedNoWheelError()
+                case [repaired_wheel]:
+                    pass
+                case too_many:
+                    raise errors.RepairStepProducedMultipleWheelsError([p.name for p in too_many])

-            if not repaired_wheels:
-                raise errors.RepairStepProducedNoWheelError()
+            if repaired_wheel.name in {wheel.name for wheel in built_wheels}:
+                raise errors.AlreadyBuiltWheelError(repaired_wheel.name)

-            for repaired_wheel in repaired_wheels:
-                if repaired_wheel.name in {wheel.name for wheel in built_wheels}:
-                    raise errors.AlreadyBuiltWheelError(repaired_wheel.name)
+            log.step_end()
+
+            if needs_audit(build_options.audit_command, repaired_wheel.name):
+                local_abi3audit_dir = local_identifier_tmp_dir / "audit"
+                local_abi3audit_dir.mkdir(parents=True, exist_ok=True)
+                try:
+                    container.copy_out(repaired_wheel_dir, local_abi3audit_dir)
+                    local_wheel = local_abi3audit_dir / repaired_wheel.name
+                    run_audit(tmp_dir=local_tmp_dir, build_options=build_options, wheel=local_wheel)
+                finally:
+                    shutil.rmtree(local_abi3audit_dir, ignore_errors=True)

        if build_options.test_command and build_options.test_selector(config.identifier):
            log.step("Testing wheel...")
@@ -374,14 +454,8 @@ def build_in_container(
                container.call(["sh", "-c", before_test_prepared], env=virtualenv_env)

            # Install the wheel we just built
-            # Note: If auditwheel produced two wheels, it's because the earlier produced wheel
-            # conforms to multiple manylinux standards. These multiple versions of the wheel are
-            # functionally the same, differing only in name, wheel metadata, and possibly include
-            # different external shared libraries. so it doesn't matter which one we run the tests on.
-            # Let's just pick the first one.
-            wheel_to_test = repaired_wheels[0]
            container.call(
-                [*pip, "install", str(wheel_to_test) + build_options.test_extras],
+                [*pip, "install", str(repaired_wheel) + build_options.test_extras],
                env=virtualenv_env,
            )

@@ -394,7 +468,7 @@ def build_in_container(
                build_options.test_command,
                project=container_project_path,
                package=container_package_dir,
-                wheel=wheel_to_test,
+                wheel=repaired_wheel,
            )

            test_cwd = testing_temp_dir / "test_cwd"
@@ -417,15 +491,15 @@ def build_in_container(
            # clean up test environment
            container.call(["rm", "-rf", testing_temp_dir])

-        # move repaired wheels to output
+        # move repaired wheel to output
+        output_wheel: Path | None = None
        if compatible_wheel is None:
            container.call(["mkdir", "-p", container_output_dir])
-            container.call(["mv", *repaired_wheels, container_output_dir])
-            built_wheels.extend(
-                container_output_dir / repaired_wheel.name for repaired_wheel in repaired_wheels
-            )
+            container.call(["mv", repaired_wheel, container_output_dir])
+            built_wheels.append(container_output_dir / repaired_wheel.name)
+            output_wheel = options.globals.output_dir / repaired_wheel.name

-        log.build_end()
+        log.build_end(output_wheel)

    log.step("Copying wheels back to host...")
    # copy the output back into the host
@@ -442,7 +516,7 @@ def build(options: Options, tmp_path: Path) -> None:
    abs_package_dir = options.globals.package_dir.resolve()
    if cwd != abs_package_dir and cwd not in abs_package_dir.parents:
        msg = "package_dir must be inside the working directory"
-        raise Exception(msg)
+        raise errors.ConfigurationError(msg)

    container_project_path = PurePosixPath("/project")
    container_package_dir = container_project_path / abs_package_dir.relative_to(cwd)
@@ -462,8 +536,7 @@ def build(options: Options, tmp_path: Path) -> None:
                Docker or Podman is required to run Linux builds. If you're
                building on Travis CI, add `services: [docker]` to your
                .travis.yml. If you're building on Circle CI in Linux, add a
-                `setup_remote_docker` step to your .circleci/config.yml. If
-                you're building on Cirrus CI, use `docker_builder` task.
+                `setup_remote_docker` step to your .circleci/config.yml.
                """
            )
            raise errors.ConfigurationError(msg) from error
@@ -506,6 +579,7 @@ def _matches_prepared_command(error_cmd: Sequence[str], command_template: str) -
 def troubleshoot(options: Options, error: Exception) -> None:
    if isinstance(error, subprocess.CalledProcessError) and (
        error.cmd[0:4] == ["python", "-m", "pip", "wheel"]
+        or error.cmd[0:2] == ["uv", "build"]
        or error.cmd[0:3] == ["python", "-m", "build"]
        or _matches_prepared_command(
            error.cmd, options.build_options(None).repair_command
@@ -1,3 +1,27 @@
+from __future__ import annotations
+
+__lazy_modules__ = {
+    "cibuildwheel.audit",
+    "cibuildwheel.ci",
+    "cibuildwheel.frontend",
+    "cibuildwheel.logger",
+    "cibuildwheel.util",
+    "cibuildwheel.util.cmd",
+    "cibuildwheel.util.file",
+    "cibuildwheel.util.helpers",
+    "cibuildwheel.util.packaging",
+    "cibuildwheel.venv",
+    "filelock",
+    "inspect",
+    "packaging",
+    "packaging.version",
+    "pathlib",
+    "platform",
+    "re",
+    "shutil",
+    "subprocess",
+}
+
 import dataclasses
 import functools
 import inspect
@@ -8,32 +32,43 @@ import shutil
 import subprocess
 import sys
 import typing
-from collections.abc import Set
 from pathlib import Path
-from typing import Literal, assert_never
+from typing import assert_never

 from filelock import FileLock
 from packaging.version import Version

-from .. import errors
-from ..architecture import Architecture
-from ..ci import detect_ci_provider
-from ..environment import ParsedEnvironment
-from ..frontend import BuildFrontendConfig, BuildFrontendName, get_build_frontend_extra_flags
-from ..logger import log
-from ..options import Options
-from ..selector import BuildSelector
-from ..util import resources
-from ..util.cmd import call, shell
-from ..util.file import (
+from cibuildwheel import errors
+from cibuildwheel.audit import run_audit
+from cibuildwheel.ci import detect_ci_provider
+from cibuildwheel.frontend import (
+    BuildFrontendName,
+    get_build_frontend_extra_flags,
+    prepare_config_settings,
+)
+from cibuildwheel.logger import log
+from cibuildwheel.util import resources
+from cibuildwheel.util.cmd import call, shell
+from cibuildwheel.util.file import (
    CIBW_CACHE_PATH,
    copy_test_sources,
    download,
    move_file,
+    remove_on_error,
 )
-from ..util.helpers import prepare_command, unwrap
-from ..util.packaging import combine_constraints, find_compatible_wheel, get_pip_version
-from ..venv import constraint_flags, find_uv, virtualenv
+from cibuildwheel.util.helpers import prepare_command, unwrap
+from cibuildwheel.util.packaging import find_compatible_wheel, get_pip_version
+from cibuildwheel.venv import constraint_flags, find_uv, target_marker_env, virtualenv
+
+TYPE_CHECKING = False
+if TYPE_CHECKING:
+    from collections.abc import Set
+    from typing import Literal
+
+    from cibuildwheel.architecture import Architecture
+    from cibuildwheel.environment import ParsedEnvironment
+    from cibuildwheel.options import Options
+    from cibuildwheel.selector import BuildSelector


@functools.cache
@@ -60,7 +95,7 @@ def get_macos_version() -> tuple[int, int]:
            capture_stdout=True,
        )
        version = tuple(map(int, version_str.split(".")[:2]))
-    return typing.cast(tuple[int, int], version)
+    return typing.cast("tuple[int, int]", version)


@functools.cache
@@ -81,6 +116,7 @@ class PythonConfiguration:
    version: str
    identifier: str
    url: str
+    sha256: str


 def all_python_configurations() -> list[PythonConfiguration]:
@@ -128,7 +164,7 @@ def get_python_configurations(
    return python_configurations


-def install_cpython(_tmp: Path, version: str, url: str, free_threading: bool) -> Path:
+def install_cpython(_tmp: Path, version: str, url: str, free_threading: bool, sha256: str) -> Path:
    ft = "T" if free_threading else ""
    installation_path = Path(f"/Library/Frameworks/Python{ft}.framework/Versions/{version}")
    with FileLock(CIBW_CACHE_PATH / f"cpython{version}.lock"):
@@ -141,7 +177,8 @@ def install_cpython(_tmp: Path, version: str, url: str, free_threading: bool) ->
                # let the user know & provide a link to the installer
                msg = inspect.cleandoc(
                    f"""
-                        Error: CPython {version} is not installed.
+                        Framework CPython {version} not detected as installed in:
+                            {installation_path}
                        cibuildwheel will not perform system-wide installs when running outside of CI.
                        To build locally, install CPython {version} on this machine, or, disable this
                        version of Python using CIBW_SKIP=cp{version.replace(".", "")}-macosx_*
@@ -150,16 +187,15 @@ def install_cpython(_tmp: Path, version: str, url: str, free_threading: bool) ->
                    """
                )
                raise errors.FatalError(msg)
-            python_filename = url.split("/")[-1]
+            python_filename = url.rsplit("/", maxsplit=1)[-1]
            pkg_path = CIBW_CACHE_PATH / "cpython-installer" / python_filename
            if not pkg_path.exists():
-                download(url, pkg_path)
+                download(url, pkg_path, sha256=sha256)
            args = []
-            if version.startswith("3.13"):
-                # Python 3.13 is the first version to have a free-threading option
-                args += ["-applyChoiceChangesXML", str(resources.FREE_THREAD_ENABLE_313.resolve())]
-            elif version.startswith("3.14"):
+            if version.startswith("3.14"):
                args += ["-applyChoiceChangesXML", str(resources.FREE_THREAD_ENABLE_314.resolve())]
+            elif version.startswith("3.15"):
+                args += ["-applyChoiceChangesXML", str(resources.FREE_THREAD_ENABLE_315.resolve())]
            call("sudo", "installer", "-pkg", pkg_path, *args, "-target", "/")
            pkg_path.unlink()
            env = os.environ.copy()
@@ -178,22 +214,24 @@ def install_cpython(_tmp: Path, version: str, url: str, free_threading: bool) ->
    return installation_path / "bin" / (f"python{version}t" if free_threading else "python3")


-def install_pypy(tmp: Path, url: str) -> Path:
-    pypy_tar_bz2 = url.rsplit("/", 1)[-1]
-    extension = ".tar.bz2"
-    assert pypy_tar_bz2.endswith(extension)
-    installation_path = CIBW_CACHE_PATH / pypy_tar_bz2[: -len(extension)]
+def install_pypy(tmp: Path, url: str, sha256: str) -> Path:
+    pypy_archive = url.rsplit("/", 1)[-1]
+    # PyPy ships .tar.bz2 for some platforms and .tar.gz for others.
+    extension = ".tar.bz2" if pypy_archive.endswith(".tar.bz2") else ".tar.gz"
+    assert pypy_archive.endswith(extension)
+    installation_path = CIBW_CACHE_PATH / pypy_archive[: -len(extension)]
    with FileLock(str(installation_path) + ".lock"):
        if not installation_path.exists():
-            downloaded_tar_bz2 = tmp / pypy_tar_bz2
-            download(url, downloaded_tar_bz2)
+            downloaded_archive = tmp / pypy_archive
+            download(url, downloaded_archive, sha256=sha256)
            installation_path.parent.mkdir(parents=True, exist_ok=True)
-            call("tar", "-C", installation_path.parent, "-xf", downloaded_tar_bz2)
-            downloaded_tar_bz2.unlink()
+            with remove_on_error(installation_path):
+                call("tar", "-C", installation_path.parent, "-xf", downloaded_archive)
+            downloaded_archive.unlink()
    return installation_path / "bin" / "pypy3"


-def install_graalpy(tmp: Path, url: str) -> Path:
+def install_graalpy(tmp: Path, url: str, sha256: str) -> Path:
    graalpy_archive = url.rsplit("/", 1)[-1]
    extension = ".tar.gz"
    assert graalpy_archive.endswith(extension)
@@ -201,10 +239,18 @@ def install_graalpy(tmp: Path, url: str) -> Path:
    with FileLock(str(installation_path) + ".lock"):
        if not installation_path.exists():
            downloaded_archive = tmp / graalpy_archive
-            download(url, downloaded_archive)
-            installation_path.mkdir(parents=True)
-            # GraalPy top-folder name is inconsistent with archive name
-            call("tar", "-C", installation_path, "--strip-components=1", "-xzf", downloaded_archive)
+            download(url, downloaded_archive, sha256=sha256)
+            with remove_on_error(installation_path):
+                installation_path.mkdir(parents=True)
+                # GraalPy top-folder name is inconsistent with archive name
+                call(
+                    "tar",
+                    "-C",
+                    installation_path,
+                    "--strip-components=1",
+                    "-xzf",
+                    downloaded_archive,
+                )
            downloaded_archive.unlink()
    return installation_path / "bin" / "graalpy"

@@ -217,7 +263,7 @@ def setup_python(
    build_frontend: BuildFrontendName,
 ) -> tuple[Path, dict[str, str]]:
    uv_path = find_uv()
-    use_uv = build_frontend == "build[uv]"
+    use_uv = build_frontend in {"build[uv]", "uv"}

    tmp.mkdir()
    implementation_id = python_configuration.identifier.split("-")[0]
@@ -225,13 +271,17 @@ def setup_python(
    if implementation_id.startswith("cp"):
        free_threading = "t-macos" in python_configuration.identifier
        base_python = install_cpython(
-            tmp, python_configuration.version, python_configuration.url, free_threading
+            tmp,
+            python_configuration.version,
+            python_configuration.url,
+            free_threading,
+            python_configuration.sha256,
        )

    elif implementation_id.startswith("pp"):
-        base_python = install_pypy(tmp, python_configuration.url)
+        base_python = install_pypy(tmp, python_configuration.url, python_configuration.sha256)
    elif implementation_id.startswith("gp"):
-        base_python = install_graalpy(tmp, python_configuration.url)
+        base_python = install_graalpy(tmp, python_configuration.url, python_configuration.sha256)
    else:
        msg = "Unknown Python implementation"
        raise ValueError(msg)
@@ -247,6 +297,7 @@ def setup_python(
        venv_path,
        dependency_constraint,
        use_uv=use_uv,
+        marker_env=target_marker_env(implementation_id=implementation_id),
    )
    venv_bin_path = venv_path / "bin"
    assert venv_bin_path.exists()
@@ -257,6 +308,10 @@ def setup_python(
    # https://github.com/pypa/virtualenv/issues/620
    # Also see https://github.com/python/cpython/pull/9516
    env.pop("__PYVENV_LAUNCHER__", None)
+    # uv uses this over the current environment's python, so remove it to avoid confusion
+    env.pop("PYTHON_VERSION", None)
+    env.pop("PYTHON_ARCH", None)
+    env.pop("UV_PYTHON", None)

    # we version pip ourselves, so we don't care about pip version checking
    env["PIP_DISABLE_PIP_VERSION_CHECK"] = "1"
@@ -270,7 +325,7 @@ def setup_python(
    if which_python != str(venv_bin_path / "python"):
        msg = "python available on PATH doesn't match our installed instance. If you have modified PATH, ensure that you don't overwrite cibuildwheel's entry or insert python above it."
        raise errors.FatalError(msg)
-    call("python", "--version", env=env)
+    call("python", "-V", "-V", env=env)

    # check what pip version we're on
    if not use_uv:
@@ -289,8 +344,11 @@ def setup_python(
    # For arm64, the minimal deployment target is 11.0.
    # On x86_64 (or universal2), use 10.9 as a default.
    # CPython 3.12.6+ needs 10.13.
+    # CPython 3.14.0 needs 10.15.
    if config_is_arm64:
        default_target = "11.0"
+    elif Version(python_configuration.version) >= Version("3.14"):
+        default_target = "10.15"
    elif Version(python_configuration.version) >= Version("3.12"):
        default_target = "10.13"
    elif python_configuration.identifier.startswith("pp") and Version(
@@ -345,39 +403,58 @@ def setup_python(
            env.setdefault("SDKROOT", arm64_compatible_sdks[0])

    log.step("Installing build tools...")
-    if build_frontend == "pip":
-        call(
-            "pip",
-            "install",
-            "--upgrade",
-            "delocate",
-            *constraint_flags(dependency_constraint),
-            env=env,
-        )
-    elif build_frontend == "build":
-        call(
-            "pip",
-            "install",
-            "--upgrade",
-            "delocate",
-            "build[virtualenv]",
-            *constraint_flags(dependency_constraint),
-            env=env,
-        )
-    elif build_frontend == "build[uv]":
-        assert uv_path is not None
-        call(
-            uv_path,
-            "pip",
-            "install",
-            "--upgrade",
-            "delocate",
-            "build[virtualenv, uv]",
-            *constraint_flags(dependency_constraint),
-            env=env,
-        )
-    else:
-        assert_never(build_frontend)
+    match build_frontend:
+        case "pip":
+            call(
+                "pip",
+                "install",
+                "--upgrade",
+                "delocate",
+                *constraint_flags(dependency_constraint),
+                env=env,
+            )
+        case "build":
+            call(
+                "pip",
+                "install",
+                "--upgrade",
+                "delocate",
+                "build[virtualenv]",
+                *constraint_flags(dependency_constraint),
+                env=env,
+            )
+        case "build[uv]":
+            assert uv_path is not None
+            call(
+                uv_path,
+                "pip",
+                "install",
+                "--python",
+                which_python,
+                "--upgrade",
+                "delocate",
+                "build[virtualenv, uv]",
+                *constraint_flags(dependency_constraint),
+                env=env,
+            )
+        case "uv":
+            assert uv_path is not None
+            call(
+                uv_path,
+                "pip",
+                "install",
+                "--python",
+                which_python,
+                "--upgrade",
+                "delocate",
+                *constraint_flags(dependency_constraint),
+                env=env,
+            )
+        case "pyodide-build":
+            msg = "The 'pyodide-build' build frontend is not supported on this platform"
+            raise errors.FatalError(msg)
+        case _:
+            assert_never(build_frontend)

    return base_python, env

@@ -407,8 +484,8 @@ def build(options: Options, tmp_path: Path) -> None:

        for config in python_configurations:
            build_options = options.build_options(config.identifier)
-            build_frontend = build_options.build_frontend or BuildFrontendConfig("build")
-            use_uv = build_frontend.name == "build[uv]"
+            build_frontend = build_options.build_frontend
+            use_uv = build_frontend.name in {"build[uv]", "uv"}
            uv_path = find_uv()
            if use_uv and uv_path is None:
                msg = "uv not found"
@@ -435,6 +512,7 @@ def build(options: Options, tmp_path: Path) -> None:
                build_options.environment,
                build_frontend.name,
            )
+            env["CIBUILDWHEEL_BUILD_IDENTIFIER"] = config.identifier
            pip_version = None if use_uv else get_pip_version(env)

            compatible_wheel = find_compatible_wheel(built_wheels, config.identifier)
@@ -456,48 +534,71 @@ def build(options: Options, tmp_path: Path) -> None:
                built_wheel_dir.mkdir()

                extra_flags = get_build_frontend_extra_flags(
-                    build_frontend, build_options.build_verbosity, build_options.config_settings
+                    build_frontend,
+                    build_options.build_verbosity,
+                    prepare_config_settings(
+                        build_options.config_settings,
+                        project=Path.cwd(),
+                        package=build_options.package_dir,
+                    ),
                )

                build_env = env.copy()
-                if pip_version is not None:
-                    build_env["VIRTUALENV_PIP"] = pip_version
-                if constraints_path:
-                    combine_constraints(
-                        build_env, constraints_path, identifier_tmp_dir if use_uv else None
-                    )

-                if build_frontend.name == "pip":
-                    # Path.resolve() is needed. Without it pip wheel may try to fetch package from pypi.org
-                    # see https://github.com/pypa/cibuildwheel/pull/369
-                    call(
-                        "python",
-                        "-m",
-                        "pip",
-                        "wheel",
-                        build_options.package_dir.resolve(),
-                        f"--wheel-dir={built_wheel_dir}",
-                        "--no-deps",
-                        *extra_flags,
-                        env=build_env,
-                    )
-                elif build_frontend.name == "build" or build_frontend.name == "build[uv]":
-                    if use_uv and "--no-isolation" not in extra_flags and "-n" not in extra_flags:
-                        extra_flags.append("--installer=uv")
-                    call(
-                        "python",
-                        "-m",
-                        "build",
-                        build_options.package_dir,
-                        "--wheel",
-                        f"--outdir={built_wheel_dir}",
-                        *extra_flags,
-                        env=build_env,
-                    )
-                else:
-                    assert_never(build_frontend)
+                match build_frontend.name:
+                    case "pip":
+                        # Path.resolve() is needed. Without it pip wheel may try to fetch package from pypi.org
+                        # see https://github.com/pypa/cibuildwheel/pull/369
+                        call(
+                            "python",
+                            "-m",
+                            "pip",
+                            "wheel",
+                            build_options.package_dir.resolve(),
+                            f"--wheel-dir={built_wheel_dir}",
+                            "--no-deps",
+                            *extra_flags,
+                            env=build_env,
+                        )
+                    case "build" | "build[uv]":
+                        if (
+                            use_uv
+                            and "--no-isolation" not in extra_flags
+                            and "-n" not in extra_flags
+                        ):
+                            extra_flags.append("--installer=uv")
+                        call(
+                            "python",
+                            "-m",
+                            "build",
+                            build_options.package_dir,
+                            "--wheel",
+                            f"--outdir={built_wheel_dir}",
+                            *extra_flags,
+                            env=build_env,
+                        )
+                    case "uv":
+                        assert uv_path is not None
+                        call(
+                            uv_path,
+                            "build",
+                            f"--python={base_python}",
+                            build_options.package_dir,
+                            "--wheel",
+                            f"--out-dir={built_wheel_dir}",
+                            *extra_flags,
+                            env=build_env,
+                        )
+                    case "pyodide-build":
+                        msg = "The 'pyodide-build' build frontend is not supported on this platform"
+                        raise errors.FatalError(msg)
+                    case _:
+                        assert_never(build_frontend)

-                built_wheel = next(built_wheel_dir.glob("*.whl"))
+                try:
+                    built_wheel = next(built_wheel_dir.glob("*.whl"))
+                except StopIteration:
+                    raise errors.BuildProducedNoWheelError() from None

                repaired_wheel_dir.mkdir()

@@ -519,6 +620,8 @@ def build(options: Options, tmp_path: Path) -> None:
                        wheel=built_wheel,
                        dest_dir=repaired_wheel_dir,
                        delocate_archs=delocate_archs,
+                        package=build_options.package_dir,
+                        project=".",
                    )
                    shell(repair_command_prepared, env=env)
                else:
@@ -534,15 +637,10 @@ def build(options: Options, tmp_path: Path) -> None:

                log.step_end()

+                run_audit(tmp_dir=tmp_path, build_options=build_options, wheel=repaired_wheel)
+
            if build_options.test_command and build_options.test_selector(config.identifier):
                machine_arch = platform.machine()
-                python_arch = call(
-                    "python",
-                    "-sSc",
-                    "import platform; print(platform.machine())",
-                    env=env,
-                    capture_stdout=True,
-                ).strip()
                testing_archs: list[Literal["x86_64", "arm64"]]

                if config_is_arm64:
@@ -590,24 +688,6 @@ def build(options: Options, tmp_path: Path) -> None:
                        # skip this test
                        continue

-                    is_cp38 = config.identifier.startswith("cp38-")
-                    if testing_arch == "arm64" and is_cp38 and python_arch != "arm64":
-                        log.warning(
-                            unwrap(
-                                """
-                                While cibuildwheel can build CPython 3.8 universal2/arm64 wheels, we
-                                cannot test the arm64 part of them, even when running on an Apple
-                                Silicon machine. This is because we use the x86_64 installer of
-                                CPython 3.8. See the discussion in
-                                https://github.com/pypa/cibuildwheel/pull/1169 for the details. To
-                                silence this warning, set `CIBW_TEST_SKIP: "cp38-macosx_*:arm64"`.
-                                """
-                            )
-                        )
-
-                        # skip this test
-                        continue
-
                    log.step(
                        "Testing wheel..."
                        if testing_arch == machine_arch
@@ -664,33 +744,16 @@ def build(options: Options, tmp_path: Path) -> None:
                        shell_with_arch(before_test_prepared, env=virtualenv_env)

                    # install the wheel
-                    if is_cp38 and python_arch == "x86_64":
-                        virtualenv_env_install_wheel = virtualenv_env.copy()
-                        virtualenv_env_install_wheel["SYSTEM_VERSION_COMPAT"] = "0"
-                        log.notice(
-                            unwrap(
-                                """
-                                Setting SYSTEM_VERSION_COMPAT=0 to ensure CPython 3.8 can get
-                                correct macOS version and allow installation of wheels with
-                                MACOSX_DEPLOYMENT_TARGET >= 11.0.
-                                See https://github.com/pypa/cibuildwheel/issues/1767 for the
-                                details.
-                                """
-                            )
-                        )
-                    else:
-                        virtualenv_env_install_wheel = virtualenv_env
-
                    pip_install(
                        f"{repaired_wheel}{build_options.test_extras}",
-                        env=virtualenv_env_install_wheel,
+                        env=virtualenv_env,
                    )

                    # test the wheel
                    if build_options.test_requires:
                        pip_install(
                            *build_options.test_requires,
-                            env=virtualenv_env_install_wheel,
+                            env=virtualenv_env,
                        )

                    # run the tests from a temp dir, with an absolute path in the command
@@ -726,6 +789,7 @@ def build(options: Options, tmp_path: Path) -> None:
                    shell_with_arch(test_command_prepared, cwd=test_cwd, env=virtualenv_env)

            # we're all done here; move it to output (overwrite existing)
+            output_wheel = None
            if compatible_wheel is None:
                output_wheel = build_options.output_dir.joinpath(repaired_wheel.name)
                moved_wheel = move_file(repaired_wheel, output_wheel)
@@ -738,7 +802,7 @@ def build(options: Options, tmp_path: Path) -> None:
            # clean up
            shutil.rmtree(identifier_tmp_dir)

-            log.build_end()
+            log.build_end(output_wheel)
    except subprocess.CalledProcessError as error:
        msg = f"Command {error.cmd} failed with code {error.returncode}. {error.stdout or ''}"
        raise errors.FatalError(msg) from error
@@ -1,42 +1,72 @@
+from __future__ import annotations
+
+__lazy_modules__ = {
+    "cibuildwheel.architecture",
+    "cibuildwheel.audit",
+    "cibuildwheel.frontend",
+    "cibuildwheel.logger",
+    "cibuildwheel.util",
+    "cibuildwheel.util.cmd",
+    "cibuildwheel.util.file",
+    "cibuildwheel.util.helpers",
+    "cibuildwheel.util.packaging",
+    "cibuildwheel.util.python_build_standalone",
+    "cibuildwheel.venv",
+    "filelock",
+    "json",
+    "pathlib",
+    "shutil",
+    "subprocess",
+    "tempfile",
+    "tomllib",
+}
+
 import dataclasses
 import functools
 import json
 import os
 import shutil
+import subprocess
 import sys
 import tomllib
 import typing
-from collections.abc import Set
 from pathlib import Path
 from tempfile import TemporaryDirectory
 from typing import Final, TypedDict

 from filelock import FileLock

-from .. import errors
-from ..architecture import Architecture
-from ..environment import ParsedEnvironment
-from ..frontend import BuildFrontendConfig, get_build_frontend_extra_flags
-from ..logger import log
-from ..options import Options
-from ..selector import BuildSelector
-from ..util import resources
-from ..util.cmd import call, shell
-from ..util.file import (
+from cibuildwheel import errors
+from cibuildwheel.architecture import Architecture
+from cibuildwheel.audit import run_audit
+from cibuildwheel.frontend import get_build_frontend_extra_flags, prepare_config_settings
+from cibuildwheel.logger import log
+from cibuildwheel.util import resources
+from cibuildwheel.util.cmd import call, shell
+from cibuildwheel.util.file import (
    CIBW_CACHE_PATH,
    copy_test_sources,
    download,
    extract_tar,
    extract_zip,
    move_file,
+    remove_on_error,
 )
-from ..util.helpers import prepare_command, unwrap, unwrap_preserving_paragraphs
-from ..util.packaging import combine_constraints, find_compatible_wheel, get_pip_version
-from ..util.python_build_standalone import (
+from cibuildwheel.util.helpers import prepare_command, unwrap, unwrap_preserving_paragraphs
+from cibuildwheel.util.packaging import find_compatible_wheel, get_pip_version
+from cibuildwheel.util.python_build_standalone import (
    PythonBuildStandaloneError,
    create_python_build_standalone_environment,
 )
-from ..venv import constraint_flags, virtualenv
+from cibuildwheel.venv import constraint_flags, virtualenv
+
+TYPE_CHECKING = False
+if TYPE_CHECKING:
+    from collections.abc import Set
+
+    from cibuildwheel.environment import ParsedEnvironment
+    from cibuildwheel.options import Options
+    from cibuildwheel.selector import BuildSelector

 IS_WIN: Final[bool] = sys.platform.startswith("win")

@@ -47,6 +77,7 @@ class PythonConfiguration:
    identifier: str
    default_pyodide_version: str
    node_version: str
+    sha256: str = ""


 class PyodideXBuildEnvInfoVersionRange(TypedDict):
@@ -83,32 +114,40 @@ def ensure_node(major_version: str) -> Path:
            with TemporaryDirectory() as tmp_path:
                archive = Path(tmp_path) / f"{name}.{ext}"
                download(url, archive)
-                if ext == "zip":
-                    extract_zip(archive, path.parent)
-                else:
-                    extract_tar(archive, path.parent)
+                with remove_on_error(path):
+                    if ext == "zip":
+                        extract_zip(archive, path.parent)
+                    else:
+                        extract_tar(archive, path.parent)
    assert path.exists()
    if not IS_WIN:
        return path / "bin"
    return path


-def install_emscripten(tmp: Path, version: str) -> Path:
-    url = f"https://github.com/emscripten-core/emsdk/archive/refs/tags/{version}.zip"
-    installation_path = CIBW_CACHE_PATH / f"emsdk-{version}"
-    emsdk_path = installation_path / f"emsdk-{version}/emsdk"
-    emcc_path = installation_path / f"emsdk-{version}/upstream/emscripten/emcc"
-    with FileLock(f"{installation_path}.lock"):
-        if installation_path.exists():
-            return emcc_path
-        emsdk_zip = tmp / "emsdk.zip"
-        download(url, emsdk_zip)
-        installation_path.mkdir()
-        extract_zip(emsdk_zip, installation_path)
-        call(emsdk_path, "install", version)
-        call(emsdk_path, "activate", version)
-
-    return emcc_path
+def install_emscripten(env: dict[str, str], version: str, xbuildenv_cache_path: Path) -> Path:
+    """Install Emscripten via pyodide-build, which also applies Pyodide-specific patches."""
+    emscripten_dir = Path(
+        call("pyodide", "config", "get", "emscripten_dir", env=env, capture_stdout=True).strip()
+    )
+    with FileLock(CIBW_CACHE_PATH / "emscripten.lock"):
+        if emscripten_dir.exists():
+            return emscripten_dir
+        with remove_on_error(emscripten_dir):
+            call(
+                "pyodide",
+                "xbuildenv",
+                "install-emscripten",
+                "--force",
+                "--version",
+                version,
+                "--path",
+                str(xbuildenv_cache_path),
+                env=env,
+                cwd=CIBW_CACHE_PATH,
+            )
+    assert emscripten_dir.exists()
+    return emscripten_dir


 def get_all_xbuildenv_version_info(env: dict[str, str]) -> list[PyodideXBuildEnvInfo]:
@@ -129,7 +168,7 @@ def get_all_xbuildenv_version_info(env: dict[str, str]) -> list[PyodideXBuildEnv
        msg = f"Invalid xbuildenvs info, got {xbuildenvs_info}"
        raise ValueError(msg)

-    return typing.cast(list[PyodideXBuildEnvInfo], xbuildenvs_info["environments"])
+    return typing.cast("list[PyodideXBuildEnvInfo]", xbuildenvs_info["environments"])


 def get_xbuildenv_version_info(
@@ -179,12 +218,38 @@ def validate_pyodide_build_version(
        raise errors.FatalError(msg)


-def install_xbuildenv(env: dict[str, str], pyodide_build_version: str, pyodide_version: str) -> str:
+def validate_pyodide_target_python(
+    xbuildenv_info: PyodideXBuildEnvInfo, python_configuration: PythonConfiguration
+) -> None:
+    """
+    Validate that the resolved Pyodide xbuildenv targets the same Python version
+    as the identifier being built.
+
+    This is to catch the case where a global ``pyodide-version`` is applied to an
+    identifier whose Python version does not match, such as setting
+    ``pyodide-version = "3Y.0.0"`` (a Python 3.Y environment) while
+    building ``cp3X-pyodide_wasm32``.
+    """
+    xbuildenv_version = xbuildenv_info["version"]
+    identifier = python_configuration.identifier
+    expected_version = python_configuration.version
+    default_version = python_configuration.default_pyodide_version
+    xbuildenv_python_minor = ".".join(xbuildenv_info["python"].split(".")[:2])
+    if xbuildenv_python_minor != expected_version:
+        msg = unwrap_preserving_paragraphs(f"""
+            The `pyodide-version` option is set to {xbuildenv_version}, which
+            provides Python {xbuildenv_python_minor}, but the {identifier} build
+            needs Python {expected_version}.
+
+            Either remove `pyodide-version` so {identifier} uses its default
+            ({default_version}), or stop building {identifier} so that
+            `pyodide-version` only applies to an identifier it matches.
+        """)
+        raise errors.ConfigurationError(msg)
+
+
+def install_xbuildenv(env: dict[str, str], xbuildenv_cache_path: Path, pyodide_version: str) -> str:
    """Install a particular Pyodide xbuildenv version and set a path to the Pyodide root."""
-    # Since pyodide-build was unvendored from Pyodide v0.27.0, the versions of
-    # pyodide-build are uncoupled from the versions of Pyodide. So, we specify
-    # both the pyodide-build version and the Pyodide version in the temp path.
-    xbuildenv_cache_path = CIBW_CACHE_PATH / f"pyodide-build-{pyodide_build_version}"
    pyodide_root = xbuildenv_cache_path / pyodide_version / "xbuildenv" / "pyodide-root"

    with FileLock(CIBW_CACHE_PATH / "xbuildenv.lock"):
@@ -197,17 +262,18 @@ def install_xbuildenv(env: dict[str, str], pyodide_build_version: str, pyodide_v
        env.pop("PYODIDE_ROOT", None)

        # Install the xbuildenv
-        call(
-            "pyodide",
-            "xbuildenv",
-            "install",
-            "--path",
-            str(xbuildenv_cache_path),
-            pyodide_version,
-            env=env,
-            cwd=CIBW_CACHE_PATH,
-        )
-        assert pyodide_root.exists()
+        with remove_on_error(xbuildenv_cache_path / pyodide_version):
+            call(
+                "pyodide",
+                "xbuildenv",
+                "install",
+                "--path",
+                str(xbuildenv_cache_path),
+                pyodide_version,
+                env=env,
+                cwd=CIBW_CACHE_PATH,
+            )
+            assert pyodide_root.exists()

    return str(pyodide_root)

@@ -267,7 +333,7 @@ def setup_python(
    if which_python != str(venv_bin_path / "python"):
        msg = "python available on PATH doesn't match our venv instance. If you have modified PATH, ensure that you don't overwrite cibuildwheel's entry or insert python above it."
        raise errors.FatalError(msg)
-    call("python", "--version", env=env)
+    call("python", "-V", "-V", env=env)

    # check what pip version we're on
    assert (venv_bin_path / "pip").exists()
@@ -283,8 +349,6 @@ def setup_python(
        "pip",
        "install",
        "--upgrade",
-        "auditwheel-emscripten",
-        "build[virtualenv]",
        "pyodide-build",
        *constraint_flags(constraints_path),
        env=env,
@@ -303,15 +367,23 @@ def setup_python(
        xbuildenv_info=xbuildenv_info,
        pyodide_build_version=pyodide_build_version,
    )
+    validate_pyodide_target_python(
+        xbuildenv_info=xbuildenv_info,
+        python_configuration=python_configuration,
+    )

-    emscripten_version = xbuildenv_info["emscripten"]
-    log.step(f"Installing Emscripten version: {emscripten_version} ...")
-    emcc_path = install_emscripten(tmp, emscripten_version)
-
-    env["PATH"] = os.pathsep.join([str(emcc_path.parent), env["PATH"]])
+    xbuildenv_cache_path = CIBW_CACHE_PATH / f"pyodide-build-{pyodide_build_version}"

    log.step(f"Installing Pyodide xbuildenv version: {pyodide_version} ...")
-    env["PYODIDE_ROOT"] = install_xbuildenv(env, pyodide_build_version, pyodide_version)
+    env["PYODIDE_ROOT"] = install_xbuildenv(env, xbuildenv_cache_path, pyodide_version)
+
+    emscripten_version = xbuildenv_info["emscripten"]
+    log.step(
+        f"Installing Emscripten {emscripten_version} and applying Pyodide-specific patches ..."
+    )
+    emscripten_dir = install_emscripten(env, emscripten_version, xbuildenv_cache_path)
+
+    env["PATH"] = os.pathsep.join([str(emscripten_dir), env["PATH"]])

    return env

@@ -352,11 +424,7 @@ def build(options: Options, tmp_path: Path) -> None:

        for config in python_configurations:
            build_options = options.build_options(config.identifier)
-            build_frontend = build_options.build_frontend or BuildFrontendConfig("build")
-
-            if build_frontend.name == "pip":
-                msg = "The pyodide platform doesn't support pip frontend"
-                raise errors.FatalError(msg)
+            build_frontend = build_options.build_frontend

            log.build_start(config.identifier)

@@ -379,6 +447,7 @@ def build(options: Options, tmp_path: Path) -> None:
                environment=build_options.environment,
                user_pyodide_version=build_options.pyodide_version,
            )
+            env["CIBUILDWHEEL_BUILD_IDENTIFIER"] = config.identifier
            pip_version = get_pip_version(env)
            # The Pyodide command line runner mounts all directories in the host
            # filesystem into the Pyodide file system, except for the custom
@@ -416,22 +485,27 @@ def build(options: Options, tmp_path: Path) -> None:
                log.step("Building wheel...")

                extra_flags = get_build_frontend_extra_flags(
-                    build_frontend, build_options.build_verbosity, build_options.config_settings
+                    build_frontend,
+                    build_options.build_verbosity,
+                    prepare_config_settings(
+                        build_options.config_settings,
+                        project=Path.cwd(),
+                        package=build_options.package_dir,
+                    ),
                )

-                build_env = env.copy()
-                if constraints_path:
-                    combine_constraints(build_env, constraints_path, identifier_tmp_dir)
-                build_env["VIRTUALENV_PIP"] = pip_version
                call(
                    "pyodide",
                    "build",
                    build_options.package_dir,
                    f"--outdir={built_wheel_dir}",
                    *extra_flags,
-                    env=build_env,
+                    env=env,
                )
-                built_wheel = next(built_wheel_dir.glob("*.whl"))
+                try:
+                    built_wheel = next(built_wheel_dir.glob("*.whl"))
+                except StopIteration:
+                    raise errors.BuildProducedNoWheelError() from None

                if built_wheel.name.endswith("none-any.whl"):
                    raise errors.NonPlatformWheelError()
@@ -443,16 +517,24 @@ def build(options: Options, tmp_path: Path) -> None:
                        build_options.repair_command,
                        wheel=built_wheel,
                        dest_dir=repaired_wheel_dir,
+                        package=build_options.package_dir,
+                        project=".",
                    )
                    shell(repair_command_prepared, env=env)
+                    log.step_end()
                else:
                    shutil.move(str(built_wheel), repaired_wheel_dir)

-                repaired_wheel = next(repaired_wheel_dir.glob("*.whl"))
+                try:
+                    repaired_wheel = next(repaired_wheel_dir.glob("*.whl"))
+                except StopIteration:
+                    raise errors.RepairStepProducedNoWheelError() from None

                if repaired_wheel.name in {wheel.name for wheel in built_wheels}:
                    raise errors.AlreadyBuiltWheelError(repaired_wheel.name)

+                run_audit(tmp_dir=tmp_path, build_options=build_options, wheel=repaired_wheel)
+
            if build_options.test_command and build_options.test_selector(config.identifier):
                log.step("Testing wheel...")

@@ -538,6 +620,7 @@ def build(options: Options, tmp_path: Path) -> None:
                shell(test_command_prepared, cwd=test_cwd, env=virtualenv_env)

            # we're all done here; move it to output (overwrite existing)
+            output_wheel: Path | None = None
            if compatible_wheel is None:
                output_wheel = build_options.output_dir.joinpath(repaired_wheel.name)
                moved_wheel = move_file(repaired_wheel, output_wheel)
@@ -546,6 +629,8 @@ def build(options: Options, tmp_path: Path) -> None:
                        f"{repaired_wheel} was moved to {moved_wheel} instead of {output_wheel}"
                    )
                built_wheels.append(output_wheel)
+            log.build_end(output_wheel)

-    finally:
-        pass
+    except subprocess.CalledProcessError as error:
+        msg = f"Command {error.cmd} failed with code {error.returncode}. {error.stdout or ''}"
+        raise errors.FatalError(msg) from error
@@ -1,30 +1,67 @@
+from __future__ import annotations
+
+__lazy_modules__ = {
+    "cibuildwheel.architecture",
+    "cibuildwheel.audit",
+    "cibuildwheel.frontend",
+    "cibuildwheel.logger",
+    "cibuildwheel.util",
+    "cibuildwheel.util.cmd",
+    "cibuildwheel.util.file",
+    "cibuildwheel.util.helpers",
+    "cibuildwheel.util.packaging",
+    "cibuildwheel.venv",
+    "filelock",
+    "pathlib",
+    "platform",
+    "shutil",
+    "subprocess",
+    "textwrap",
+    "typing",
+}
+
 import dataclasses
-import json
 import os
 import platform as platform_module
 import shutil
 import subprocess
 import textwrap
-from collections.abc import MutableMapping, Set
 from functools import cache
 from pathlib import Path
 from typing import assert_never

 from filelock import FileLock

-from .. import errors
-from ..architecture import Architecture
-from ..environment import ParsedEnvironment
-from ..frontend import BuildFrontendConfig, BuildFrontendName, get_build_frontend_extra_flags
-from ..logger import log
-from ..options import Options
-from ..selector import BuildSelector
-from ..util import resources
-from ..util.cmd import call, shell
-from ..util.file import CIBW_CACHE_PATH, copy_test_sources, download, extract_zip, move_file
-from ..util.helpers import prepare_command, unwrap
-from ..util.packaging import combine_constraints, find_compatible_wheel, get_pip_version
-from ..venv import constraint_flags, find_uv, virtualenv
+from cibuildwheel import errors
+from cibuildwheel.architecture import Architecture
+from cibuildwheel.audit import run_audit
+from cibuildwheel.frontend import (
+    BuildFrontendName,
+    get_build_frontend_extra_flags,
+    prepare_config_settings,
+)
+from cibuildwheel.logger import log
+from cibuildwheel.util import resources
+from cibuildwheel.util.cmd import call, shell
+from cibuildwheel.util.file import (
+    CIBW_CACHE_PATH,
+    copy_test_sources,
+    download,
+    extract_zip,
+    move_file,
+    remove_on_error,
+)
+from cibuildwheel.util.helpers import prepare_command, unwrap
+from cibuildwheel.util.packaging import find_compatible_wheel, get_pip_version
+from cibuildwheel.venv import constraint_flags, find_uv, target_marker_env, virtualenv
+
+TYPE_CHECKING = False
+if TYPE_CHECKING:
+    from collections.abc import MutableMapping, Sequence, Set
+
+    from cibuildwheel.environment import ParsedEnvironment
+    from cibuildwheel.options import Options
+    from cibuildwheel.selector import BuildSelector


 def get_nuget_args(
@@ -54,9 +91,17 @@ def get_nuget_args(
@dataclasses.dataclass(frozen=True, kw_only=True)
 class PythonConfiguration:
    version: str
-    arch: str
    identifier: str
    url: str | None = None
+    sha256: str = ""
+
+    @property
+    def arch(self) -> str:
+        return {
+            "win32": "32",
+            "win_amd64": "64",
+            "win_arm64": "ARM64",
+        }[self.identifier.split("-")[-1]]


 def all_python_configurations() -> list[PythonConfiguration]:
@@ -87,7 +132,8 @@ def _ensure_nuget() -> Path:
    nuget = CIBW_CACHE_PATH / "nuget.exe"
    with FileLock(str(nuget) + ".lock"):
        if not nuget.exists():
-            download("https://dist.nuget.org/win-x86-commandline/latest/nuget.exe", nuget)
+            with remove_on_error(nuget):
+                download("https://dist.nuget.org/win-x86-commandline/latest/nuget.exe", nuget)
    return nuget


@@ -103,11 +149,12 @@ def install_cpython(configuration: PythonConfiguration, arch: str | None = None)
    with FileLock(str(base_output_dir) + f"-{version}{free_threaded_str}-{arch}.lock"):
        if not installation_path.exists():
            nuget = _ensure_nuget()
-            call(nuget, "install", *nuget_args)
+            with remove_on_error(installation_path.parent):
+                call(nuget, "install", *nuget_args)
    return installation_path / "python.exe"


-def install_pypy(tmp: Path, arch: str, url: str) -> Path:
+def install_pypy(tmp: Path, arch: str, url: str, sha256: str) -> Path:
    assert arch == "64"
    assert "win64" in url
    # Inside the PyPy zip file is a directory with the same name
@@ -118,13 +165,14 @@ def install_pypy(tmp: Path, arch: str, url: str) -> Path:
    with FileLock(str(installation_path) + ".lock"):
        if not installation_path.exists():
            pypy_zip = tmp / zip_filename
-            download(url, pypy_zip)
-            # Extract to the parent directory because the zip file still contains a directory
-            extract_zip(pypy_zip, installation_path.parent)
+            download(url, pypy_zip, sha256=sha256)
+            with remove_on_error(installation_path):
+                # Extract to the parent directory because the zip file still contains a directory
+                extract_zip(pypy_zip, installation_path.parent)
    return installation_path / "python.exe"


-def install_graalpy(tmp: Path, url: str) -> Path:
+def install_graalpy(tmp: Path, url: str, sha256: str) -> Path:
    zip_filename = url.rsplit("/", 1)[-1]
    extension = ".zip"
    assert zip_filename.endswith(extension)
@@ -132,9 +180,10 @@ def install_graalpy(tmp: Path, url: str) -> Path:
    with FileLock(str(installation_path) + ".lock"):
        if not installation_path.exists():
            graalpy_zip = tmp / zip_filename
-            download(url, graalpy_zip)
-            # Extract to the parent directory because the zip file still contains a directory
-            extract_zip(graalpy_zip, installation_path.parent)
+            download(url, graalpy_zip, sha256=sha256)
+            with remove_on_error(installation_path):
+                # Extract to the parent directory because the zip file still contains a directory
+                extract_zip(graalpy_zip, installation_path.parent)
    return installation_path / "bin" / "graalpy.exe"


@@ -225,11 +274,6 @@ def setup_rust_cross_compile(
        )


-def can_use_uv(python_configuration: PythonConfiguration) -> bool:
-    conditions = (not python_configuration.identifier.startswith("pp38-"),)
-    return all(conditions)
-
-
 def setup_python(
    tmp: Path,
    python_configuration: PythonConfiguration,
@@ -253,18 +297,20 @@ def setup_python(
            base_python = install_cpython(python_configuration, arch=native_arch)
    elif implementation_id.startswith("pp"):
        assert python_configuration.url is not None
-        base_python = install_pypy(tmp, python_configuration.arch, python_configuration.url)
+        assert python_configuration.sha256
+        base_python = install_pypy(
+            tmp, python_configuration.arch, python_configuration.url, python_configuration.sha256
+        )
    elif implementation_id.startswith("gp"):
-        base_python = install_graalpy(tmp, python_configuration.url or "")
+        assert python_configuration.url is not None
+        assert python_configuration.sha256
+        base_python = install_graalpy(tmp, python_configuration.url, python_configuration.sha256)
    else:
        msg = "Unknown Python implementation"
        raise ValueError(msg)
    assert base_python.exists()

-    if build_frontend == "build[uv]" and not can_use_uv(python_configuration):
-        build_frontend = "build"
-
-    use_uv = build_frontend == "build[uv]"
+    use_uv = build_frontend in {"build[uv]", "uv"}
    uv_path = find_uv()

    log.step("Setting up build environment...")
@@ -275,12 +321,15 @@ def setup_python(
        venv_path,
        dependency_constraint,
        use_uv=use_uv,
+        marker_env=target_marker_env(implementation_id=implementation_id),
    )

    # set up environment variables for run_with_env
    env["PYTHON_VERSION"] = python_configuration.version
    env["PYTHON_ARCH"] = python_configuration.arch
-    env["PIP_DISABLE_PIP_VERSION_CHECK"] = "1"
+    env.pop("UV_PYTHON", None)
+    if not use_uv:
+        env["PIP_DISABLE_PIP_VERSION_CHECK"] = "1"

    # update env with results from CIBW_ENVIRONMENT
    env = environment.as_dictionary(prev_environment=env)
@@ -291,7 +340,7 @@ def setup_python(
    if where_python != str(venv_path / "Scripts" / "python.exe"):
        msg = "python available on PATH doesn't match our installed instance. If you have modified PATH, ensure that you don't overwrite cibuildwheel's entry or insert python above it."
        raise errors.FatalError(msg)
-    call("python", "--version", env=env)
+    call("python", "-V", "-V", env=env)
    call("python", "-c", "\"import struct; print(struct.calcsize('P') * 8)\"", env=env)

    # check what pip version we're on
@@ -299,74 +348,70 @@ def setup_python(
        assert (venv_path / "Scripts" / "pip.exe").exists()
        where_pip = call("where", "pip", env=env, capture_stdout=True).splitlines()[0].strip()
        print(where_pip)
-        if where_pip.strip() != str(venv_path / "Scripts" / "pip.exe"):
+        if where_pip != str(venv_path / "Scripts" / "pip.exe"):
            msg = "pip available on PATH doesn't match our installed instance. If you have modified PATH, ensure that you don't overwrite cibuildwheel's entry or insert pip above it."
            raise errors.FatalError(msg)
        call("pip", "--version", env=env)

    log.step("Installing build tools...")
-    if build_frontend == "build":
-        call(
-            "pip",
-            "install",
-            "--upgrade",
-            "build[virtualenv]",
-            *constraint_flags(dependency_constraint),
-            env=env,
-        )
-    elif build_frontend == "build[uv]":
-        assert uv_path is not None
-        call(
-            uv_path,
-            "pip",
-            "install",
-            "--upgrade",
-            "build[virtualenv]",
-            *constraint_flags(dependency_constraint),
-            env=env,
-        )
+    match build_frontend:
+        case "pip":
+            call(
+                "pip",
+                "install",
+                "--upgrade",
+                "delvewheel",
+                *constraint_flags(dependency_constraint),
+                env=env,
+            )
+        case "build":
+            call(
+                "pip",
+                "install",
+                "--upgrade",
+                "build[virtualenv]",
+                "delvewheel",
+                *constraint_flags(dependency_constraint),
+                env=env,
+            )
+        case "build[uv]":
+            assert uv_path is not None
+            call(
+                uv_path,
+                "pip",
+                "install",
+                "--python",
+                where_python,
+                "--upgrade",
+                "build[virtualenv]",
+                "delvewheel",
+                *constraint_flags(dependency_constraint),
+                env=env,
+            )
+        case "uv":
+            assert uv_path is not None
+            call(
+                uv_path,
+                "pip",
+                "install",
+                "--python",
+                where_python,
+                "--upgrade",
+                "delvewheel",
+                *constraint_flags(dependency_constraint),
+                env=env,
+            )
+        case "pyodide-build":
+            msg = "The 'pyodide-build' build frontend is not supported on this platform"
+            raise errors.FatalError(msg)
+        case _:
+            assert_never(build_frontend)

    if python_libs_base:
        # Set up the environment for various backends to enable cross-compilation
        setup_setuptools_cross_compile(tmp, python_configuration, python_libs_base, env)
        setup_rust_cross_compile(tmp, python_configuration, python_libs_base, env)

-    if implementation_id.startswith("gp"):
-        # GraalPy fails to discover compilers, setup the relevant environment
-        # variables. Adapted from
-        # https://github.com/microsoft/vswhere/wiki/Start-Developer-Command-Prompt
-        # Remove when https://github.com/oracle/graalpython/issues/492 is fixed.
-        vcpath = call(
-            Path(os.environ["PROGRAMFILES(X86)"])
-            / "Microsoft Visual Studio"
-            / "Installer"
-            / "vswhere.exe",
-            "-products",
-            "*",
-            "-latest",
-            "-property",
-            "installationPath",
-            capture_stdout=True,
-        ).strip()
-        log.notice(f"Discovering Visual Studio for GraalPy at {vcpath}")
-        vcvars_file = tmp / "vcvars.json"
-        call(
-            f"{vcpath}\\Common7\\Tools\\vsdevcmd.bat",
-            "-no_logo",
-            "-arch=amd64",
-            "-host_arch=amd64",
-            "&&",
-            "python",
-            "-c",
-            # this command needs to be one line for Windows reasons
-            "import sys, json, pathlib, os; pathlib.Path(sys.argv[1]).write_text(json.dumps(dict(os.environ)))",
-            vcvars_file,
-            env=env,
-        )
-        with open(vcvars_file, encoding="utf-8") as f:
-            vcvars = json.load(f)
-        env.update(vcvars)
-
    return base_python, env


@@ -378,6 +423,8 @@ def build(options: Options, tmp_path: Path) -> None:
    if not python_configurations:
        return

+    uv_path = find_uv()
+
    try:
        before_all_options_identifier = python_configurations[0].identifier
        before_all_options = options.build_options(before_all_options_identifier)
@@ -394,9 +441,8 @@ def build(options: Options, tmp_path: Path) -> None:

        for config in python_configurations:
            build_options = options.build_options(config.identifier)
-            build_frontend = build_options.build_frontend or BuildFrontendConfig("build")
-
-            use_uv = build_frontend.name == "build[uv]" and can_use_uv(config)
+            build_frontend = build_options.build_frontend
+            use_uv = build_frontend.name in {"build[uv]", "uv"}
            log.build_start(config.identifier)

            identifier_tmp_dir = tmp_path / config.identifier
@@ -417,6 +463,7 @@ def build(options: Options, tmp_path: Path) -> None:
                build_options.environment,
                build_frontend.name,
            )
+            env["CIBUILDWHEEL_BUILD_IDENTIFIER"] = config.identifier
            pip_version = None if use_uv else get_pip_version(env)

            compatible_wheel = find_compatible_wheel(built_wheels, config.identifier)
@@ -441,64 +488,70 @@ def build(options: Options, tmp_path: Path) -> None:
                built_wheel_dir.mkdir()

                extra_flags = get_build_frontend_extra_flags(
-                    build_frontend, build_options.build_verbosity, build_options.config_settings
+                    build_frontend,
+                    build_options.build_verbosity,
+                    prepare_config_settings(
+                        build_options.config_settings,
+                        project=Path.cwd(),
+                        package=options.globals.package_dir,
+                    ),
                )

-                if (
-                    config.identifier.startswith("gp")
-                    and build_frontend.name == "build"
-                    and "--no-isolation" not in extra_flags
-                    and "-n" not in extra_flags
-                ):
-                    # GraalPy fails to discover its standard library when a venv is created
-                    # from a virtualenv seeded executable. See
-                    # https://github.com/oracle/graalpython/issues/491 and remove this once
-                    # fixed upstream.
-                    log.notice(
-                        "Disabling build isolation to workaround GraalPy bug. If the build fails, consider using pip or build[uv] as build frontend."
-                    )
-                    shell("graalpy -m pip install setuptools wheel", env=env)
-                    extra_flags = [*extra_flags, "-n"]
+                match build_frontend.name:
+                    case "pip":
+                        # Path.resolve() is needed. Without it pip wheel may try to fetch package from pypi.org
+                        # see https://github.com/pypa/cibuildwheel/pull/369
+                        call(
+                            "python",
+                            "-m",
+                            "pip",
+                            "wheel",
+                            options.globals.package_dir.resolve(),
+                            f"--wheel-dir={built_wheel_dir}",
+                            "--no-deps",
+                            *extra_flags,
+                            env=env,
+                        )
+                    case "build" | "build[uv]":
+                        if (
+                            use_uv
+                            and "--no-isolation" not in extra_flags
+                            and "-n" not in extra_flags
+                        ):
+                            extra_flags.append("--installer=uv")

-                build_env = env.copy()
-                if pip_version is not None:
-                    build_env["VIRTUALENV_PIP"] = pip_version
+                        call(
+                            "python",
+                            "-m",
+                            "build",
+                            build_options.package_dir,
+                            "--wheel",
+                            f"--outdir={built_wheel_dir}",
+                            *extra_flags,
+                            env=env,
+                        )
+                    case "uv":
+                        assert uv_path is not None
+                        call(
+                            uv_path,
+                            "build",
+                            f"--python={base_python}",
+                            build_options.package_dir,
+                            "--wheel",
+                            f"--out-dir={built_wheel_dir}",
+                            *extra_flags,
+                            env=env,
+                        )
+                    case "pyodide-build":
+                        msg = "The 'pyodide-build' build frontend is not supported on this platform"
+                        raise errors.FatalError(msg)
+                    case _:
+                        assert_never(build_frontend)

-                if constraints_path:
-                    combine_constraints(build_env, constraints_path, identifier_tmp_dir)
-
-                if build_frontend.name == "pip":
-                    # Path.resolve() is needed. Without it pip wheel may try to fetch package from pypi.org
-                    # see https://github.com/pypa/cibuildwheel/pull/369
-                    call(
-                        "python",
-                        "-m",
-                        "pip",
-                        "wheel",
-                        options.globals.package_dir.resolve(),
-                        f"--wheel-dir={built_wheel_dir}",
-                        "--no-deps",
-                        *extra_flags,
-                        env=build_env,
-                    )
-                elif build_frontend.name == "build" or build_frontend.name == "build[uv]":
-                    if use_uv and "--no-isolation" not in extra_flags and "-n" not in extra_flags:
-                        extra_flags.append("--installer=uv")
-
-                    call(
-                        "python",
-                        "-m",
-                        "build",
-                        build_options.package_dir,
-                        "--wheel",
-                        f"--outdir={built_wheel_dir}",
-                        *extra_flags,
-                        env=build_env,
-                    )
-                else:
-                    assert_never(build_frontend)
-
-                built_wheel = next(built_wheel_dir.glob("*.whl"))
+                try:
+                    built_wheel = next(built_wheel_dir.glob("*.whl"))
+                except StopIteration:
+                    raise errors.BuildProducedNoWheelError() from None

                # repair the wheel
                repaired_wheel_dir.mkdir()
@@ -512,6 +565,8 @@ def build(options: Options, tmp_path: Path) -> None:
                        build_options.repair_command,
                        wheel=built_wheel,
                        dest_dir=repaired_wheel_dir,
+                        package=build_options.package_dir,
+                        project=".",
                    )
                    shell(repair_command_prepared, env=env)
                else:
@@ -525,6 +580,8 @@ def build(options: Options, tmp_path: Path) -> None:
                if repaired_wheel.name in {wheel.name for wheel in built_wheels}:
                    raise errors.AlreadyBuiltWheelError(repaired_wheel.name)

+                run_audit(tmp_dir=tmp_path, build_options=build_options, wheel=repaired_wheel)
+
            test_selected = options.globals.test_selector(config.identifier)
            if test_selected and config.arch == "ARM64" != platform_module.machine():
                log.warning(
@@ -567,7 +624,12 @@ def build(options: Options, tmp_path: Path) -> None:
                    )
                    shell(before_test_prepared, env=virtualenv_env)

-                pip = ["uv", "pip"] if use_uv else ["pip"]
+                pip: Sequence[Path | str]
+                if use_uv:
+                    assert uv_path is not None
+                    pip = [uv_path, "pip"]
+                else:
+                    pip = ["pip"]

                # install the wheel
                call(
@@ -607,6 +669,7 @@ def build(options: Options, tmp_path: Path) -> None:
                shell(test_command_prepared, cwd=test_cwd, env=virtualenv_env)

            # we're all done here; move it to output (remove if already exists)
+            output_wheel = None
            if compatible_wheel is None:
                output_wheel = build_options.output_dir.joinpath(repaired_wheel.name)
                moved_wheel = move_file(repaired_wheel, output_wheel)
@@ -621,7 +684,7 @@ def build(options: Options, tmp_path: Path) -> None:
            # don't want to abort a build because of that)
            shutil.rmtree(identifier_tmp_dir, ignore_errors=True)

-            log.build_end()
+            log.build_end(output_wheel)
    except subprocess.CalledProcessError as error:
        msg = f"Command {error.cmd} failed with code {error.returncode}. {error.stdout or ''}"
        raise errors.FatalError(msg) from error
@@ -1,11 +1,18 @@
+from __future__ import annotations
+
+__lazy_modules__ = {"configparser", "contextlib", "dependency_groups"}
+
 import ast
 import configparser
 import contextlib
-from pathlib import Path
-from typing import Any

 import dependency_groups

+TYPE_CHECKING = False
+if TYPE_CHECKING:
+    from pathlib import Path
+    from typing import Any
+

 def get_parent(node: ast.AST | None, depth: int = 1) -> ast.AST | None:
    for _ in range(depth):
@@ -14,32 +21,16 @@ def get_parent(node: ast.AST | None, depth: int = 1) -> ast.AST | None:


 def is_main(parent: ast.AST | None) -> bool:
-    if parent is None:
-        return False
-
-    # This would be much nicer with 3.10's pattern matching!
-    if not isinstance(parent, ast.If):
-        return False
-    if not isinstance(parent.test, ast.Compare):
-        return False
-
-    try:
-        (op,) = parent.test.ops
-        (comp,) = parent.test.comparators
-    except ValueError:
-        return False
-
-    if not isinstance(op, ast.Eq):
-        return False
-
-    values = {comp, parent.test.left}
-
-    mains = {x for x in values if isinstance(x, ast.Constant) and x.value == "__main__"}
-    if len(mains) != 1:
-        return False
-    consts = {x for x in values if isinstance(x, ast.Name) and x.id == "__name__"}
-
-    return len(consts) == 1
+    match parent:
+        case ast.If(test=ast.Compare(left=left, ops=[ast.Eq()], comparators=[comp])):
+            values = {left, comp}
+            mains = {x for x in values if isinstance(x, ast.Constant) and x.value == "__main__"}
+            if len(mains) != 1:
+                return False
+            consts = {x for x in values if isinstance(x, ast.Name) and x.id == "__name__"}
+            return len(consts) == 1
+        case _:
+            return False


 class Analyzer(ast.NodeVisitor):
@@ -65,12 +56,10 @@ class Analyzer(ast.NodeVisitor):
            parent is not None and get_parent(parent) is None and is_main(get_parent(node, 3))
        )

-        if (
-            node.arg == "python_requires"
-            and isinstance(node.value, ast.Constant)
-            and (unnested or name_main_unnested)
-        ):
-            self.requires_python = node.value.value
+        match node:
+            case ast.keyword(arg="python_requires", value=ast.Constant(value=str() as version)):
+                if unnested or name_main_unnested:
+                    self.requires_python = version


 def setup_py_python_requires(content: str) -> str | None:
@@ -0,0 +1 @@
+import _cross_venv; _cross_venv.initialize()
@@ -0,0 +1,90 @@
+# This module is copied into the site-packages directory of an Android build environment, and
+# activated via a .pth file when we want the environment to simulate Android.
+
+import os
+import platform
+import re
+import sys
+import sysconfig
+from pathlib import Path
+from typing import Any
+
+
+def initialize() -> None:
+    if not (host_triplet := os.environ.get("CIBW_HOST_TRIPLET")):
+        return
+
+    # Pre-import any modules which would fail to import after the monkey-patching.
+    import ctypes  # noqa: F401, PLC0415 - uses get_config_var("LDLIBRARY")
+
+    # os ######################################################################
+    def cross_os_uname() -> os.uname_result:
+        return os.uname_result(
+            (
+                "Linux",
+                "localhost",
+                # The Linux kernel version and release are unlikely to be significant, but return
+                # realistic values anyway (from an API level 24 emulator).
+                "3.18.91+",
+                "#1 SMP PREEMPT Tue Jan 9 20:35:43 UTC 2018",
+                host_triplet.split("-")[0],
+            )
+        )
+
+    os.name = "posix"
+    os.uname = cross_os_uname
+
+    # platform ################################################################
+    #
+    # We can't determine the user-visible Android version number from the API level, so return a
+    # string which will work fine for display, but will fail to parse as a version number.
+    def cross_android_ver(*args: Any, **kwargs: Any) -> platform.AndroidVer:
+        return platform.AndroidVer(
+            release=f"API level {cross_getandroidapilevel()}",
+            api_level=cross_getandroidapilevel(),
+            manufacturer="Google",
+            model="sdk_gphone64",
+            device="emu64",
+            is_emulator=True,
+        )
+
+    # platform.uname, platform.system etc. are all implemented in terms of platform.android_ver.
+    platform.android_ver = cross_android_ver
+
+    # sys #####################################################################
+    def cross_getandroidapilevel() -> int:
+        api_level = sysconfig.get_config_var("ANDROID_API_LEVEL")
+        assert isinstance(api_level, int)
+        return api_level
+
+    # Some packages may recognize sys.cross_compiling from the crossenv tool.
+    sys.cross_compiling = True  # type: ignore[attr-defined]
+    sys.getandroidapilevel = cross_getandroidapilevel  # type: ignore[attr-defined]
+    sys.implementation._multiarch = host_triplet  # type: ignore[attr-defined]
+    sys.platform = "android"
+
+    # Determine the abiflags from the sysconfigdata filename.
+    sysconfigdata_path = next(Path(__file__).parent.glob("_sysconfigdata_*.py"))
+    abiflags_match = re.match(r"_sysconfigdata_(.*?)_", sysconfigdata_path.name)
+    assert abiflags_match is not None
+    sys.abiflags = abiflags_match[1]
+
+    # sysconfig ###############################################################
+    #
+    # Load the sysconfigdata file, generating its name from sys.abiflags,
+    # sys.platform, and sys.implementation._multiarch.
+    sysconfig._init_config_vars()  # type: ignore[attr-defined]
+
+    # We don't change the actual sys.base_prefix and base_exec_prefix, because that
+    # could have unpredictable effects. Instead, we change the sysconfig variables
+    # used by sysconfig.get_paths().
+    vars = sysconfig.get_config_vars()
+    try:
+        host_prefix = vars["host_prefix"]  # This variable was added in Python 3.14.
+    except KeyError:
+        host_prefix = vars["exec_prefix"]
+    vars["installed_base"] = vars["installed_platbase"] = host_prefix
+
+    # sysconfig.get_platform, which determines the wheel tag, is implemented in terms of
+    # sys.platform, sysconfig.get_config_var("ANDROID_API_LEVEL") (see localized_vars in
+    # android.py), and os.uname.
@@ -0,0 +1,121 @@
+# This file intentionally has no hashbang line in the source: cibuildwheel will add it
+# above this comment when the file is deployed.
+
+import os
+import re
+import shutil
+import sys
+from pathlib import Path
+from tempfile import gettempdir
+
+from filelock import FileLock
+
+from cibuildwheel.util.file import CIBW_CACHE_PATH, download
+
+# In the future we might pick a different Flang release depending on the NDK version,
+# but so far all Python versions use the same NDK version, so there's no need.
+RELEASE_URL = "https://github.com/termux/ndk-toolchain-clang-with-flang/releases/download"
+RELEASE_VERSION = "r27c"
+ARCHS = ["aarch64", "x86_64"]
+
+# The compiler is built for Linux x86_64, so we use Docker on macOS.
+DOCKER_IMAGE = "debian:trixie-slim"
+
+
+def main() -> None:
+    cache_dir = CIBW_CACHE_PATH / f"flang-android-{RELEASE_VERSION}"
+    with FileLock(f"{cache_dir}.lock"):
+        if not cache_dir.exists():
+            download_flang(cache_dir)
+
+    run_flang(cache_dir)
+
+
+def download_flang(cache_dir: Path) -> None:
+    tmp_dir = Path(f"{cache_dir}.tmp")
+    if tmp_dir.exists():
+        shutil.rmtree(tmp_dir)
+    tmp_dir.mkdir(parents=True)
+
+    for archive_name in [f"package-flang-{arch}.tar.bz2" for arch in ARCHS] + [
+        "package-flang-host.tar.bz2",
+        "package-install.tar.bz2",
+    ]:
+        archive_path = tmp_dir / archive_name
+        download(f"{RELEASE_URL}/{RELEASE_VERSION}/{archive_name}", archive_path)
+        shutil.unpack_archive(archive_path, tmp_dir)
+        archive_path.unlink()
+
+    # Merge the extracted trees together, along with the necessary parts of the NDK. Based on
+    # https://github.com/kivy/python-for-android/blob/develop/pythonforandroid/recipes/fortran/__init__.py.
+    flang_toolchain = tmp_dir / "toolchain"
+    (tmp_dir / "out/install/linux-x86/clang-dev").rename(flang_toolchain)
+
+    ndk_toolchain = Path(os.environ["CC"]).parents[1]
+    if (clang_ver_flang := clang_ver(flang_toolchain)) != (
+        clang_ver_ndk := clang_ver(ndk_toolchain)
+    ):
+        msg = f"Flang uses Clang {clang_ver_flang}, but NDK uses Clang {clang_ver_ndk}"
+        raise ValueError(msg)
+
+    clang_lib_path = f"lib/clang/{clang_ver_ndk}/lib"
+    shutil.rmtree(flang_toolchain / clang_lib_path)
+
+    for src, dst in [
+        (f"{tmp_dir}/build-{arch}-install", f"sysroot/usr/lib/{arch}-linux-android")
+        for arch in ARCHS
+    ] + [
+        (f"{tmp_dir}/build-host-install", ""),
+        (f"{ndk_toolchain}/{clang_lib_path}", clang_lib_path),
+        (f"{ndk_toolchain}/sysroot", "sysroot"),
+    ]:
+        shutil.copytree(src, flang_toolchain / dst, symlinks=True, dirs_exist_ok=True)
+
+    flang_toolchain.rename(cache_dir)
+    shutil.rmtree(tmp_dir)
+
+
+def clang_ver(toolchain: Path) -> str:
+    versions = [p.name for p in (toolchain / "lib/clang").iterdir()]
+    assert len(versions) == 1
+    return versions[0]
+
+
+def run_flang(cache_dir: Path) -> None:
+    match = re.fullmatch(r".+/(.+)-clang", os.environ["CC"])
+    assert match is not None
+    target = match[1]
+
+    # In a future Flang version the executable name will change to "flang"
+    # (https://blog.llvm.org/posts/2025-03-11-flang-new/).
+    flang_args = [f"{cache_dir}/bin/flang-new", f"--target={target}", *sys.argv[1:]]
+
+    if sys.platform == "linux":
+        args = flang_args
+    elif sys.platform == "darwin":
+        args = ["docker", "run", "--rm", "--platform", "linux/amd64"]
+        # Docker on macOS only allows certain directories to be mounted as volumes
+        # by default, but they include all the locations we're likely to need.
+        for path in [
+            # Location of CIBW_CACHE_PATH (containing the Fortran compiler), and
+            # probably the project directory.
+            Path.home(),
+            # Temporary directories created by build backends and cibuildwheel itself.
+            # This is controlled by the TMPDIR environment variable, which is set to
+            # an unpredictable subdirectory of /var/folders. /var is itself a symlink
+            # to /private/var.
+            Path(gettempdir()),
+            Path(gettempdir()).resolve(),
+        ]:
+            args += ["-v", f"{path}:{path}"]
+        args += ["--workdir", str(Path.cwd())]
+        args += ["--entrypoint", flang_args[0], DOCKER_IMAGE, *flang_args[1:]]
+    else:
+        msg = f"unknown platform: {sys.platform}"
+        raise ValueError(msg)
+
+    os.execvp(args[0], args)
+
+
+if __name__ == "__main__":
+    main()
@@ -0,0 +1,57 @@
+#!/usr/bin/env python3
+
+import os
+import shutil
+import subprocess
+import sys
+from pathlib import Path
+
+
+def main() -> None:
+    # CIBW_HOST_TRIPLET is set in the android_env to the Android target triplet.
+    target = os.environ.get("CIBW_HOST_TRIPLET")
+
+    cmd_name = Path(sys.argv[0]).name
+
+    # Find the real command in PATH, excluding the current script's directory
+    path_env = os.environ.get("PATH", "")
+    script_dir = Path(__file__).resolve().parent
+
+    paths = path_env.split(os.pathsep)
+    # Filter out the script directory to avoid recursion
+    filtered_paths = [p for p in paths if Path(p).resolve() != script_dir]
+    filtered_path_env = os.pathsep.join(filtered_paths)
+
+    real_cmd = shutil.which(cmd_name, path=filtered_path_env)
+
+    if not real_cmd:
+        sys.stderr.write(f"cibuildwheel: Error: Could not find system {cmd_name}\n")
+        sys.exit(1)
+
+    # If we have a target (i.e. we are in the android_env), try to install it.
+    if target:
+        # Check if rustup is available to install the target
+        rustup_path = shutil.which("rustup", path=filtered_path_env)
+
+        if rustup_path:
+            try:
+                # We call rustup to ensure the target is installed.
+                subprocess.run(
+                    [rustup_path, "target", "add", target],
+                    check=True,
+                    stdout=subprocess.DEVNULL,
+                    stderr=subprocess.PIPE,
+                    text=True,
+                )
+            except subprocess.CalledProcessError as e:
+                sys.stderr.write(
+                    f"cibuildwheel: Error: Failed to install Rust target {target}: {e.stderr}\n"
+                )
+                sys.exit(1)
+
+    # Execute the real command
+    os.execv(real_cmd, [real_cmd, *sys.argv[1:]])
+
+
+if __name__ == "__main__":
+    main()
@@ -1,232 +1,244 @@
 [linux]
 python_configurations = [
-  { identifier = "cp38-manylinux_x86_64", version = "3.8", path_str = "/opt/python/cp38-cp38" },
  { identifier = "cp39-manylinux_x86_64", version = "3.9", path_str = "/opt/python/cp39-cp39" },
  { identifier = "cp310-manylinux_x86_64", version = "3.10", path_str = "/opt/python/cp310-cp310" },
  { identifier = "cp311-manylinux_x86_64", version = "3.11", path_str = "/opt/python/cp311-cp311" },
  { identifier = "cp312-manylinux_x86_64", version = "3.12", path_str = "/opt/python/cp312-cp312" },
  { identifier = "cp313-manylinux_x86_64", version = "3.13", path_str = "/opt/python/cp313-cp313" },
-  { identifier = "cp313t-manylinux_x86_64", version = "3.13", path_str = "/opt/python/cp313-cp313t" },
  { identifier = "cp314-manylinux_x86_64", version = "3.14", path_str = "/opt/python/cp314-cp314" },
  { identifier = "cp314t-manylinux_x86_64", version = "3.14", path_str = "/opt/python/cp314-cp314t" },
-  { identifier = "cp38-manylinux_i686", version = "3.8", path_str = "/opt/python/cp38-cp38" },
+  { identifier = "cp315-manylinux_x86_64", version = "3.15", path_str = "/opt/python/cp315-cp315" },
+  { identifier = "cp315t-manylinux_x86_64", version = "3.15", path_str = "/opt/python/cp315-cp315t" },
  { identifier = "cp39-manylinux_i686", version = "3.9", path_str = "/opt/python/cp39-cp39" },
  { identifier = "cp310-manylinux_i686", version = "3.10", path_str = "/opt/python/cp310-cp310" },
  { identifier = "cp311-manylinux_i686", version = "3.11", path_str = "/opt/python/cp311-cp311" },
  { identifier = "cp312-manylinux_i686", version = "3.12", path_str = "/opt/python/cp312-cp312" },
  { identifier = "cp313-manylinux_i686", version = "3.13", path_str = "/opt/python/cp313-cp313" },
-  { identifier = "cp313t-manylinux_i686", version = "3.13", path_str = "/opt/python/cp313-cp313t" },
  { identifier = "cp314-manylinux_i686", version = "3.14", path_str = "/opt/python/cp314-cp314" },
  { identifier = "cp314t-manylinux_i686", version = "3.14", path_str = "/opt/python/cp314-cp314t" },
-  { identifier = "pp38-manylinux_x86_64", version = "3.8", path_str = "/opt/python/pp38-pypy38_pp73" },
+  { identifier = "cp315-manylinux_i686", version = "3.15", path_str = "/opt/python/cp315-cp315" },
+  { identifier = "cp315t-manylinux_i686", version = "3.15", path_str = "/opt/python/cp315-cp315t" },
  { identifier = "pp39-manylinux_x86_64", version = "3.9", path_str = "/opt/python/pp39-pypy39_pp73" },
  { identifier = "pp310-manylinux_x86_64", version = "3.10", path_str = "/opt/python/pp310-pypy310_pp73" },
  { identifier = "pp311-manylinux_x86_64", version = "3.11", path_str = "/opt/python/pp311-pypy311_pp73" },
-  { identifier = "gp311_242-manylinux_x86_64", version = "3.11", path_str = "/opt/python/graalpy311-graalpy242_311_native" },
-  { identifier = "cp38-manylinux_aarch64", version = "3.8", path_str = "/opt/python/cp38-cp38" },
+  { identifier = "gp312_250-manylinux_x86_64", version = "3.12", path_str = "/opt/python/graalpy312-graalpy250_312_native" },
  { identifier = "cp39-manylinux_aarch64", version = "3.9", path_str = "/opt/python/cp39-cp39" },
  { identifier = "cp310-manylinux_aarch64", version = "3.10", path_str = "/opt/python/cp310-cp310" },
  { identifier = "cp311-manylinux_aarch64", version = "3.11", path_str = "/opt/python/cp311-cp311" },
  { identifier = "cp312-manylinux_aarch64", version = "3.12", path_str = "/opt/python/cp312-cp312" },
  { identifier = "cp313-manylinux_aarch64", version = "3.13", path_str = "/opt/python/cp313-cp313" },
-  { identifier = "cp313t-manylinux_aarch64", version = "3.13", path_str = "/opt/python/cp313-cp313t" },
  { identifier = "cp314-manylinux_aarch64", version = "3.14", path_str = "/opt/python/cp314-cp314" },
  { identifier = "cp314t-manylinux_aarch64", version = "3.14", path_str = "/opt/python/cp314-cp314t" },
-  { identifier = "cp38-manylinux_ppc64le", version = "3.8", path_str = "/opt/python/cp38-cp38" },
+  { identifier = "cp315-manylinux_aarch64", version = "3.15", path_str = "/opt/python/cp315-cp315" },
+  { identifier = "cp315t-manylinux_aarch64", version = "3.15", path_str = "/opt/python/cp315-cp315t" },
  { identifier = "cp39-manylinux_ppc64le", version = "3.9", path_str = "/opt/python/cp39-cp39" },
  { identifier = "cp310-manylinux_ppc64le", version = "3.10", path_str = "/opt/python/cp310-cp310" },
  { identifier = "cp311-manylinux_ppc64le", version = "3.11", path_str = "/opt/python/cp311-cp311" },
  { identifier = "cp312-manylinux_ppc64le", version = "3.12", path_str = "/opt/python/cp312-cp312" },
  { identifier = "cp313-manylinux_ppc64le", version = "3.13", path_str = "/opt/python/cp313-cp313" },
-  { identifier = "cp313t-manylinux_ppc64le", version = "3.13", path_str = "/opt/python/cp313-cp313t" },
  { identifier = "cp314-manylinux_ppc64le", version = "3.14", path_str = "/opt/python/cp314-cp314" },
  { identifier = "cp314t-manylinux_ppc64le", version = "3.14", path_str = "/opt/python/cp314-cp314t" },
-  { identifier = "cp38-manylinux_s390x", version = "3.8", path_str = "/opt/python/cp38-cp38" },
+  { identifier = "cp315-manylinux_ppc64le", version = "3.15", path_str = "/opt/python/cp315-cp315" },
+  { identifier = "cp315t-manylinux_ppc64le", version = "3.15", path_str = "/opt/python/cp315-cp315t" },
  { identifier = "cp39-manylinux_s390x", version = "3.9", path_str = "/opt/python/cp39-cp39" },
  { identifier = "cp310-manylinux_s390x", version = "3.10", path_str = "/opt/python/cp310-cp310" },
  { identifier = "cp311-manylinux_s390x", version = "3.11", path_str = "/opt/python/cp311-cp311" },
  { identifier = "cp312-manylinux_s390x", version = "3.12", path_str = "/opt/python/cp312-cp312" },
  { identifier = "cp313-manylinux_s390x", version = "3.13", path_str = "/opt/python/cp313-cp313" },
-  { identifier = "cp313t-manylinux_s390x", version = "3.13", path_str = "/opt/python/cp313-cp313t" },
  { identifier = "cp314-manylinux_s390x", version = "3.14", path_str = "/opt/python/cp314-cp314" },
  { identifier = "cp314t-manylinux_s390x", version = "3.14", path_str = "/opt/python/cp314-cp314t" },
-  { identifier = "cp38-manylinux_armv7l", version = "3.8", path_str = "/opt/python/cp38-cp38" },
+  { identifier = "cp315-manylinux_s390x", version = "3.15", path_str = "/opt/python/cp315-cp315" },
+  { identifier = "cp315t-manylinux_s390x", version = "3.15", path_str = "/opt/python/cp315-cp315t" },
  { identifier = "cp39-manylinux_armv7l", version = "3.9", path_str = "/opt/python/cp39-cp39" },
  { identifier = "cp310-manylinux_armv7l", version = "3.10", path_str = "/opt/python/cp310-cp310" },
  { identifier = "cp311-manylinux_armv7l", version = "3.11", path_str = "/opt/python/cp311-cp311" },
  { identifier = "cp312-manylinux_armv7l", version = "3.12", path_str = "/opt/python/cp312-cp312" },
  { identifier = "cp313-manylinux_armv7l", version = "3.13", path_str = "/opt/python/cp313-cp313" },
-  { identifier = "cp313t-manylinux_armv7l", version = "3.13", path_str = "/opt/python/cp313-cp313t" },
  { identifier = "cp314-manylinux_armv7l", version = "3.14", path_str = "/opt/python/cp314-cp314" },
  { identifier = "cp314t-manylinux_armv7l", version = "3.14", path_str = "/opt/python/cp314-cp314t" },
-  { identifier = "cp38-manylinux_riscv64", version = "3.8", path_str = "/opt/python/cp38-cp38" },
+  { identifier = "cp315-manylinux_armv7l", version = "3.15", path_str = "/opt/python/cp315-cp315" },
+  { identifier = "cp315t-manylinux_armv7l", version = "3.15", path_str = "/opt/python/cp315-cp315t" },
  { identifier = "cp39-manylinux_riscv64", version = "3.9", path_str = "/opt/python/cp39-cp39" },
  { identifier = "cp310-manylinux_riscv64", version = "3.10", path_str = "/opt/python/cp310-cp310" },
  { identifier = "cp311-manylinux_riscv64", version = "3.11", path_str = "/opt/python/cp311-cp311" },
  { identifier = "cp312-manylinux_riscv64", version = "3.12", path_str = "/opt/python/cp312-cp312" },
  { identifier = "cp313-manylinux_riscv64", version = "3.13", path_str = "/opt/python/cp313-cp313" },
-  { identifier = "cp313t-manylinux_riscv64", version = "3.13", path_str = "/opt/python/cp313-cp313t" },
  { identifier = "cp314-manylinux_riscv64", version = "3.14", path_str = "/opt/python/cp314-cp314" },
  { identifier = "cp314t-manylinux_riscv64", version = "3.14", path_str = "/opt/python/cp314-cp314t" },
-  { identifier = "pp38-manylinux_aarch64", version = "3.8", path_str = "/opt/python/pp38-pypy38_pp73" },
+  { identifier = "cp315-manylinux_riscv64", version = "3.15", path_str = "/opt/python/cp315-cp315" },
+  { identifier = "cp315t-manylinux_riscv64", version = "3.15", path_str = "/opt/python/cp315-cp315t" },
  { identifier = "pp39-manylinux_aarch64", version = "3.9", path_str = "/opt/python/pp39-pypy39_pp73" },
  { identifier = "pp310-manylinux_aarch64", version = "3.10", path_str = "/opt/python/pp310-pypy310_pp73" },
  { identifier = "pp311-manylinux_aarch64", version = "3.11", path_str = "/opt/python/pp311-pypy311_pp73" },
-  { identifier = "gp311_242-manylinux_aarch64", version = "3.11", path_str = "/opt/python/graalpy311-graalpy242_311_native" },
-  { identifier = "pp38-manylinux_i686", version = "3.8", path_str = "/opt/python/pp38-pypy38_pp73" },
+  { identifier = "gp312_250-manylinux_aarch64", version = "3.12", path_str = "/opt/python/graalpy312-graalpy250_312_native" },
  { identifier = "pp39-manylinux_i686", version = "3.9", path_str = "/opt/python/pp39-pypy39_pp73" },
  { identifier = "pp310-manylinux_i686", version = "3.10", path_str = "/opt/python/pp310-pypy310_pp73" },
  { identifier = "pp311-manylinux_i686", version = "3.11", path_str = "/opt/python/pp311-pypy311_pp73" },
-  { identifier = "cp38-musllinux_x86_64", version = "3.8", path_str = "/opt/python/cp38-cp38" },
  { identifier = "cp39-musllinux_x86_64", version = "3.9", path_str = "/opt/python/cp39-cp39" },
  { identifier = "cp310-musllinux_x86_64", version = "3.10", path_str = "/opt/python/cp310-cp310" },
  { identifier = "cp311-musllinux_x86_64", version = "3.11", path_str = "/opt/python/cp311-cp311" },
  { identifier = "cp312-musllinux_x86_64", version = "3.12", path_str = "/opt/python/cp312-cp312" },
  { identifier = "cp313-musllinux_x86_64", version = "3.13", path_str = "/opt/python/cp313-cp313" },
-  { identifier = "cp313t-musllinux_x86_64", version = "3.13", path_str = "/opt/python/cp313-cp313t" },
  { identifier = "cp314-musllinux_x86_64", version = "3.14", path_str = "/opt/python/cp314-cp314" },
  { identifier = "cp314t-musllinux_x86_64", version = "3.14", path_str = "/opt/python/cp314-cp314t" },
-  { identifier = "cp38-musllinux_i686", version = "3.8", path_str = "/opt/python/cp38-cp38" },
+  { identifier = "cp315-musllinux_x86_64", version = "3.15", path_str = "/opt/python/cp315-cp315" },
+  { identifier = "cp315t-musllinux_x86_64", version = "3.15", path_str = "/opt/python/cp315-cp315t" },
  { identifier = "cp39-musllinux_i686", version = "3.9", path_str = "/opt/python/cp39-cp39" },
  { identifier = "cp310-musllinux_i686", version = "3.10", path_str = "/opt/python/cp310-cp310" },
  { identifier = "cp311-musllinux_i686", version = "3.11", path_str = "/opt/python/cp311-cp311" },
  { identifier = "cp312-musllinux_i686", version = "3.12", path_str = "/opt/python/cp312-cp312" },
  { identifier = "cp313-musllinux_i686", version = "3.13", path_str = "/opt/python/cp313-cp313" },
-  { identifier = "cp313t-musllinux_i686", version = "3.13", path_str = "/opt/python/cp313-cp313t" },
  { identifier = "cp314-musllinux_i686", version = "3.14", path_str = "/opt/python/cp314-cp314" },
  { identifier = "cp314t-musllinux_i686", version = "3.14", path_str = "/opt/python/cp314-cp314t" },
-  { identifier = "cp38-musllinux_aarch64", version = "3.8", path_str = "/opt/python/cp38-cp38" },
+  { identifier = "cp315-musllinux_i686", version = "3.15", path_str = "/opt/python/cp315-cp315" },
+  { identifier = "cp315t-musllinux_i686", version = "3.15", path_str = "/opt/python/cp315-cp315t" },
  { identifier = "cp39-musllinux_aarch64", version = "3.9", path_str = "/opt/python/cp39-cp39" },
  { identifier = "cp310-musllinux_aarch64", version = "3.10", path_str = "/opt/python/cp310-cp310" },
  { identifier = "cp311-musllinux_aarch64", version = "3.11", path_str = "/opt/python/cp311-cp311" },
  { identifier = "cp312-musllinux_aarch64", version = "3.12", path_str = "/opt/python/cp312-cp312" },
  { identifier = "cp313-musllinux_aarch64", version = "3.13", path_str = "/opt/python/cp313-cp313" },
-  { identifier = "cp313t-musllinux_aarch64", version = "3.13", path_str = "/opt/python/cp313-cp313t" },
  { identifier = "cp314-musllinux_aarch64", version = "3.14", path_str = "/opt/python/cp314-cp314" },
  { identifier = "cp314t-musllinux_aarch64", version = "3.14", path_str = "/opt/python/cp314-cp314t" },
-  { identifier = "cp38-musllinux_ppc64le", version = "3.8", path_str = "/opt/python/cp38-cp38" },
+  { identifier = "cp315-musllinux_aarch64", version = "3.15", path_str = "/opt/python/cp315-cp315" },
+  { identifier = "cp315t-musllinux_aarch64", version = "3.15", path_str = "/opt/python/cp315-cp315t" },
  { identifier = "cp39-musllinux_ppc64le", version = "3.9", path_str = "/opt/python/cp39-cp39" },
  { identifier = "cp310-musllinux_ppc64le", version = "3.10", path_str = "/opt/python/cp310-cp310" },
  { identifier = "cp311-musllinux_ppc64le", version = "3.11", path_str = "/opt/python/cp311-cp311" },
  { identifier = "cp312-musllinux_ppc64le", version = "3.12", path_str = "/opt/python/cp312-cp312" },
  { identifier = "cp313-musllinux_ppc64le", version = "3.13", path_str = "/opt/python/cp313-cp313" },
-  { identifier = "cp313t-musllinux_ppc64le", version = "3.13", path_str = "/opt/python/cp313-cp313t" },
  { identifier = "cp314-musllinux_ppc64le", version = "3.14", path_str = "/opt/python/cp314-cp314" },
  { identifier = "cp314t-musllinux_ppc64le", version = "3.14", path_str = "/opt/python/cp314-cp314t" },
-  { identifier = "cp38-musllinux_s390x", version = "3.8", path_str = "/opt/python/cp38-cp38" },
+  { identifier = "cp315-musllinux_ppc64le", version = "3.15", path_str = "/opt/python/cp315-cp315" },
+  { identifier = "cp315t-musllinux_ppc64le", version = "3.15", path_str = "/opt/python/cp315-cp315t" },
  { identifier = "cp39-musllinux_s390x", version = "3.9", path_str = "/opt/python/cp39-cp39" },
  { identifier = "cp310-musllinux_s390x", version = "3.10", path_str = "/opt/python/cp310-cp310" },
  { identifier = "cp311-musllinux_s390x", version = "3.11", path_str = "/opt/python/cp311-cp311" },
  { identifier = "cp312-musllinux_s390x", version = "3.12", path_str = "/opt/python/cp312-cp312" },
  { identifier = "cp313-musllinux_s390x", version = "3.13", path_str = "/opt/python/cp313-cp313" },
-  { identifier = "cp313t-musllinux_s390x", version = "3.13", path_str = "/opt/python/cp313-cp313t" },
  { identifier = "cp314-musllinux_s390x", version = "3.14", path_str = "/opt/python/cp314-cp314" },
  { identifier = "cp314t-musllinux_s390x", version = "3.14", path_str = "/opt/python/cp314-cp314t" },
-  { identifier = "cp38-musllinux_armv7l", version = "3.8", path_str = "/opt/python/cp38-cp38" },
+  { identifier = "cp315-musllinux_s390x", version = "3.15", path_str = "/opt/python/cp315-cp315" },
+  { identifier = "cp315t-musllinux_s390x", version = "3.15", path_str = "/opt/python/cp315-cp315t" },
  { identifier = "cp39-musllinux_armv7l", version = "3.9", path_str = "/opt/python/cp39-cp39" },
  { identifier = "cp310-musllinux_armv7l", version = "3.10", path_str = "/opt/python/cp310-cp310" },
  { identifier = "cp311-musllinux_armv7l", version = "3.11", path_str = "/opt/python/cp311-cp311" },
  { identifier = "cp312-musllinux_armv7l", version = "3.12", path_str = "/opt/python/cp312-cp312" },
  { identifier = "cp313-musllinux_armv7l", version = "3.13", path_str = "/opt/python/cp313-cp313" },
-  { identifier = "cp313t-musllinux_armv7l", version = "3.13", path_str = "/opt/python/cp313-cp313t" },
  { identifier = "cp314-musllinux_armv7l", version = "3.14", path_str = "/opt/python/cp314-cp314" },
  { identifier = "cp314t-musllinux_armv7l", version = "3.14", path_str = "/opt/python/cp314-cp314t" },
-  { identifier = "cp38-musllinux_riscv64", version = "3.8", path_str = "/opt/python/cp38-cp38" },
-  { identifier = "cp39-musllinux_ricv64", version = "3.9", path_str = "/opt/python/cp39-cp39" },
+  { identifier = "cp315-musllinux_armv7l", version = "3.15", path_str = "/opt/python/cp315-cp315" },
+  { identifier = "cp315t-musllinux_armv7l", version = "3.15", path_str = "/opt/python/cp315-cp315t" },
+  { identifier = "cp39-musllinux_riscv64", version = "3.9", path_str = "/opt/python/cp39-cp39" },
  { identifier = "cp310-musllinux_riscv64", version = "3.10", path_str = "/opt/python/cp310-cp310" },
  { identifier = "cp311-musllinux_riscv64", version = "3.11", path_str = "/opt/python/cp311-cp311" },
  { identifier = "cp312-musllinux_riscv64", version = "3.12", path_str = "/opt/python/cp312-cp312" },
  { identifier = "cp313-musllinux_riscv64", version = "3.13", path_str = "/opt/python/cp313-cp313" },
-  { identifier = "cp313t-musllinux_riscv64", version = "3.13", path_str = "/opt/python/cp313-cp313t" },
  { identifier = "cp314-musllinux_riscv64", version = "3.14", path_str = "/opt/python/cp314-cp314" },
  { identifier = "cp314t-musllinux_riscv64", version = "3.14", path_str = "/opt/python/cp314-cp314t" },
+  { identifier = "cp315-musllinux_riscv64", version = "3.15", path_str = "/opt/python/cp315-cp315" },
+  { identifier = "cp315t-musllinux_riscv64", version = "3.15", path_str = "/opt/python/cp315-cp315t" },
 ]

 [macos]
 python_configurations = [
-  { identifier = "cp38-macosx_x86_64", version = "3.8", url = "https://www.python.org/ftp/python/3.8.10/python-3.8.10-macosx10.9.pkg" },
-  { identifier = "cp38-macosx_arm64", version = "3.8", url = "https://www.python.org/ftp/python/3.8.10/python-3.8.10-macosx10.9.pkg" },
-  { identifier = "cp38-macosx_universal2", version = "3.8", url = "https://www.python.org/ftp/python/3.8.10/python-3.8.10-macosx10.9.pkg" },
-  { identifier = "cp39-macosx_x86_64", version = "3.9", url = "https://www.python.org/ftp/python/3.9.13/python-3.9.13-macos11.pkg" },
-  { identifier = "cp39-macosx_arm64", version = "3.9", url = "https://www.python.org/ftp/python/3.9.13/python-3.9.13-macos11.pkg" },
-  { identifier = "cp39-macosx_universal2", version = "3.9", url = "https://www.python.org/ftp/python/3.9.13/python-3.9.13-macos11.pkg" },
-  { identifier = "cp310-macosx_x86_64", version = "3.10", url = "https://www.python.org/ftp/python/3.10.11/python-3.10.11-macos11.pkg" },
-  { identifier = "cp310-macosx_arm64", version = "3.10", url = "https://www.python.org/ftp/python/3.10.11/python-3.10.11-macos11.pkg" },
-  { identifier = "cp310-macosx_universal2", version = "3.10", url = "https://www.python.org/ftp/python/3.10.11/python-3.10.11-macos11.pkg" },
-  { identifier = "cp311-macosx_x86_64", version = "3.11", url = "https://www.python.org/ftp/python/3.11.9/python-3.11.9-macos11.pkg" },
-  { identifier = "cp311-macosx_arm64", version = "3.11", url = "https://www.python.org/ftp/python/3.11.9/python-3.11.9-macos11.pkg" },
-  { identifier = "cp311-macosx_universal2", version = "3.11", url = "https://www.python.org/ftp/python/3.11.9/python-3.11.9-macos11.pkg" },
-  { identifier = "cp312-macosx_x86_64", version = "3.12", url = "https://www.python.org/ftp/python/3.12.10/python-3.12.10-macos11.pkg" },
-  { identifier = "cp312-macosx_arm64", version = "3.12", url = "https://www.python.org/ftp/python/3.12.10/python-3.12.10-macos11.pkg" },
-  { identifier = "cp312-macosx_universal2", version = "3.12", url = "https://www.python.org/ftp/python/3.12.10/python-3.12.10-macos11.pkg" },
-  { identifier = "cp313-macosx_x86_64", version = "3.13", url = "https://www.python.org/ftp/python/3.13.4/python-3.13.4-macos11.pkg" },
-  { identifier = "cp313-macosx_arm64", version = "3.13", url = "https://www.python.org/ftp/python/3.13.4/python-3.13.4-macos11.pkg" },
-  { identifier = "cp313-macosx_universal2", version = "3.13", url = "https://www.python.org/ftp/python/3.13.4/python-3.13.4-macos11.pkg" },
-  { identifier = "cp313t-macosx_x86_64", version = "3.13", url = "https://www.python.org/ftp/python/3.13.4/python-3.13.4-macos11.pkg" },
-  { identifier = "cp313t-macosx_arm64", version = "3.13", url = "https://www.python.org/ftp/python/3.13.4/python-3.13.4-macos11.pkg" },
-  { identifier = "cp313t-macosx_universal2", version = "3.13", url = "https://www.python.org/ftp/python/3.13.4/python-3.13.4-macos11.pkg" },
-  { identifier = "cp314-macosx_x86_64", version = "3.14", url = "https://www.python.org/ftp/python/3.14.0/python-3.14.0b2-macos11.pkg" },
-  { identifier = "cp314-macosx_arm64", version = "3.14", url = "https://www.python.org/ftp/python/3.14.0/python-3.14.0b2-macos11.pkg" },
-  { identifier = "cp314-macosx_universal2", version = "3.14", url = "https://www.python.org/ftp/python/3.14.0/python-3.14.0b2-macos11.pkg" },
-  { identifier = "cp314t-macosx_x86_64", version = "3.14", url = "https://www.python.org/ftp/python/3.14.0/python-3.14.0b2-macos11.pkg" },
-  { identifier = "cp314t-macosx_arm64", version = "3.14", url = "https://www.python.org/ftp/python/3.14.0/python-3.14.0b2-macos11.pkg" },
-  { identifier = "cp314t-macosx_universal2", version = "3.14", url = "https://www.python.org/ftp/python/3.14.0/python-3.14.0b2-macos11.pkg" },
-  { identifier = "pp38-macosx_x86_64", version = "3.8", url = "https://downloads.python.org/pypy/pypy3.8-v7.3.11-macos_x86_64.tar.bz2" },
-  { identifier = "pp38-macosx_arm64", version = "3.8", url = "https://downloads.python.org/pypy/pypy3.8-v7.3.11-macos_arm64.tar.bz2" },
-  { identifier = "pp39-macosx_x86_64", version = "3.9", url = "https://downloads.python.org/pypy/pypy3.9-v7.3.16-macos_x86_64.tar.bz2" },
-  { identifier = "pp39-macosx_arm64", version = "3.9", url = "https://downloads.python.org/pypy/pypy3.9-v7.3.16-macos_arm64.tar.bz2" },
-  { identifier = "pp310-macosx_x86_64", version = "3.10", url = "https://downloads.python.org/pypy/pypy3.10-v7.3.19-macos_x86_64.tar.bz2" },
-  { identifier = "pp310-macosx_arm64", version = "3.10", url = "https://downloads.python.org/pypy/pypy3.10-v7.3.19-macos_arm64.tar.bz2" },
-  { identifier = "pp311-macosx_x86_64", version = "3.11", url = "https://downloads.python.org/pypy/pypy3.11-v7.3.19-macos_x86_64.tar.bz2" },
-  { identifier = "pp311-macosx_arm64", version = "3.11", url = "https://downloads.python.org/pypy/pypy3.11-v7.3.19-macos_arm64.tar.bz2" },
-  { identifier = "gp311_242-macosx_x86_64", version = "3.11", url = "https://github.com/oracle/graalpython/releases/download/graal-24.2.1/graalpy-24.2.1-macos-amd64.tar.gz" },
-  { identifier = "gp311_242-macosx_arm64", version = "3.11", url = "https://github.com/oracle/graalpython/releases/download/graal-24.2.1/graalpy-24.2.1-macos-aarch64.tar.gz" },
+  { identifier = "cp39-macosx_x86_64", version = "3.9", url = "https://www.python.org/ftp/python/3.9.13/python-3.9.13-macos11.pkg", sha256 = "351fe18f4fb03be7afac5e4012fc0a51345f43202af43ef620cf1eee5ee36578" },
+  { identifier = "cp39-macosx_arm64", version = "3.9", url = "https://www.python.org/ftp/python/3.9.13/python-3.9.13-macos11.pkg", sha256 = "351fe18f4fb03be7afac5e4012fc0a51345f43202af43ef620cf1eee5ee36578" },
+  { identifier = "cp39-macosx_universal2", version = "3.9", url = "https://www.python.org/ftp/python/3.9.13/python-3.9.13-macos11.pkg", sha256 = "351fe18f4fb03be7afac5e4012fc0a51345f43202af43ef620cf1eee5ee36578" },
+  { identifier = "cp310-macosx_x86_64", version = "3.10", url = "https://www.python.org/ftp/python/3.10.11/python-3.10.11-macos11.pkg", sha256 = "767ed35ad688d28ea4494081ae96408a0318d0d5bb9ca0139d74d6247b231cfc" },
+  { identifier = "cp310-macosx_arm64", version = "3.10", url = "https://www.python.org/ftp/python/3.10.11/python-3.10.11-macos11.pkg", sha256 = "767ed35ad688d28ea4494081ae96408a0318d0d5bb9ca0139d74d6247b231cfc" },
+  { identifier = "cp310-macosx_universal2", version = "3.10", url = "https://www.python.org/ftp/python/3.10.11/python-3.10.11-macos11.pkg", sha256 = "767ed35ad688d28ea4494081ae96408a0318d0d5bb9ca0139d74d6247b231cfc" },
+  { identifier = "cp311-macosx_x86_64", version = "3.11", url = "https://www.python.org/ftp/python/3.11.9/python-3.11.9-macos11.pkg", sha256 = "b6cfdee2571ca56ee895043ca1e7110fb78a878cee3eb0c21accb2de34d24b55" },
+  { identifier = "cp311-macosx_arm64", version = "3.11", url = "https://www.python.org/ftp/python/3.11.9/python-3.11.9-macos11.pkg", sha256 = "b6cfdee2571ca56ee895043ca1e7110fb78a878cee3eb0c21accb2de34d24b55" },
+  { identifier = "cp311-macosx_universal2", version = "3.11", url = "https://www.python.org/ftp/python/3.11.9/python-3.11.9-macos11.pkg", sha256 = "b6cfdee2571ca56ee895043ca1e7110fb78a878cee3eb0c21accb2de34d24b55" },
+  { identifier = "cp312-macosx_x86_64", version = "3.12", url = "https://www.python.org/ftp/python/3.12.10/python-3.12.10-macos11.pkg", sha256 = "8373e58da4ea146b3eb1c1f9834f19a319440b6b679b06050b1f9ee3237aa8e4" },
+  { identifier = "cp312-macosx_arm64", version = "3.12", url = "https://www.python.org/ftp/python/3.12.10/python-3.12.10-macos11.pkg", sha256 = "8373e58da4ea146b3eb1c1f9834f19a319440b6b679b06050b1f9ee3237aa8e4" },
+  { identifier = "cp312-macosx_universal2", version = "3.12", url = "https://www.python.org/ftp/python/3.12.10/python-3.12.10-macos11.pkg", sha256 = "8373e58da4ea146b3eb1c1f9834f19a319440b6b679b06050b1f9ee3237aa8e4" },
+  { identifier = "cp313-macosx_x86_64", version = "3.13", url = "https://www.python.org/ftp/python/3.13.14/python-3.13.14-macos11.pkg", sha256 = "8e58affb218c155a1dfdc27b291f817129669f8760e7a297adb2e4439ba5d2e8" },
+  { identifier = "cp313-macosx_arm64", version = "3.13", url = "https://www.python.org/ftp/python/3.13.14/python-3.13.14-macos11.pkg", sha256 = "8e58affb218c155a1dfdc27b291f817129669f8760e7a297adb2e4439ba5d2e8" },
+  { identifier = "cp313-macosx_universal2", version = "3.13", url = "https://www.python.org/ftp/python/3.13.14/python-3.13.14-macos11.pkg", sha256 = "8e58affb218c155a1dfdc27b291f817129669f8760e7a297adb2e4439ba5d2e8" },
+  { identifier = "cp314-macosx_x86_64", version = "3.14", url = "https://www.python.org/ftp/python/3.14.6/python-3.14.6-macos11.pkg", sha256 = "d3c9fff52214847e4fab03e9eaf53dd2a8e51e3534aa0b61f201b749f86bef28" },
+  { identifier = "cp314-macosx_arm64", version = "3.14", url = "https://www.python.org/ftp/python/3.14.6/python-3.14.6-macos11.pkg", sha256 = "d3c9fff52214847e4fab03e9eaf53dd2a8e51e3534aa0b61f201b749f86bef28" },
+  { identifier = "cp314-macosx_universal2", version = "3.14", url = "https://www.python.org/ftp/python/3.14.6/python-3.14.6-macos11.pkg", sha256 = "d3c9fff52214847e4fab03e9eaf53dd2a8e51e3534aa0b61f201b749f86bef28" },
+  { identifier = "cp314t-macosx_x86_64", version = "3.14", url = "https://www.python.org/ftp/python/3.14.6/python-3.14.6-macos11.pkg", sha256 = "d3c9fff52214847e4fab03e9eaf53dd2a8e51e3534aa0b61f201b749f86bef28" },
+  { identifier = "cp314t-macosx_arm64", version = "3.14", url = "https://www.python.org/ftp/python/3.14.6/python-3.14.6-macos11.pkg", sha256 = "d3c9fff52214847e4fab03e9eaf53dd2a8e51e3534aa0b61f201b749f86bef28" },
+  { identifier = "cp314t-macosx_universal2", version = "3.14", url = "https://www.python.org/ftp/python/3.14.6/python-3.14.6-macos11.pkg", sha256 = "d3c9fff52214847e4fab03e9eaf53dd2a8e51e3534aa0b61f201b749f86bef28" },
+  { identifier = "cp315-macosx_x86_64", version = "3.15", url = "https://www.python.org/ftp/python/3.15.0/python-3.15.0b4-macos11.pkg", sha256 = "6f1ed07cc92ed6e694b38b29d929a4e55190532fddb3828afe68d07cd4bf4aff" },
+  { identifier = "cp315-macosx_arm64", version = "3.15", url = "https://www.python.org/ftp/python/3.15.0/python-3.15.0b4-macos11.pkg", sha256 = "6f1ed07cc92ed6e694b38b29d929a4e55190532fddb3828afe68d07cd4bf4aff" },
+  { identifier = "cp315-macosx_universal2", version = "3.15", url = "https://www.python.org/ftp/python/3.15.0/python-3.15.0b4-macos11.pkg", sha256 = "6f1ed07cc92ed6e694b38b29d929a4e55190532fddb3828afe68d07cd4bf4aff" },
+  { identifier = "cp315t-macosx_x86_64", version = "3.15", url = "https://www.python.org/ftp/python/3.15.0/python-3.15.0b4-macos11.pkg", sha256 = "6f1ed07cc92ed6e694b38b29d929a4e55190532fddb3828afe68d07cd4bf4aff" },
+  { identifier = "cp315t-macosx_arm64", version = "3.15", url = "https://www.python.org/ftp/python/3.15.0/python-3.15.0b4-macos11.pkg", sha256 = "6f1ed07cc92ed6e694b38b29d929a4e55190532fddb3828afe68d07cd4bf4aff" },
+  { identifier = "cp315t-macosx_universal2", version = "3.15", url = "https://www.python.org/ftp/python/3.15.0/python-3.15.0b4-macos11.pkg", sha256 = "6f1ed07cc92ed6e694b38b29d929a4e55190532fddb3828afe68d07cd4bf4aff" },
+  { identifier = "pp39-macosx_x86_64", version = "3.9", url = "https://downloads.python.org/pypy/pypy3.9-v7.3.16-macos_x86_64.tar.gz", sha256 = "7ea762a1b0af7545a74cd4260bb3fd2812813deffef2ef8d2fddd5e03fa63ef1" },
+  { identifier = "pp39-macosx_arm64", version = "3.9", url = "https://downloads.python.org/pypy/pypy3.9-v7.3.16-macos_arm64.tar.gz", sha256 = "b09ce3a865c1c0f4e58c0ee4f70511f1b27dfc1f7148f4b6060cfdfd581c9e82" },
+  { identifier = "pp310-macosx_x86_64", version = "3.10", url = "https://downloads.python.org/pypy/pypy3.10-v7.3.19-macos_x86_64.tar.gz", sha256 = "63f9d30cdd9e47cfe279be941975ac3d24e46c79756cd1d1bd2c551c27d8b32c" },
+  { identifier = "pp310-macosx_arm64", version = "3.10", url = "https://downloads.python.org/pypy/pypy3.10-v7.3.19-macos_arm64.tar.gz", sha256 = "72a74cf645e43608f7d88831581fb0f8e1f963fb38f0793bacd37d5018a9aeb8" },
+  { identifier = "pp311-macosx_x86_64", version = "3.11", url = "https://downloads.python.org/pypy/pypy3.11-v7.3.23-macos_x86_64.tar.gz", sha256 = "798279b0f233893ae22754290aedf35a1aea1ec9013a8ad8110f166d85944c91" },
+  { identifier = "pp311-macosx_arm64", version = "3.11", url = "https://downloads.python.org/pypy/pypy3.11-v7.3.23-macos_arm64.tar.gz", sha256 = "f837b3c203d60d7e25a31e267671a07ba0c9b9ac8081ad225571fb06fccf1b7b" },
+  { identifier = "gp312_250-macosx_x86_64", version = "3.12", url = "https://github.com/oracle/graalpython/releases/download/graal-25.0.1/graalpy-25.0.1-macos-amd64.tar.gz", sha256 = "10b0721d52397f0cc85f038900318da2203711cbcfae7899e3faed49d3dc6221" },
+  { identifier = "gp312_250-macosx_arm64", version = "3.12", url = "https://github.com/oracle/graalpython/releases/download/graal-25.0.3/graalpy-25.0.3-macos-aarch64.tar.gz", sha256 = "387d9f5b376860842bea4d55aae5820974f3f3b68fc36c77ae863a061a888857" },
 ]

 [windows]
 python_configurations = [
-  { identifier = "cp38-win32", version = "3.8.10", arch = "32" },
-  { identifier = "cp38-win_amd64", version = "3.8.10", arch = "64" },
-  { identifier = "cp39-win32", version = "3.9.13", arch = "32" },
-  { identifier = "cp39-win_amd64", version = "3.9.13", arch = "64" },
-  { identifier = "cp310-win32", version = "3.10.11", arch = "32" },
-  { identifier = "cp310-win_amd64", version = "3.10.11", arch = "64" },
-  { identifier = "cp311-win32", version = "3.11.9", arch = "32" },
-  { identifier = "cp311-win_amd64", version = "3.11.9", arch = "64" },
-  { identifier = "cp312-win32", version = "3.12.10", arch = "32" },
-  { identifier = "cp312-win_amd64", version = "3.12.10", arch = "64" },
-  { identifier = "cp313-win32", version = "3.13.4", arch = "32" },
-  { identifier = "cp313t-win32", version = "3.13.4", arch = "32" },
-  { identifier = "cp313-win_amd64", version = "3.13.4", arch = "64" },
-  { identifier = "cp313t-win_amd64", version = "3.13.4", arch = "64" },
-  { identifier = "cp314-win32", version = "3.14.0-b2", arch = "32" },
-  { identifier = "cp314t-win32", version = "3.14.0-b2", arch = "32" },
-  { identifier = "cp314-win_amd64", version = "3.14.0-b2", arch = "64" },
-  { identifier = "cp314t-win_amd64", version = "3.14.0-b2", arch = "64" },
-  { identifier = "cp39-win_arm64", version = "3.9.10", arch = "ARM64" },
-  { identifier = "cp310-win_arm64", version = "3.10.11", arch = "ARM64" },
-  { identifier = "cp311-win_arm64", version = "3.11.9", arch = "ARM64" },
-  { identifier = "cp312-win_arm64", version = "3.12.10", arch = "ARM64" },
-  { identifier = "cp313-win_arm64", version = "3.13.4", arch = "ARM64" },
-  { identifier = "cp313t-win_arm64", version = "3.13.4", arch = "ARM64" },
-  { identifier = "cp314-win_arm64", version = "3.14.0-b2", arch = "ARM64" },
-  { identifier = "cp314t-win_arm64", version = "3.14.0-b2", arch = "ARM64" },
-  { identifier = "pp38-win_amd64", version = "3.8", arch = "64", url = "https://downloads.python.org/pypy/pypy3.8-v7.3.11-win64.zip" },
-  { identifier = "pp39-win_amd64", version = "3.9", arch = "64", url = "https://downloads.python.org/pypy/pypy3.9-v7.3.16-win64.zip" },
-  { identifier = "pp310-win_amd64", version = "3.10", arch = "64", url = "https://downloads.python.org/pypy/pypy3.10-v7.3.19-win64.zip" },
-  { identifier = "pp311-win_amd64", version = "3.11", arch = "64", url = "https://downloads.python.org/pypy/pypy3.11-v7.3.19-win64.zip" },
-  { identifier = "gp311_242-win_amd64", version = "3.11", arch = "64", url = "https://github.com/oracle/graalpython/releases/download/graal-24.2.1/graalpy-24.2.1-windows-amd64.zip" },
+  { identifier = "cp39-win32", version = "3.9.13" },
+  { identifier = "cp39-win_amd64", version = "3.9.13" },
+  { identifier = "cp310-win32", version = "3.10.11" },
+  { identifier = "cp310-win_amd64", version = "3.10.11" },
+  { identifier = "cp311-win32", version = "3.11.9" },
+  { identifier = "cp311-win_amd64", version = "3.11.9" },
+  { identifier = "cp312-win32", version = "3.12.10" },
+  { identifier = "cp312-win_amd64", version = "3.12.10" },
+  { identifier = "cp313-win32", version = "3.13.14" },
+  { identifier = "cp313-win_amd64", version = "3.13.14" },
+  { identifier = "cp314-win32", version = "3.14.6" },
+  { identifier = "cp314t-win32", version = "3.14.6" },
+  { identifier = "cp314-win_amd64", version = "3.14.6" },
+  { identifier = "cp314t-win_amd64", version = "3.14.6" },
+  { identifier = "cp315-win32", version = "3.15.0-b4" },
+  { identifier = "cp315t-win32", version = "3.15.0-b4" },
+  { identifier = "cp315-win_amd64", version = "3.15.0-b4" },
+  { identifier = "cp315t-win_amd64", version = "3.15.0-b4" },
+  { identifier = "cp39-win_arm64", version = "3.9.10" },
+  { identifier = "cp310-win_arm64", version = "3.10.11" },
+  { identifier = "cp311-win_arm64", version = "3.11.9" },
+  { identifier = "cp312-win_arm64", version = "3.12.10" },
+  { identifier = "cp313-win_arm64", version = "3.13.14" },
+  { identifier = "cp314-win_arm64", version = "3.14.6" },
+  { identifier = "cp314t-win_arm64", version = "3.14.6" },
+  { identifier = "cp315-win_arm64", version = "3.15.0-b4" },
+  { identifier = "cp315t-win_arm64", version = "3.15.0-b4" },
+  { identifier = "pp39-win_amd64", version = "3.9", url = "https://downloads.python.org/pypy/pypy3.9-v7.3.16-win64.zip", sha256 = "06ec12a5e964dc0ad33e6f380185a4d295178dce6d6df512f508e7aee00a1323" },
+  { identifier = "pp310-win_amd64", version = "3.10", url = "https://downloads.python.org/pypy/pypy3.10-v7.3.19-win64.zip", sha256 = "c0d07bba6c8fb4e5804f4a8b3f8ef07cc3d89f6ad1db42a45ffb9be60bbb7cc2" },
+  { identifier = "pp311-win_amd64", version = "3.11", url = "https://downloads.python.org/pypy/pypy3.11-v7.3.23-win64.zip", sha256 = "948b8ea58dea5b9917210fe4afd242c788fbfaba1c3f1a25e696a404f703389a" },
+  { identifier = "gp312_250-win_amd64", version = "3.12", url = "https://github.com/oracle/graalpython/releases/download/graal-25.0.3/graalpy-25.0.3-windows-amd64.zip", sha256 = "2ae5c42b93e08d9e106a017634a3442b272ccae6d08ace157244de0449e937d4" },
 ]

 [pyodide]
 python_configurations = [
-  { identifier = "cp312-pyodide_wasm32", version = "3.12", default_pyodide_version = "0.27.7", node_version = "v22" },
-  { identifier = "cp313-pyodide_wasm32", version = "3.13", default_pyodide_version = "0.28.0a3", node_version = "v22" },
+  { identifier = "cp312-pyodide_wasm32", version = "3.12", default_pyodide_version = "0.27.7", node_version = "v22", sha256 = "0c2e7db42efa5d1dac38b50f8b3d659a1e3885d0a233494831b8206281307d52" },
+  { identifier = "cp313-pyodide_wasm32", version = "3.13", default_pyodide_version = "0.29.4", node_version = "v22", sha256 = "a29fc4a076408a18fc29eb4b280f80c6dddc95c19514c874c29e590d0931c02a" },
+  { identifier = "cp314-pyodide_wasm32", version = "3.14", default_pyodide_version = "314.0.2", node_version = "v24", sha256 = "01ab1b229bf2031603bf20ad4ceb9c1059ba680b26df7bda2db4748906dfd78a" },
+]
+
+[android]
+python_configurations = [
+  { identifier = "cp313-android_arm64_v8a", version = "3.13", url = "https://repo.maven.apache.org/maven2/com/chaquo/python/python/3.13.14/python-3.13.14-aarch64-linux-android.tar.gz", sha256 = "2541c4fa77b6543504c97fa90a71c745225b5800fe25bc8c73a6516b594d0cbc" },
+  { identifier = "cp313-android_x86_64", version = "3.13", url = "https://repo.maven.apache.org/maven2/com/chaquo/python/python/3.13.14/python-3.13.14-x86_64-linux-android.tar.gz", sha256 = "9d96f7e077677b6651b2e756034ed41ab4479f5f8bf3168a814f458bc2ac137e" },
+  { identifier = "cp314-android_arm64_v8a", version = "3.14", url = "https://www.python.org/ftp/python/3.14.6/python-3.14.6-aarch64-linux-android.tar.gz", sha256 = "38bbe77d3167b5cd554e03b1021324926f09f3825202b065951dd7638e9c37e5" },
+  { identifier = "cp314-android_x86_64", version = "3.14", url = "https://www.python.org/ftp/python/3.14.6/python-3.14.6-x86_64-linux-android.tar.gz", sha256 = "e04eb26607627e68d148f89de793372f54a345c91b13628567f24abcdd3bfa3e" },
+  { identifier = "cp315-android_arm64_v8a", version = "3.15", url = "https://www.python.org/ftp/python/3.15.0/python-3.15.0b2-aarch64-linux-android.tar.gz", sha256 = "de5e36ffc3c33b63a1ed53fe83db4dee16b003a3180ac35e5c4c203d3750e076" },
+  { identifier = "cp315-android_x86_64", version = "3.15", url = "https://www.python.org/ftp/python/3.15.0/python-3.15.0b2-x86_64-linux-android.tar.gz", sha256 = "e05ef9c142ea83b41b194b16014ffe2249d27783313c3b00b97f6c93d9a56b92" },
 ]

 [ios]
 python_configurations = [
-  { identifier = "cp313-ios_arm64_iphoneos", version = "3.13", url = "https://github.com/beeware/Python-Apple-support/releases/download/3.13-b9/Python-3.13-iOS-support.b9.tar.gz" },
-  { identifier = "cp313-ios_x86_64_iphonesimulator", version = "3.13", url = "https://github.com/beeware/Python-Apple-support/releases/download/3.13-b9/Python-3.13-iOS-support.b9.tar.gz" },
-  { identifier = "cp313-ios_arm64_iphonesimulator", version = "3.13", url = "https://github.com/beeware/Python-Apple-support/releases/download/3.13-b9/Python-3.13-iOS-support.b9.tar.gz" },
+  { identifier = "cp313-ios_arm64_iphoneos", version = "3.13", url = "https://github.com/beeware/Python-Apple-support/releases/download/3.13-b14/Python-3.13-iOS-support.b14.tar.gz", sha256 = "8b5cb76ef8d8a2946052479358eeec9d54b4496cb60920e175ec1489b5cf7963" },
+  { identifier = "cp313-ios_x86_64_iphonesimulator", version = "3.13", url = "https://github.com/beeware/Python-Apple-support/releases/download/3.13-b14/Python-3.13-iOS-support.b14.tar.gz", sha256 = "8b5cb76ef8d8a2946052479358eeec9d54b4496cb60920e175ec1489b5cf7963" },
+  { identifier = "cp313-ios_arm64_iphonesimulator", version = "3.13", url = "https://github.com/beeware/Python-Apple-support/releases/download/3.13-b14/Python-3.13-iOS-support.b14.tar.gz", sha256 = "8b5cb76ef8d8a2946052479358eeec9d54b4496cb60920e175ec1489b5cf7963" },
+  { identifier = "cp314-ios_arm64_iphoneos", version = "3.14", url = "https://github.com/beeware/Python-Apple-support/releases/download/3.14-b10/Python-3.14-iOS-support.b10.tar.gz", sha256 = "200ef60eb67be0483ceb638daa9048f84f41a9a952707a5ad4c3198037c7b583" },
+  { identifier = "cp314-ios_x86_64_iphonesimulator", version = "3.14", url = "https://github.com/beeware/Python-Apple-support/releases/download/3.14-b10/Python-3.14-iOS-support.b10.tar.gz", sha256 = "200ef60eb67be0483ceb638daa9048f84f41a9a952707a5ad4c3198037c7b583" },
+  { identifier = "cp314-ios_arm64_iphonesimulator", version = "3.14", url = "https://github.com/beeware/Python-Apple-support/releases/download/3.14-b10/Python-3.14-iOS-support.b10.tar.gz", sha256 = "200ef60eb67be0483ceb638daa9048f84f41a9a952707a5ad4c3198037c7b583" },
+  { identifier = "cp315-ios_arm64_iphoneos", version = "3.15", url = "https://www.python.org/ftp/python/3.15.0/python-3.15.0b4-iOS-XCframework.tar.gz", sha256 = "dbf1095502e0b4a0dc2a4d96ae1b1d92ee8c0b7bea773862f7124ede0017e3dc" },
+  { identifier = "cp315-ios_x86_64_iphonesimulator", version = "3.15", url = "https://www.python.org/ftp/python/3.15.0/python-3.15.0b4-iOS-XCframework.tar.gz", sha256 = "dbf1095502e0b4a0dc2a4d96ae1b1d92ee8c0b7bea773862f7124ede0017e3dc" },
+  { identifier = "cp315-ios_arm64_iphonesimulator", version = "3.15", url = "https://www.python.org/ftp/python/3.15.0/python-3.15.0b4-iOS-XCframework.tar.gz", sha256 = "dbf1095502e0b4a0dc2a4d96ae1b1d92ee8c0b7bea773862f7124ede0017e3dc" },
 ]
@@ -13,8 +13,6 @@
    },
    "enable": {
      "enum": [
-        "cpython-experimental-riscv64",
-        "cpython-freethreading",
        "cpython-prerelease",
        "graalpy",
        "pyodide-prerelease",
@@ -28,6 +26,36 @@
  "description": "cibuildwheel's settings.",
  "type": "object",
  "properties": {
+    "audit-command": {
+      "description": "Execute a shell command to audit each wheel after it is repaired. Use {wheel} for each wheel path, or {abi3_wheel} to only audit abi3 wheels.",
+      "oneOf": [
+        {
+          "type": "string"
+        },
+        {
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        }
+      ],
+      "title": "CIBW_AUDIT_COMMAND"
+    },
+    "audit-requires": {
+      "description": "Install Python dependencies for the audit step.",
+      "oneOf": [
+        {
+          "type": "string"
+        },
+        {
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        }
+      ],
+      "title": "CIBW_AUDIT_REQUIRES"
+    },
    "archs": {
      "description": "Change the architectures built on your machine by default.",
      "oneOf": [
@@ -108,13 +136,14 @@
    },
    "build-frontend": {
      "default": "default",
-      "description": "Set the tool to use to build, either \"pip\" (default for now), \"build\", or \"build[uv]\"",
+      "description": "Set the tool to use to build, either \"build\" (default), \"build[uv]\", \"uv\", or \"pip\"",
      "oneOf": [
        {
          "enum": [
            "pip",
            "build",
            "build[uv]",
+            "uv",
            "default"
          ]
        },
@@ -130,6 +159,10 @@
          "type": "string",
          "pattern": "^build\\[uv\\]; ?args:"
        },
+        {
+          "type": "string",
+          "pattern": "^uv; ?args:"
+        },
        {
          "type": "object",
          "additionalProperties": false,
@@ -141,7 +174,8 @@
              "enum": [
                "pip",
                "build",
-                "build[uv]"
+                "build[uv]",
+                "uv"
              ]
            },
            "args": {
@@ -426,6 +460,34 @@
      ],
      "title": "CIBW_XBUILD_TOOLS"
    },
+    "xbuild-files": {
+      "description": "Platform-specific files in the build environment",
+      "oneOf": [
+        {
+          "type": "string"
+        },
+        {
+          "type": "object",
+          "additionalProperties": false,
+          "patternProperties": {
+            ".+": {
+              "oneOf": [
+                {
+                  "type": "string"
+                },
+                {
+                  "type": "array",
+                  "items": {
+                    "type": "string"
+                  }
+                }
+              ]
+            }
+          }
+        }
+      ],
+      "title": "CIBW_XBUILD_FILES"
+    },
    "pyodide-version": {
      "type": "string",
      "description": "Specify the version of Pyodide to use",
@@ -569,6 +631,39 @@
      ],
      "title": "CIBW_TEST_ENVIRONMENT"
    },
+    "test-runtime": {
+      "description": "Additional configuration for the test runner",
+      "oneOf": [
+        {
+          "type": "string",
+          "pattern": "^$"
+        },
+        {
+          "type": "object",
+          "additionalProperties": false
+        },
+        {
+          "type": "string",
+          "pattern": "args:"
+        },
+        {
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "args"
+          ],
+          "properties": {
+            "args": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              }
+            }
+          }
+        }
+      ],
+      "title": "CIBW_TEST_RUNTIME"
+    },
    "overrides": {
      "type": "array",
      "description": "An overrides array",
@@ -597,6 +692,12 @@
            "type": "object",
            "additionalProperties": false,
            "properties": {
+              "audit-command": {
+                "$ref": "#/$defs/inherit"
+              },
+              "audit-requires": {
+                "$ref": "#/$defs/inherit"
+              },
              "before-all": {
                "$ref": "#/$defs/inherit"
              },
@@ -606,6 +707,9 @@
              "xbuild-tools": {
                "$ref": "#/$defs/inherit"
              },
+              "xbuild-files": {
+                "$ref": "#/$defs/inherit"
+              },
              "before-test": {
                "$ref": "#/$defs/inherit"
              },
@@ -638,9 +742,18 @@
              },
              "test-environment": {
                "$ref": "#/$defs/inherit"
+              },
+              "test-runtime": {
+                "$ref": "#/$defs/inherit"
              }
            }
          },
+          "audit-command": {
+            "$ref": "#/properties/audit-command"
+          },
+          "audit-requires": {
+            "$ref": "#/properties/audit-requires"
+          },
          "before-all": {
            "$ref": "#/properties/before-all"
          },
@@ -725,6 +838,9 @@
          "xbuild-tools": {
            "$ref": "#/properties/xbuild-tools"
          },
+          "xbuild-files": {
+            "$ref": "#/properties/xbuild-files"
+          },
          "pyodide-version": {
            "$ref": "#/properties/pyodide-version"
          },
@@ -748,6 +864,9 @@
          },
          "test-environment": {
            "$ref": "#/properties/test-environment"
+          },
+          "test-runtime": {
+            "$ref": "#/properties/test-runtime"
          }
        }
      }
@@ -756,6 +875,12 @@
      "type": "object",
      "additionalProperties": false,
      "properties": {
+        "audit-command": {
+          "$ref": "#/properties/audit-command"
+        },
+        "audit-requires": {
+          "$ref": "#/properties/audit-requires"
+        },
        "archs": {
          "$ref": "#/properties/archs"
        },
@@ -840,6 +965,9 @@
        "xbuild-tools": {
          "$ref": "#/properties/xbuild-tools"
        },
+        "xbuild-files": {
+          "$ref": "#/properties/xbuild-files"
+        },
        "pyodide-version": {
          "$ref": "#/properties/pyodide-version"
        },
@@ -876,6 +1004,9 @@
        },
        "test-environment": {
          "$ref": "#/properties/test-environment"
+        },
+        "test-runtime": {
+          "$ref": "#/properties/test-runtime"
        }
      }
    },
@@ -883,6 +1014,12 @@
      "type": "object",
      "additionalProperties": false,
      "properties": {
+        "audit-command": {
+          "$ref": "#/properties/audit-command"
+        },
+        "audit-requires": {
+          "$ref": "#/properties/audit-requires"
+        },
        "archs": {
          "$ref": "#/properties/archs"
        },
@@ -913,11 +1050,27 @@
        "xbuild-tools": {
          "$ref": "#/properties/xbuild-tools"
        },
+        "xbuild-files": {
+          "$ref": "#/properties/xbuild-files"
+        },
        "pyodide-version": {
          "$ref": "#/properties/pyodide-version"
        },
        "repair-wheel-command": {
-          "$ref": "#/properties/repair-wheel-command"
+          "description": "Execute a shell command to repair each built wheel.",
+          "oneOf": [
+            {
+              "type": "string"
+            },
+            {
+              "type": "array",
+              "items": {
+                "type": "string"
+              }
+            }
+          ],
+          "title": "CIBW_REPAIR_WHEEL_COMMAND",
+          "default": "delvewheel repair -w {dest_dir} -v {wheel}"
        },
        "test-command": {
          "$ref": "#/properties/test-command"
@@ -936,6 +1089,9 @@
        },
        "test-environment": {
          "$ref": "#/properties/test-environment"
+        },
+        "test-runtime": {
+          "$ref": "#/properties/test-runtime"
        }
      }
    },
@@ -943,6 +1099,12 @@
      "type": "object",
      "additionalProperties": false,
      "properties": {
+        "audit-command": {
+          "$ref": "#/properties/audit-command"
+        },
+        "audit-requires": {
+          "$ref": "#/properties/audit-requires"
+        },
        "archs": {
          "$ref": "#/properties/archs"
        },
@@ -973,6 +1135,9 @@
        "xbuild-tools": {
          "$ref": "#/properties/xbuild-tools"
        },
+        "xbuild-files": {
+          "$ref": "#/properties/xbuild-files"
+        },
        "pyodide-version": {
          "$ref": "#/properties/pyodide-version"
        },
@@ -1009,6 +1174,9 @@
        },
        "test-environment": {
          "$ref": "#/properties/test-environment"
+        },
+        "test-runtime": {
+          "$ref": "#/properties/test-runtime"
        }
      }
    },
@@ -1016,6 +1184,117 @@
      "type": "object",
      "additionalProperties": false,
      "properties": {
+        "audit-command": {
+          "$ref": "#/properties/audit-command"
+        },
+        "audit-requires": {
+          "$ref": "#/properties/audit-requires"
+        },
+        "archs": {
+          "$ref": "#/properties/archs"
+        },
+        "before-all": {
+          "$ref": "#/properties/before-all"
+        },
+        "before-build": {
+          "$ref": "#/properties/before-build"
+        },
+        "before-test": {
+          "$ref": "#/properties/before-test"
+        },
+        "build-frontend": {
+          "default": "pyodide-build",
+          "description": "On the pyodide platform, the build frontend must be \"pyodide-build\"",
+          "oneOf": [
+            {
+              "enum": [
+                "pyodide-build"
+              ]
+            },
+            {
+              "type": "string",
+              "pattern": "^pyodide-build; ?args:"
+            },
+            {
+              "type": "object",
+              "additionalProperties": false,
+              "required": [
+                "name"
+              ],
+              "properties": {
+                "name": {
+                  "enum": [
+                    "pyodide-build"
+                  ]
+                },
+                "args": {
+                  "type": "array",
+                  "items": {
+                    "type": "string"
+                  }
+                }
+              }
+            }
+          ],
+          "title": "CIBW_BUILD_FRONTEND"
+        },
+        "build-verbosity": {
+          "$ref": "#/properties/build-verbosity"
+        },
+        "config-settings": {
+          "$ref": "#/properties/config-settings"
+        },
+        "dependency-versions": {
+          "$ref": "#/properties/dependency-versions"
+        },
+        "environment": {
+          "$ref": "#/properties/environment"
+        },
+        "xbuild-tools": {
+          "$ref": "#/properties/xbuild-tools"
+        },
+        "xbuild-files": {
+          "$ref": "#/properties/xbuild-files"
+        },
+        "pyodide-version": {
+          "$ref": "#/properties/pyodide-version"
+        },
+        "repair-wheel-command": {
+          "$ref": "#/properties/repair-wheel-command"
+        },
+        "test-command": {
+          "$ref": "#/properties/test-command"
+        },
+        "test-extras": {
+          "$ref": "#/properties/test-extras"
+        },
+        "test-sources": {
+          "$ref": "#/properties/test-sources"
+        },
+        "test-groups": {
+          "$ref": "#/properties/test-groups"
+        },
+        "test-requires": {
+          "$ref": "#/properties/test-requires"
+        },
+        "test-environment": {
+          "$ref": "#/properties/test-environment"
+        },
+        "test-runtime": {
+          "$ref": "#/properties/test-runtime"
+        }
+      }
+    },
+    "android": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "audit-command": {
+          "$ref": "#/properties/audit-command"
+        },
+        "audit-requires": {
+          "$ref": "#/properties/audit-requires"
+        },
        "archs": {
          "$ref": "#/properties/archs"
        },
@@ -1046,11 +1325,27 @@
        "xbuild-tools": {
          "$ref": "#/properties/xbuild-tools"
        },
+        "xbuild-files": {
+          "$ref": "#/properties/xbuild-files"
+        },
        "pyodide-version": {
          "$ref": "#/properties/pyodide-version"
        },
        "repair-wheel-command": {
-          "$ref": "#/properties/repair-wheel-command"
+          "description": "Execute a shell command to repair each built wheel.",
+          "oneOf": [
+            {
+              "type": "string"
+            },
+            {
+              "type": "array",
+              "items": {
+                "type": "string"
+              }
+            }
+          ],
+          "title": "CIBW_REPAIR_WHEEL_COMMAND",
+          "default": "auditwheel repair --ldpaths {ldpaths} -w {dest_dir} {wheel}"
        },
        "test-command": {
          "$ref": "#/properties/test-command"
@@ -1069,6 +1364,9 @@
        },
        "test-environment": {
          "$ref": "#/properties/test-environment"
+        },
+        "test-runtime": {
+          "$ref": "#/properties/test-runtime"
        }
      }
    },
@@ -1076,6 +1374,12 @@
      "type": "object",
      "additionalProperties": false,
      "properties": {
+        "audit-command": {
+          "$ref": "#/properties/audit-command"
+        },
+        "audit-requires": {
+          "$ref": "#/properties/audit-requires"
+        },
        "archs": {
          "$ref": "#/properties/archs"
        },
@@ -1106,6 +1410,9 @@
        "xbuild-tools": {
          "$ref": "#/properties/xbuild-tools"
        },
+        "xbuild-files": {
+          "$ref": "#/properties/xbuild-files"
+        },
        "pyodide-version": {
          "$ref": "#/properties/pyodide-version"
        },
@@ -1129,6 +1436,9 @@
        },
        "test-environment": {
          "$ref": "#/properties/test-environment"
+        },
+        "test-runtime": {
+          "$ref": "#/properties/test-runtime"
        }
      }
    }
@@ -2,116 +2,90 @@
 #    nox -s update_constraints
 annotated-types==0.7.0
    # via pydantic
-anyio==4.9.0
-    # via httpx
-auditwheel-emscripten==0.1.0
+auditwheel-emscripten==0.2.5
    # via pyodide-build
-build==1.2.2.post1
+build==1.5.0
    # via
    #   -r .nox/update_constraints/tmp/constraints-pyodide.in
    #   pyodide-build
-certifi==2025.4.26
-    # via
-    #   httpcore
-    #   httpx
-    #   requests
-charset-normalizer==3.4.2
+certifi==2026.6.17
+    # via requests
+charset-normalizer==3.4.9
    # via requests
 click==8.1.8
    # via
    #   -r .nox/update_constraints/tmp/constraints-pyodide.in
-    #   typer
-distlib==0.3.9
+    #   pyodide-build
+    #   pyodide-cli
+distlib==0.4.3
    # via virtualenv
-filelock==3.18.0
-    # via virtualenv
-h11==0.16.0
-    # via httpcore
-httpcore==1.0.9
-    # via httpx
-httpx==0.28.1
-    # via unearth
-idna==3.10
+filelock==3.31.1
    # via
-    #   anyio
-    #   httpx
-    #   requests
-leb128==1.0.8
+    #   python-discovery
+    #   virtualenv
+idna==3.18
+    # via requests
+leb128==1.0.9
    # via auditwheel-emscripten
-markdown-it-py==3.0.0
+markdown-it-py==4.2.0
    # via rich
 mdurl==0.1.2
    # via markdown-it-py
-packaging==25.0
+packaging==26.2
    # via
    #   auditwheel-emscripten
    #   build
    #   pyodide-build
-    #   unearth
-pip==25.1.1
+    #   wheel
+pip==26.1.2
    # via -r .nox/update_constraints/tmp/constraints-pyodide.in
-platformdirs==4.3.8
+platformdirs==4.10.1
    # via
    #   pyodide-build
+    #   python-discovery
    #   virtualenv
-pydantic==2.11.5
+pydantic==2.13.4
    # via
    #   pyodide-build
    #   pyodide-lock
-pydantic-core==2.33.2
+pydantic-core==2.46.4
    # via pydantic
-pygments==2.19.1
+pygments==2.20.0
    # via rich
-pyodide-build==0.30.5
+pyodide-build==0.36.0
    # via -r .nox/update_constraints/tmp/constraints-pyodide.in
-pyodide-cli==0.3.0
+pyodide-cli==0.5.0
    # via
    #   auditwheel-emscripten
    #   pyodide-build
-pyodide-lock==0.1.0a7
+pyodide-lock==0.1.3
    # via pyodide-build
 pyproject-hooks==1.2.0
    # via build
-requests==2.32.4
+python-discovery==1.4.4
+    # via virtualenv
+requests==2.34.2
    # via pyodide-build
-resolvelib==1.1.0
-    # via pyodide-build
-rich==14.0.0
+rich==15.0.0
    # via
    #   pyodide-build
    #   pyodide-cli
-    #   typer
-ruamel-yaml==0.18.14
+ruamel-yaml==0.19.1
    # via pyodide-build
-ruamel-yaml-clib==0.2.12
-    # via ruamel-yaml
-shellingham==1.5.4
-    # via typer
-sniffio==1.3.1
-    # via anyio
-typer==0.16.0
+typing-extensions==4.16.0
    # via
-    #   auditwheel-emscripten
-    #   pyodide-build
-    #   pyodide-cli
-typing-extensions==4.14.0
-    # via
-    #   anyio
    #   pydantic
    #   pydantic-core
-    #   typer
    #   typing-inspection
-typing-inspection==0.4.1
+typing-inspection==0.4.2
    # via pydantic
-unearth==0.17.5
-    # via pyodide-build
-urllib3==2.4.0
+urllib3==2.7.0
    # via requests
-virtualenv==20.31.2
+virtualenv==21.6.1
    # via
    #   build
    #   pyodide-build
-wheel==0.45.1
+wheel==0.47.0
    # via
    #   auditwheel-emscripten
    #   pyodide-build
@@ -2,115 +2,90 @@
 #    nox -s update_constraints
 annotated-types==0.7.0
    # via pydantic
-anyio==4.9.0
-    # via httpx
-auditwheel-emscripten==0.1.0
+auditwheel-emscripten==0.2.5
    # via pyodide-build
-build==1.2.2.post1
+build==1.5.0
    # via
    #   -r .nox/update_constraints/tmp/constraints-pyodide.in
    #   pyodide-build
-certifi==2025.4.26
-    # via
-    #   httpcore
-    #   httpx
-    #   requests
-charset-normalizer==3.4.2
+certifi==2026.6.17
+    # via requests
+charset-normalizer==3.4.9
    # via requests
 click==8.1.8
    # via
    #   -r .nox/update_constraints/tmp/constraints-pyodide.in
-    #   typer
-distlib==0.3.9
+    #   pyodide-build
+    #   pyodide-cli
+distlib==0.4.3
    # via virtualenv
-filelock==3.18.0
-    # via virtualenv
-h11==0.16.0
-    # via httpcore
-httpcore==1.0.9
-    # via httpx
-httpx==0.28.1
-    # via unearth
-idna==3.10
+filelock==3.31.1
    # via
-    #   anyio
-    #   httpx
-    #   requests
-leb128==1.0.8
+    #   python-discovery
+    #   virtualenv
+idna==3.18
+    # via requests
+leb128==1.0.9
    # via auditwheel-emscripten
-markdown-it-py==3.0.0
+markdown-it-py==4.2.0
    # via rich
 mdurl==0.1.2
    # via markdown-it-py
-packaging==25.0
+packaging==26.2
    # via
    #   auditwheel-emscripten
    #   build
    #   pyodide-build
-    #   unearth
-pip==25.1.1
+    #   wheel
+pip==26.1.2
    # via -r .nox/update_constraints/tmp/constraints-pyodide.in
-platformdirs==4.3.8
+platformdirs==4.10.1
    # via
    #   pyodide-build
+    #   python-discovery
    #   virtualenv
-pydantic==2.11.5
+pydantic==2.13.4
    # via
    #   pyodide-build
    #   pyodide-lock
-pydantic-core==2.33.2
+pydantic-core==2.46.4
    # via pydantic
-pygments==2.19.1
+pygments==2.20.0
    # via rich
-pyodide-build==0.30.5
+pyodide-build==0.36.0
    # via -r .nox/update_constraints/tmp/constraints-pyodide.in
-pyodide-cli==0.3.0
+pyodide-cli==0.5.0
    # via
    #   auditwheel-emscripten
    #   pyodide-build
-pyodide-lock==0.1.0a7
+pyodide-lock==0.1.3
    # via pyodide-build
 pyproject-hooks==1.2.0
    # via build
-requests==2.32.4
+python-discovery==1.4.4
+    # via virtualenv
+requests==2.34.2
    # via pyodide-build
-resolvelib==1.1.0
-    # via pyodide-build
-rich==14.0.0
+rich==15.0.0
    # via
    #   pyodide-build
    #   pyodide-cli
-    #   typer
-ruamel-yaml==0.18.14
+ruamel-yaml==0.19.1
    # via pyodide-build
-ruamel-yaml-clib==0.2.12
-    # via ruamel-yaml
-shellingham==1.5.4
-    # via typer
-sniffio==1.3.1
-    # via anyio
-typer==0.16.0
-    # via
-    #   auditwheel-emscripten
-    #   pyodide-build
-    #   pyodide-cli
-typing-extensions==4.14.0
+typing-extensions==4.16.0
    # via
    #   pydantic
    #   pydantic-core
-    #   typer
    #   typing-inspection
-typing-inspection==0.4.1
+typing-inspection==0.4.2
    # via pydantic
-unearth==0.17.5
-    # via pyodide-build
-urllib3==2.4.0
+urllib3==2.7.0
    # via requests
-virtualenv==20.31.2
+virtualenv==21.6.1
    # via
    #   build
    #   pyodide-build
-wheel==0.45.1
+wheel==0.47.0
    # via
    #   auditwheel-emscripten
    #   pyodide-build
@@ -0,0 +1,91 @@
+# This file was autogenerated by uv via the following command:
+#    nox -s update_constraints
+annotated-types==0.7.0
+    # via pydantic
+auditwheel-emscripten==0.2.5
+    # via pyodide-build
+build==1.5.0
+    # via
+    #   -r .nox/update_constraints/tmp/constraints-pyodide.in
+    #   pyodide-build
+certifi==2026.6.17
+    # via requests
+charset-normalizer==3.4.9
+    # via requests
+click==8.1.8
+    # via
+    #   -r .nox/update_constraints/tmp/constraints-pyodide.in
+    #   pyodide-build
+    #   pyodide-cli
+distlib==0.4.3
+    # via virtualenv
+filelock==3.31.1
+    # via
+    #   python-discovery
+    #   virtualenv
+idna==3.18
+    # via requests
+leb128==1.0.9
+    # via auditwheel-emscripten
+markdown-it-py==4.2.0
+    # via rich
+mdurl==0.1.2
+    # via markdown-it-py
+packaging==26.2
+    # via
+    #   auditwheel-emscripten
+    #   build
+    #   pyodide-build
+    #   wheel
+pip==26.1.2
+    # via -r .nox/update_constraints/tmp/constraints-pyodide.in
+platformdirs==4.10.1
+    # via
+    #   pyodide-build
+    #   python-discovery
+    #   virtualenv
+pydantic==2.13.4
+    # via
+    #   pyodide-build
+    #   pyodide-lock
+pydantic-core==2.46.4
+    # via pydantic
+pygments==2.20.0
+    # via rich
+pyodide-build==0.36.0
+    # via -r .nox/update_constraints/tmp/constraints-pyodide.in
+pyodide-cli==0.5.0
+    # via
+    #   auditwheel-emscripten
+    #   pyodide-build
+pyodide-lock==0.1.3
+    # via pyodide-build
+pyproject-hooks==1.2.0
+    # via build
+python-discovery==1.4.4
+    # via virtualenv
+requests==2.34.2
+    # via pyodide-build
+rich==15.0.0
+    # via
+    #   pyodide-build
+    #   pyodide-cli
+ruamel-yaml==0.19.1
+    # via pyodide-build
+typing-extensions==4.16.0
+    # via
+    #   pydantic
+    #   pydantic-core
+    #   typing-inspection
+typing-inspection==0.4.2
+    # via pydantic
+urllib3==2.7.0
+    # via requests
+virtualenv==21.6.1
+    # via
+    #   build
+    #   pyodide-build
+wheel==0.47.0
+    # via
+    #   auditwheel-emscripten
+    #   pyodide-build
@@ -1,34 +1,105 @@
 # This file was autogenerated by uv via the following command:
 #    nox -s update_constraints
-altgraph==0.17.4
-    # via macholib
-build==1.2.2.post1
+abi3audit==0.0.26
    # via -r cibuildwheel/resources/constraints.in
+abi3info==2025.11.29
+    # via abi3audit
+altgraph==0.17.5
+    # via macholib
+attrs==26.1.0
+    # via
+    #   cattrs
+    #   requests-cache
+auditwheel==6.7.0
+    # via -r cibuildwheel/resources/constraints.in
+build==1.5.0
+    # via -r cibuildwheel/resources/constraints.in
+cattrs==26.1.0
+    # via requests-cache
+certifi==2026.6.17
+    # via requests
+charset-normalizer==3.4.9
+    # via requests
 delocate==0.13.0
    # via -r cibuildwheel/resources/constraints.in
-distlib==0.3.9
+delvewheel==1.13.0
+    # via -r cibuildwheel/resources/constraints.in
+distlib==0.4.3
    # via virtualenv
-filelock==3.18.0
-    # via virtualenv
-importlib-metadata==8.7.0
-    # via build
-macholib==1.16.3
-    # via delocate
-packaging==25.0
+exceptiongroup==1.3.1
+    # via cattrs
+filelock==3.31.1
    # via
+    #   python-discovery
+    #   virtualenv
+idna==3.18
+    # via
+    #   requests
+    #   url-normalize
+importlib-metadata==9.0.0
+    # via build
+kaitaistruct==0.11
+    # via abi3audit
+macholib==1.16.4
+    # via delocate
+markdown-it-py==4.2.0
+    # via rich
+mdurl==0.1.2
+    # via markdown-it-py
+packaging==26.2
+    # via
+    #   abi3audit
+    #   auditwheel
    #   build
    #   delocate
-pip==25.1.1
+patchelf==0.17.2.4
    # via -r cibuildwheel/resources/constraints.in
-platformdirs==4.3.8
-    # via virtualenv
+pefile==2024.8.26
+    # via
+    #   abi3audit
+    #   delvewheel
+pip==26.1.2
+    # via -r cibuildwheel/resources/constraints.in
+pkgconf==3.0.1.post0
+    # via -r cibuildwheel/resources/constraints.in
+platformdirs==4.10.1
+    # via
+    #   python-discovery
+    #   requests-cache
+    #   virtualenv
+pyelftools==0.33
+    # via
+    #   abi3audit
+    #   auditwheel
+pygments==2.20.0
+    # via rich
 pyproject-hooks==1.2.0
    # via build
-tomli==2.2.1
+python-discovery==1.4.4
+    # via virtualenv
+requests==2.34.2
+    # via
+    #   abi3audit
+    #   requests-cache
+requests-cache==1.3.3
+    # via abi3audit
+rich==15.0.0
+    # via abi3audit
+tomli==2.4.1
    # via build
-typing-extensions==4.14.0
-    # via delocate
-virtualenv==20.31.2
+typing-extensions==4.16.0
+    # via
+    #   cattrs
+    #   delocate
+    #   exceptiongroup
+    #   virtualenv
+url-normalize==3.0.0
+    # via requests-cache
+urllib3==2.7.0
+    # via
+    #   requests
+    #   requests-cache
+virtualenv==21.6.1
    # via -r cibuildwheel/resources/constraints.in
-zipp==3.23.0
+zipp==4.1.0
    # via importlib-metadata
@@ -1,28 +1,95 @@
 # This file was autogenerated by uv via the following command:
 #    nox -s update_constraints
-altgraph==0.17.4
-    # via macholib
-build==1.2.2.post1
+abi3audit==0.0.26
    # via -r cibuildwheel/resources/constraints.in
+abi3info==2025.11.29
+    # via abi3audit
+altgraph==0.17.5
+    # via macholib
+attrs==26.1.0
+    # via
+    #   cattrs
+    #   requests-cache
+auditwheel==6.7.0
+    # via -r cibuildwheel/resources/constraints.in
+build==1.5.0
+    # via -r cibuildwheel/resources/constraints.in
+cattrs==26.1.0
+    # via requests-cache
+certifi==2026.6.17
+    # via requests
+charset-normalizer==3.4.9
+    # via requests
 delocate==0.13.0
    # via -r cibuildwheel/resources/constraints.in
-distlib==0.3.9
+delvewheel==1.13.0
+    # via -r cibuildwheel/resources/constraints.in
+distlib==0.4.3
    # via virtualenv
-filelock==3.18.0
-    # via virtualenv
-macholib==1.16.3
-    # via delocate
-packaging==25.0
+filelock==3.31.1
    # via
+    #   python-discovery
+    #   virtualenv
+idna==3.18
+    # via
+    #   requests
+    #   url-normalize
+kaitaistruct==0.11
+    # via abi3audit
+macholib==1.16.4
+    # via delocate
+markdown-it-py==4.2.0
+    # via rich
+mdurl==0.1.2
+    # via markdown-it-py
+packaging==26.2
+    # via
+    #   abi3audit
+    #   auditwheel
    #   build
    #   delocate
-pip==25.1.1
+patchelf==0.17.2.4
    # via -r cibuildwheel/resources/constraints.in
-platformdirs==4.3.8
-    # via virtualenv
+pefile==2024.8.26
+    # via
+    #   abi3audit
+    #   delvewheel
+pip==26.1.2
+    # via -r cibuildwheel/resources/constraints.in
+pkgconf==3.0.1.post0
+    # via -r cibuildwheel/resources/constraints.in
+platformdirs==4.10.1
+    # via
+    #   python-discovery
+    #   requests-cache
+    #   virtualenv
+pyelftools==0.33
+    # via
+    #   abi3audit
+    #   auditwheel
+pygments==2.20.0
+    # via rich
 pyproject-hooks==1.2.0
    # via build
-typing-extensions==4.14.0
-    # via delocate
-virtualenv==20.31.2
+python-discovery==1.4.4
+    # via virtualenv
+requests==2.34.2
+    # via
+    #   abi3audit
+    #   requests-cache
+requests-cache==1.3.3
+    # via abi3audit
+rich==15.0.0
+    # via abi3audit
+typing-extensions==4.16.0
+    # via
+    #   cattrs
+    #   delocate
+url-normalize==3.0.0
+    # via requests-cache
+urllib3==2.7.0
+    # via
+    #   requests
+    #   requests-cache
+virtualenv==21.6.1
    # via -r cibuildwheel/resources/constraints.in
@@ -1,28 +1,97 @@
 # This file was autogenerated by uv via the following command:
 #    nox -s update_constraints
-altgraph==0.17.4
-    # via macholib
-build==1.2.2.post1
+abi3audit==0.0.26
    # via -r cibuildwheel/resources/constraints.in
+abi3info==2025.11.29
+    # via abi3audit
+altgraph==0.17.5
+    # via macholib
+attrs==26.1.0
+    # via
+    #   cattrs
+    #   requests-cache
+auditwheel==6.7.0
+    # via -r cibuildwheel/resources/constraints.in
+build==1.5.0
+    # via -r cibuildwheel/resources/constraints.in
+cattrs==26.1.0
+    # via requests-cache
+certifi==2026.6.17
+    # via requests
+charset-normalizer==3.4.9
+    # via requests
 delocate==0.13.0
    # via -r cibuildwheel/resources/constraints.in
-distlib==0.3.9
+delvewheel==1.13.0
+    # via -r cibuildwheel/resources/constraints.in
+distlib==0.4.3
    # via virtualenv
-filelock==3.18.0
-    # via virtualenv
-macholib==1.16.3
-    # via delocate
-packaging==25.0
+filelock==3.31.1; implementation_name != "graalpy"
+filelock==3.29.7; implementation_name == "graalpy"
    # via
+    #   python-discovery
+    #   virtualenv
+idna==3.18
+    # via
+    #   requests
+    #   url-normalize
+kaitaistruct==0.11
+    # via abi3audit
+macholib==1.16.4
+    # via delocate
+markdown-it-py==4.2.0
+    # via rich
+mdurl==0.1.2
+    # via markdown-it-py
+packaging==26.2
+    # via
+    #   abi3audit
+    #   auditwheel
    #   build
    #   delocate
-pip==25.1.1
+patchelf==0.17.2.4
    # via -r cibuildwheel/resources/constraints.in
-platformdirs==4.3.8
-    # via virtualenv
+pefile==2024.8.26
+    # via
+    #   abi3audit
+    #   delvewheel
+pip==26.1.2; implementation_name != "graalpy" or platform_system != "Windows"
+pip==26.0.1; implementation_name == "graalpy" and platform_system == "Windows"
+    # via -r cibuildwheel/resources/constraints.in
+pkgconf==3.0.1.post0
+    # via -r cibuildwheel/resources/constraints.in
+platformdirs==4.10.1
+    # via
+    #   python-discovery
+    #   requests-cache
+    #   virtualenv
+pyelftools==0.33
+    # via
+    #   abi3audit
+    #   auditwheel
+pygments==2.20.0
+    # via rich
 pyproject-hooks==1.2.0
    # via build
-typing-extensions==4.14.0
-    # via delocate
-virtualenv==20.31.2
+python-discovery==1.4.4
+    # via virtualenv
+requests==2.34.2
+    # via
+    #   abi3audit
+    #   requests-cache
+requests-cache==1.3.3
+    # via abi3audit
+rich==15.0.0
+    # via abi3audit
+typing-extensions==4.16.0
+    # via
+    #   cattrs
+    #   delocate
+url-normalize==3.0.0
+    # via requests-cache
+urllib3==2.7.0
+    # via
+    #   requests
+    #   requests-cache
+virtualenv==21.6.1
    # via -r cibuildwheel/resources/constraints.in
@@ -1,28 +1,95 @@
 # This file was autogenerated by uv via the following command:
 #    nox -s update_constraints
-altgraph==0.17.4
-    # via macholib
-build==1.2.2.post1
+abi3audit==0.0.26
    # via -r cibuildwheel/resources/constraints.in
+abi3info==2025.11.29
+    # via abi3audit
+altgraph==0.17.5
+    # via macholib
+attrs==26.1.0
+    # via
+    #   cattrs
+    #   requests-cache
+auditwheel==6.7.0
+    # via -r cibuildwheel/resources/constraints.in
+build==1.5.0
+    # via -r cibuildwheel/resources/constraints.in
+cattrs==26.1.0
+    # via requests-cache
+certifi==2026.6.17
+    # via requests
+charset-normalizer==3.4.9
+    # via requests
 delocate==0.13.0
    # via -r cibuildwheel/resources/constraints.in
-distlib==0.3.9
+delvewheel==1.13.0
+    # via -r cibuildwheel/resources/constraints.in
+distlib==0.4.3
    # via virtualenv
-filelock==3.18.0
-    # via virtualenv
-macholib==1.16.3
-    # via delocate
-packaging==25.0
+filelock==3.31.1
    # via
+    #   python-discovery
+    #   virtualenv
+idna==3.18
+    # via
+    #   requests
+    #   url-normalize
+kaitaistruct==0.11
+    # via abi3audit
+macholib==1.16.4
+    # via delocate
+markdown-it-py==4.2.0
+    # via rich
+mdurl==0.1.2
+    # via markdown-it-py
+packaging==26.2
+    # via
+    #   abi3audit
+    #   auditwheel
    #   build
    #   delocate
-pip==25.1.1
+patchelf==0.17.2.4
    # via -r cibuildwheel/resources/constraints.in
-platformdirs==4.3.8
-    # via virtualenv
+pefile==2024.8.26
+    # via
+    #   abi3audit
+    #   delvewheel
+pip==26.1.2
+    # via -r cibuildwheel/resources/constraints.in
+pkgconf==3.0.1.post0
+    # via -r cibuildwheel/resources/constraints.in
+platformdirs==4.10.1
+    # via
+    #   python-discovery
+    #   requests-cache
+    #   virtualenv
+pyelftools==0.33
+    # via
+    #   abi3audit
+    #   auditwheel
+pygments==2.20.0
+    # via rich
 pyproject-hooks==1.2.0
    # via build
-typing-extensions==4.14.0
-    # via delocate
-virtualenv==20.31.2
+python-discovery==1.4.4
+    # via virtualenv
+requests==2.34.2
+    # via
+    #   abi3audit
+    #   requests-cache
+requests-cache==1.3.3
+    # via abi3audit
+rich==15.0.0
+    # via abi3audit
+typing-extensions==4.16.0
+    # via
+    #   cattrs
+    #   delocate
+url-normalize==3.0.0
+    # via requests-cache
+urllib3==2.7.0
+    # via
+    #   requests
+    #   requests-cache
+virtualenv==21.6.1
    # via -r cibuildwheel/resources/constraints.in
@@ -1,28 +1,95 @@
 # This file was autogenerated by uv via the following command:
 #    nox -s update_constraints
-altgraph==0.17.4
-    # via macholib
-build==1.2.2.post1
+abi3audit==0.0.26
    # via -r cibuildwheel/resources/constraints.in
+abi3info==2025.11.29
+    # via abi3audit
+altgraph==0.17.5
+    # via macholib
+attrs==26.1.0
+    # via
+    #   cattrs
+    #   requests-cache
+auditwheel==6.7.0
+    # via -r cibuildwheel/resources/constraints.in
+build==1.5.0
+    # via -r cibuildwheel/resources/constraints.in
+cattrs==26.1.0
+    # via requests-cache
+certifi==2026.6.17
+    # via requests
+charset-normalizer==3.4.9
+    # via requests
 delocate==0.13.0
    # via -r cibuildwheel/resources/constraints.in
-distlib==0.3.9
+delvewheel==1.13.0
+    # via -r cibuildwheel/resources/constraints.in
+distlib==0.4.3
    # via virtualenv
-filelock==3.18.0
-    # via virtualenv
-macholib==1.16.3
-    # via delocate
-packaging==25.0
+filelock==3.31.1
    # via
+    #   python-discovery
+    #   virtualenv
+idna==3.18
+    # via
+    #   requests
+    #   url-normalize
+kaitaistruct==0.11
+    # via abi3audit
+macholib==1.16.4
+    # via delocate
+markdown-it-py==4.2.0
+    # via rich
+mdurl==0.1.2
+    # via markdown-it-py
+packaging==26.2
+    # via
+    #   abi3audit
+    #   auditwheel
    #   build
    #   delocate
-pip==25.1.1
+patchelf==0.17.2.4
    # via -r cibuildwheel/resources/constraints.in
-platformdirs==4.3.8
-    # via virtualenv
+pefile==2024.8.26
+    # via
+    #   abi3audit
+    #   delvewheel
+pip==26.1.2
+    # via -r cibuildwheel/resources/constraints.in
+pkgconf==3.0.1.post0
+    # via -r cibuildwheel/resources/constraints.in
+platformdirs==4.10.1
+    # via
+    #   python-discovery
+    #   requests-cache
+    #   virtualenv
+pyelftools==0.33
+    # via
+    #   abi3audit
+    #   auditwheel
+pygments==2.20.0
+    # via rich
 pyproject-hooks==1.2.0
    # via build
-typing-extensions==4.14.0
-    # via delocate
-virtualenv==20.31.2
+python-discovery==1.4.4
+    # via virtualenv
+requests==2.34.2
+    # via
+    #   abi3audit
+    #   requests-cache
+requests-cache==1.3.3
+    # via abi3audit
+rich==15.0.0
+    # via abi3audit
+typing-extensions==4.16.0
+    # via
+    #   cattrs
+    #   delocate
+url-normalize==3.0.0
+    # via requests-cache
+urllib3==2.7.0
+    # via
+    #   requests
+    #   requests-cache
+virtualenv==21.6.1
    # via -r cibuildwheel/resources/constraints.in
@@ -0,0 +1,95 @@
+# This file was autogenerated by uv via the following command:
+#    nox -s update_constraints
+abi3audit==0.0.26
+    # via -r cibuildwheel/resources/constraints.in
+abi3info==2025.11.29
+    # via abi3audit
+altgraph==0.17.5
+    # via macholib
+attrs==26.1.0
+    # via
+    #   cattrs
+    #   requests-cache
+auditwheel==6.7.0
+    # via -r cibuildwheel/resources/constraints.in
+build==1.5.0
+    # via -r cibuildwheel/resources/constraints.in
+cattrs==26.1.0
+    # via requests-cache
+certifi==2026.6.17
+    # via requests
+charset-normalizer==3.4.9
+    # via requests
+delocate==0.13.0
+    # via -r cibuildwheel/resources/constraints.in
+delvewheel==1.13.0
+    # via -r cibuildwheel/resources/constraints.in
+distlib==0.4.3
+    # via virtualenv
+filelock==3.31.1
+    # via
+    #   python-discovery
+    #   virtualenv
+idna==3.18
+    # via
+    #   requests
+    #   url-normalize
+kaitaistruct==0.11
+    # via abi3audit
+macholib==1.16.4
+    # via delocate
+markdown-it-py==4.2.0
+    # via rich
+mdurl==0.1.2
+    # via markdown-it-py
+packaging==26.2
+    # via
+    #   abi3audit
+    #   auditwheel
+    #   build
+    #   delocate
+patchelf==0.17.2.4
+    # via -r cibuildwheel/resources/constraints.in
+pefile==2024.8.26
+    # via
+    #   abi3audit
+    #   delvewheel
+pip==26.1.2
+    # via -r cibuildwheel/resources/constraints.in
+pkgconf==3.0.1.post0
+    # via -r cibuildwheel/resources/constraints.in
+platformdirs==4.10.1
+    # via
+    #   python-discovery
+    #   requests-cache
+    #   virtualenv
+pyelftools==0.33
+    # via
+    #   abi3audit
+    #   auditwheel
+pygments==2.20.0
+    # via rich
+pyproject-hooks==1.2.0
+    # via build
+python-discovery==1.4.4
+    # via virtualenv
+requests==2.34.2
+    # via
+    #   abi3audit
+    #   requests-cache
+requests-cache==1.3.3
+    # via abi3audit
+rich==15.0.0
+    # via abi3audit
+typing-extensions==4.16.0
+    # via
+    #   cattrs
+    #   delocate
+url-normalize==3.0.0
+    # via requests-cache
+urllib3==2.7.0
+    # via
+    #   requests
+    #   requests-cache
+virtualenv==21.6.1
+    # via -r cibuildwheel/resources/constraints.in
@@ -1,34 +0,0 @@
-# This file was autogenerated by uv via the following command:
-#    nox -s update_constraints
-altgraph==0.17.4
-    # via macholib
-build==1.2.2.post1
-    # via -r cibuildwheel/resources/constraints.in
-delocate==0.12.0
-    # via -r cibuildwheel/resources/constraints.in
-distlib==0.3.9
-    # via virtualenv
-filelock==3.16.1
-    # via virtualenv
-importlib-metadata==8.5.0
-    # via build
-macholib==1.16.3
-    # via delocate
-packaging==25.0
-    # via
-    #   build
-    #   delocate
-pip==25.0.1
-    # via -r cibuildwheel/resources/constraints.in
-platformdirs==4.3.6
-    # via virtualenv
-pyproject-hooks==1.2.0
-    # via build
-tomli==2.2.1
-    # via build
-typing-extensions==4.13.2
-    # via delocate
-virtualenv==20.31.2
-    # via -r cibuildwheel/resources/constraints.in
-zipp==3.20.2
-    # via importlib-metadata
@@ -1,34 +1,107 @@
 # This file was autogenerated by uv via the following command:
 #    nox -s update_constraints
-altgraph==0.17.4
-    # via macholib
-build==1.2.2.post1
+abi3audit==0.0.25
    # via -r cibuildwheel/resources/constraints.in
+abi3info==2025.4.29
+    # via abi3audit
+altgraph==0.17.5
+    # via macholib
+attrs==26.1.0
+    # via
+    #   cattrs
+    #   requests-cache
+auditwheel==6.4.2
+    # via -r cibuildwheel/resources/constraints.in
+build==1.4.4
+    # via -r cibuildwheel/resources/constraints.in
+cattrs==25.3.0
+    # via requests-cache
+certifi==2026.6.17
+    # via requests
+charset-normalizer==3.4.9
+    # via requests
 delocate==0.13.0
    # via -r cibuildwheel/resources/constraints.in
-distlib==0.3.9
+delvewheel==1.13.0
+    # via -r cibuildwheel/resources/constraints.in
+distlib==0.4.3
    # via virtualenv
-filelock==3.18.0
-    # via virtualenv
-importlib-metadata==8.7.0
-    # via build
-macholib==1.16.3
-    # via delocate
-packaging==25.0
+exceptiongroup==1.3.1
+    # via cattrs
+filelock==3.19.1
+    # via
+    #   python-discovery
+    #   virtualenv
+idna==3.18
+    # via
+    #   requests
+    #   url-normalize
+importlib-metadata==8.7.1
    # via
    #   build
+    #   pkgconf
+kaitaistruct==0.11
+    # via abi3audit
+macholib==1.16.4
+    # via delocate
+markdown-it-py==3.0.0
+    # via rich
+mdurl==0.1.2
+    # via markdown-it-py
+packaging==25.0
+    # via
+    #   abi3audit
+    #   auditwheel
+    #   build
    #   delocate
-pip==25.1.1
+patchelf==0.17.2.4
    # via -r cibuildwheel/resources/constraints.in
-platformdirs==4.3.8
-    # via virtualenv
+pefile==2024.8.26
+    # via
+    #   abi3audit
+    #   delvewheel
+pip==26.0.1
+    # via -r cibuildwheel/resources/constraints.in
+pkgconf==2.4.3.post2
+    # via -r cibuildwheel/resources/constraints.in
+platformdirs==4.4.0
+    # via
+    #   python-discovery
+    #   requests-cache
+    #   virtualenv
+pyelftools==0.32
+    # via
+    #   abi3audit
+    #   auditwheel
+pygments==2.20.0
+    # via rich
 pyproject-hooks==1.2.0
    # via build
-tomli==2.2.1
+python-discovery==1.4.4
+    # via virtualenv
+requests==2.32.5
+    # via
+    #   abi3audit
+    #   requests-cache
+requests-cache==1.2.1
+    # via abi3audit
+rich==14.2.0
+    # via abi3audit
+tomli==2.4.1
    # via build
-typing-extensions==4.14.0
-    # via delocate
-virtualenv==20.31.2
+typing-extensions==4.16.0
+    # via
+    #   cattrs
+    #   delocate
+    #   exceptiongroup
+    #   virtualenv
+url-normalize==2.2.1
+    # via requests-cache
+urllib3==2.6.3
+    # via
+    #   requests
+    #   requests-cache
+virtualenv==21.6.1
    # via -r cibuildwheel/resources/constraints.in
-zipp==3.23.0
+zipp==3.23.1
    # via importlib-metadata
@@ -1,4 +1,11 @@
 pip
 build
 delocate
+delvewheel
 virtualenv
+abi3audit
+
+# Android
+auditwheel
+patchelf
+pkgconf
@@ -1,28 +1,95 @@
 # This file was autogenerated by uv via the following command:
 #    nox -s update_constraints
-altgraph==0.17.4
-    # via macholib
-build==1.2.2.post1
+abi3audit==0.0.26
    # via -r cibuildwheel/resources/constraints.in
+abi3info==2025.11.29
+    # via abi3audit
+altgraph==0.17.5
+    # via macholib
+attrs==26.1.0
+    # via
+    #   cattrs
+    #   requests-cache
+auditwheel==6.7.0
+    # via -r cibuildwheel/resources/constraints.in
+build==1.5.0
+    # via -r cibuildwheel/resources/constraints.in
+cattrs==26.1.0
+    # via requests-cache
+certifi==2026.6.17
+    # via requests
+charset-normalizer==3.4.9
+    # via requests
 delocate==0.13.0
    # via -r cibuildwheel/resources/constraints.in
-distlib==0.3.9
+delvewheel==1.13.0
+    # via -r cibuildwheel/resources/constraints.in
+distlib==0.4.3
    # via virtualenv
-filelock==3.18.0
-    # via virtualenv
-macholib==1.16.3
-    # via delocate
-packaging==25.0
+filelock==3.31.1
    # via
+    #   python-discovery
+    #   virtualenv
+idna==3.18
+    # via
+    #   requests
+    #   url-normalize
+kaitaistruct==0.11
+    # via abi3audit
+macholib==1.16.4
+    # via delocate
+markdown-it-py==4.2.0
+    # via rich
+mdurl==0.1.2
+    # via markdown-it-py
+packaging==26.2
+    # via
+    #   abi3audit
+    #   auditwheel
    #   build
    #   delocate
-pip==25.1.1
+patchelf==0.17.2.4
    # via -r cibuildwheel/resources/constraints.in
-platformdirs==4.3.8
-    # via virtualenv
+pefile==2024.8.26
+    # via
+    #   abi3audit
+    #   delvewheel
+pip==26.1.2
+    # via -r cibuildwheel/resources/constraints.in
+pkgconf==3.0.1.post0
+    # via -r cibuildwheel/resources/constraints.in
+platformdirs==4.10.1
+    # via
+    #   python-discovery
+    #   requests-cache
+    #   virtualenv
+pyelftools==0.33
+    # via
+    #   abi3audit
+    #   auditwheel
+pygments==2.20.0
+    # via rich
 pyproject-hooks==1.2.0
    # via build
-typing-extensions==4.14.0
-    # via delocate
-virtualenv==20.31.2
+python-discovery==1.4.4
+    # via virtualenv
+requests==2.34.2
+    # via
+    #   abi3audit
+    #   requests-cache
+requests-cache==1.3.3
+    # via abi3audit
+rich==15.0.0
+    # via abi3audit
+typing-extensions==4.16.0
+    # via
+    #   cattrs
+    #   delocate
+url-normalize==3.0.0
+    # via requests-cache
+urllib3==2.7.0
+    # via
+    #   requests
+    #   requests-cache
+virtualenv==21.6.1
    # via -r cibuildwheel/resources/constraints.in
@@ -1,3 +1,6 @@
+# These are the defaults used by cibuildwheel itself. They should match the values in
+# generate_schema.py, which are used by external tools for validation and IDE support.
+
 [tool.cibuildwheel]
 build = "*"
 skip = ""
@@ -5,6 +8,8 @@ test-skip = ""
 enable = []

 archs = ["auto"]
+audit-requires = ["abi3audit"]
+audit-command = "abi3audit --strict --report {abi3_wheel}"
 build-frontend = "default"
 config-settings = {}
 dependency-versions = "pinned"
@@ -25,20 +30,21 @@ test-requires = []
 test-extras = []
 test-groups = []
 test-environment = {}
+test-runtime = {}

 container-engine = "docker"

 pyodide-version = ""

 manylinux-x86_64-image = "manylinux_2_28"
-manylinux-i686-image = "manylinux2014"
+manylinux-i686-image = "manylinux_2_28"
 manylinux-aarch64-image = "manylinux_2_28"
 manylinux-ppc64le-image = "manylinux_2_28"
 manylinux-s390x-image = "manylinux_2_28"
 manylinux-armv7l-image = "manylinux_2_31"
-manylinux-riscv64-image = "ghcr.io/pypa/cibuildwheel/no_default_image:please_use_override"
+manylinux-riscv64-image = "manylinux_2_39"
 manylinux-pypy_x86_64-image = "manylinux_2_28"
-manylinux-pypy_i686-image = "manylinux2014"
+manylinux-pypy_i686-image = "manylinux_2_28"
 manylinux-pypy_aarch64-image = "manylinux_2_28"

 musllinux-x86_64-image = "musllinux_1_2"
@@ -47,8 +53,15 @@ musllinux-aarch64-image = "musllinux_1_2"
 musllinux-ppc64le-image = "musllinux_1_2"
 musllinux-s390x-image = "musllinux_1_2"
 musllinux-armv7l-image = "musllinux_1_2"
-musllinux-riscv64-image = "ghcr.io/pypa/cibuildwheel/no_default_image:please_use_override"
+musllinux-riscv64-image = "musllinux_1_2"

+[tool.cibuildwheel.xbuild-files]
+numpy = [
+    "numpy/_core/include/numpy/_numpyconfig.h",
+    "numpy/_core/include/numpy/numpyconfig.h",
+    "numpy/_core/lib/libnpymath.a",
+    "numpy/random/lib/libnpyrandom.a",
+]

 [tool.cibuildwheel.linux]
 repair-wheel-command = "auditwheel repair -w {dest_dir} {wheel}"
@@ -57,7 +70,13 @@ repair-wheel-command = "auditwheel repair -w {dest_dir} {wheel}"
 repair-wheel-command = "delocate-wheel --require-archs {delocate_archs} -w {dest_dir} -v {wheel}"

 [tool.cibuildwheel.windows]
+repair-wheel-command = "delvewheel repair -w {dest_dir} -v {wheel}"
+
+[tool.cibuildwheel.android]
+repair-wheel-command = "auditwheel repair --ldpaths {ldpaths} -w {dest_dir} {wheel}"

 [tool.cibuildwheel.ios]

 [tool.cibuildwheel.pyodide]
+audit-command = ""
+build-frontend = "pyodide-build"
@@ -8,7 +8,7 @@
                <key>choiceAttribute</key>
                <string>selected</string>
                <key>choiceIdentifier</key>
-                <string>org.python.Python.PythonTFramework-3.13</string>
+                <string>org.python.Python.PythonTFramework-3.15</string>
        </dict>
 </array>
 </plist>
@@ -33,7 +33,7 @@ def main() -> None:
        [sys.executable, "-E", "-s", "-m", "pip", "install", "--upgrade", "certifi"]
    )

-    import certifi
+    import certifi  # noqa: PLC0415

    # change working directory to the default SSL directory
    os.chdir(openssl_dir)
@@ -0,0 +1,103 @@
+import shutil
+import sys
+import sysconfig
+from pathlib import Path
+
+SITE_PACKAGE_PATH = Path(__file__).parent
+
+###########################################################################
+# importlib module patches
+###########################################################################
+
+
+def patch_env_create(env):
+    """
+    Patch the process of creating virtual environments to ensure that the cross
+    environment modification files are also copied as part of environment
+    creation.
+    """
+    old_pip_env_create = env._PipBackend.create
+
+    def pip_env_create(self, path, *args, **kwargs):
+        result = old_pip_env_create(self, path, *args, **kwargs)
+        # Copy any _cross_*.pth or _cross_*.py file, plus the cross-platform
+        # sysconfigdata module and sysconfig_vars JSON to the new environment.
+        data_name = sysconfig._get_sysconfigdata_name()
+        json_name = data_name.replace("_sysconfigdata", "_sysconfig_vars")
+        for filename in [
+            "_cross_venv.pth",
+            "_cross_venv.py",
+            f"_cross_{sys.implementation._multiarch.replace('-', '_')}.py",
+            f"{data_name}.py",
+            f"{json_name}.json",
+        ]:
+            src = SITE_PACKAGE_PATH / filename
+            target = Path(path) / src.relative_to(SITE_PACKAGE_PATH.parent.parent.parent)
+            if not target.exists():
+                shutil.copy(src, target)
+        return result
+
+    env._PipBackend.create = pip_env_create
+
+
+# Import hook that patches the creation of virtual environments by `build`
+#
+# The approach used here is the same as the one used by virtualenv to patch
+# distutils (but without support for the older load_module API).
+# https://docs.python.org/3/library/importlib.html#setting-up-an-importer
+_BUILD_PATCH = ("build.env",)
+
+
+class _Finder:
+    """A meta path finder that allows patching the imported build modules."""
+
+    fullname = None
+
+    # lock[0] is threading.Lock(), but initialized lazily to avoid importing
+    # threading very early at startup, because there are gevent-based
+    # applications that need to be first to import threading by themselves.
+    # See https://github.com/pypa/virtualenv/issues/1895 for details.
+    lock = []  # noqa: RUF012
+
+    def find_spec(self, fullname, path, target=None):
+        if fullname in _BUILD_PATCH and self.fullname is None:
+            # initialize lock[0] lazily
+            if len(self.lock) == 0:
+                import threading
+
+                lock = threading.Lock()
+                # there is possibility that two threads T1 and T2 are
+                # simultaneously running into find_spec, observing .lock as
+                # empty, and further going into hereby initialization. However
+                # due to the GIL, list.append() operation is atomic and this
+                # way only one of the threads will "win" to put the lock
+                # - that every thread will use - into .lock[0].
+                # https://docs.python.org/3/faq/library.html#what-kinds-of-global-value-mutation-are-thread-safe
+                self.lock.append(lock)
+
+            from functools import partial
+            from importlib.util import find_spec
+
+            with self.lock[0]:
+                self.fullname = fullname
+                try:
+                    spec = find_spec(fullname, path)
+                    if spec is not None:
+                        # https://www.python.org/dev/peps/pep-0451/#how-loading-will-work
+                        old = spec.loader.exec_module
+                        func = self.exec_module
+                        if old is not func:
+                            spec.loader.exec_module = partial(func, old)
+                        return spec
+                finally:
+                    self.fullname = None
+        return None
+
+    @staticmethod
+    def exec_module(old, module):
+        old(module)
+        if module.__name__ in _BUILD_PATCH:
+            patch_env_create(module)
+
+
+sys.meta_path.insert(0, _Finder())
@@ -0,0 +1,79 @@
+# A site package that turns a macOS virtual environment
+# into an arm64 iphoneos cross-platform virtual environment
+import platform
+import subprocess
+import sys
+import sysconfig
+
+###########################################################################
+# sys module patches
+###########################################################################
+sys.cross_compiling = True
+sys.platform = "ios"
+sys.implementation._multiarch = "arm64-iphoneos"
+sys.base_prefix = sysconfig._get_sysconfigdata()["prefix"]
+sys.base_exec_prefix = sysconfig._get_sysconfigdata()["prefix"]
+
+###########################################################################
+# subprocess module patches
+###########################################################################
+subprocess._can_fork_exec = True
+
+
+###########################################################################
+# platform module patches
+###########################################################################
+
+
+def cross_system():
+    return "iOS"
+
+
+def cross_uname():
+    return platform.uname_result(
+        system="iOS",
+        node="build",
+        release="13.0",
+        version="",
+        machine="arm64",
+    )
+
+
+def cross_ios_ver(system="", release="", model="", is_simulator=False):
+    if system == "":
+        system = "iOS"
+    if release == "":
+        release = "13.0"
+    if model == "":
+        model = "iphoneos"
+
+    return platform.IOSVersionInfo(system, release, model, False)
+
+
+platform.system = cross_system
+platform.uname = cross_uname
+platform.ios_ver = cross_ios_ver
+
+
+###########################################################################
+# sysconfig module patches
+###########################################################################
+
+
+def cross_get_platform():
+    return "ios-13.0-arm64-iphoneos"
+
+
+def cross_get_sysconfigdata_name():
+    return "_sysconfigdata__ios_arm64-iphoneos"
+
+
+sysconfig.get_platform = cross_get_platform
+sysconfig._get_sysconfigdata_name = cross_get_sysconfigdata_name
+
+# Ensure module-level values cached at time of import are updated.
+sysconfig._BASE_PREFIX = sys.base_prefix
+sysconfig._BASE_EXEC_PREFIX = sys.base_exec_prefix
+
+# Force sysconfig data to be loaded (and cached).
+sysconfig._init_config_vars()
@@ -0,0 +1,22 @@
+# A site customization that can be used to trick pip into installing packages
+# cross-platform. If the folder containing this file is on your PYTHONPATH when
+# you invoke python, the interpreter will behave as if it were running on
+# arm64 iphoneos.
+import sys
+import os
+
+# Apply the cross-platform patch
+import _cross_arm64_iphoneos
+import _cross_venv
+
+
+# Call the next sitecustomize script if there is one
+# (https://nedbatchelder.com/blog/201001/running_code_at_python_startup.html).
+del sys.modules["sitecustomize"]
+this_dir = os.path.dirname(__file__)
+path_index = sys.path.index(this_dir)
+del sys.path[path_index]
+try:
+    import sitecustomize  # noqa: F401
+finally:
+    sys.path.insert(path_index, this_dir)
@@ -0,0 +1,79 @@
+# A site package that turns a macOS virtual environment
+# into an arm64 iphonesimulator cross-platform virtual environment
+import platform
+import subprocess
+import sys
+import sysconfig
+
+###########################################################################
+# sys module patches
+###########################################################################
+sys.cross_compiling = True
+sys.platform = "ios"
+sys.implementation._multiarch = "arm64-iphonesimulator"
+sys.base_prefix = sysconfig._get_sysconfigdata()["prefix"]
+sys.base_exec_prefix = sysconfig._get_sysconfigdata()["prefix"]
+
+###########################################################################
+# subprocess module patches
+###########################################################################
+subprocess._can_fork_exec = True
+
+
+###########################################################################
+# platform module patches
+###########################################################################
+
+
+def cross_system():
+    return "iOS"
+
+
+def cross_uname():
+    return platform.uname_result(
+        system="iOS",
+        node="build",
+        release="13.0",
+        version="",
+        machine="arm64",
+    )
+
+
+def cross_ios_ver(system="", release="", model="", is_simulator=False):
+    if system == "":
+        system = "iOS"
+    if release == "":
+        release = "13.0"
+    if model == "":
+        model = "iphonesimulator"
+
+    return platform.IOSVersionInfo(system, release, model, True)
+
+
+platform.system = cross_system
+platform.uname = cross_uname
+platform.ios_ver = cross_ios_ver
+
+
+###########################################################################
+# sysconfig module patches
+###########################################################################
+
+
+def cross_get_platform():
+    return "ios-13.0-arm64-iphonesimulator"
+
+
+def cross_get_sysconfigdata_name():
+    return "_sysconfigdata__ios_arm64-iphonesimulator"
+
+
+sysconfig.get_platform = cross_get_platform
+sysconfig._get_sysconfigdata_name = cross_get_sysconfigdata_name
+
+# Ensure module-level values cached at time of import are updated.
+sysconfig._BASE_PREFIX = sys.base_prefix
+sysconfig._BASE_EXEC_PREFIX = sys.base_exec_prefix
+
+# Force sysconfig data to be loaded (and cached).
+sysconfig._init_config_vars()
@@ -0,0 +1,22 @@
+# A site customization that can be used to trick pip into installing packages
+# cross-platform. If the folder containing this file is on your PYTHONPATH when
+# you invoke python, the interpreter will behave as if it were running on
+# arm64 iphonesimulator.
+import sys
+import os
+
+# Apply the cross-platform patch
+import _cross_arm64_iphonesimulator
+import _cross_venv
+
+
+# Call the next sitecustomize script if there is one
+# (https://nedbatchelder.com/blog/201001/running_code_at_python_startup.html).
+del sys.modules["sitecustomize"]
+this_dir = os.path.dirname(__file__)
+path_index = sys.path.index(this_dir)
+del sys.path[path_index]
+try:
+    import sitecustomize  # noqa: F401
+finally:
+    sys.path.insert(path_index, this_dir)
@@ -0,0 +1,175 @@
+from __future__ import annotations
+
+import json
+import pprint
+import shutil
+import sys
+from importlib import util as importlib_util
+from pathlib import Path
+from typing import Any
+
+
+def localized_vars(orig_vars: dict[str, Any], slice_path: Path) -> dict[str, Any]:
+    """Update (where possible) any references to build-time variables with the
+    best guess of the installed location.
+    """
+    # The host's sysconfigdata will include references to build-time variables.
+    # Update these to refer to the current known install location.
+    orig_prefix = orig_vars["prefix"]
+    localized_vars = {}
+    for key, value in orig_vars.items():
+        final = value
+        if isinstance(value, str):
+            # Replace any reference to the build installation prefix
+            final = final.replace(orig_prefix, str(slice_path))
+            # Replace any reference to the build-time Framework location
+            final = final.replace("-F .", f"-F {slice_path}")
+        localized_vars[key] = final
+
+    return localized_vars
+
+
+def localize_sysconfigdata(sysconfig_path: Path, venv_site_packages: Path) -> None:
+    """Localize a sysconfigdata python module.
+
+    :param sysconfig_path: The platform config that contains the
+        sysconfigdata module to localize.
+    :param venv_site_packages: The site packages folder where the localized
+        sysconfigdata module should be output.
+    """
+    # Find the "_sysconfigdata_*.py" file in the platform config
+    sysconfigdata_path = next(sysconfig_path.glob("_sysconfigdata_*.py"))
+
+    # Import the sysconfigdata module
+    spec = importlib_util.spec_from_file_location(sysconfigdata_path.stem, sysconfigdata_path)
+    if spec is None:
+        msg = f"Unable to load spec for {sysconfigdata_path}"
+        raise ValueError(msg)
+    if spec.loader is None:
+        msg = f"Spec for {sysconfigdata_path} does not define a loader"
+        raise ValueError(msg)
+    sysconfigdata = importlib_util.module_from_spec(spec)
+    spec.loader.exec_module(sysconfigdata)
+
+    # Write the updated sysconfigdata module into the cross-platform site.
+    slice_path = sysconfigdata_path.parent.parent.parent
+    with (venv_site_packages / sysconfigdata_path.name).open("w") as f:
+        f.write(f"# Generated from {sysconfigdata_path}\n")
+        f.write("build_time_vars = ")
+        pprint.pprint(
+            localized_vars(sysconfigdata.build_time_vars, slice_path), stream=f, compact=True
+        )
+
+
+def localize_sysconfig_vars(sysconfig_path: Path, venv_site_packages: Path) -> None:
+    """Localize a sysconfig_vars.json file.
+
+    :param sysconfig_path: The platform config that contains the
+        sysconfigdata module to localize.
+    :param venv_site_packages: The site-packages folder where the localized
+        sysconfig_vars.json file should be output.
+    """
+    # Find the "_sysconfig_vars_*.json" file in the platform config
+    sysconfig_vars_path = next(sysconfig_path.glob("_sysconfig_vars_*.json"))
+
+    with sysconfig_vars_path.open("rb") as f:
+        build_time_vars = json.load(f)
+
+    slice_path = sysconfig_vars_path.parent.parent.parent
+    with (venv_site_packages / sysconfig_vars_path.name).open("w") as f:
+        json.dump(localized_vars(build_time_vars, slice_path), f, indent=2)
+
+
+def make_cross_venv(
+    venv_path: Path,
+    sysconfig_path: Path,
+    platform_config_path: Path,
+) -> None:
+    """Convert a virtual environment into a cross-platform environment.
+
+    :param venv_path: The path to the root of the venv.
+    :param sysconfig_path: The path containing sysconfigdata files for the
+        target platform.
+    :param platform_config_path: The path containing the cross-venv support
+        scripts (_cross_venv.py and the multiarch-specific _cross_*.py).
+    """
+    if not venv_path.exists():
+        msg = f"Virtual environment {venv_path} does not exist."
+        raise ValueError(msg)
+    if not (venv_path / "bin/python3").exists():
+        msg = f"{venv_path} does not appear to be a virtual environment."
+        raise ValueError(msg)
+
+    LIB_PATH = f"lib/python{sys.version_info[0]}.{sys.version_info[1]}"
+
+    # Derive the multiarch tag from the sysconfigdata filename if available;
+    # otherwise fall back to the directory name (BeeWare convention).
+    sysconfigdata_files = list(sysconfig_path.glob("_sysconfigdata_*.py"))
+    if sysconfigdata_files:
+        multiarch_tag = sysconfigdata_files[0].stem.split("_ios_")[1]
+        cross_multiarch = f"_cross_{multiarch_tag.replace('-', '_')}"
+    else:
+        multiarch_tag = sysconfig_path.name
+        cross_multiarch = f"_cross_{multiarch_tag.replace('-', '_')}"
+
+    print(
+        f"Converting {venv_path} into a {multiarch_tag} environment... ",
+        end="",
+    )
+
+    # Update path references in the sysconfigdata to reflect local conditions.
+    venv_site_packages = venv_path / LIB_PATH / "site-packages"
+    localize_sysconfigdata(sysconfig_path, venv_site_packages)
+    localize_sysconfig_vars(sysconfig_path, venv_site_packages)
+    # The multiarch-specific script may be directly in platform_config_path (BeeWare
+    # convention, where all files are co-located) or in a named subdirectory
+    # (cibuildwheel resource layout, where each multiarch has its own subdir).
+    multiarch_script = platform_config_path / f"{cross_multiarch}.py"
+    if not multiarch_script.exists():
+        multiarch_script = platform_config_path / multiarch_tag / f"{cross_multiarch}.py"
+    shutil.copy(
+        multiarch_script,
+        venv_site_packages / f"{cross_multiarch}.py",
+    )
+    shutil.copy(
+        platform_config_path / "_cross_venv.py",
+        venv_site_packages / "_cross_venv.py",
+    )
+    # Write the .pth file that will enable the cross-env modifications
+    (venv_site_packages / "_cross_venv.pth").write_text(
+        f"import {cross_multiarch}; import _cross_venv\n"
+    )
+
+    print("done.")
+
+
+if __name__ == "__main__":
+    try:
+        sysconfig_path = Path(sys.argv[2]).resolve()
+    except IndexError:
+        sysconfig_path = Path(__file__).parent
+
+    try:
+        platform_config_path = Path(sys.argv[3]).resolve()
+    except IndexError:
+        platform_config_path = sysconfig_path
+
+    try:
+        venv_path = Path(sys.argv[1]).resolve()
+        make_cross_venv(venv_path, sysconfig_path, platform_config_path)
+    except IndexError:
+        print("""
+Convert a virtual environment into a cross-platform environment.
+
+Usage:
+    make_cross_venv <venv> (<sysconfig path>) (<platform config path>)
+
+The sysconfig path is the path that contains the `_sysconfigdata-*.py` file
+for the platform being targeted. If an explicit sysconfig path isn't
+provided, it is assumed the directory containing the make_cross_venv script
+also contains the sysconfig data for the interpreter.
+
+The platform config path is the path that contains the cross-venv support
+scripts. If an explicit platform config path isn't provided, it is assumed
+that the sysconfig path also contains the platform configuration files.
+""")
@@ -0,0 +1,79 @@
+# A site package that turns a macOS virtual environment
+# into an x86_64 iphonesimulator cross-platform virtual environment
+import platform
+import subprocess
+import sys
+import sysconfig
+
+###########################################################################
+# sys module patches
+###########################################################################
+sys.cross_compiling = True
+sys.platform = "ios"
+sys.implementation._multiarch = "x86_64-iphonesimulator"
+sys.base_prefix = sysconfig._get_sysconfigdata()["prefix"]
+sys.base_exec_prefix = sysconfig._get_sysconfigdata()["prefix"]
+
+###########################################################################
+# subprocess module patches
+###########################################################################
+subprocess._can_fork_exec = True
+
+
+###########################################################################
+# platform module patches
+###########################################################################
+
+
+def cross_system():
+    return "iOS"
+
+
+def cross_uname():
+    return platform.uname_result(
+        system="iOS",
+        node="build",
+        release="13.0",
+        version="",
+        machine="x86_64",
+    )
+
+
+def cross_ios_ver(system="", release="", model="", is_simulator=False):
+    if system == "":
+        system = "iOS"
+    if release == "":
+        release = "13.0"
+    if model == "":
+        model = "iphonesimulator"
+
+    return platform.IOSVersionInfo(system, release, model, True)
+
+
+platform.system = cross_system
+platform.uname = cross_uname
+platform.ios_ver = cross_ios_ver
+
+
+###########################################################################
+# sysconfig module patches
+###########################################################################
+
+
+def cross_get_platform():
+    return "ios-13.0-x86_64-iphonesimulator"
+
+
+def cross_get_sysconfigdata_name():
+    return "_sysconfigdata__ios_x86_64-iphonesimulator"
+
+
+sysconfig.get_platform = cross_get_platform
+sysconfig._get_sysconfigdata_name = cross_get_sysconfigdata_name
+
+# Ensure module-level values cached at time of import are updated.
+sysconfig._BASE_PREFIX = sys.base_prefix
+sysconfig._BASE_EXEC_PREFIX = sys.base_exec_prefix
+
+# Force sysconfig data to be loaded (and cached).
+sysconfig._init_config_vars()
@@ -0,0 +1,22 @@
+# A site customization that can be used to trick pip into installing packages
+# cross-platform. If the folder containing this file is on your PYTHONPATH when
+# you invoke python, the interpreter will behave as if it were running on
+# x86_64 iphonesimulator.
+import sys
+import os
+
+# Apply the cross-platform patch
+import _cross_x86_64_iphonesimulator
+import _cross_venv
+
+
+# Call the next sitecustomize script if there is one
+# (https://nedbatchelder.com/blog/201001/running_code_at_python_startup.html).
+del sys.modules["sitecustomize"]
+this_dir = os.path.dirname(__file__)
+path_index = sys.path.index(this_dir)
+del sys.path[path_index]
+try:
+    import sitecustomize  # noqa: F401
+finally:
+    sys.path.insert(path_index, this_dir)
@@ -1,3 +1,4 @@
 url = "https://nodejs.org/dist/"
-v22 = "v22.16.0"
-v20 = "v20.19.2"
+v24 = "v24.18.0"
+v22 = "v22.23.1"
+v20 = "v20.20.2"
@@ -1,47 +1,54 @@
 [x86_64]
-manylinux2014 = quay.io/pypa/manylinux2014_x86_64:2025.06.08-1
-manylinux_2_28 = quay.io/pypa/manylinux_2_28_x86_64:2025.06.08-1
-manylinux_2_34 = quay.io/pypa/manylinux_2_34_x86_64:2025.06.08-1
-musllinux_1_2 = quay.io/pypa/musllinux_1_2_x86_64:2025.06.08-1
+manylinux2014 = quay.io/pypa/manylinux2014_x86_64@sha256:0d25b049964b2549b83384036abdff06789a8c0b1e9ff003ec80f0d531f79e50  # 2026.07.19-1
+manylinux_2_28 = quay.io/pypa/manylinux_2_28_x86_64@sha256:a61875a2f84cab7df8de222ff12cabc08ff86eb4ad402ac90ba7bdaed9600cca  # 2026.07.19-1
+manylinux_2_34 = quay.io/pypa/manylinux_2_34_x86_64@sha256:b6e1f264da7bf4e8db3e6a625ea1ecaf1e52290253df8588f71e4a9e50a85a17  # 2026.07.19-1
+musllinux_1_2 = quay.io/pypa/musllinux_1_2_x86_64@sha256:fd0694e23637ae8d13433c58f647aba1aae5de4fd50350201307be453a8b2ff4  # 2026.07.19-1

 [i686]
-manylinux2014 = quay.io/pypa/manylinux2014_i686:2025.06.08-1
-musllinux_1_2 = quay.io/pypa/musllinux_1_2_i686:2025.06.08-1
+manylinux2014 = quay.io/pypa/manylinux2014_i686@sha256:9833ed0665e4bd2aceeda6f7ea81b69c75a941464b659edf62c98aa63526d1ba  # 2026.07.19-1
+manylinux_2_28 = quay.io/pypa/manylinux_2_28_i686@sha256:3a4de216ae551c1cbb8f93d4bbf9faebe7fb16a67afa3380b9a3ed2cc7b80fcf  # 2026.07.19-1
+manylinux_2_34 = quay.io/pypa/manylinux_2_34_i686@sha256:1fc55618156152a6570991a6ee81038fd507b48c41cbdede495931146b074869  # 2026.07.19-1
+musllinux_1_2 = quay.io/pypa/musllinux_1_2_i686@sha256:a85be8fc5aa7fa291b8bee5647469d3d48dd26600cc7295553ff47ca60906ff2  # 2026.07.19-1

 [aarch64]
-manylinux2014 = quay.io/pypa/manylinux2014_aarch64:2025.06.08-1
-manylinux_2_28 = quay.io/pypa/manylinux_2_28_aarch64:2025.06.08-1
-manylinux_2_34 = quay.io/pypa/manylinux_2_34_aarch64:2025.06.08-1
-musllinux_1_2 = quay.io/pypa/musllinux_1_2_aarch64:2025.06.08-1
+manylinux2014 = quay.io/pypa/manylinux2014_aarch64@sha256:ae34a6ceeefe0b535c525b2e96f297311c8f1e01cfd8b9be5f647eece5b5c60b  # 2026.07.19-1
+manylinux_2_28 = quay.io/pypa/manylinux_2_28_aarch64@sha256:162c81dfd3efc710732a571717d3c916a6945ebf279e879ddee3243af96fe46f  # 2026.07.19-1
+manylinux_2_34 = quay.io/pypa/manylinux_2_34_aarch64@sha256:ae032906c631ad572a91bcc9545023d327822912957ae85a57c85181836662b6  # 2026.07.19-1
+musllinux_1_2 = quay.io/pypa/musllinux_1_2_aarch64@sha256:e6ac3eca5f7d2cd5b8267b94b65d9a693e7ba06f5ba4c6643b1b0e6f9ae2cde3  # 2026.07.19-1

 [ppc64le]
-manylinux2014 = quay.io/pypa/manylinux2014_ppc64le:2025.06.08-1
-manylinux_2_28 = quay.io/pypa/manylinux_2_28_ppc64le:2025.06.08-1
-manylinux_2_34 = quay.io/pypa/manylinux_2_34_ppc64le:2025.06.08-1
-musllinux_1_2 = quay.io/pypa/musllinux_1_2_ppc64le:2025.06.08-1
+manylinux2014 = quay.io/pypa/manylinux2014_ppc64le@sha256:7e311ceece0fd3faa54a8539fb0b7906ee2ac068ecc39095e48ed1097312eaa0  # 2026.07.19-1
+manylinux_2_28 = quay.io/pypa/manylinux_2_28_ppc64le@sha256:32ec597dd87e27980750115a6c020cae54fd17386e18d86d695e35e6b3a3e0da  # 2026.07.19-1
+manylinux_2_34 = quay.io/pypa/manylinux_2_34_ppc64le@sha256:7f649dea6f31fbc4ca6d665e78e87a192b55e739c44ed9965129956be77c4e3d  # 2026.07.19-1
+musllinux_1_2 = quay.io/pypa/musllinux_1_2_ppc64le@sha256:d59ad21615cf5b83cc9046cf7c44d07e8ef1247333e8a72147d7c781008605c1  # 2026.07.19-1

 [s390x]
-manylinux2014 = quay.io/pypa/manylinux2014_s390x:2025.06.08-1
-manylinux_2_28 = quay.io/pypa/manylinux_2_28_s390x:2025.06.08-1
-manylinux_2_34 = quay.io/pypa/manylinux_2_34_s390x:2025.06.08-1
-musllinux_1_2 = quay.io/pypa/musllinux_1_2_s390x:2025.06.08-1
+manylinux2014 = quay.io/pypa/manylinux2014_s390x@sha256:e392818123219665c259c9a5e389cecd978918dc279fe8e3542864f1067b9cdb  # 2026.07.19-1
+manylinux_2_28 = quay.io/pypa/manylinux_2_28_s390x@sha256:9c4f347bc43b1b799a296f6801a8845af132fa6f919cc6237b889c8d2e16ae01  # 2026.07.19-1
+manylinux_2_34 = quay.io/pypa/manylinux_2_34_s390x@sha256:37fe79ec71fed0eaa4d6edfb22244699877e3cd92a2ca4679bf9e4fd5f45c61d  # 2026.07.19-1
+musllinux_1_2 = quay.io/pypa/musllinux_1_2_s390x@sha256:e29d28c68a0bd4594fd41cb2435ca64388038b05c24e77b34f186ff90a2968c4  # 2026.07.19-1

 [pypy_x86_64]
-manylinux2014 = quay.io/pypa/manylinux2014_x86_64:2025.06.08-1
-manylinux_2_28 = quay.io/pypa/manylinux_2_28_x86_64:2025.06.08-1
-manylinux_2_34 = quay.io/pypa/manylinux_2_34_x86_64:2025.06.08-1
+manylinux2014 = quay.io/pypa/manylinux2014_x86_64@sha256:0d25b049964b2549b83384036abdff06789a8c0b1e9ff003ec80f0d531f79e50  # 2026.07.19-1
+manylinux_2_28 = quay.io/pypa/manylinux_2_28_x86_64@sha256:a61875a2f84cab7df8de222ff12cabc08ff86eb4ad402ac90ba7bdaed9600cca  # 2026.07.19-1
+manylinux_2_34 = quay.io/pypa/manylinux_2_34_x86_64@sha256:b6e1f264da7bf4e8db3e6a625ea1ecaf1e52290253df8588f71e4a9e50a85a17  # 2026.07.19-1

 [pypy_i686]
-manylinux2014 = quay.io/pypa/manylinux2014_i686:2025.06.08-1
+manylinux2014 = quay.io/pypa/manylinux2014_i686@sha256:9833ed0665e4bd2aceeda6f7ea81b69c75a941464b659edf62c98aa63526d1ba  # 2026.07.19-1
+manylinux_2_28 = quay.io/pypa/manylinux_2_28_i686@sha256:3a4de216ae551c1cbb8f93d4bbf9faebe7fb16a67afa3380b9a3ed2cc7b80fcf  # 2026.07.19-1
+manylinux_2_34 = quay.io/pypa/manylinux_2_34_i686@sha256:1fc55618156152a6570991a6ee81038fd507b48c41cbdede495931146b074869  # 2026.07.19-1

 [pypy_aarch64]
-manylinux2014 = quay.io/pypa/manylinux2014_aarch64:2025.06.08-1
-manylinux_2_28 = quay.io/pypa/manylinux_2_28_aarch64:2025.06.08-1
-manylinux_2_34 = quay.io/pypa/manylinux_2_34_aarch64:2025.06.08-1
+manylinux2014 = quay.io/pypa/manylinux2014_aarch64@sha256:ae34a6ceeefe0b535c525b2e96f297311c8f1e01cfd8b9be5f647eece5b5c60b  # 2026.07.19-1
+manylinux_2_28 = quay.io/pypa/manylinux_2_28_aarch64@sha256:162c81dfd3efc710732a571717d3c916a6945ebf279e879ddee3243af96fe46f  # 2026.07.19-1
+manylinux_2_34 = quay.io/pypa/manylinux_2_34_aarch64@sha256:ae032906c631ad572a91bcc9545023d327822912957ae85a57c85181836662b6  # 2026.07.19-1

 [armv7l]
-manylinux_2_31 = quay.io/pypa/manylinux_2_31_armv7l:2025.06.08-1
-musllinux_1_2 = quay.io/pypa/musllinux_1_2_armv7l:2025.06.08-1
+manylinux_2_31 = quay.io/pypa/manylinux_2_31_armv7l@sha256:a58ece566251a37b3b4cd17d7ef85d88df05f80670c7dfe80c1b1ffe4cd00bf8  # 2026.07.19-1
+manylinux_2_35 = quay.io/pypa/manylinux_2_35_armv7l@sha256:c8dba9616907a810e2668afb88153bf47a84422933733dbf4ea7b561af5e8d1e  # 2026.07.19-1
+musllinux_1_2 = quay.io/pypa/musllinux_1_2_armv7l@sha256:d87cbc211df71486a6a90fb2bece474166f3e2dcf81bbfc4be07607fd64185b0  # 2026.07.19-1

 [riscv64]
+manylinux_2_39 = quay.io/pypa/manylinux_2_39_riscv64@sha256:04b3acc69a6cebb10ac1252587d202acce6445d91c783d3f92229bb2b2483069  # 2026.07.19-1
+musllinux_1_2 = quay.io/pypa/musllinux_1_2_riscv64@sha256:2d36623ffc59785e124ecf2992456847baaf2f2e0a87e64d23f2f6a69e5a0357  # 2026.07.19-1

@@ -8,11 +8,11 @@ from typing import NoReturn

 class TestStringMethods(unittest.TestCase):
    def test_fail(self) -> NoReturn:
-        if sys.platform == "ios":
+        if sys.platform in ["android", "ios"]:
            msg = (
                "You tried to run tests from the testbed app's working "
                "directory, without specifying `test-sources`. "
-                "On iOS, you must copy your test files to the testbed app by "
+                "On this platform, you must copy your test files to the testbed app by "
                "setting the `test-sources` option in your cibuildwheel "
                "configuration."
            )
@@ -1 +1 @@
-default = { version = "20.31.2", url = "https://github.com/pypa/get-virtualenv/blob/20.31.2/public/virtualenv.pyz?raw=true" }
+default = { version = "21.6.1", url = "https://github.com/pypa/get-virtualenv/releases/download/21.6.1/virtualenv.pyz", sha256 = "32490c6eea415c3a8f44ee112bbef07bc7b70a0aba706672240c6c66d4f7d9cc" }
@@ -1,7 +1,14 @@
-import json
-from typing import Any
+from __future__ import annotations

-from .util import resources
+__lazy_modules__ = {"cibuildwheel.util", "json"}
+
+import json
+
+from cibuildwheel.util import resources
+
+TYPE_CHECKING = False
+if TYPE_CHECKING:
+    from typing import Any


 def get_schema(tool_name: str = "cibuildwheel") -> dict[str, Any]:
@@ -1,13 +1,21 @@
+from __future__ import annotations
+
+__lazy_modules__ = {"bracex", "fnmatch", "itertools", "packaging", "packaging.version"}
+
 import dataclasses
 import itertools
 from enum import StrEnum
 from fnmatch import fnmatch
-from typing import Any

 import bracex
-from packaging.specifiers import SpecifierSet
 from packaging.version import Version

+TYPE_CHECKING = False
+if TYPE_CHECKING:
+    from typing import Self
+
+    from packaging.specifiers import SpecifierSet
+

 def selector_matches(patterns: str, string: str) -> bool:
    """
@@ -29,20 +37,19 @@ class EnableGroup(StrEnum):
    Groups of build selectors that are not enabled by default.
    """

-    CPythonExperimentalRiscV64 = "cpython-experimental-riscv64"
-    CPythonFreeThreading = "cpython-freethreading"
    CPythonPrerelease = "cpython-prerelease"
    GraalPy = "graalpy"
    PyPy = "pypy"
    PyPyEoL = "pypy-eol"
+    PyodideEoL = "pyodide-eol"
    PyodidePrerelease = "pyodide-prerelease"

    @classmethod
-    def all_groups(cls) -> frozenset["EnableGroup"]:
+    def all_groups(cls) -> frozenset[Self]:
        return frozenset(cls)

    @classmethod
-    def parse_option_value(cls, value: str) -> frozenset["EnableGroup"]:
+    def parse_option_value(cls, value: str) -> frozenset[Self]:
        """
        Parses a string of space-separated values into a set of EnableGroup
        members. The string may contain group names or "all".
@@ -76,7 +83,7 @@ class BuildSelector:
    def __call__(self, build_id: str) -> bool:
        # Filter build selectors by python_requires if set
        if self.requires_python is not None:
-            py_ver_str = build_id.split("-")[0].split("_")[0]
+            py_ver_str = build_id.split("-", maxsplit=1)[0].split("_", maxsplit=1)[0]
            py_ver_str = py_ver_str.removesuffix("t")
            major = int(py_ver_str[2])
            minor = int(py_ver_str[3:])
@@ -85,31 +92,38 @@ class BuildSelector:
                return False

        # filter out groups that are not enabled
-        if EnableGroup.CPythonFreeThreading not in self.enable and fnmatch(build_id, "cp3??t-*"):
+        if EnableGroup.CPythonPrerelease not in self.enable and fnmatch(build_id, "cp315*"):
            return False
-        if EnableGroup.CPythonPrerelease not in self.enable and fnmatch(build_id, "cp314*"):
+        is_pypy_eol = fnmatch(build_id, "pp3?-*") or fnmatch(build_id, "pp310-*")
+        is_pypy = fnmatch(build_id, "pp*") and not is_pypy_eol
+        if EnableGroup.PyPy not in self.enable and is_pypy:
            return False
-        if EnableGroup.PyPy not in self.enable and fnmatch(build_id, "pp31*"):
-            return False
-        if EnableGroup.PyPyEoL not in self.enable and fnmatch(build_id, "pp3?-*"):
-            return False
-        if EnableGroup.CPythonExperimentalRiscV64 not in self.enable and fnmatch(
-            build_id, "*_riscv64"
-        ):
+        if EnableGroup.PyPyEoL not in self.enable and is_pypy_eol:
            return False
        if EnableGroup.GraalPy not in self.enable and fnmatch(build_id, "gp*"):
            return False
-        if EnableGroup.PyodidePrerelease not in self.enable and fnmatch(
-            build_id, "cp313-pyodide_*"
-        ):
+        if EnableGroup.PyodideEoL not in self.enable and fnmatch(build_id, "cp312-pyodide_*"):
            return False
+        # NOTE: Re-enable this when we have a new Pyodide prerelease (e.g., 315.0.0a1+)
+        # When doing this, also:
+        #   1. update Pyodide tests in unit_test/build_selector_test.py and unit_test/options_test.py accordingly.
+        #   2. update Python versions for Pyodide identifiers in cibuildwheel/selector.py.
+        #   3. update constraints as necessary via bin/generate_pyodide_constraints.py and add/delete
+        #      Pyodide constraints files in cibuildwheel/resources/constraints/ as necessary.
+        # When re-enabling, update the pattern to match the experimental Python version when
+        # it is bumped to Python 3.15 (likely cp315-pyodide_*).
+        # This depends on the CPython version being used in the Pyodide runtime at the time.
+        # if EnableGroup.PyodidePrerelease not in self.enable and fnmatch(
+        #     build_id, "cp315-pyodide_*"
+        # ):
+        #     return False

        should_build = selector_matches(self.build_config, build_id)
        should_skip = selector_matches(self.skip_config, build_id)

        return should_build and not should_skip

-    def options_summary(self) -> Any:
+    def options_summary(self) -> dict[str, str | list[str]]:
        return {
            "build_config": self.build_config,
            "skip_config": self.skip_config,
@@ -130,5 +144,5 @@ class TestSelector:
        should_skip = selector_matches(self.skip_config, build_id)
        return not should_skip

-    def options_summary(self) -> Any:
+    def options_summary(self) -> dict[str, str]:
        return {"skip_config": self.skip_config}
@@ -12,7 +12,7 @@ __all__ = (
 PathOrStr = str | os.PathLike[str]


-PlatformName = Literal["linux", "macos", "windows", "pyodide", "ios"]
+PlatformName = Literal["linux", "macos", "windows", "pyodide", "android", "ios"]
 PLATFORMS: Final[frozenset[PlatformName]] = frozenset(typing.get_args(PlatformName))


@@ -1,14 +1,22 @@
+from __future__ import annotations
+
+__lazy_modules__ = {"cibuildwheel.errors", "shlex", "shutil", "subprocess"}
+
 import os
 import shlex
 import shutil
 import subprocess
 import sys
 import typing
-from collections.abc import Iterator, Mapping
-from typing import Final, Literal

-from ..errors import FatalError
-from ..typing import PathOrStr
+from cibuildwheel.errors import FatalError
+
+TYPE_CHECKING = False
+if TYPE_CHECKING:
+    from collections.abc import Iterator, Mapping
+    from typing import Final, Literal
+
+    from cibuildwheel.typing import PathOrStr

 _IS_WIN: Final[bool] = sys.platform.startswith("win")

@@ -72,7 +80,7 @@ def call(
    if not capture_stdout:
        return None
    sys.stderr.write(result.stderr)
-    return typing.cast(str, result.stdout)
+    return typing.cast("str", result.stdout)


 def shell(
--- a/Show More
+++ b/Show More
				`@@ -0,0 +1 @@`
				`import _cross_venv; _cross_venv.initialize()`