REFACTOR: keep Python 3.15 support scoped

Remove the native-hardening and auth-test changes owned by PR #810, retaining only the Python 3.15 header-order compatibility flag and its focused contract.\n\nCo-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: bewithgaurav

mssql_python/pybind/CMakeLists.txt

@@ -255,13 +255,6 @@ endif()
 
 message(STATUS "Final Python library directory: ${PYTHON_LIB_DIR}")
 
-# Single-config POSIX generators ignore `cmake --build --config Release`.
-# Make the optimized release mode explicit instead of relying on simdutf to
-# populate this project-wide cache variable as a FetchContent side effect.
-if(UNIX AND NOT CMAKE_BUILD_TYPE AND NOT CMAKE_CONFIGURATION_TYPES)
-    set(CMAKE_BUILD_TYPE Release CACHE STRING "Build type" FORCE)
-endif()
-
 include(FetchContent)
 message(STATUS "Downloading simdutf v8.2.0 source archive with FetchContent")
 set(simdutf_fetchcontent_args
@@ -394,45 +387,10 @@ if(CMAKE_CXX_COMPILER_ID STREQUAL "GNU" OR CMAKE_CXX_COMPILER_ID STREQUAL "Clang
     endif()
 endif()
 
-# Harden the Python extension against exploitation of a separate memory-safety
-# defect. Mach-O receives stack protection; ELF-specific flags stay Linux-only.
+# Python 3.15 defines newer POSIX feature levels than glibc's C++ headers.
+# Process Python.h first so libc sees the matching feature-test macros.
 if(UNIX)
-    # Python 3.15 defines newer POSIX feature levels than glibc's C++ headers.
-    # Force Python.h to be processed first in every translation unit.
-    target_compile_options(ddbc_bindings PRIVATE
-        -include Python.h
-        -fstack-protector-strong
-    )
-endif()
-
-if(UNIX AND NOT APPLE)
-    include(CheckCXXSourceCompiles)
-    set(DDBC_REQUIRED_FLAGS_SAVED "${CMAKE_REQUIRED_FLAGS}")
-    set(CMAKE_REQUIRED_FLAGS
-        "${CMAKE_REQUIRED_FLAGS} -O2 -Werror -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=3"
-    )
-    check_cxx_source_compiles("
-        #include <features.h>
-        #if !defined(__USE_FORTIFY_LEVEL) || __USE_FORTIFY_LEVEL < 3
-        #error _FORTIFY_SOURCE=3 is unavailable
-        #endif
-        int main() { return 0; }
-    " DDBC_SUPPORTS_FORTIFY_SOURCE_3)
-    set(CMAKE_REQUIRED_FLAGS "${DDBC_REQUIRED_FLAGS_SAVED}")
-    if(DDBC_SUPPORTS_FORTIFY_SOURCE_3)
-        set(DDBC_FORTIFY_LEVEL 3)
-    else()
-        set(DDBC_FORTIFY_LEVEL 2)
-    endif()
-    target_compile_options(ddbc_bindings PRIVATE
-        $<$<NOT:$<CONFIG:Debug>>:-U_FORTIFY_SOURCE>
-        $<$<NOT:$<CONFIG:Debug>>:-D_FORTIFY_SOURCE=${DDBC_FORTIFY_LEVEL}>
-    )
-    target_link_options(ddbc_bindings PRIVATE
-        -Wl,-z,relro
-        -Wl,-z,now
-        -Wl,-z,noexecstack
-    )
+    target_compile_options(ddbc_bindings PRIVATE -include Python.h)
 endif()
 
 # Add macOS-specific string conversion fix

tests/test_008_auth.py

@@ -1554,13 +1554,7 @@ def test_multiple_connections_share_same_token_provider(self, mock_ddbc_conn):
     @patch("mssql_python.connection.ddbc_bindings.Connection")
     def test_concurrent_connections_with_same_token_provider(self, mock_ddbc_conn):
         """Concurrent connect() calls with one token provider should succeed."""
-
-        def create_native_connection(*_args, **_kwargs):
-            native_connection = MagicMock()
-            native_connection.get_autocommit.return_value = True
-            return native_connection
-
-        mock_ddbc_conn.side_effect = create_native_connection
+        mock_ddbc_conn.return_value = MagicMock()
         mock_cred = MagicMock()
         mock_cred.get_token.return_value = MagicMock(token=SAMPLE_TOKEN)
         from mssql_python import connect

tests/test_038_mssql_odbc_daily_validation.py

@@ -15,6 +15,7 @@
 PR_PIPELINE = ROOT / "eng" / "pipelines" / "pr-validation-pipeline.yml"
 PREFLIGHT = ROOT / "eng" / "scripts" / "verify_mssql_odbc_provider.py"
 RELEASE_PIPELINE = ROOT / "OneBranchPipelines" / "stages" / "build-linux-single-stage.yml"
+PYBIND_CMAKE = ROOT / "mssql_python" / "pybind" / "CMakeLists.txt"
 
 
 @unittest.skipUnless(sys.platform.startswith("linux"), "runner requires Linux GNU timeout and bash")
@@ -188,6 +189,11 @@ def test_python_315_validation_installs_stable_pyarrow(self):
         self.assertIn('pyarrow==26.0.0; python_version >= "3.15"', requirements)
         self.assertNotIn("scientific-python-nightly-wheels", requirements)
 
+    def test_python_315_processes_python_header_before_libc_headers(self):
+        cmake = PYBIND_CMAKE.read_text(encoding="utf-8")
+
+        self.assertIn("target_compile_options(ddbc_bindings PRIVATE -include Python.h)", cmake)
+
 
 if __name__ == "__main__":
     unittest.main()