gentoo auto-resync : 07:02:2024 - 15:59:05

16 files changed, 1158 insertions, 19 deletions

diff --git a/dev-lang/Manifest.gz b/dev-lang/Manifest.gz
index 8fbeebb5963d..3a4ae84a88d4 100644
--- a/dev-lang/Manifest.gz
+++ b/dev-lang/Manifest.gz
diff --git a/dev-lang/php/Manifest b/dev-lang/php/Manifest
index defcf1c3c8d3..1f6c2985b439 100644
--- a/dev-lang/php/Manifest
+++ b/dev-lang/php/Manifest
@@ -1,4 +1,5 @@
 AUX 20php5-envd 208 BLAKE2B 7d876903c7f58ab148e1d6bb2b0d86cb9f5ecd241bc00e92138d30e6272b277fddbe2ee233c82e6420c1ea42d493b872d975ed06295ba7502be5c26afa458f5a SHA512 5ddd373d586800a112666b21e449342028ccf60f4f7f1a87f4913e75f718ded881590bed79cbeff75c581a24acb8b46403f2bf496cd05f264b4f9f1e6c5e86fe
+AUX php-8.1.27-gcc14-libxml.patch 1982 BLAKE2B dcb329e5bae787aa0d47f70e7d60f5a187568b10f2e3a1dd33b5fc422df7b5774e9f4093b728d3621bcdfa2d3d96da98272e80be553cce5ea61151b362347c0a SHA512 f68cb97cc3b0b8da5eb62d7217fcbe1652579771ed19aba0b52740cb056c85710a1b1bff3286dbefa72bc22885dd4b4df8c5f5b1f089c977106251d9daa2065d
 AUX php-8.2.8-openssl-tests.patch 790 BLAKE2B fcfa6f361470f2baa65d2bbbde7c9629841546a560aa6f88d85b68727004e24949f9516340eba0339e575dcf06077d08540a7a6d58a0cda42d5cd26bf48d9e46 SHA512 d29b5334abee8bcbef62c88c01c9eaf887f25901763db75e754f6690e24138c9e45783943d32402f693bd7e4564d737521a8b0b8034d5401bac73ff30f453050
 AUX php-capstone-optional.patch 2497 BLAKE2B f23236130be88d28d933d5482f1925c4e32e09c5022544ac2dec62465e9296baabe64f57fedd7ccb9f4499d354bd466d10cfb66596e8be029be6fa4f82dbc1a1 SHA512 a9000d789a7bc54d4b6cf8ed287dcfd71958dfc85c6417737dcd66b9461be5b1aa2568a19f5a9cd29927fe9d955ac24d04e2f64f1c4018110a8f81a6eb4813c5
 AUX php-fpm_at-simple.service 316 BLAKE2B 0ba10f3e3b004fbf14956e1e4f04f59b8a127e6717fe6b92c09b9f931033a11551c75fbbee9010f6b694c5a8758ca0eec9eed457ae304ba0dea8f2c256c3b8d4 SHA512 7367a3f8d3874f8e0c76f331ba613a0250db02f60ad9f87affaf448dcb5bc34bcecb91d88f415764a12b24b46ae3d1b738a002af9f77a4b707e916e83a0021fd
@@ -9,7 +10,7 @@ DIST php-8.1.27.tar.xz 11915228 BLAKE2B 83f4f3c25435b26dc526dc1fd7aff44cd0315734
 DIST php-8.2.15.tar.xz 12075384 BLAKE2B cef15868968538e232093bd66d862a88f0960325f2274eaf53a3d114d01787c58844aa3bce8bc09a723acd95801e1935a60e79fc189317e7f1ba19196dbfcdc4 SHA512 56c94bcafe07cf4bf5eb5fc6c67fcf16654c44a262ffb18188fc3ffac5e9bb11d39093bfb26c26bc8d2dec7e530d1a175180909262c9b5c30130cf5a4a293166
 DIST php-8.3.2.tar.xz 12440200 BLAKE2B 90ab2fe220d99cc1da47162e04c768dc35ed4044ea9154f67bbc9124372859b85a33270bc38d41e9ab28df4b0defaf0e78cffe8eb8bd6fdfbec296a31ea4beab SHA512 acf9013d35ae639558fd4816d12dcae03f8af7944c2639f33cd33517503c6170d30101da6c72ebdaf5542bcaf858a54a22ecc8f86822a128f52938bd6ea9606c
 EBUILD php-8.1.26-r1.ebuild 21992 BLAKE2B 6a2d19aefc689f44603bf95a14b21e345ae739a5dd66a620a065f36e4b72233753a8144f41434211de28ee49ac0e3c0dda3dd712749215a721007126104cddfc SHA512 928b5d071618a69d398c15223c8885924c5dbe6581bacc93f041a27c6caf4384ae43e0aeeb6f2bf31582b5d1838a6656a8e6cb24d18ddddf44e9df1e18694c93
-EBUILD php-8.1.27.ebuild 22144 BLAKE2B c3ef95c2923a6f28f2db8c4e06cd301d4969eea5c3aacbca5fd97a5e80194a713059c8be8462a4ec89775ae66c80d79fad3dd14fdc1fd95fd4fb202ce0991453 SHA512 837629e4a22d0ec7ef8a2f7debc8efcceaa5378dac2e8324656b4cbdeb4101c5b0f1ea2ee196fc763de191949b269dd3368f969a5ef6ad0cd870e1569f40285f
+EBUILD php-8.1.27-r1.ebuild 22189 BLAKE2B d905eea0beaf0df5d7d6f9422cce57fef41239eede600fb35c300cac025be4859d0e8c4f058c93aa591d5706527b45bf59ee713b3386699c3c3265bd10fc159c SHA512 8fb999c6cea7cd25f5f8356ef704122cd6ec21b55a49642215d52fd43f5facb0703e2bffb8112bd39395d985cc2db29d3f1f96e4848818456910d52b057d15bc
 EBUILD php-8.2.15.ebuild 25071 BLAKE2B 22e68d7c2cc7320c075a9795f61c821b584f3fd3e43b4c0aa269321bc57b148a264220eb205fe85126f82ee2f53790479b8978a3a6faed94e4d18b7a245dfc53 SHA512 c3477fb2b148b4f413e3729f656187809a396d0d1cfc7d89836c69de70adc8873b8d6b9765c68122f1b1a6009082899579e6a319ecd2d6ab1aac842e2bdda596
 EBUILD php-8.3.2.ebuild 23786 BLAKE2B 19a772be50a0eca05a50d1012b0912bd09227dbdaa5a88393c3c9ce58c8960c4a843d3db88dae18589d12cc2fbbd62fb1d445a5d73af57636b12daa8ab8c5798 SHA512 8470ae9592b7d576f0565433a06c63d9cf0b56584d88ba8f1b23ec75aede135eedf75837de3980d0fc6928beb7e7aca89f2e4e80c3410b276032fc36ea998755
 MISC metadata.xml 3892 BLAKE2B 69f96654884695b15fd3caf260a8e9d7e1b1e004c7d72bba340e093dd981d1fed5c00dfb547fea3d58be8f1516e52a01a966abbbfb90f10bd9dc14421e18bd8f SHA512 f7d93f5213aceb33e95ad883ed7015b6ab22eef5b0749e137aad2ecb8fc5187a9aca2b7f095421ff12d6102d5087fc2280e6c3ced12eda14e9bda8f3241b29a5
diff --git a/dev-lang/php/files/php-8.1.27-gcc14-libxml.patch b/dev-lang/php/files/php-8.1.27-gcc14-libxml.patch
new file mode 100644
index 000000000000..f477ba541bfa
--- /dev/null
+++ b/dev-lang/php/files/php-8.1.27-gcc14-libxml.patch
@@ -0,0 +1,57 @@
+https://github.com/php/php-src/commit/0a39890c967aa57225bb6bdf4821aff7a3a3c082.patch
+From: Niels Dossche <7771979+nielsdos@users.noreply.github.com>
+Date: Fri, 1 Dec 2023 18:03:35 +0100
+Subject: [PATCH] Fix libxml2 2.12 build due to API breaks
+
+See https://github.com/php/php-src/actions/runs/7062192818/job/19225478601
+--- a/ext/libxml/libxml.c
++++ b/ext/libxml/libxml.c
+@@ -472,7 +472,11 @@ static void _php_libxml_free_error(void *ptr)
+ 	xmlResetError((xmlErrorPtr) ptr);
+ }
+ 
+-static void _php_list_set_error_structure(xmlErrorPtr error, const char *msg)
++#if LIBXML_VERSION >= 21200
++static void _php_list_set_error_structure(const xmlError *error, const char *msg)
++#else
++static void _php_list_set_error_structure(xmlError *error, const char *msg)
++#endif
+ {
+ 	xmlError error_copy;
+ 	int ret;
+@@ -725,7 +729,11 @@ PHP_LIBXML_API void php_libxml_ctx_warning(void *ctx, const char *msg, ...)
+ 	va_end(args);
+ }
+ 
++#if LIBXML_VERSION >= 21200
++PHP_LIBXML_API void php_libxml_structured_error_handler(void *userData, const xmlError *error)
++#else
+ PHP_LIBXML_API void php_libxml_structured_error_handler(void *userData, xmlErrorPtr error)
++#endif
+ {
+ 	_php_list_set_error_structure(error, NULL);
+ 
+@@ -957,11 +965,9 @@ PHP_FUNCTION(libxml_use_internal_errors)
+ /* {{{ Retrieve last error from libxml */
+ PHP_FUNCTION(libxml_get_last_error)
+ {
+-	xmlErrorPtr error;
+-
+ 	ZEND_PARSE_PARAMETERS_NONE();
+ 
+-	error = xmlGetLastError();
++	const xmlError *error = xmlGetLastError();
+ 
+ 	if (error) {
+ 		object_init_ex(return_value, libxmlerror_class_entry);
+--- a/ext/soap/php_sdl.c
++++ b/ext/soap/php_sdl.c
+@@ -332,7 +332,7 @@ static void load_wsdl_ex(zval *this_ptr, char *struri, sdlCtx *ctx, int include)
+ 	sdl_restore_uri_credentials(ctx);
+ 
+ 	if (!wsdl) {
+-		xmlErrorPtr xmlErrorPtr = xmlGetLastError();
++		const xmlError *xmlErrorPtr = xmlGetLastError();
+ 
+ 		if (xmlErrorPtr) {
+ 			soap_error2(E_ERROR, "Parsing WSDL: Couldn't load from '%s' : %s", struri, xmlErrorPtr->message);
diff --git a/dev-lang/php/php-8.1.27.ebuild b/dev-lang/php/php-8.1.27-r1.ebuild
index ae56343d00b2..3e3a44b7b8b2 100644
--- a/dev-lang/php/php-8.1.27.ebuild
+++ b/dev-lang/php/php-8.1.27-r1.ebuild
@@ -148,6 +148,7 @@ PHP_MV="$(ver_cut 1)"
 PATCHES=(
 	"${FILESDIR}/php-iodbc-header-location.patch"
 	"${FILESDIR}/php-capstone-optional.patch"
+	"${FILESDIR}/php-8.1.27-gcc14-libxml.patch"
 )
 
 php_install_ini() {
diff --git a/dev-lang/python/Manifest b/dev-lang/python/Manifest
index c1e22f6d2791..7c97457b518f 100644
--- a/dev-lang/python/Manifest
+++ b/dev-lang/python/Manifest
@@ -6,8 +6,12 @@ DIST Python-3.10.13.tar.xz 19663088 BLAKE2B d9a8edf89d0ccd665fd5ed444a144af240e0
 DIST Python-3.10.13.tar.xz.asc 833 BLAKE2B b00222b30a6701e77c11c6019e2240be7cf42f2b4e558c03f7a058664d242a00665fbc52fdf03106e84c75f49b51b705d8acd1f381d1f41ada67c4647652ef4c SHA512 3083e66f8d26128302dc77a0c6ba3bfefc4229928a1bbd06460f2fec2421188bd30d493e3bce138cde1fed1df206e1dda04912b9f43a0b81229f1e69135e3a7f
 DIST Python-3.11.7.tar.xz 20074108 BLAKE2B 3414118d30076e4223571825b5c595c5795422244de20dc70d07389a03b2c2b03b98a9ff562a8fd164db8f776dd741a9d7beb1c2ae4087ec6af677619a9dfd80 SHA512 11e06f2ffe1f66888cb5b4e9f607de815294d6863a77eda6ec6d7c724ef158df9f51881f4a956d4a6fa973c2fb6fd031d495e3496e9b0bb53793fb1cc8434c63
 DIST Python-3.11.7.tar.xz.asc 833 BLAKE2B 32d6984631d7b4b064e2c2588835a89098842a0ecc3d8ccb893830c9946124a159123e2082e6da3abcdb97d27dde0fb68c1fd11e4ed2bf2e0641fa95191354bb SHA512 7b342990c6e32897047f8ba33c4d264f1be987b73843b61bd7db08bfa1a7280c616e9dcd96225f37602f876549d011ff82a4d79f1e32a5ab7d7cc22651bba44f
+DIST Python-3.11.8.tar.xz 20041256 BLAKE2B 361253743c58facd01063922523c39fafe647a4204e04db79f36f0c3c180c2f1e95e8ea6662e85a8da06bdbd84d32bb7df9ac0febf361122df5b207ade562740 SHA512 434e727fa370def348838fd84acb69b4d309cfb03f61bf5069150164e9ca005637ac01dfbf997f445607d4e28d02c8bed0858b36589240ccadaa4c14c19f2320
+DIST Python-3.11.8.tar.xz.asc 833 BLAKE2B c82907808de345b263cd1869589004a29e94f225c338a6da3035130728bda137727898743f30d64cc4b819a28cd035fa70123cc45cbf8719b66f9d3ef14452e2 SHA512 aebec01f84e96a76f6c5949004df2bb51c817bac3fc8d925ee26ded1ff2d80bec1b579dd0fc129004bc9cd81cbdcdcdf7c1f0471c3d26b70bd6dac11b97187e0
 DIST Python-3.12.1.tar.xz 20583448 BLAKE2B 20f6f8b7b0d7e560d269138a38c5b9362073aa414f0a862357644b97eb76f9bf70b5365cac1dd1a615895302b046bd88404966e56818d57e506b9972d34445a3 SHA512 44cf06b89ade692d87ca3105d8e3de5c7ce3f5fb318690fff513cf56f909ff5e0d0f6a0b22ae270b12e1fe3051b1bde3ec786506ec87c810b1d02e92e45dff07
 DIST Python-3.12.1.tar.xz.asc 963 BLAKE2B 6c08f666c914fc413d24c3591c24ce7ec22d459a571f9e91b50862b534ea6d98170d7141dd42602c18893cfc07a02f5b44c42edc97571a3a12cac3cdfe6ddc82 SHA512 1c85237b5921fbf940ded4e038d99c8d02682fcb357b5de761eb5bebf94142b308a11654fc6312129663727e2ce1f546fbb5a5a3747d7dc02fc7dced9cb968fd
+DIST Python-3.12.2.tar.xz 20591308 BLAKE2B 419186d220d4ae5ca31466771158c8b56f5298b93e81a29993f36711e08b0384e002d891280ca29099ae826919ba99c2d056d468d9d3049a984d58e01d4972c0 SHA512 2ccfae7b9f95d8e15ea85d3f66eea5f6a8fdcaffc0b405095fecb33efc0df50b831c1215542910ced948b54e6de1f7242b0b8b9afc5f89079451c552430d7d9f
+DIST Python-3.12.2.tar.xz.asc 963 BLAKE2B 45bfa01009f4df19d348a1fda722901cb4f0b76eb63fcf1061c2796949b5b2ef301fd0fdf818cd145e41d45e5785e0cfbfab8d98751765741715ee7d1b27f2f8 SHA512 fb477acb49864a662b1586db79e80fd8ebab85d4e5e14acd3bfb5afc3dbe8d6b9bf97eb518dfb77662e27040d400f451ed7575fe1264a6cc0d9feb06e4f2dc84
 DIST Python-3.13.0a2.tar.xz 20244640 BLAKE2B b1edae4c5f6c33e7250f718caa3164e163ea13f245817a997f0497d20bb9695e6e2f777eb42fc210b21fb315bd1753fe4a46b7f213312a03201481d26544fa63 SHA512 2702f630ebb49a835c213656f2f0d41f87daf2dad6b856821f4011f4614c19279656eaa1dad9f1cbfd258992aa5f59d4571577057c6a4ad1cdcfa4d8ada3b607
 DIST Python-3.13.0a2.tar.xz.asc 963 BLAKE2B db603fcf2dcf0c727b3a92a5ccbaadd080e11d664b1c07944ef082b5ca8625b2ccd4d4384d344d14e61eb73466011f2284f5240d710b3be7206c7316e2a3872b SHA512 c6a0101b844701fcd860a519ec4830bde0df486ea78377831544dbe0db25dd67c28360f46d5ef01db64aa4347cf7b0d489590f6dc91e768b16753228f2c93b25
 DIST Python-3.13.0a3.tar.xz 20351452 BLAKE2B 2d90aec5df24ac06e4d4b2e4442c062612b24441442bf3cd02dad8fde2f6db769eac7e4a1ce4943da6e7e9ea3516b2b9175dfaf40a8dd8827ae476ebb7e698ab SHA512 0cabe30ca97f89df7da35684dda9ac8a3018fb7547d97f595e7883323809fdb99ff02c48719d71fb12abdacda1fc86f0ca15b1d27717e941cdc0b31c72fd63bb
@@ -19,19 +23,23 @@ DIST Python-3.9.18.tar.xz.asc 833 BLAKE2B b2160eedf7a7529c379ede5cd626f2d1e36db6
 DIST python-gentoo-patches-2.7.18_p16.tar.xz 35448 BLAKE2B 0139c0944f62f9cdd236f6a8557e0ed19704c7d72869af1cb7d8bd3e646a746cd4a0201e1b44232a5e78ef49f254db20b0d0271bf744fbfd4fe0f1e99b8f3e6c SHA512 810be590d0e06fab4b2165e6852ca49662f09dcd7e20b47a29f613ad7653252c8dfac3f0eb228d77c8a914efa7c08788b2fbd552a4b47504f5fd0ec17450c48f
 DIST python-gentoo-patches-3.10.13_p2.tar.xz 15236 BLAKE2B 1b60a9ec0973de0f5fc7454e016b01c2a03e55a4515345ec86bf20e129018809908493847f55346d0c07ed6878ee2ead32f2b7dcbc25a6902d1494f718480acf SHA512 1db65a001fc307b48d034ad58c7d9aa4561a0e01b46fa1027ee730b2db1652eb6f02c73df6a9e2b8545e76d3b0541706ea32d423787f99ed83f86463951e9e81
 DIST python-gentoo-patches-3.11.7_p1.tar.xz 8364 BLAKE2B 246da406e6d58d85ab2ef79dd3a018a134e473f90d42f8dd9274629f998a6129f3b03da228aa5e65c1b4508a71979ceb1f752a28066c356f813be21c30a40f70 SHA512 c5c1448a2e9b15b8084125e07cee288b667267779d89da8aab9df4b1d014739ba9af4d09e51b3cdc37e8942821d7aee0d1998e55820b67b83ef654d0a442767e
+DIST python-gentoo-patches-3.11.8.tar.xz 8484 BLAKE2B 2a6b9275cfcb2edc639a8bfebaa061ccdf3c43c1fda46a97a3cb7ed6eb629d7b581932bf7e3561b7559533e2374e4c5138e7929f1d8edc3e93829ee701ac0779 SHA512 bcc4a0175b7d5f78eb7c431afad5ed4681512e5ec3a0394ff291b11a4d1867212fc093ded0f2e1f504c63f7035cde4d8b19c386d3cb4e50d7a49366a1872905d
 DIST python-gentoo-patches-3.12.1.tar.xz 5152 BLAKE2B bd1470dbdb4a3336f499534131d9f67329d6a1f6378b61592f6168d9a2500d9d9d65a77167065f80c38745fa1464a2073eac3e4bc0e5c096eefbbc8971a077b6 SHA512 2e608940f2f8c3a4be2699365acd1967d887c7895e71b173327dfe91ea41b6fb10a83d0845b2caa8b59884aa73ea73e49535d7805dc8b50f63b7fcdda67b438a
 DIST python-gentoo-patches-3.12.1_p2.tar.xz 6880 BLAKE2B 20f0ba78295cc64743f6842bccc7fc684389b8800c3884572be64b61516ba38c873104612467ffaa2a84653fc35184a7d7cd77d1f6ca6e19faca0b05bce1417e SHA512 653104144c864a0c0a27972f849988833540641d24f02bf14096e99e5a9c2d41df31f5dd0d1ecbbfe36419588eefae8f2e0a4b49bff3e6d96bd8b3cf0e3b5425
+DIST python-gentoo-patches-3.12.2.tar.xz 6044 BLAKE2B cf71fac76d7eee313d249d1531e4b13166fcb5e0e03b73d311cb6203658ac7857a213d324efe9b693b2ccd607a746d087d7173ac405a9f62e350acf59dde43c1 SHA512 a2c2fce72265aeca39ce5050619c5cceacbbfe9b405169bb5590bd8eb16e89f1f665ce2f95a23682883801f31f6f4b9958d6b52082f79af9088b181c88c1d810
 DIST python-gentoo-patches-3.13.0a2_p1.tar.xz 5176 BLAKE2B 87e278c11fafc69df918b4c105dfbc3d9ca9ff805d3862b0101ccbb0fd7614fda3460ba4e6304a0f62d0c96756a82ff046ca4a5b02d75daa3325c8e84edc99d5 SHA512 5a2692f8d113a67502b60450f6fdb0635f4f350877766e800e897aa943222a58991580dd8e1f71c9f2dfd3c381bb13fc30add9289cd7ade6fe184f3a5ca3d587
 DIST python-gentoo-patches-3.13.0a3.tar.xz 5176 BLAKE2B 388453fe1bee3a901fc526f15580cfd9e2db60bda6ed0d0546df3d1bca8bbfd680931533c8b22f091699be6886985378ef2d8e5c8f2819fa53a1aa8a1cb51750 SHA512 9787feb96bfd50d9be9a5324a3e0c30175baae9fdcb62adb7fcf0d625b6b84494dc4ecefab8f8291256ef508f908350dcb781e1bdd0b12956e662bbe97fad3ae
 DIST python-gentoo-patches-3.8.18_p1.tar.xz 33160 BLAKE2B 53c7d71f2cdcc21e991a9d61c8cb8833212d144d145d5949c5b28b62080121250d7633f477453743426d6e0ebdc9f6bd6648d4ccac8dfb2d559126455d8b1da3 SHA512 7fbadb2468711b5ecb8a9fefcf4dfe567df7f9b038ec87f37095d02589e7debbf5a8ad3f759d95b69ca60ce9fcd3ccf4aecde6592ed69c030cf51250935db052
 DIST python-gentoo-patches-3.9.18_p1.tar.xz 25792 BLAKE2B f24ab6d3443c2b39a2fdca5810790eed51d2d42c93a3b41d75cad6b6c99ebf709f598eaa9881858e13ad102867d97a159f3a6d97a42569d5183de6118fb953c6 SHA512 be0c60c65d4c982cd8b934d14b69f5f41ca9f0d6c51d6bf195d64d0a5ffff3d359edc29a6a2f2808450c896d2795cc773c9f31680970205a37955134be50ee79
-EBUILD python-2.7.18_p16-r1.ebuild 8596 BLAKE2B 08bb3c66c497771799aa3a82706cb20827f740e1254c3290cf0cf4f2c1dfc4c9abf70334c01fe257c7db10849009ff8c547a3c073eb0fee54c08e7fd57ef4b82 SHA512 69386bf991e2d1cf77a5e03c1f3c13a9311cb507d529b3fdb8d9aeead3b8f5ba9a7f6940332781d617c17b7b5881d28d51d182f33f0fe6761bd7cd40f55404ba
-EBUILD python-3.10.13.ebuild 14195 BLAKE2B 07089fda2f1a45a46f4bf29a7dd9235dc08fe04eb5815708e5db3f2d24437254a359872eb59c03475d49fe16a90208a9d2a3a29ac5b00e398a7634853c27ab13 SHA512 5a7d3433526fa4dd8c5179fafe2b478204450daf9da34ed3b51399375ebd7b9ec206bfe73f84260641bb136d15338a411346e0fcd57c2d0aeaca493b879befac
-EBUILD python-3.11.7.ebuild 15078 BLAKE2B d4546bbe1ff1df2de9f38aa30ce5d413f6d1a327395f74f7de65935225e822e5062beceaa1e22312ff2b965e509a85d994343aab2d09c37a81a1ea3de5b992ad SHA512 26c95d6de0931d8e6ac1b02027b7988cb62aa6db53c3544baa4973c879bbe27ad70a10a3d6881f37dba3a7883962d02167c53062b039a41eed05af4b986c42a2
-EBUILD python-3.12.1.ebuild 14666 BLAKE2B 19e23b36237c4ad3a2a353a731f3281a8575d0f58816a99bfe577fd37d6fb46ba70f6006d2c10b547e62a5c83711c452367e424faced4091674aa82e715223c7 SHA512 df96d275eb0e6a820a7c34752793def77710f8a0331d7668bce084bff5ebcd6772e6ec87346851ccaca25c946364c1791f59a42d67b7b0416329b119d66eee8a
-EBUILD python-3.12.1_p1.ebuild 14645 BLAKE2B 7e61af7c3609b249f5f103a1a83514a1fcb282208a7fc117e487731150f374e3bc487bafa28b411b3e60ffe278f86518d9586b72b61480f1eeefd23e9c5f10a6 SHA512 3fdb296bb90e474f9e375f3b6542f78bbe00f8b61bd0ca442a8d75e6b109ec4a0be4a62a2f3704448d25a78c683659d4a0b34ee558e5ad89b470da820a70a894
-EBUILD python-3.13.0_alpha2.ebuild 14473 BLAKE2B 96eb6503b8423921f480fbdf0eeeb618e832c2084cc92febd029a23db668cff2dce55ae031efb87c27bad692ed71041075c2118f6bc532cbb0e06d4da83cac6b SHA512 12c05855e5a28c05b264e117239dc49a906811de16a227e999b22e27ac942f5f4276568f30e82ceea1ffa5ec71063af799a44ac239e3aefdb3a93f1eaaaf6da1
-EBUILD python-3.13.0_alpha3.ebuild 14470 BLAKE2B 7d0cea4a8f252aa876afa390f1cfb3da4747120123534622ce892047bf7a951d1cbee86292ae68cf75b3755982130a65ee4532a03cc44cb151036c3d7cb497a3 SHA512 65b0e49576a781f1e1c93dc61951352e050174470d1eb4d80f698700b9a0d52caac160e9f8966b33f4f19350cd563c42feb6920a5de8a323536da3c13b6ad7b5
-EBUILD python-3.8.18.ebuild 12363 BLAKE2B a662759f99e76cc638e45e470fb24a6cf98985e5a91fab360bfd552439b84592777d7a1d1661ea5cfebc00b7dda1c471ecaac494b53c45bfe3b88114ff1e486a SHA512 380330ddb490a9c78a2983ae72277dc060e30a1ce238af7b55baecbee86bfb5fad6bb76559f1db85865413d46f4523d1a0c1a56fe1e661a5947b8e5d2be95108
-EBUILD python-3.9.18.ebuild 13846 BLAKE2B 3973f0fc5053babb0ca140ab73f3253e762385439913b01ace7db73d1619c9f1b240f06c6bd25bddaa3407728e3ea99965b74b8df26a32006a7709af49e7bc4f SHA512 cdd332589961fb9d3876eb8a9d707b705e23793b5cfe8932b61dea7616279b45ee94b419545ab14f56738a6e63552fcd62690cbf30a8cf4437b6e97d455d6b3a
+EBUILD python-2.7.18_p16-r1.ebuild 8595 BLAKE2B 810a7db53bf8b6c7756113adc02cbe3c4ecc0883389223a0d363a1ffcc3f16cd07ee6a113ec1a6a96aa6c2e6eaf9d359c9833c4b13e6c0bea6e46c03e75bd70d SHA512 c7a4e70c374fbdaf7ccba7eb262c03a9009b925676609bcb934ed452313adf9104c7943338f20167f40d5a863da8755fafbe027e2571488393b9d4bdee55af03
+EBUILD python-3.10.13.ebuild 14194 BLAKE2B b2b1430e1c8f430a0d382b291e396d9e98c39a1b2e356a0955b272d69d1b18ff0513cceb7530f626470f742706a70b98880f29e8ad3822aa2ca6a2e0f32ba750 SHA512 0c2e2355e9ed690a2d433c7392de8d119efe30ba246eb12a287e16fe8822b3f555b7f12a1160744413994876c799e85ec463149bae7516483085c09ca4d0d320
+EBUILD python-3.11.7.ebuild 15077 BLAKE2B 79af0e6b8af99fa7d60d3408f408e5d55e046bd71918b9ab03b9eb68bb1605d4469d0e168524a3e3fc9a2dd42ea01c847198d6d67a874a1181755cd09200e94f SHA512 161b4e06661ce2ee21f8c2a08ade583b238d81d894738fea1e3965c00f149d3e26673e2da3a54cdd0b76a71442eaabc5c5939368c2d6c184bf5e0f2819d66dc1
+EBUILD python-3.11.8.ebuild 15082 BLAKE2B c6e51e89b2f0232aff44569cb2214ca6081a4a09f750f2e7780e23b05f516b8d42b8be86faa70e843b99dbe57a687641597d18e67fa4a7101304c98dcbfe0fd7 SHA512 9b7c7a9fe97c3da0e0388196ed0385ae0212ad52504e721cf7a604b9adbfcca4602956454f45c3d01acc93ce9f47b3b49d98292dc060094e5c198e8d4661221e
+EBUILD python-3.12.1.ebuild 14665 BLAKE2B fc36533f7ef899d40e991dabd8afee6e4a9fd12c6ca46a35de868899b9e36274a75403be2f0489f6d2a082f79bc449e14308328cc663c61890f910ecadcafb26 SHA512 142df80877917284abb34b9b8c2bac0c13dad1328c0d6ae2e0f5058412574dee4621c21e87f0282d95197523b52b28f3566e312575fbd0ddfc3b2c313a59a3a9
+EBUILD python-3.12.1_p1.ebuild 14644 BLAKE2B c665f9c4d66b10988ca13ba49b906de422cd94699473c4b6158b666fdd36e5c910f80d639a930cf8a690cfa4962baf02ea264bd6c757c73da176314adac06b1f SHA512 4dd11efcc1ebe97ac5e148dab76deee3170c22f8b96eef051ca66841439534936427949c77d30c88f79b6b09de0c6adc1b1d1fc08f1952d956444d2ce754eb74
+EBUILD python-3.12.2.ebuild 14643 BLAKE2B e865b16e1f8722cb19757f57d9fbf281ee2835d7b0ac19cc8a3c9f244ef122d272c2e5facb83117ddd3e487736eccb04e1fb10acfa21c6a4db3610b6267ed68e SHA512 a40d40177bb45f432f693dabf35a662c5e39a4cee55ae3e7fcd27182138caf061c6cb82289fae615d0ba46f6d620b01126b2163ce2824a24c5db4f3be7b6868b
+EBUILD python-3.13.0_alpha2.ebuild 14472 BLAKE2B 8c73b1b09066ecde25bf7cc02b5464b9c693726df8fab3a3087e5db4e43a8ace36c5a7308d8b8e58a6bded0105a0a35d8323bf88de8b2205d103454a27dc6052 SHA512 b444188ad98f78b3f620ca021734bd0f9790ea6a3ccd085ab11ac54ec4cf30910850ad6b54c8d05bdd35e309228327d8a7e185df951a61f69869987c838d89bd
+EBUILD python-3.13.0_alpha3.ebuild 14469 BLAKE2B 55868ed6a99db71be14e4f62b1b6e842b08dd8e1879f14aae2f75728d1d64e2325c9cd02068e151b3873a5acaab8a9bb392fb659bf8492317abc4ed2c094419c SHA512 9ce61d5f5d3f9618532ec31ad7034ec8a1f4846a9de5079961beb570f3156b99120d18976f45bf05b2e73c6e503c241bbb0bd863fbfd12bf72597d2c22b0b55d
+EBUILD python-3.8.18.ebuild 12362 BLAKE2B 28a2d0e389e3382695b199ec43d9dfdd92967c15e915362cecff6fc59812845a571cb6f33e5ba801848f4e8d3e8ea078c15a1d319dbe72c64029b1f1272b092a SHA512 f0f8f9206afe429cfee0c86435920144f2903f78bbb671e6a0038dbac1cc5f32ff1612fc14d5bca3e9cf9975ff5550f04fc6d515978b0a0ae1dbab24d107663b
+EBUILD python-3.9.18.ebuild 13845 BLAKE2B 9976335cb9df5bc1572948047efb2586ab5ecd0ad2a2c7b2e1bb617d0909dede03540e55e045b6a7e736df48a78bc4e3a92aad41e804f74f4079d54ee3394991 SHA512 cde972ba8e69e0b40a6111667f1f22b0bceddb548f615532dcb6dc93502cacb3f81c2cc068cdf35534308f3a81cf1cd9cab345e329433064175ec011a198481d
 MISC metadata.xml 1350 BLAKE2B 394c04ff855d8e48312e348ec0cd70c23f39084d52eb953c335fe5791c61344244d18af272e4b81e2c5aa2beefd9e3cc5e4bc8ff44d29aa3234532203b597cba SHA512 b71ee05531554711a7c8dffeddce0845271c05dee915421beb8bb9960507e0afaf2fa5d3898325f0bff7061e76febff2fcedb32e5cd520d4ffc3fad2355cb79f
diff --git a/dev-lang/python/python-2.7.18_p16-r1.ebuild b/dev-lang/python/python-2.7.18_p16-r1.ebuild
index 539f7addcb1c..7474e7d083e5 100644
--- a/dev-lang/python/python-2.7.18_p16-r1.ebuild
+++ b/dev-lang/python/python-2.7.18_p16-r1.ebuild
@@ -60,7 +60,7 @@ RDEPEND="
 		dev-tcltk/blt:=
 		dev-tcltk/tix
 	)
-	xml? ( >=dev-libs/expat-2.1:= )
+	xml? ( <dev-libs/expat-2.6:= )
 "
 # bluetooth requires headers from bluez
 DEPEND="
diff --git a/dev-lang/python/python-3.10.13.ebuild b/dev-lang/python/python-3.10.13.ebuild
index 0b1e7b33f03a..a843933d9ab8 100644
--- a/dev-lang/python/python-3.10.13.ebuild
+++ b/dev-lang/python/python-3.10.13.ebuild
@@ -65,7 +65,7 @@ RDEPEND="
 		dev-tcltk/blt:=
 		dev-tcltk/tix
 	)
-	xml? ( >=dev-libs/expat-2.1:= )
+	xml? ( <dev-libs/expat-2.6:= )
 "
 # bluetooth requires headers from bluez
 DEPEND="
diff --git a/dev-lang/python/python-3.11.7.ebuild b/dev-lang/python/python-3.11.7.ebuild
index b484a90f142c..bd0403f833ed 100644
--- a/dev-lang/python/python-3.11.7.ebuild
+++ b/dev-lang/python/python-3.11.7.ebuild
@@ -44,7 +44,7 @@ RDEPEND="
 	app-arch/bzip2:=
 	app-arch/xz-utils:=
 	app-crypt/libb2
-	>=dev-libs/expat-2.1:=
+	<dev-libs/expat-2.6:=
 	dev-libs/libffi:=
 	dev-python/gentoo-common
 	>=sys-libs/zlib-1.1.3:=
diff --git a/dev-lang/python/python-3.11.8.ebuild b/dev-lang/python/python-3.11.8.ebuild
new file mode 100644
index 000000000000..669069799e62
--- /dev/null
+++ b/dev-lang/python/python-3.11.8.ebuild
@@ -0,0 +1,537 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+WANT_LIBTOOL="none"
+
+inherit autotools check-reqs flag-o-matic multiprocessing pax-utils
+inherit prefix python-utils-r1 toolchain-funcs verify-sig
+
+MY_PV=${PV/_rc/rc}
+MY_P="Python-${MY_PV%_p*}"
+PYVER=$(ver_cut 1-2)
+PATCHSET="python-gentoo-patches-${MY_PV}"
+
+DESCRIPTION="An interpreted, interactive, object-oriented programming language"
+HOMEPAGE="
+	https://www.python.org/
+	https://github.com/python/cpython/
+"
+SRC_URI="
+	https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz
+	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
+	verify-sig? (
+		https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz.asc
+	)
+"
+S="${WORKDIR}/${MY_P}"
+
+LICENSE="PSF-2"
+SLOT="${PYVER}"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+IUSE="
+	bluetooth build debug +ensurepip examples gdbm libedit
+	+ncurses pgo +readline +sqlite +ssl test tk valgrind
+"
+RESTRICT="!test? ( test )"
+
+# Do not add a dependency on dev-lang/python to this ebuild.
+# If you need to apply a patch which requires python for bootstrapping, please
+# run the bootstrap code on your dev box and include the results in the
+# patchset. See bug 447752.
+
+RDEPEND="
+	app-arch/bzip2:=
+	app-arch/xz-utils:=
+	app-crypt/libb2
+	<dev-libs/expat-2.6:=
+	dev-libs/libffi:=
+	dev-python/gentoo-common
+	>=sys-libs/zlib-1.1.3:=
+	virtual/libcrypt:=
+	virtual/libintl
+	ensurepip? ( dev-python/ensurepip-wheels )
+	gdbm? ( sys-libs/gdbm:=[berkdb] )
+	kernel_linux? ( sys-apps/util-linux:= )
+	ncurses? ( >=sys-libs/ncurses-5.2:= )
+	readline? (
+		!libedit? ( >=sys-libs/readline-4.1:= )
+		libedit? ( dev-libs/libedit:= )
+	)
+	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
+	ssl? ( >=dev-libs/openssl-1.1.1:= )
+	tk? (
+		>=dev-lang/tcl-8.0:=
+		>=dev-lang/tk-8.0:=
+		dev-tcltk/blt:=
+		dev-tcltk/tix
+	)
+"
+# bluetooth requires headers from bluez
+DEPEND="
+	${RDEPEND}
+	bluetooth? ( net-wireless/bluez )
+	test? ( app-arch/xz-utils )
+	valgrind? ( dev-debug/valgrind )
+"
+# autoconf-archive needed to eautoreconf
+BDEPEND="
+	dev-build/autoconf-archive
+	app-alternatives/awk
+	virtual/pkgconfig
+	verify-sig? ( sec-keys/openpgp-keys-python )
+"
+RDEPEND+="
+	!build? ( app-misc/mime-types )
+"
+if [[ ${PV} != *_alpha* ]]; then
+	RDEPEND+="
+		dev-lang/python-exec[python_targets_python${PYVER/./_}(-)]
+	"
+fi
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/python.org.asc
+
+# large file tests involve a 2.5G file being copied (duplicated)
+CHECKREQS_DISK_BUILD=5500M
+
+QA_PKGCONFIG_VERSION=${PYVER}
+# false positives -- functions specific to *BSD
+QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
+
+pkg_pretend() {
+	use test && check-reqs_pkg_pretend
+}
+
+pkg_setup() {
+	use test && check-reqs_pkg_setup
+}
+
+src_unpack() {
+	if use verify-sig; then
+		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.asc}
+	fi
+	default
+}
+
+src_prepare() {
+	# Ensure that internal copies of expat and libffi are not used.
+	rm -r Modules/expat || die
+	rm -r Modules/_ctypes/libffi* || die
+
+	local PATCHES=(
+		"${WORKDIR}/${PATCHSET}"
+	)
+
+	default
+
+	# https://bugs.gentoo.org/850151
+	sed -i -e "s:@@GENTOO_LIBDIR@@:$(get_libdir):g" setup.py || die
+
+	# force the correct number of jobs
+	# https://bugs.gentoo.org/737660
+	local jobs=$(makeopts_jobs)
+	sed -i -e "s:-j0:-j${jobs}:" Makefile.pre.in || die
+	sed -i -e "/self\.parallel/s:True:${jobs}:" setup.py || die
+
+	eautoreconf
+}
+
+build_cbuild_python() {
+	# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
+	local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	#
+	# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
+	local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
+	local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+	local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
+	local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
+
+	# We need to build our own Python on CBUILD first, and feed it in.
+	# bug #847910
+	local myeconfargs_cbuild=(
+		"${myeconfargs[@]}"
+
+		--prefix="${BROOT}"/usr
+		--libdir="${cbuild_libdir:2}"
+
+		# Avoid needing to load the right libpython.so.
+		--disable-shared
+
+		# As minimal as possible for the mini CBUILD Python
+		# we build just for cross to satisfy --with-build-python.
+		--without-lto
+		--without-readline
+		--disable-optimizations
+	)
+
+	mkdir "${WORKDIR}"/${P}-${CBUILD} || die
+	pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
+	# We disable _ctypes and _crypt for CBUILD because Python's setup.py can't handle locating
+	# libdir correctly for cross.
+	PYTHON_DISABLE_MODULES+=" _ctypes _crypt" \
+		ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
+
+	# Avoid as many dependencies as possible for the cross build.
+	cat >> Makefile <<-EOF || die
+		MODULE_NIS_STATE=disabled
+		MODULE__DBM_STATE=disabled
+		MODULE__GDBM_STATE=disabled
+		MODULE__DBM_STATE=disabled
+		MODULE__SQLITE3_STATE=disabled
+		MODULE__HASHLIB_STATE=disabled
+		MODULE__SSL_STATE=disabled
+		MODULE__CURSES_STATE=disabled
+		MODULE__CURSES_PANEL_STATE=disabled
+		MODULE_READLINE_STATE=disabled
+		MODULE__TKINTER_STATE=disabled
+		MODULE_PYEXPAT_STATE=disabled
+		MODULE_ZLIB_STATE=disabled
+	EOF
+
+	# Unfortunately, we do have to build this immediately, and
+	# not in src_compile, because CHOST configure for Python
+	# will check the existence of the --with-build-python value
+	# immediately.
+	PYTHON_DISABLE_MODULES+=" _ctypes _crypt" emake
+	popd &> /dev/null || die
+}
+
+src_configure() {
+	# disable automagic bluetooth headers detection
+	if ! use bluetooth; then
+		local -x ac_cv_header_bluetooth_bluetooth_h=no
+	fi
+
+	append-flags -fwrapv
+	filter-flags -malign-double
+
+	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
+	# PKG_CONFIG needed for cross.
+	tc-export CXX PKG_CONFIG
+
+	local dbmliborder=
+	if use gdbm; then
+		dbmliborder+="${dbmliborder:+:}gdbm"
+	fi
+
+	if use pgo; then
+		local profile_task_flags=(
+			-m test
+			"-j$(makeopts_jobs)"
+			--pgo-extended
+			-u-network
+
+			# We use a timeout because of how often we've had hang issues
+			# here. It also matches the default upstream PROFILE_TASK.
+			--timeout 1200
+
+			-x test_gdb
+			-x test_dtrace
+
+			# All of these seem to occasionally hang for PGO inconsistently
+			# They'll even hang here but be fine in src_test sometimes.
+			# bug #828535 (and related: bug #788022)
+			-x test_asyncio
+			-x test_httpservers
+			-x test_logging
+			-x test_multiprocessing_fork
+			-x test_socket
+			-x test_xmlrpc
+
+			# Hangs (actually runs indefinitely executing itself w/ many cpython builds)
+			# bug #900429
+			-x test_tools
+		)
+
+		if has_version "app-arch/rpm" ; then
+			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
+			profile_task_flags+=(
+				-x test_distutils
+			)
+		fi
+		local -x PROFILE_TASK="${profile_task_flags[*]}"
+	fi
+
+	local myeconfargs=(
+		# glibc-2.30 removes it; since we can't cleanly force-rebuild
+		# Python on glibc upgrade, remove it proactively to give
+		# a chance for users rebuilding python before glibc
+		ac_cv_header_stropts_h=no
+
+		--enable-shared
+		--without-static-libpython
+		--enable-ipv6
+		--infodir='${prefix}/share/info'
+		--mandir='${prefix}/share/man'
+		--with-computed-gotos
+		--with-dbmliborder="${dbmliborder}"
+		--with-libc=
+		--enable-loadable-sqlite-extensions
+		--without-ensurepip
+		--without-lto
+		--with-system-expat
+		--with-system-ffi
+		--with-platlibdir=lib
+		--with-pkg-config=yes
+		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
+
+		$(use_with debug assertions)
+		$(use_enable pgo optimizations)
+		$(use_with readline readline "$(usex libedit editline readline)")
+		$(use_with valgrind)
+	)
+
+	# disable implicit optimization/debugging flags
+	local -x OPT=
+
+	# https://bugs.gentoo.org/700012
+	if tc-is-lto; then
+		append-cflags $(test-flags-CC -ffat-lto-objects)
+		myeconfargs+=(
+			--with-lto
+		)
+	fi
+
+	if tc-is-cross-compiler ; then
+		build_cbuild_python
+		myeconfargs+=(
+			# Point the imminent CHOST build to the Python we just
+			# built for CBUILD.
+			--with-build-python="${WORKDIR}"/${P}-${CBUILD}/python
+		)
+	fi
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	local -x CFLAGS_NODIST=${CFLAGS}
+	local -x LDFLAGS_NODIST=${LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+
+	# Fix implicit declarations on cross and prefix builds. Bug #674070.
+	if use ncurses; then
+		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
+	fi
+
+	hprefixify setup.py
+	econf "${myeconfargs[@]}"
+
+	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
+		eerror "configure has detected that the sem_open function is broken."
+		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
+		die "Broken sem_open function (bug 496328)"
+	fi
+
+	# force-disable modules we don't want built
+	local disable_modules=( NIS )
+	use gdbm || disable_modules+=( _GDBM _DBM )
+	use sqlite || disable_modules+=( _SQLITE3 )
+	use ssl || disable_modules+=( _HASHLIB _SSL )
+	use ncurses || disable_modules+=( _CURSES _CURSES_PANEL )
+	use readline || disable_modules+=( READLINE )
+	use tk || disable_modules+=( _TKINTER )
+
+	local mod
+	for mod in "${disable_modules[@]}"; do
+		echo "MODULE_${mod}_STATE=disabled"
+	done >> Makefile || die
+
+	# install epython.py as part of stdlib
+	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
+}
+
+src_compile() {
+	# Ensure sed works as expected
+	# https://bugs.gentoo.org/594768
+	local -x LC_ALL=C
+	# Prevent using distutils bundled by setuptools.
+	# https://bugs.gentoo.org/823728
+	export SETUPTOOLS_USE_DISTUTILS=stdlib
+	export PYTHONSTRICTEXTENSIONBUILD=1
+
+	# Save PYTHONDONTWRITEBYTECODE so that 'has_version' doesn't
+	# end up writing bytecode & violating sandbox.
+	# bug #831897
+	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
+
+	if use pgo ; then
+		# bug 660358
+		local -x COLUMNS=80
+		local -x PYTHONDONTWRITEBYTECODE=
+
+		addpredict "/usr/lib/python${PYVER}/site-packages"
+	fi
+
+	# also need to clear the flags explicitly here or they end up
+	# in _sysconfigdata*
+	emake CPPFLAGS= CFLAGS= LDFLAGS=
+
+	# Restore saved value from above.
+	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
+
+	# Work around bug 329499. See also bug 413751 and 457194.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E python
+	else
+		pax-mark m python
+	fi
+}
+
+src_test() {
+	# Tests will not work when cross compiling.
+	if tc-is-cross-compiler; then
+		elog "Disabling tests due to crosscompiling."
+		return
+	fi
+
+	# this just happens to skip test_support.test_freeze that is broken
+	# without bundled expat
+	# TODO: get a proper skip for it upstream
+	local -x LOGNAME=buildbot
+
+	local test_opts=(
+		-u-network
+		-j "$(makeopts_jobs)"
+
+		# fails
+		-x test_gdb
+	)
+
+	if use sparc ; then
+		# bug #788022
+		test_opts+=(
+			-x test_multiprocessing_fork
+			-x test_multiprocessing_forkserver
+		)
+	fi
+
+	# workaround docutils breaking tests
+	cat > Lib/docutils.py <<-EOF || die
+		raise ImportError("Thou shalt not import!")
+	EOF
+
+	# bug 660358
+	local -x COLUMNS=80
+	local -x PYTHONDONTWRITEBYTECODE=
+	# workaround https://bugs.gentoo.org/775416
+	addwrite "/usr/lib/python${PYVER}/site-packages"
+
+	nonfatal emake test EXTRATESTOPTS="${test_opts[*]}" \
+		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
+	local ret=${?}
+
+	rm Lib/docutils.py || die
+
+	[[ ${ret} -eq 0 ]] || die "emake test failed"
+}
+
+src_install() {
+	local libdir=${ED}/usr/lib/python${PYVER}
+
+	# -j1 hack for now for bug #843458
+	emake -j1 DESTDIR="${D}" altinstall
+
+	# Fix collisions between different slots of Python.
+	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
+
+	# Cheap hack to get version with ABIFLAGS
+	local abiver=$(cd "${ED}/usr/include"; echo python*)
+	if [[ ${abiver} != python${PYVER} ]]; then
+		# Replace python3.X with a symlink to python3.Xm
+		rm "${ED}/usr/bin/python${PYVER}" || die
+		dosym "${abiver}" "/usr/bin/python${PYVER}"
+		# Create python3.X-config symlink
+		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
+		# Create python-3.5m.pc symlink
+		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
+	fi
+
+	# python seems to get rebuilt in src_install (bug 569908)
+	# Work around it for now.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E "${ED}/usr/bin/${abiver}"
+	else
+		pax-mark m "${ED}/usr/bin/${abiver}"
+	fi
+
+	rm -r "${libdir}"/ensurepip/_bundled || die
+	if ! use ensurepip; then
+		rm -r "${libdir}"/ensurepip || die
+	fi
+	if ! use sqlite; then
+		rm -r "${libdir}/"sqlite3 || die
+	fi
+	if ! use tk; then
+		rm -r "${ED}/usr/bin/idle${PYVER}" || die
+		rm -r "${libdir}/"{idlelib,tkinter,test/test_tk*} || die
+	fi
+
+	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
+
+	dodoc Misc/{ACKS,HISTORY,NEWS}
+
+	if use examples; then
+		docinto examples
+		find Tools -name __pycache__ -exec rm -fr {} + || die
+		dodoc -r Tools
+	fi
+	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
+	local libname=$(
+		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
+		emake --no-print-directory -s -f - 2>/dev/null
+	)
+	newins Tools/gdb/libpython.py "${libname}"-gdb.py
+
+	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
+	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
+	sed \
+		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
+		-e "s:@PYDOC@:pydoc${PYVER}:" \
+		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
+		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
+
+	# python-exec wrapping support
+	local pymajor=${PYVER%.*}
+	local EPYTHON=python${PYVER}
+	local scriptdir=${D}$(python_get_scriptdir)
+	mkdir -p "${scriptdir}" || die
+	# python and pythonX
+	ln -s "../../../bin/${abiver}" "${scriptdir}/python${pymajor}" || die
+	ln -s "python${pymajor}" "${scriptdir}/python" || die
+	# python-config and pythonX-config
+	# note: we need to create a wrapper rather than symlinking it due
+	# to some random dirname(argv[0]) magic performed by python-config
+	cat > "${scriptdir}/python${pymajor}-config" <<-EOF || die
+		#!/bin/sh
+		exec "${abiver}-config" "\${@}"
+	EOF
+	chmod +x "${scriptdir}/python${pymajor}-config" || die
+	ln -s "python${pymajor}-config" "${scriptdir}/python-config" || die
+	# 2to3, pydoc
+	ln -s "../../../bin/2to3-${PYVER}" "${scriptdir}/2to3" || die
+	ln -s "../../../bin/pydoc${PYVER}" "${scriptdir}/pydoc" || die
+	# idle
+	if use tk; then
+		ln -s "../../../bin/idle${PYVER}" "${scriptdir}/idle" || die
+	fi
+}
+
+pkg_postinst() {
+	local v
+	for v in ${REPLACING_VERSIONS}; do
+		if ver_test "${v}" -lt 3.11.0_beta4-r2; then
+			ewarn "Python 3.11.0b4 has changed its module ABI.  The .pyc files"
+			ewarn "installed previously are no longer valid and will be regenerated"
+			ewarn "(or ignored) on the next import.  This may cause sandbox failures"
+			ewarn "when installing some packages and checksum mismatches when removing"
+			ewarn "old versions.  To actively prevent this, rebuild all packages"
+			ewarn "installing Python 3.11 modules, e.g. using:"
+			ewarn
+			ewarn "  emerge -1v /usr/lib/python3.11/site-packages"
+		fi
+	done
+}
diff --git a/dev-lang/python/python-3.12.1.ebuild b/dev-lang/python/python-3.12.1.ebuild
index 1f73dafbbdb3..bcacd5492511 100644
--- a/dev-lang/python/python-3.12.1.ebuild
+++ b/dev-lang/python/python-3.12.1.ebuild
@@ -44,7 +44,7 @@ RDEPEND="
 	app-arch/bzip2:=
 	app-arch/xz-utils:=
 	app-crypt/libb2
-	>=dev-libs/expat-2.1:=
+	<dev-libs/expat-2.6:=
 	dev-libs/libffi:=
 	dev-python/gentoo-common
 	>=sys-libs/zlib-1.1.3:=
diff --git a/dev-lang/python/python-3.12.1_p1.ebuild b/dev-lang/python/python-3.12.1_p1.ebuild
index d38350148f6c..261d285075cf 100644
--- a/dev-lang/python/python-3.12.1_p1.ebuild
+++ b/dev-lang/python/python-3.12.1_p1.ebuild
@@ -44,7 +44,7 @@ RDEPEND="
 	app-arch/bzip2:=
 	app-arch/xz-utils:=
 	app-crypt/libb2
-	>=dev-libs/expat-2.1:=
+	<dev-libs/expat-2.6:=
 	dev-libs/libffi:=
 	dev-python/gentoo-common
 	>=sys-libs/zlib-1.1.3:=
diff --git a/dev-lang/python/python-3.12.2.ebuild b/dev-lang/python/python-3.12.2.ebuild
new file mode 100644
index 000000000000..0c77d80ba8fa
--- /dev/null
+++ b/dev-lang/python/python-3.12.2.ebuild
@@ -0,0 +1,535 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+WANT_LIBTOOL="none"
+
+inherit autotools check-reqs flag-o-matic multiprocessing pax-utils
+inherit python-utils-r1 toolchain-funcs verify-sig
+
+MY_PV=${PV/_rc/rc}
+MY_P="Python-${MY_PV%_p*}"
+PYVER=$(ver_cut 1-2)
+PATCHSET="python-gentoo-patches-${MY_PV}"
+
+DESCRIPTION="An interpreted, interactive, object-oriented programming language"
+HOMEPAGE="
+	https://www.python.org/
+	https://github.com/python/cpython/
+"
+SRC_URI="
+	https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz
+	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
+	verify-sig? (
+		https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz.asc
+	)
+"
+S="${WORKDIR}/${MY_P}"
+
+LICENSE="PSF-2"
+SLOT="${PYVER}"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+IUSE="
+	bluetooth build debug +ensurepip examples gdbm libedit
+	+ncurses pgo +readline +sqlite +ssl test tk valgrind
+"
+RESTRICT="!test? ( test )"
+
+# Do not add a dependency on dev-lang/python to this ebuild.
+# If you need to apply a patch which requires python for bootstrapping, please
+# run the bootstrap code on your dev box and include the results in the
+# patchset. See bug 447752.
+
+RDEPEND="
+	app-arch/bzip2:=
+	app-arch/xz-utils:=
+	app-crypt/libb2
+	<dev-libs/expat-2.6:=
+	dev-libs/libffi:=
+	dev-python/gentoo-common
+	>=sys-libs/zlib-1.1.3:=
+	virtual/libcrypt:=
+	virtual/libintl
+	ensurepip? ( dev-python/ensurepip-pip )
+	gdbm? ( sys-libs/gdbm:=[berkdb] )
+	kernel_linux? ( sys-apps/util-linux:= )
+	ncurses? ( >=sys-libs/ncurses-5.2:= )
+	readline? (
+		!libedit? ( >=sys-libs/readline-4.1:= )
+		libedit? ( dev-libs/libedit:= )
+	)
+	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
+	ssl? ( >=dev-libs/openssl-1.1.1:= )
+	tk? (
+		>=dev-lang/tcl-8.0:=
+		>=dev-lang/tk-8.0:=
+		dev-tcltk/blt:=
+		dev-tcltk/tix
+	)
+"
+# bluetooth requires headers from bluez
+DEPEND="
+	${RDEPEND}
+	bluetooth? ( net-wireless/bluez )
+	test? (
+		app-arch/xz-utils
+		dev-python/ensurepip-pip
+		dev-python/ensurepip-setuptools
+		dev-python/ensurepip-wheel
+	)
+	valgrind? ( dev-debug/valgrind )
+"
+# autoconf-archive needed to eautoreconf
+BDEPEND="
+	dev-build/autoconf-archive
+	app-alternatives/awk
+	virtual/pkgconfig
+	verify-sig? ( >=sec-keys/openpgp-keys-python-20221025 )
+"
+RDEPEND+="
+	!build? ( app-misc/mime-types )
+"
+if [[ ${PV} != *_alpha* ]]; then
+	RDEPEND+="
+		dev-lang/python-exec[python_targets_python${PYVER/./_}(-)]
+	"
+fi
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/python.org.asc
+
+# large file tests involve a 2.5G file being copied (duplicated)
+CHECKREQS_DISK_BUILD=5500M
+
+QA_PKGCONFIG_VERSION=${PYVER}
+# false positives -- functions specific to *BSD
+QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
+
+pkg_pretend() {
+	use test && check-reqs_pkg_pretend
+}
+
+pkg_setup() {
+	use test && check-reqs_pkg_setup
+}
+
+src_unpack() {
+	if use verify-sig; then
+		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.asc}
+	fi
+	default
+}
+
+src_prepare() {
+	# Ensure that internal copies of expat and libffi are not used.
+	# TODO: Makefile has annoying deps on expat headers
+	#rm -r Modules/expat || die
+
+	local PATCHES=(
+		"${WORKDIR}/${PATCHSET}"
+	)
+
+	default
+
+	# force the correct number of jobs
+	# https://bugs.gentoo.org/737660
+	sed -i -e "s:-j0:-j$(makeopts_jobs):" Makefile.pre.in || die
+
+	eautoreconf
+}
+
+build_cbuild_python() {
+	# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
+	local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	#
+	# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
+	local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
+	local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+	local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
+	local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
+
+	# We need to build our own Python on CBUILD first, and feed it in.
+	# bug #847910
+	local myeconfargs_cbuild=(
+		"${myeconfargs[@]}"
+
+		--prefix="${BROOT}"/usr
+		--libdir="${cbuild_libdir:2}"
+
+		# Avoid needing to load the right libpython.so.
+		--disable-shared
+
+		# As minimal as possible for the mini CBUILD Python
+		# we build just for cross to satisfy --with-build-python.
+		--without-lto
+		--without-readline
+		--disable-optimizations
+	)
+
+	mkdir "${WORKDIR}"/${P}-${CBUILD} || die
+	pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
+
+	# Avoid as many dependencies as possible for the cross build.
+	mkdir Modules || die
+	cat > Modules/Setup.local <<-EOF || die
+		*disabled*
+		nis
+		_dbm _gdbm
+		_sqlite3
+		_hashlib _ssl
+		_curses _curses_panel
+		readline
+		_tkinter
+		pyexpat
+		zlib
+		# We disabled these for CBUILD because Python's setup.py can't handle locating
+		# libdir correctly for cross. This should be rechecked for the pure Makefile approach,
+		# and uncommented if needed.
+		#_ctypes _crypt
+	EOF
+
+	ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
+
+	# Unfortunately, we do have to build this immediately, and
+	# not in src_compile, because CHOST configure for Python
+	# will check the existence of the --with-build-python value
+	# immediately.
+	emake
+	popd &> /dev/null || die
+}
+
+src_configure() {
+	# disable automagic bluetooth headers detection
+	if ! use bluetooth; then
+		local -x ac_cv_header_bluetooth_bluetooth_h=no
+	fi
+
+	append-flags -fwrapv
+	filter-flags -malign-double
+
+	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
+	# PKG_CONFIG needed for cross.
+	tc-export CXX PKG_CONFIG
+
+	local dbmliborder=
+	if use gdbm; then
+		dbmliborder+="${dbmliborder:+:}gdbm"
+	fi
+
+	if use pgo; then
+		local profile_task_flags=(
+			-m test
+			"-j$(makeopts_jobs)"
+			--pgo-extended
+			-u-network
+
+			# We use a timeout because of how often we've had hang issues
+			# here. It also matches the default upstream PROFILE_TASK.
+			--timeout 1200
+
+			-x test_gdb
+			-x test_dtrace
+
+			# All of these seem to occasionally hang for PGO inconsistently
+			# They'll even hang here but be fine in src_test sometimes.
+			# bug #828535 (and related: bug #788022)
+			-x test_asyncio
+			-x test_httpservers
+			-x test_logging
+			-x test_multiprocessing_fork
+			-x test_socket
+			-x test_xmlrpc
+
+			# Hangs (actually runs indefinitely executing itself w/ many cpython builds)
+			# bug #900429
+			-x test_tools
+		)
+
+		if has_version "app-arch/rpm" ; then
+			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
+			profile_task_flags+=(
+				-x test_distutils
+			)
+		fi
+		local -x PROFILE_TASK="${profile_task_flags[*]}"
+	fi
+
+	local myeconfargs=(
+		# glibc-2.30 removes it; since we can't cleanly force-rebuild
+		# Python on glibc upgrade, remove it proactively to give
+		# a chance for users rebuilding python before glibc
+		ac_cv_header_stropts_h=no
+
+		--enable-shared
+		--without-static-libpython
+		--enable-ipv6
+		--infodir='${prefix}/share/info'
+		--mandir='${prefix}/share/man'
+		--with-computed-gotos
+		--with-dbmliborder="${dbmliborder}"
+		--with-libc=
+		--enable-loadable-sqlite-extensions
+		--without-ensurepip
+		--without-lto
+		--with-system-expat
+		--with-platlibdir=lib
+		--with-pkg-config=yes
+		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
+
+		$(use_with debug assertions)
+		$(use_enable pgo optimizations)
+		$(use_with readline readline "$(usex libedit editline readline)")
+		$(use_with valgrind)
+	)
+
+	# https://bugs.gentoo.org/700012
+	if tc-is-lto; then
+		append-cflags $(test-flags-CC -ffat-lto-objects)
+		myeconfargs+=(
+			--with-lto
+		)
+	fi
+
+	# Force-disable modules we don't want built.
+	# See Modules/Setup for docs on how this works. Setup.local contains our local deviations.
+	cat > Modules/Setup.local <<-EOF || die
+		*disabled*
+		nis
+		$(usev !gdbm '_gdbm _dbm')
+		$(usev !sqlite '_sqlite3')
+		$(usev !ssl '_hashlib _ssl')
+		$(usev !ncurses '_curses _curses_panel')
+		$(usev !readline 'readline')
+		$(usev !tk '_tkinter')
+	EOF
+
+	# disable implicit optimization/debugging flags
+	local -x OPT=
+
+	if tc-is-cross-compiler ; then
+		build_cbuild_python
+		myeconfargs+=(
+			# Point the imminent CHOST build to the Python we just
+			# built for CBUILD.
+			--with-build-python="${WORKDIR}"/${P}-${CBUILD}/python
+		)
+	fi
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	local -x CFLAGS_NODIST=${CFLAGS}
+	local -x LDFLAGS_NODIST=${LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+
+	# Fix implicit declarations on cross and prefix builds. Bug #674070.
+	if use ncurses; then
+		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
+	fi
+
+	econf "${myeconfargs[@]}"
+
+	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
+		eerror "configure has detected that the sem_open function is broken."
+		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
+		die "Broken sem_open function (bug 496328)"
+	fi
+
+	# install epython.py as part of stdlib
+	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
+}
+
+src_compile() {
+	# Ensure sed works as expected
+	# https://bugs.gentoo.org/594768
+	local -x LC_ALL=C
+	export PYTHONSTRICTEXTENSIONBUILD=1
+
+	# Save PYTHONDONTWRITEBYTECODE so that 'has_version' doesn't
+	# end up writing bytecode & violating sandbox.
+	# bug #831897
+	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
+
+	if use pgo ; then
+		# bug 660358
+		local -x COLUMNS=80
+		local -x PYTHONDONTWRITEBYTECODE=
+
+		addpredict "/usr/lib/python${PYVER}/site-packages"
+	fi
+
+	# also need to clear the flags explicitly here or they end up
+	# in _sysconfigdata*
+	emake CPPFLAGS= CFLAGS= LDFLAGS=
+
+	# Restore saved value from above.
+	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
+
+	# Work around bug 329499. See also bug 413751 and 457194.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E python
+	else
+		pax-mark m python
+	fi
+}
+
+src_test() {
+	# Tests will not work when cross compiling.
+	if tc-is-cross-compiler; then
+		elog "Disabling tests due to crosscompiling."
+		return
+	fi
+
+	# this just happens to skip test_support.test_freeze that is broken
+	# without bundled expat
+	# TODO: get a proper skip for it upstream
+	local -x LOGNAME=buildbot
+
+	local test_opts=(
+		-u-network
+		-j "$(makeopts_jobs)"
+
+		# fails
+		-x test_gdb
+	)
+
+	if use sparc ; then
+		# bug #788022
+		test_opts+=(
+			-x test_multiprocessing_fork
+			-x test_multiprocessing_forkserver
+		)
+	fi
+
+	# workaround docutils breaking tests
+	cat > Lib/docutils.py <<-EOF || die
+		raise ImportError("Thou shalt not import!")
+	EOF
+
+	# bug 660358
+	local -x COLUMNS=80
+	local -x PYTHONDONTWRITEBYTECODE=
+	# workaround https://bugs.gentoo.org/775416
+	addwrite "/usr/lib/python${PYVER}/site-packages"
+
+	nonfatal emake test EXTRATESTOPTS="${test_opts[*]}" \
+		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
+	local ret=${?}
+
+	rm Lib/docutils.py || die
+
+	[[ ${ret} -eq 0 ]] || die "emake test failed"
+}
+
+src_install() {
+	local libdir=${ED}/usr/lib/python${PYVER}
+
+	# the Makefile rules are broken
+	# https://github.com/python/cpython/issues/100221
+	mkdir -p "${libdir}"/lib-dynload || die
+
+	# -j1 hack for now for bug #843458
+	emake -j1 DESTDIR="${D}" altinstall
+
+	# Fix collisions between different slots of Python.
+	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
+
+	# Cheap hack to get version with ABIFLAGS
+	local abiver=$(cd "${ED}/usr/include"; echo python*)
+	if [[ ${abiver} != python${PYVER} ]]; then
+		# Replace python3.X with a symlink to python3.Xm
+		rm "${ED}/usr/bin/python${PYVER}" || die
+		dosym "${abiver}" "/usr/bin/python${PYVER}"
+		# Create python3.X-config symlink
+		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
+		# Create python-3.5m.pc symlink
+		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
+	fi
+
+	# python seems to get rebuilt in src_install (bug 569908)
+	# Work around it for now.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E "${ED}/usr/bin/${abiver}"
+	else
+		pax-mark m "${ED}/usr/bin/${abiver}"
+	fi
+
+	rm -r "${libdir}"/ensurepip/_bundled || die
+	if ! use ensurepip; then
+		rm -r "${libdir}"/ensurepip || die
+	fi
+	if ! use sqlite; then
+		rm -r "${libdir}/"sqlite3 || die
+	fi
+	if ! use tk; then
+		rm -r "${ED}/usr/bin/idle${PYVER}" || die
+		rm -r "${libdir}/"{idlelib,tkinter,test/test_tk*} || die
+	fi
+
+	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
+
+	dodoc Misc/{ACKS,HISTORY,NEWS}
+
+	if use examples; then
+		docinto examples
+		find Tools -name __pycache__ -exec rm -fr {} + || die
+		dodoc -r Tools
+	fi
+	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
+	local libname=$(
+		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
+		emake --no-print-directory -s -f - 2>/dev/null
+	)
+	newins Tools/gdb/libpython.py "${libname}"-gdb.py
+
+	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
+	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
+	sed \
+		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
+		-e "s:@PYDOC@:pydoc${PYVER}:" \
+		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
+		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
+
+	# python-exec wrapping support
+	local pymajor=${PYVER%.*}
+	local EPYTHON=python${PYVER}
+	local scriptdir=${D}$(python_get_scriptdir)
+	mkdir -p "${scriptdir}" || die
+	# python and pythonX
+	ln -s "../../../bin/${abiver}" "${scriptdir}/python${pymajor}" || die
+	ln -s "python${pymajor}" "${scriptdir}/python" || die
+	# python-config and pythonX-config
+	# note: we need to create a wrapper rather than symlinking it due
+	# to some random dirname(argv[0]) magic performed by python-config
+	cat > "${scriptdir}/python${pymajor}-config" <<-EOF || die
+		#!/bin/sh
+		exec "${abiver}-config" "\${@}"
+	EOF
+	chmod +x "${scriptdir}/python${pymajor}-config" || die
+	ln -s "python${pymajor}-config" "${scriptdir}/python-config" || die
+	# 2to3, pydoc
+	ln -s "../../../bin/2to3-${PYVER}" "${scriptdir}/2to3" || die
+	ln -s "../../../bin/pydoc${PYVER}" "${scriptdir}/pydoc" || die
+	# idle
+	if use tk; then
+		ln -s "../../../bin/idle${PYVER}" "${scriptdir}/idle" || die
+	fi
+}
+
+pkg_postinst() {
+	local v
+	for v in ${REPLACING_VERSIONS}; do
+		if ver_test "${v}" -lt 3.11.0_beta4-r2; then
+			ewarn "Python 3.11.0b4 has changed its module ABI.  The .pyc files"
+			ewarn "installed previously are no longer valid and will be regenerated"
+			ewarn "(or ignored) on the next import.  This may cause sandbox failures"
+			ewarn "when installing some packages and checksum mismatches when removing"
+			ewarn "old versions.  To actively prevent this, rebuild all packages"
+			ewarn "installing Python 3.11 modules, e.g. using:"
+			ewarn
+			ewarn "  emerge -1v /usr/lib/python3.11/site-packages"
+		fi
+	done
+}
diff --git a/dev-lang/python/python-3.13.0_alpha2.ebuild b/dev-lang/python/python-3.13.0_alpha2.ebuild
index 3d383937a488..6907f2db8bd3 100644
--- a/dev-lang/python/python-3.13.0_alpha2.ebuild
+++ b/dev-lang/python/python-3.13.0_alpha2.ebuild
@@ -43,7 +43,7 @@ RDEPEND="
 	app-arch/bzip2:=
 	app-arch/xz-utils:=
 	app-crypt/libb2
-	>=dev-libs/expat-2.1:=
+	<dev-libs/expat-2.6:=
 	dev-libs/libffi:=
 	dev-python/gentoo-common
 	>=sys-libs/zlib-1.1.3:=
diff --git a/dev-lang/python/python-3.13.0_alpha3.ebuild b/dev-lang/python/python-3.13.0_alpha3.ebuild
index 2cd791faab28..772ef1abd235 100644
--- a/dev-lang/python/python-3.13.0_alpha3.ebuild
+++ b/dev-lang/python/python-3.13.0_alpha3.ebuild
@@ -43,7 +43,7 @@ RDEPEND="
 	app-arch/bzip2:=
 	app-arch/xz-utils:=
 	app-crypt/libb2
-	>=dev-libs/expat-2.1:=
+	<dev-libs/expat-2.6:=
 	dev-libs/libffi:=
 	dev-python/gentoo-common
 	>=sys-libs/zlib-1.1.3:=
diff --git a/dev-lang/python/python-3.8.18.ebuild b/dev-lang/python/python-3.8.18.ebuild
index 27d83e4ca8dd..54af09bc8cfd 100644
--- a/dev-lang/python/python-3.8.18.ebuild
+++ b/dev-lang/python/python-3.8.18.ebuild
@@ -60,7 +60,7 @@ RDEPEND="
 		dev-tcltk/blt:=
 		dev-tcltk/tix
 	)
-	xml? ( >=dev-libs/expat-2.1:= )
+	xml? ( <dev-libs/expat-2.6:= )
 "
 # bluetooth requires headers from bluez
 DEPEND="
diff --git a/dev-lang/python/python-3.9.18.ebuild b/dev-lang/python/python-3.9.18.ebuild
index 24bb10243804..15bb2cfef77e 100644
--- a/dev-lang/python/python-3.9.18.ebuild
+++ b/dev-lang/python/python-3.9.18.ebuild
@@ -61,7 +61,7 @@ RDEPEND="
 		dev-tcltk/blt:=
 		dev-tcltk/tix
 	)
-	xml? ( >=dev-libs/expat-2.1:= )
+	xml? ( <dev-libs/expat-2.6:= )
 "
 # bluetooth requires headers from bluez
 DEPEND="