Bump Pythons to 3.12.15/3.13.16/3.14.8; iOS 15.0 / macOS 12.0 minimums; dart_bridge 1.11.0

[FeodorFitsner]

Fixes #44. Part of flet-dev/flet#6940.

Depends on flet-dev/dart-bridge#23. The manifest pins dart_bridge_version: 1.11.0, so dart-bridge 1.11.0 has to be released before this one.

Why

Xcode 27 rejects deployment targets below iOS 15.0 / macOS 12.0, and Flet 1.1.0 already moved its build template and client to those minimums (flet-dev/flet#6914). The frameworks published here still declared iOS 13.0 (MinimumOSVersion in Python.framework and in every per-module xcframework) and macOS 11.0. This PR raises them and moves CPython to the latest patch releases.

Changes

iOS 15.0

• darwin/build_ios.py:
  • New IOS_DEPLOYMENT_TARGET = "15.0".
  • The Apple tool configures an unversioned --host=arm64-apple-ios, so configure falls back to its hardcoded IPHONEOS_DEPLOYMENT_TARGET:=13.0}, which also overwrites the env var. The script now rewrites that default next to the existing _multiprocessing/_posixshmem rewrite, and fails if the string isn't found exactly once. The line is the same in 3.14+ upstream, 3.13 upstream and our 3.12 back-port patch.
  • Everything derived from that default follows: -mios[-simulator]-version-min, the Python.framework MinimumOSVersion, the sysconfig platform (ios-15.0-...), and HOST_GNU_TYPE (aarch64-apple-ios15.0).
  • The VERSIONS file now reads the constant.
  • The Apple tool ships its testbed build/iOS-dylib-Info-template.plist inside the xcframework with 13.0 hardcoded. reshape() now rewrites it to match.
• darwin/xcframework_utils.sh: the per-module framework plists now say MinimumOSVersion 15.0.

macOS 12.0

• darwin/build_macos.py: DEFAULT_DEPLOYMENT_TARGET 11.0 → 12.0. This covers CPython, OpenSSL, xz, zstd and VERSIONS.

Pythons

• manifest.json:

  • full_version: 3.12.15 / 3.13.16 / 3.14.8.
  • standalone_release_date: 20261001, the first python-build-standalone release with all three.
  • dart_bridge_version: 1.11.0.
  • Pyodide stays at 0.27.8 / 0.29.5 / 314.0.7, which are still the latest.

• .github/workflows/build-python-version.yml: updated the dispatch options.

• darwin/ios_patches/3.13/Python.patch: 3.13.16 rewrote upstream's iOS min-version block to AS_CASE([$host], [*-apple-ios*-simulator] ... [*-apple-ios*] ...), adding -mios-simulator-version-min. As a result:

  • The configure.ac hunk was rejected.
  • The configure hunk applied with fuzz, leaving tvOS)/watchOS) labels inside a case $host where they could never match.

  Both hunks are rebased onto the new block, and the tvOS/watchOS cases are now *-apple-tvos* / *-apple-watchos* host patterns. The 3.12 patch applies cleanly to 3.12.15.

Testing

All local, on Xcode 26, with output written to a scratch root.

• Patches: patch -p1 applies both patches to clean 3.12.15 / 3.13.16 sources with no rejects and no fuzz. The configure default string appears exactly once in 3.12.15 (patched), 3.13.16 (patched) and 3.14.8.
• python build_ios.py 3.13.16:
  • Python.framework: LC_BUILD_VERSION is minos 15.0 on the device slice and on both simulator archs. The MinimumOSVersion in the plist is 15.0.
  • _ssl.so (device and x86_64 simulator): minos 15.0.
  • _sysconfigdata: IPHONEOS_DEPLOYMENT_TARGET is '15.0', and HOST_GNU_TYPE is aarch64-apple-ios15.0 / x86_64-apple-ios15.0-simulator.
  • VERSIONS and the build/iOS-dylib-Info-template.plist both say 15.0.
• package-ios-for-dart.sh . 3.13.16: all 112 framework Info.plists in the tarball say MinimumOSVersion 15.0.
• python build_macos.py 3.14.8:
  • Python.framework and _ssl.so: minos 12.0 for arm64 and x86_64.
  • VERSIONS: Min macOS version: 12.0.
  • sysconfig: MACOSX_DEPLOYMENT_TARGET '12.0'.

The full matrix (3.12/3.14 iOS, Android, Linux, Windows, Pyodide) is left to CI.

After merge

Publish the release. Then serious_python re-pins with gen_version_tables --release-date <date> (flet-dev/serious-python#254), and Flet updates PYTHON_BUILD_RELEASE_DATE.

[FeodorFitsner]

Pushed a fix for the 3.12.15 iOS failure, which isn't caused by this PR's changes.

The macOS runner image now links Homebrew openssl@4 (4.0.3). The Apple tool first compiles a native build-python with no --with-openssl, so pkg-config picks that up. OpenSSL 4 made ASN1_STRING opaque, and 3.12's Modules/_ssl.c still reads ->length / ->data directly, which gives 8 incomplete definition of type 'ASN1_OCTET_STRING' errors. 3.13+ already use the accessors, and 3.14.8 iOS passed here.

The fix adds a Modules/_ssl.c section to ios_patches/3.12/Python.patch that switches to ASN1_STRING_length() / ASN1_STRING_get0_data(), the same code as 3.13 upstream. These accessors exist since OpenSSL 1.1.0, so the iOS slices, which link OpenSSL 3.0.18 from cpython-apple-source-deps, are unaffected. ios_patches/README.md notes it.

Verified locally:

• The patch applies cleanly to 3.12.15.
• Compiling _ssl.c against generated OpenSSL 4.0.3 headers reproduces the 8 errors before the fix and gives 0 after.
• It still compiles with 0 errors against OpenSSL 3.6.