pypa · mayeut · Dec 3, 2025 · Dec 6, 2025 · Dec 6, 2025 · Dec 6, 2025
diff --git a/README.rst b/README.rst
@@ -102,7 +102,7 @@ for repeatable builds.
 manylinux_2_39 (AlmaLinux/RockyLinux 10 based) - ALPHA
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
-Toolchain: GCC 14
+Toolchain: GCC 15
 
 - aarch64 image: ``quay.io/pypa/manylinux_2_39_aarch64``
 - riscv64 image: ``quay.io/pypa/manylinux_2_39_riscv64``
@@ -157,7 +157,7 @@ grafted into a wheel, will fail to run on older hardware. There's no PEP to hand
 yet when it comes to packaging or installing wheels. Auditwheel doesn't detect this either.
 See https://github.com/pypa/manylinux/issues/1725
 
-Toolchain: GCC 14
+Toolchain: GCC 15
 
 - x86_64 image: ``quay.io/pypa/manylinux_2_34_x86_64``
 - i686 image: ``quay.io/pypa/manylinux_2_34_i686``
@@ -207,7 +207,7 @@ distros using glibc 2.31 or later, including:
 manylinux_2_28 (AlmaLinux 8 based)
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
-Toolchain: GCC 14
+Toolchain: GCC 15
 
 - x86_64 image: ``quay.io/pypa/manylinux_2_28_x86_64``
 - i686 image: ``quay.io/pypa/manylinux_2_28_i686``
@@ -284,10 +284,10 @@ Toolchain: GCC 4.8
 - i686 image: ``quay.io/pypa/manylinux1_i686``
 
 
-musllinux_1_2 (Alpine Linux 3.22 based, 3.13+ compatible)
+musllinux_1_2 (Alpine Linux 3.23 based, 3.13+ compatible)
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
-Toolchain: GCC 14
+Toolchain: GCC 15
 
 - x86_64 image: ``quay.io/pypa/musllinux_1_2_x86_64``
 - i686 image: ``quay.io/pypa/musllinux_1_2_i686``
@@ -323,12 +323,12 @@ Image content
 
 All supported images currently contain:
 
-- CPython 3.8, 3.9, 3.10, 3.11, 3.12, 3.13, 3.13t, 3.14, 3.14t and PyPy 3.11 installed in
+- CPython 3.9, 3.10, 3.11, 3.12, 3.13, 3.14, 3.14t, 3.15, 3.15t and PyPy 3.11 installed in
   ``/opt/python/<python tag>-<abi tag>``. The directories are named
   after the PEP 425 tags for each environment --
-  e.g. ``/opt/python/cp313-cp313`` contains a CPython 3.13 build, and
+  e.g. ``/opt/python/cp314-cp314`` contains a CPython 3.14 build, and
   can be used to produce wheels named like
-  ``<pkg>-<version>-cp313-cp313-<arch>.whl``.
+  ``<pkg>-<version>-cp314-cp314-<arch>.whl``.
 
 - Development packages for all the libraries that PEP 571/599 list. One should not assume the presence of any other development package.
 

diff --git a/build.sh b/build.sh
@@ -35,7 +35,7 @@ if [ "${POLICY}" == "manylinux2014" ]; then
 	fi
 elif [ "${POLICY}" == "manylinux_2_28" ]; then
 	BASEIMAGE="quay.io/almalinuxorg/almalinux:8"
-	DEVTOOLSET_ROOTPATH="/opt/rh/gcc-toolset-14/root"
+	DEVTOOLSET_ROOTPATH="/opt/rh/gcc-toolset-15/root"
 	PREPEND_PATH="${DEVTOOLSET_ROOTPATH}/usr/bin:"
 	LD_LIBRARY_PATH_ARG="${DEVTOOLSET_ROOTPATH}/usr/lib64:${DEVTOOLSET_ROOTPATH}/usr/lib:${DEVTOOLSET_ROOTPATH}/usr/lib64/dyninst:${DEVTOOLSET_ROOTPATH}/usr/lib/dyninst"
 elif [ "${POLICY}" == "manylinux_2_31" ]; then
@@ -45,7 +45,7 @@ elif [ "${POLICY}" == "manylinux_2_31" ]; then
 	LD_LIBRARY_PATH_ARG=
 elif [ "${POLICY}" == "manylinux_2_34" ]; then
 	BASEIMAGE="quay.io/almalinuxorg/almalinux:9"
-	DEVTOOLSET_ROOTPATH="/opt/rh/gcc-toolset-14/root"
+	DEVTOOLSET_ROOTPATH="/opt/rh/gcc-toolset-15/root"
 	PREPEND_PATH="/usr/local/bin:${DEVTOOLSET_ROOTPATH}/usr/bin:"
 	LD_LIBRARY_PATH_ARG="${DEVTOOLSET_ROOTPATH}/usr/lib64:${DEVTOOLSET_ROOTPATH}/usr/lib:${DEVTOOLSET_ROOTPATH}/usr/lib64/dyninst:${DEVTOOLSET_ROOTPATH}/usr/lib/dyninst"
 elif [ "${POLICY}" == "manylinux_2_35" ]; then
@@ -59,15 +59,11 @@ elif [ "${POLICY}" == "manylinux_2_39" ]; then
 		x86_64) GOARCH="amd64/v2";;
 		riscv64) BASEIMAGE="rockylinux/rockylinux:10";;
 	esac
-	# TODO enable gcc-toolset-15 once available (probably in 10.1)
-	# DEVTOOLSET_ROOTPATH="/opt/rh/gcc-toolset-15/root"
-	# PREPEND_PATH="/usr/local/bin:${DEVTOOLSET_ROOTPATH}/usr/bin:"
-	# LD_LIBRARY_PATH_ARG="${DEVTOOLSET_ROOTPATH}/usr/lib64:${DEVTOOLSET_ROOTPATH}/usr/lib:${DEVTOOLSET_ROOTPATH}/usr/lib64/dyninst:${DEVTOOLSET_ROOTPATH}/usr/lib/dyninst"
-	DEVTOOLSET_ROOTPATH=
-	PREPEND_PATH=
-	LD_LIBRARY_PATH_ARG=
+	DEVTOOLSET_ROOTPATH="/opt/rh/gcc-toolset-15/root"
+	PREPEND_PATH="/usr/local/bin:${DEVTOOLSET_ROOTPATH}/usr/bin:"
+	LD_LIBRARY_PATH_ARG="${DEVTOOLSET_ROOTPATH}/usr/lib64:${DEVTOOLSET_ROOTPATH}/usr/lib:${DEVTOOLSET_ROOTPATH}/usr/lib64/dyninst:${DEVTOOLSET_ROOTPATH}/usr/lib/dyninst"
 elif [ "${POLICY}" == "musllinux_1_2" ]; then
-	BASEIMAGE="alpine:3.22"
+	BASEIMAGE="alpine:3.23"
 	DEVTOOLSET_ROOTPATH=
 	PREPEND_PATH=
 	LD_LIBRARY_PATH_ARG=

diff --git a/docker/Dockerfile b/docker/Dockerfile
@@ -164,11 +164,6 @@ COPY --from=cosign-bin /ko-app/cosign /usr/local/bin/cosign
 COPY build_scripts/build-cpython.sh /opt/_internal/build_scripts/
 
 
-FROM build_cpython AS build_cpython38
-ARG MANYLINUX_DISABLE_CLANG_FOR_CPYTHON
-RUN --mount=type=bind,from=static_clang,target=/tmp/cross-compiler,ro \
-    /tmp/cross-compiler/entrypoint /opt/_internal/build_scripts/build-cpython.sh lukasz@langa.pl https://github.com/login/oauth 3.8.20
-
 FROM build_cpython AS build_cpython39
 ARG MANYLINUX_DISABLE_CLANG_FOR_CPYTHON
 RUN --mount=type=bind,from=static_clang,target=/tmp/cross-compiler,ro \
@@ -194,11 +189,6 @@ ARG MANYLINUX_DISABLE_CLANG_FOR_CPYTHON
 RUN --mount=type=bind,from=static_clang,target=/tmp/cross-compiler,ro \
     /tmp/cross-compiler/entrypoint /opt/_internal/build_scripts/build-cpython.sh thomas@python.org https://accounts.google.com 3.13.11
 
-FROM build_cpython AS build_cpython313_nogil
-ARG MANYLINUX_DISABLE_CLANG_FOR_CPYTHON
-RUN --mount=type=bind,from=static_clang,target=/tmp/cross-compiler,ro \
-    /tmp/cross-compiler/entrypoint /opt/_internal/build_scripts/build-cpython.sh thomas@python.org https://accounts.google.com 3.13.11 nogil
-
 FROM build_cpython AS build_cpython314
 ARG MANYLINUX_DISABLE_CLANG_FOR_CPYTHON
 RUN --mount=type=bind,from=static_clang,target=/tmp/cross-compiler,ro \
@@ -209,6 +199,16 @@ ARG MANYLINUX_DISABLE_CLANG_FOR_CPYTHON
 RUN --mount=type=bind,from=static_clang,target=/tmp/cross-compiler,ro \
     /tmp/cross-compiler/entrypoint /opt/_internal/build_scripts/build-cpython.sh hugo@python.org https://github.com/login/oauth 3.14.2 nogil
 
+FROM build_cpython AS build_cpython315
+ARG MANYLINUX_DISABLE_CLANG_FOR_CPYTHON
+RUN --mount=type=bind,from=static_clang,target=/tmp/cross-compiler,ro \
+    /tmp/cross-compiler/entrypoint /opt/_internal/build_scripts/build-cpython.sh hugo@python.org https://github.com/login/oauth 3.15.0a2
+
+FROM build_cpython AS build_cpython315_nogil
+ARG MANYLINUX_DISABLE_CLANG_FOR_CPYTHON
+RUN --mount=type=bind,from=static_clang,target=/tmp/cross-compiler,ro \
+    /tmp/cross-compiler/entrypoint /opt/_internal/build_scripts/build-cpython.sh hugo@python.org https://github.com/login/oauth 3.15.0a2 nogil
+
 
 FROM runtime_base
 COPY --from=build_tcl_tk /manylinux-rootfs /
@@ -217,18 +217,18 @@ COPY --from=build_zstd /manylinux-rootfs /
 COPY --from=build_sqlite3 /manylinux-rootfs /
 COPY --from=build_git /manylinux-rootfs /
 COPY build_scripts /opt/_internal/build_scripts/
-RUN --mount=type=bind,target=/build_cpython38,from=build_cpython38 \
-    --mount=type=bind,target=/build_cpython39,from=build_cpython39 \
+RUN --mount=type=bind,target=/build_cpython39,from=build_cpython39 \
     --mount=type=bind,target=/build_cpython310,from=build_cpython310 \
     --mount=type=bind,target=/build_cpython311,from=build_cpython311 \
     --mount=type=bind,target=/build_cpython312,from=build_cpython312 \
     --mount=type=bind,target=/build_cpython313,from=build_cpython313 \
-    --mount=type=bind,target=/build_cpython313_nogil,from=build_cpython313_nogil \
     --mount=type=bind,target=/build_cpython314,from=build_cpython314 \
     --mount=type=bind,target=/build_cpython314_nogil,from=build_cpython314_nogil \
+    --mount=type=bind,target=/build_cpython315,from=build_cpython315 \
+    --mount=type=bind,target=/build_cpython315_nogil,from=build_cpython315_nogil \
     mkdir -p /opt/_internal && \
     cp -rf /build_cpython*/opt/_internal/cpython* /opt/_internal/ && \
-    if test -n "$(find /build_cpython314/opt/_internal -maxdepth 1 -name 'openssl*' -print -quit)"; then cp -rf /build_cpython314/opt/_internal/openssl* /opt/_internal/; fi && \
+    if test -n "$(find /build_cpython315/opt/_internal -maxdepth 1 -name 'openssl*' -print -quit)"; then cp -rf /build_cpython315/opt/_internal/openssl* /opt/_internal/; fi && \
     manylinux-entrypoint /opt/_internal/build_scripts/finalize.sh \
       pp311-pypy311_pp73
 

diff --git a/docker/build_scripts/build-cpython.sh b/docker/build_scripts/build-cpython.sh
@@ -55,15 +55,15 @@ elif [ "${BASE_POLICY}_${AUDITWHEEL_ARCH}" == "musllinux_armv7l" ]; then
 fi
 
 case "${CPYTHON_VERSION}" in
-	3.8.*|3.9.*|3.10.*) sed -i "s|/usr/local/include/sqlite3|/opt/_internal/sqlite3/include|g ; s|sqlite_extra_link_args = ()|sqlite_extra_link_args = ('-Wl,-rpath=/opt/_internal/sqlite3/lib',)|g" setup.py;;
+	3.9.*|3.10.*) sed -i "s|/usr/local/include/sqlite3|/opt/_internal/sqlite3/include|g ; s|sqlite_extra_link_args = ()|sqlite_extra_link_args = ('-Wl,-rpath=/opt/_internal/sqlite3/lib',)|g" setup.py;;
 	*) ;;
 esac
 
 OPENSSL_PREFIX=$(find /opt/_internal -maxdepth 1 -name 'openssl*')
 if [ "${OPENSSL_PREFIX}" != "" ]; then
 	CONFIGURE_ARGS+=("--with-openssl=${OPENSSL_PREFIX}")
 	case "${CPYTHON_VERSION}" in
-		3.8.*|3.9.*) export LDFLAGS_EXTRA="-Wl,-rpath,${OPENSSL_PREFIX}/lib";;
+		3.9.*) export LDFLAGS_EXTRA="-Wl,-rpath,${OPENSSL_PREFIX}/lib";;
 		*) CONFIGURE_ARGS+=(--with-openssl-rpath=auto);;
 	esac
 fi

diff --git a/docker/build_scripts/finalize-one.sh b/docker/build_scripts/finalize-one.sh
@@ -36,7 +36,7 @@ elif [ -f "/usr/local/bin/cpython${PY_VER}" ]; then
 else
 	"${PREFIX}/bin/python" -m ensurepip
 	case ${PY_VER} in
-		3.8|3.9|3.10|3.11) "${PREFIX}/bin/python" -m pip uninstall -y setuptools;;
+		3.9|3.10|3.11) "${PREFIX}/bin/python" -m pip uninstall -y setuptools;;
 	esac
 	"${PREFIX}/bin/python" -m pip install -U --require-hashes -r "${MY_DIR}/requirements${PY_VER}.txt"
 fi

diff --git a/docker/build_scripts/finalize.sh b/docker/build_scripts/finalize.sh
@@ -106,8 +106,3 @@ LC_ALL=C "${MY_DIR}/update-system-packages.sh"
 
 # wrap compilers (see https://github.com/pypa/manylinux/issues/1725)
 "${MY_DIR}/install-gcc-wrapper.sh"
-
-# patch libstdc++.so  (see https://github.com/pypa/manylinux/issues/1760)
-if [ "${AUDITWHEEL_POLICY}" == "manylinux_2_28" ] || [ "${AUDITWHEEL_POLICY}" == "manylinux_2_34" ]; then
-	find "${DEVTOOLSET_ROOTPATH}" -name 'libstdc++.so' -exec sed -i 's/INPUT\s*(\s*\([^ ]\+\)\s*\([^ ]\+\)\s*)/INPUT ( \1 \2 \1 )/g' {} \;
-fi
diff --git a/docker/build_scripts/install-runtime-packages.sh b/docker/build_scripts/install-runtime-packages.sh
@@ -128,13 +128,7 @@ elif [ "${OS_ID_LIKE}" == "rhel" ]; then
 	else
 		dnf config-manager --set-enabled crb
 	fi
-	if [ "${AUDITWHEEL_POLICY}" == "manylinux_2_28" ] || [ "${AUDITWHEEL_POLICY}" == "manylinux_2_34" ]; then
-		TOOLCHAIN_DEPS=(gcc-toolset-14-binutils gcc-toolset-14-gcc gcc-toolset-14-gcc-c++ gcc-toolset-14-gcc-gfortran gcc-toolset-14-libatomic-devel)
-	else
-		# TODO enable gcc-toolset-15 once available (probably in 10.1)
-		# TOOLCHAIN_DEPS=(gcc-toolset-15-binutils gcc-toolset-15-gcc gcc-toolset-15-gcc-c++ gcc-toolset-15-gcc-gfortran gcc-toolset-15-libatomic-devel)
-		TOOLCHAIN_DEPS=(binutils gcc gcc-c++ gcc-gfortran libatomic)
-	fi
+	TOOLCHAIN_DEPS=(gcc-toolset-15-binutils gcc-toolset-15-gcc gcc-toolset-15-gcc-c++ gcc-toolset-15-gcc-gfortran gcc-toolset-15-libatomic-devel)
 elif [ "${OS_ID_LIKE}" == "debian" ]; then
 	TOOLCHAIN_DEPS+=(binutils gcc g++ gfortran libatomic1)
 	BASE_TOOLS+=(gpg gpg-agent hardlink hostname locales xz-utils)

diff --git a/docker/build_scripts/python_versions.json b/docker/build_scripts/python_versions.json
@@ -23,23 +23,6 @@
       "sha256": "f3315d1a3f13e7fcd785d0ca9b954d251da5f5d0dedae094c28a0566a239e4fd"
     }
   },
-  "pp38-pypy38_pp73": {
-    "x86_64": {
-      "version": "7.3.11",
-      "download_url": "https://downloads.python.org/pypy/pypy3.8-v7.3.11-linux64.tar.bz2",
-      "sha256": "470330e58ac105c094041aa07bb05676b06292bc61409e26f5c5593ebb2292d9"
-    },
-    "aarch64": {
-      "version": "7.3.11",
-      "download_url": "https://downloads.python.org/pypy/pypy3.8-v7.3.11-aarch64.tar.bz2",
-      "sha256": "9a2fa0b8d92b7830aa31774a9a76129b0ff81afbd22cd5c41fbdd9119e859f55"
-    },
-    "i686": {
-      "version": "7.3.11",
-      "download_url": "https://downloads.python.org/pypy/pypy3.8-v7.3.11-linux32.tar.bz2",
-      "sha256": "a79b31fce8f5bc1f9940b6777134189a1d3d18bda4b1c830384cda90077c9176"
-    }
-  },
   "pp39-pypy39_pp73": {
     "x86_64": {
       "version": "7.3.16",

diff --git a/docker/build_scripts/requirements3.15.txt b/docker/build_scripts/requirements3.15.txt
@@ -0,0 +1,20 @@
+# This file was autogenerated by uv via the following command:
+#    nox -s update_python_dependencies
+build==1.3.0 \
+    --hash=sha256:698edd0ea270bde950f53aed21f3a0135672206f3911e0176261a31e0e07b397 \
+    --hash=sha256:7145f0b5061ba90a1500d60bd1b13ca0a8a4cebdd0cc16ed8adf1c0e739f43b4
+    # via -r requirements.in
+packaging==25.0 \
+    --hash=sha256:29572ef2b1f17581046b3a2227d5c611fb25ec70ca1ba8554b24b0e69331a484 \
+    --hash=sha256:d443872c98d677bf60f6a1f2f8c1cb748e8fe762d2bf9d3148b5599295b0fc4f
+    # via
+    #   -r requirements.in
+    #   build
+pip==25.3 ; implementation_name != 'graalpy' \
+    --hash=sha256:8d0538dbbd7babbd207f261ed969c65de439f6bc9e5dbd3b3b9a77f25d95f343 \
+    --hash=sha256:9655943313a94722b7774661c21049070f6bbb0a1516bf02f7c8d5d9201514cd
+    # via -r requirements.in
+pyproject-hooks==1.2.0 \
+    --hash=sha256:1e859bd5c40fae9448642dd871adf459e5e2084186e8d2c2a79a824c970da1f8 \
+    --hash=sha256:9e5c6bfa8dcc30091c74b0cf803c81fdd29d94f01992a7707bc97babb1141913
+    # via build
diff --git a/docker/build_scripts/requirements3.8.txt b/docker/build_scripts/requirements3.8.txt
diff --git a/docker/tests/forty-two/setup.py b/docker/tests/forty-two/setup.py
@@ -3,6 +3,6 @@
 setup(
     name="forty_two",
     version="0.1.0",
-    python_requires=">=3.8",
+    python_requires=">=3.9",
     ext_modules=[Extension("forty_two", sources=["forty-two.c"])],
 )
diff --git a/docker/tests/run_tests.sh b/docker/tests/run_tests.sh
@@ -12,10 +12,10 @@ if [ "${AUDITWHEEL_POLICY:0:10}" == "musllinux_" ]; then
 else
 	if [ "${AUDITWHEEL_ARCH}" == "x86_64" ] || [ "${AUDITWHEEL_ARCH}" == "aarch64" ]; then
 		EXPECTED_PYTHON_COUNT=10
-		EXPECTED_PYTHON_COUNT_ALL=15
+		EXPECTED_PYTHON_COUNT_ALL=14
 	elif [ "${AUDITWHEEL_ARCH}" == "i686" ]; then
 		EXPECTED_PYTHON_COUNT=10
-		EXPECTED_PYTHON_COUNT_ALL=13
+		EXPECTED_PYTHON_COUNT_ALL=12
 	else
 		EXPECTED_PYTHON_COUNT=9
 		EXPECTED_PYTHON_COUNT_ALL=9

diff --git a/noxfile.py b/noxfile.py
@@ -19,7 +19,7 @@ def update_python_dependencies(session):
     # regenerate the constraints files
     env["UV_CUSTOM_COMPILE_COMMAND"] = f"nox -s {session.name}"
 
-    for python_minor in range(8, 15):
+    for python_minor in range(9, 16):
         python_version = f"3.{python_minor}"
         session.run(
             "uv",