Prevent use on Python 3.12.5 (#4447)

Fixes #4446
See https://github.com/python/cpython/issues/123821

It's possible this is too strict? We could instead do this anytime the
AST safety check fails, but feels weird to have that happen
non-deterministically

.github/workflows/doc.yml

@@ -26,7 +26,8 @@ jobs:
       - name: Set up latest Python
         uses: actions/setup-python@v5
         with:
-          python-version: "*"
+          python-version: "3.13"
+          allow-prereleases: true
 
       - name: Install dependencies
         run: |

.github/workflows/fuzz.yml

@@ -22,7 +22,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        python-version: ["3.8", "3.9", "3.10", "3.11", "3.12", "3.13"]
+        python-version: ["3.8", "3.9", "3.10", "3.11", "3.12.4", "3.13"]
 
     steps:
       - uses: actions/checkout@v4

.github/workflows/lint.yml

@@ -26,7 +26,8 @@ jobs:
       - name: Set up latest Python
         uses: actions/setup-python@v5
         with:
-          python-version: "*"
+          python-version: "3.13"
+          allow-prereleases: true
 
       - name: Install dependencies
         run: |

.github/workflows/pypi_upload.yml

@@ -23,7 +23,8 @@ jobs:
       - name: Set up latest Python
         uses: actions/setup-python@v5
         with:
-          python-version: "*"
+          python-version: "3.13"
+          allow-prereleases: true
 
       - name: Install latest pip, build, twine
         run: |

.github/workflows/test.yml

@@ -31,7 +31,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        python-version: ["3.8", "3.9", "3.10", "3.11", "3.12", "3.13", "pypy-3.9"]
+        python-version: ["3.8", "3.9", "3.10", "3.11", "3.12.4", "3.13", "pypy-3.9"]
         os: [ubuntu-latest, macOS-latest, windows-latest]
 
     steps:
@@ -99,7 +99,7 @@ jobs:
       - name: Set up latest Python
         uses: actions/setup-python@v5
         with:
-          python-version: "*"
+          python-version: "3.12.4"
 
       - name: Install black with uvloop
         run: |

.github/workflows/upload_binary.yml

@@ -34,7 +34,7 @@ jobs:
       - name: Set up latest Python
         uses: actions/setup-python@v5
         with:
-          python-version: "*"
+          python-version: "3.12.4"
 
       - name: Install Black and PyInstaller
         run: |

CHANGES.md

@@ -7,6 +7,9 @@
 <!-- Include any especially major or disruptive changes here -->
 
 - Black now officially supports Python 3.13 (#4436)
+- Black will issue an error when used with Python 3.12.5, due to an upstream memory
+  safety issue in Python 3.12.5 that can cause Black's AST safety checks to fail. Please
+  use Python 3.12.6 or Python 3.12.4 instead. (#4447)
 
 ### Stable style
 

src/black/__init__.py

@@ -549,6 +549,14 @@ def main(  # noqa: C901
     """The uncompromising code formatter."""
     ctx.ensure_object(dict)
 
+    if sys.version_info[:3] == (3, 12, 5):
+        out(
+            "Python 3.12.5 has a memory safety issue that can cause Black's "
+            "AST safety checks to fail. "
+            "Please upgrade to Python 3.12.6 or downgrade to Python 3.12.4"
+        )
+        ctx.exit(1)
+
     if src and code is not None:
         out(
             main.get_usage(ctx)