00471: CVE-2025-12084

* pythongh-142145: Remove quadratic behavior in node ID cache clearing (pythonGH-142146)
* pythongh-142754: Ensure that Element & Attr instances have the ownerDocument attribute (pythonGH-142794)
(cherry picked from commit 1cc7551)
(cherry picked from commit 08d8e18)
(cherry picked from commit 8d2d7bb)

Co-authored-by: Jacob Walls <[email protected]>
Co-authored-by: Seth Michael Larson <[email protected]>
Co-authored-by: Petr Viktorin <[email protected]>
Co-authored-by: Hugo van Kemenade <[email protected]>
Co-authored-by: Gregory P. Smith <[email protected]>
Co-authored-by: Hugo van Kemenade <[email protected]>
Co-authored-by: Gregory P. Smith <[email protected]>
Co-authored-by: Gregory P. Smith <[email protected]>

00466: Downstream only: Skip tests not working with older expat version

We want to run these tests in Fedora and EPEL 10, but not in EPEL 9,
which has too old version of expat. We set the upper bound version
in the conditionalized skip to a release available in CentOS Stream 10,
which is tested as working.

00466: Downstream only: Skip tests not working with older expat version

We want to run these tests in Fedora and EPEL 10, but not in EPEL 9,
which has too old version of expat. We set the upper bound version
in the conditionalized skip to a release available in CentOS Stream 10,
which is tested as working.

00466: Downstream only: Skip tests not working with older expat version

We want to run these tests in Fedora and EPEL 10, but not in EPEL 9,
which has too old version of expat. We set the upper bound version
in the conditionalized skip to a release available in CentOS Stream 10,
which is tested as working.

00466: Downstream only: Skip tests not working with older expat version

We want to run these tests in Fedora and EPEL 10, but not in EPEL 9,
which has too old version of expat. We set the upper bound version
in the conditionalized skip to a release available in CentOS Stream 10,
which is tested as working.

00469: pythongh-141784: Fix _remote_debugging_module.c compilation on…

… 32-bit Linux (python#141796)

Include Python.h before system headers to make sure that
_remote_debugging_module.c uses the same types (ABI) than Python.

00452: Properly apply exported CFLAGS for dtrace/systemtap builds

When using --with-dtrace the resulting object file could be missing
specific CFLAGS exported by the build system due to the systemtap
script using specific defaults.

Exporting the CC and CFLAGS variables before the dtrace invocation
allows us to properly apply CFLAGS exported by the build system
even when cross-compiling.

Co-authored-by: stratakis <[email protected]>

00466: Downstream only: Skip tests not working with older expat version

We want to run these tests in Fedora and EPEL 10, but not in EPEL 9,
which has too old version of expat. We set the upper bound version
in the conditionalized skip to a release available in CentOS Stream 10,
which is tested as working.

00466: Downstream only: Skip tests not working with older expat version

We want to run these tests in Fedora and EPEL 10, but not in EPEL 9,
which has too old version of expat. We set the upper bound version
in the conditionalized skip to a release available in CentOS Stream 10,
which is tested as working.

00464: Enable PAC and BTI protections for aarch64

Apply protection against ROP/JOP attacks for aarch64 on asm_trampoline.S

The BTI flag must be applied in the assembler sources for this class
of attacks to be mitigated on newer aarch64 processors.

Upstream PR: https://github.com/python/cpython/pull/130864/files

The upstream patch is incomplete but only for the case where
frame pointers are not used on 3.13+.

Since on Fedora we always compile with frame pointers the BTI/PAC
hardware protections can be enabled without losing Perf unwinding.