diff --git a/.gitattributes b/.gitattributes
index f10261fb12..1dadf8a5be 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -1 +1,7 @@
+# Normalize all text files to use LF (\n) line endings.
+# More specific rules below this line may override this default,
+# for example:
+# *.bat   text eol=crlf
+* text=auto eol=lf
+
 dpctl/_version.py export-subst
diff --git a/.github/workflows/conda-package-cf.yml b/.github/workflows/conda-package-cf.yml
index 82660758d4..1426b07db1 100644
--- a/.github/workflows/conda-package-cf.yml
+++ b/.github/workflows/conda-package-cf.yml
@@ -22,7 +22,9 @@ env:
 
 jobs:
   build_linux:
-    runs-on: ubuntu-latest
+    # Pinned: ubuntu-latest is moving to Ubuntu 26.04, whose image has no
+    # preinstalled Miniconda ($CONDA is empty), and Linux jobs below rely on it
+    runs-on: ubuntu-24.04
     timeout-minutes: 90
 
     strategy:
@@ -84,7 +86,7 @@ jobs:
             conda build --no-test --python ${{ matrix.python }} ${{ env.CHANNELS }} ${{ env.RECIPE_DIR }}
           fi
       - name: Upload artifact
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: ${{ env.PACKAGE_NAME }} ${{ runner.os }} Python ${{ matrix.python == '3.14' && (contains(matrix.python_spec, 'cp314t') && '3.14t' || '3.14') || matrix.python }}
           path: /usr/share/miniconda/conda-bld/linux-64/${{ env.PACKAGE_NAME }}-*.conda
@@ -149,7 +151,7 @@ jobs:
           )
 
       - name: Upload artifact
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: ${{ env.PACKAGE_NAME }} ${{ runner.os }} Python ${{ matrix.python == '3.14' && (contains(matrix.python_spec, 'cp314t') && '3.14t' || '3.14') || matrix.python }}
           path: ${{ env.CONDA_BLD }}${{ env.PACKAGE_NAME }}-*.conda
@@ -166,19 +168,19 @@ jobs:
         include:
           - python: '3.14'
             python_spec: '3.14.* *_cp314'
-            runner: ubuntu-latest
+            runner: ubuntu-24.04
           - python: '3.14'
             python_spec: '3.14.* *_cp314t'
-            runner: ubuntu-latest
+            runner: ubuntu-24.04
           - python: '3.15'
             python_spec: '3.15.* *_cp315'
-            runner: ubuntu-latest
+            runner: ubuntu-24.04
           # TODO: add 3.15t (cp315t) when NumPy cp315t builds are available on conda-forge
-        runner: [ubuntu-latest]
+        runner: [ubuntu-24.04]
 
     steps:
       - name: Download artifact
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: ${{ env.PACKAGE_NAME }} ${{ runner.os }} Python ${{ matrix.python == '3.14' && (contains(matrix.python_spec, 'cp314t') && '3.14t' || '3.14') || matrix.python }}
       - name: Add conda to system path
@@ -294,7 +296,7 @@ jobs:
 
     steps:
       - name: Download artifact
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: ${{ env.PACKAGE_NAME }} ${{ runner.os }} Python ${{ matrix.python == '3.14' && (contains(matrix.python_spec, 'cp314t') && '3.14t' || '3.14') || matrix.python }}
 
@@ -393,11 +395,11 @@ jobs:
       matrix:
         python: ['3.14']
         python_spec: ['3.14.* *_cp314']
-        runner: [ubuntu-latest]
+        runner: [ubuntu-24.04]
         include:
           - python: '3.14'
             python_spec: '3.14.* *_cp314t'
-            runner: ubuntu-latest
+            runner: ubuntu-24.04
     timeout-minutes: 60
     env:
       EXAMPLES_ENV_NAME: examples
@@ -418,7 +420,7 @@ jobs:
           persist-credentials: false
           fetch-depth: 0
       - name: Download artifact
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: ${{ env.PACKAGE_NAME }} ${{ runner.os }} Python ${{ matrix.python == '3.14' && (contains(matrix.python_spec, 'cp314t') && '3.14t' || '3.14') || matrix.python }}
       - name: Add conda to system path
@@ -589,7 +591,7 @@ jobs:
           fetch-depth: 0
 
       - name: Download artifact
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: ${{ env.PACKAGE_NAME }} ${{ runner.os }} Python ${{ matrix.python == '3.14' && (contains(matrix.python_spec, 'cp314t') && '3.14t' || '3.14') || matrix.python }}
 
diff --git a/.github/workflows/conda-package.yml b/.github/workflows/conda-package.yml
index 0388d7d6cf..bd630c9db7 100644
--- a/.github/workflows/conda-package.yml
+++ b/.github/workflows/conda-package.yml
@@ -22,7 +22,9 @@ env:
 
 jobs:
   build_linux:
-    runs-on: ubuntu-latest
+    # Pinned: ubuntu-latest is moving to Ubuntu 26.04, whose image has no
+    # preinstalled Miniconda ($CONDA is empty), and Linux jobs below rely on it
+    runs-on: ubuntu-24.04
     timeout-minutes: 90
 
     strategy:
@@ -89,12 +91,12 @@ jobs:
             conda build --no-test --python ${{ matrix.python }} --numpy 2.0 -c conda-forge --override-channels conda-recipe
           fi
       - name: Upload artifact
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: ${{ env.PACKAGE_NAME }} ${{ runner.os }} Python ${{ matrix.python == '3.14' && (contains(matrix.python_spec, 'cp314t') && '3.14t' || '3.14') || matrix.python }}
           path: /usr/share/miniconda/conda-bld/linux-64/${{ env.PACKAGE_NAME }}-*.conda
       - name: Upload wheels artifact
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: ${{ env.PACKAGE_NAME }} ${{ runner.os }} Wheels Python ${{ matrix.python == '3.14' && (contains(matrix.python_spec, 'cp314t') && '3.14t' || '3.14') || matrix.python }}
           path: ${{ env.WHEELS_OUTPUT_FOLDER }}${{ env.PACKAGE_NAME }}-*.whl
@@ -171,13 +173,13 @@ jobs:
           )
 
       - name: Upload artifact
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: ${{ env.PACKAGE_NAME }} ${{ runner.os }} Python ${{ matrix.python == '3.14' && (contains(matrix.python_spec, 'cp314t') && '3.14t' || '3.14') || matrix.python }}
           path: ${{ env.CONDA_BLD }}${{ env.PACKAGE_NAME }}-*.conda
 
       - name: Upload wheels artifact
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: ${{ env.PACKAGE_NAME }} ${{ runner.os }} Wheels Python ${{ matrix.python == '3.14' && (contains(matrix.python_spec, 'cp314t') && '3.14t' || '3.14') || matrix.python }}
           path: ${{ env.WHEELS_OUTPUT_FOLDER }}${{ env.PACKAGE_NAME }}-*.whl
@@ -195,18 +197,18 @@ jobs:
           - python: '3.14'
             python_spec: '3.14.* *_cp314'
             experimental: false
-            runner: ubuntu-latest
+            runner: ubuntu-24.04
           - python: '3.14'
             python_spec: '3.14.* *_cp314t'
             experimental: false
-            runner: ubuntu-latest
+            runner: ubuntu-24.04
           - python: '3.15'
             python_spec: '3.15.* *_cp315'
             experimental: false
-            runner: ubuntu-latest
+            runner: ubuntu-24.04
           # TODO: add 3.15t (cp315t) when NumPy cp315t builds are available on conda-forge
         experimental: [false]
-        runner: [ubuntu-latest]
+        runner: [ubuntu-24.04]
     continue-on-error: ${{ matrix.experimental }}
 
     steps:
@@ -217,7 +219,7 @@ jobs:
         run: |
           echo "${{ env.CHANNELS }}"
       - name: Download artifact
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: ${{ env.PACKAGE_NAME }} ${{ runner.os }} Python ${{ matrix.python == '3.14' && (contains(matrix.python_spec, 'cp314t') && '3.14t' || '3.14') || matrix.python }}
       - name: Add conda to system path
@@ -346,7 +348,7 @@ jobs:
           echo "${{ env.CHANNELS }}"
 
       - name: Download artifact
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: ${{ env.PACKAGE_NAME }} ${{ runner.os }} Python ${{ matrix.python == '3.14' && (contains(matrix.python_spec, 'cp314t') && '3.14t' || '3.14') || matrix.python }}
 
@@ -507,7 +509,7 @@ jobs:
     if: |
       (github.repository == 'IntelPython/dpctl') &&
       (github.ref == 'refs/heads/master' || (startsWith(github.ref, 'refs/heads/release') == true) || github.event_name == 'push' && contains(github.ref, 'refs/tags/'))
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 20
     strategy:
       matrix:
@@ -523,12 +525,12 @@ jobs:
           # TODO: add 3.15t (cp315t) when NumPy cp315t builds are available on conda-forge
     steps:
       - name: Download conda artifact
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: ${{ env.PACKAGE_NAME }} ${{ runner.os }} Python ${{ matrix.python == '3.14' && (contains(matrix.python_spec, 'cp314t') && '3.14t' || '3.14') || matrix.python }}
 
       - name: Download wheel artifact
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: ${{ env.PACKAGE_NAME }} ${{ runner.os }} Wheels Python ${{ matrix.python == '3.14' && (contains(matrix.python_spec, 'cp314t') && '3.14t' || '3.14') || matrix.python }}
 
@@ -575,12 +577,12 @@ jobs:
           # TODO: add 3.15t (cp315t) when NumPy cp315t builds are available on conda-forge
     steps:
       - name: Download artifact
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: ${{ env.PACKAGE_NAME }} ${{ runner.os }} Python ${{ matrix.python == '3.14' && (contains(matrix.python_spec, 'cp314t') && '3.14t' || '3.14') || matrix.python }}
 
       - name: Download wheel artifact
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: ${{ env.PACKAGE_NAME }} ${{ runner.os }} Wheels Python ${{ matrix.python == '3.14' && (contains(matrix.python_spec, 'cp314t') && '3.14t' || '3.14') || matrix.python }}
 
@@ -616,13 +618,13 @@ jobs:
         python: ['3.15']
         python_spec: ['3.15.* *_cp315']
         experimental: [false]
-        runner: [ubuntu-latest]
+        runner: [ubuntu-24.04]
         include:
           # TODO: switch to 3.15t (cp315t) when NumPy cp315t builds are available on conda-forge
           - python: '3.14'
             python_spec: '3.14.* *_cp314t'
             experimental: false
-            runner: ubuntu-latest
+            runner: ubuntu-24.04
     continue-on-error: ${{ matrix.experimental }}
     timeout-minutes: 60
     env:
@@ -647,7 +649,7 @@ jobs:
           persist-credentials: false
           fetch-depth: 0
       - name: Download artifact
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: ${{ env.PACKAGE_NAME }} ${{ runner.os }} Python ${{ matrix.python == '3.14' && (contains(matrix.python_spec, 'cp314t') && '3.14t' || '3.14') || matrix.python }}
       - name: Add conda to system path
@@ -832,7 +834,7 @@ jobs:
           persist-credentials: false
           fetch-depth: 0
       - name: Download artifact
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: ${{ env.PACKAGE_NAME }} ${{ runner.os }} Python ${{ matrix.python == '3.14' && (contains(matrix.python_spec, 'cp314t') && '3.14t' || '3.14') || matrix.python }}
       - uses: conda-incubator/setup-miniconda@be893c923ea9cf1cf7cd510fbdde27c7e18cbdcb # v4.1.0
diff --git a/.github/workflows/coverity.yml b/.github/workflows/coverity.yml
index aa687db6c3..7cfac68d61 100644
--- a/.github/workflows/coverity.yml
+++ b/.github/workflows/coverity.yml
@@ -28,6 +28,7 @@ jobs:
         with:
           # versioneer needs the tags to compute the package version
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Add Intel repository
         run: |
@@ -79,39 +80,63 @@ jobs:
           echo "${PWD}/cov-analysis/bin" >> "$GITHUB_PATH"
 
       - name: Configure Coverity for the DPC++ compiler
-        env:
-          # icx/icpx are not in Coverity's list of known compilers, so the
-          # clang-based templates below have to be accepted explicitly
-          COVERITY_UNSUPPORTED: 1
         run: |
           source "${ONEAPI_ROOT}/setvars.sh"
-          # Cython-generated sources and the pybind11 extensions go through
-          # icpx, the sysroot/driver probing bits still use gcc
           cov-configure --gcc
-          cov-configure --template --comptype clangcc --compiler icx
-          cov-configure --template --comptype clangcxx --compiler icpx
+          # Generic clang templates can't parse SYCL headers, see https://github.com/IntelPython/dpctl/pull/2401
+          comptypes="$(cov-configure --list-compiler-types | cut -d, -f1)"
+          comptype=""
+          for candidate in intel_oneapi_icx intel_oneapi_icx:linux intel_icx:linux; do
+            if grep -qxF "${candidate}" <<< "${comptypes}"; then
+              comptype="${candidate}"
+              break
+            fi
+          done
+          if [ -z "${comptype}" ]; then
+            echo "::error::No Intel oneAPI compiler type in this cov-analysis; refusing to fall back to the generic Clang configuration."
+            exit 1
+          fi
+          echo "Using Coverity compiler type: ${comptype}"
+          cov-configure --template --comptype "${comptype}" --compiler icx
+          cov-configure --template --comptype "${comptype}" --compiler icpx
 
       - name: Build under cov-build
         timeout-minutes: 90
-        env:
-          COVERITY_UNSUPPORTED: 1
         run: |
           set -o pipefail
           source "${ONEAPI_ROOT}/setvars.sh"
-          rm -rf _skbuild
-          # --skip-editable: the in-place build_ext already compiled everything
-          # Coverity needs to see, a pip install would only repeat it
+          # --skip-editable: build_ext --inplace already compiled everything
           cov-build --dir cov-int \
               python scripts/build_locally.py --oneapi --skip-editable --verbose \
               2>&1 | tee cov-build.log
-          if ! grep -qE "Emitted [1-9][0-9]* .*compilation unit" cov-build.log; then
-            echo "::error::Coverity captured 0 compilation units — the C++ build did not run under cov-build."
+          {
+            echo "### Coverity capture"
+            echo '```'
+            grep -E "Emitted .*compilation unit|are ready for analysis" cov-build.log || true
+            echo '```'
+          } >> "$GITHUB_STEP_SUMMARY"
+          # Gate on per-source emits, not the P% total, see https://github.com/IntelPython/dpctl/pull/2401
+          log=cov-int/build-log.txt
+          compiled="$(grep -oP '\[STATUS\] Compiling \K\S+' "${log}" | grep -F "${GITHUB_WORKSPACE}/" | grep -vF /CMakeFiles/ | sort -u || true)"
+          # Unanchored: parallel compiles can splice output onto the same log line
+          emitted="$(grep -oP "Emit for file '\K[^']+(?=' \(TU [0-9]+\) complete\.)" "${log}" | sort -u || true)"
+          missing="$(comm -23 <(echo "${compiled}") <(echo "${emitted}"))"
+          total="$(grep -c . <<< "${compiled}" || true)"
+          nmissing="$(grep -c . <<< "${missing}" || true)"
+          echo "Coverity emitted $(( total - nmissing )) of ${total} project sources" | tee -a "$GITHUB_STEP_SUMMARY"
+          if [ "${total}" -eq 0 ]; then
+            echo "::error::No project sources were compiled under cov-build."
+            exit 1
+          fi
+          if [ "${nmissing}" -gt 0 ]; then
+            echo "${missing}"
+            echo "::error::Coverity did not emit ${nmissing} of ${total} project sources (listed above)."
             exit 1
           fi
 
       - name: Upload Coverity build log
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: coverity-build-log
           path: |
@@ -121,6 +146,8 @@ jobs:
           if-no-files-found: warn
 
       - name: Submit results to Coverity Scan
+        # A branch submit would replace master's results on the Scan dashboard
+        if: github.ref == 'refs/heads/master'
         timeout-minutes: 15
         env:
           COVERITY_SCAN_TOKEN: ${{ secrets.COVERITY_SCAN_TOKEN }}
diff --git a/.github/workflows/generate-docs.yml b/.github/workflows/generate-docs.yml
index 1a7efad084..4a10c9d73a 100644
--- a/.github/workflows/generate-docs.yml
+++ b/.github/workflows/generate-docs.yml
@@ -99,7 +99,7 @@ jobs:
           git push tokened_docs gh-pages
       - name: Save built docs as an artifact
         if: ${{ github.event.pull_request && github.event.pull_request.head.repo.fork && github.event.action != 'closed'}}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: ${{ env.PACKAGE_NAME }} rendered documentation
           path: ~/docs
diff --git a/.github/workflows/openssf-scorecard.yml b/.github/workflows/openssf-scorecard.yml
index 0fba06da77..b3e49083bb 100644
--- a/.github/workflows/openssf-scorecard.yml
+++ b/.github/workflows/openssf-scorecard.yml
@@ -40,7 +40,7 @@ jobs:
           persist-credentials: false
 
       - name: "Run analysis"
-        uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4
+        uses: ossf/scorecard-action@fa7117db83c52d787ae5a89f350999701505d78e # v2.5.0
         with:
           results_file: results.sarif
           results_format: sarif
@@ -62,7 +62,7 @@ jobs:
       # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
       # format to the repository Actions tab.
       - name: "Upload artifact"
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: SARIF file
           path: results.sarif
@@ -70,6 +70,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
+        uses: github/codeql-action/upload-sarif@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
         with:
           sarif_file: results.sarif
diff --git a/.github/workflows/os-llvm-sycl-build.yml b/.github/workflows/os-llvm-sycl-build.yml
index 3fcdc1ffed..c698c1fa3f 100644
--- a/.github/workflows/os-llvm-sycl-build.yml
+++ b/.github/workflows/os-llvm-sycl-build.yml
@@ -10,7 +10,9 @@ permissions:
 jobs:
   install-compiler:
     name: Build with nightly build of DPC++ toolchain
-    runs-on: ubuntu-latest
+    # TODO: back to ubuntu-latest once intel/llvm#23618 is fixed
+    # (nightly ld.lld needs libxml2.so.2, missing on ubuntu-26.04)
+    runs-on: ubuntu-24.04
     timeout-minutes: 90
 
     env:
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
index cb245d6300..c33e31a5a4 100644
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@@ -29,7 +29,7 @@ jobs:
           persist-credentials: false
 
       - name: Run zizmor
-        uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4
+        uses: zizmorcore/zizmor-action@85b2b9fb8e3325e7a23d7d0a9d7ba5ae0f999e3e # v0.7.1
         with:
           # Low/informational template-injection notes come from internally-defined
           # values (no external input), so they are reported as annotations but do not gate CI
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index d991606c88..d8c10aee28 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -54,7 +54,7 @@ repos:
       - tomli
       exclude: "docs/doxyrest-config.lua.in"
 -   repo: https://github.com/psf/black
-    rev: 26.5.1
+    rev: 26.10.1
     hooks:
     -   id: black
         exclude: "versioneer.py|dpctl/_version.py"
@@ -74,7 +74,7 @@ repos:
     hooks:
     -   id: flake8
 -   repo: https://github.com/pre-commit/mirrors-clang-format
-    rev: v23.1.2
+    rev: v23.1.3
     hooks:
     -   id: clang-format
         args: ["-i"]
@@ -84,7 +84,7 @@ repos:
     -   id: pretty-format-toml
         args: [--autofix]
 - repo: https://github.com/MarcoGorelli/cython-lint
-  rev: v0.21.1
+  rev: v0.22.0
   hooks:
   - id: cython-lint
   - id: double-quote-cython-strings
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 728d81dc55..2cc5c4bf8a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,33 +7,104 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [dev] - XXX. XX, XXXX
 
 ### Added
-* `dpctl.SyclQueue.copy` and `dpctl.SyclQueue.copy_async` methods [gh-2273](https://github.com/IntelPython/dpctl/pull/2273)
+
+### Changed
+
+### Deprecated
+
+### Removed
+
+### Fixed
+
+### Maintenance
+
+## [0.23.0] - Oct. 22, 2026
+
+This release extends the SYCL interface exposed by `dpctl` in several directions: `dpctl.compiler.SyclKernelBundle` objects can now be built from SYCL source strings via the DPC++ `kernel_compiler` extension, SPIR-V specialization constants are supported, USM-device allocations can be shared between processes using the SYCL IPC memory extension, and `dpctl.SyclQueue` gained `copy`, `memset`, and `fill` methods along with their asynchronous counterparts. The package can now be used with free-threaded builds of CPython 3.14 and supports Python 3.15. The `dpctl.program` submodule is deprecated in favor of `dpctl.compiler`, which better describes its purpose.
+
+**NOTE**: This release contains breaking changes:
+
+* Device and platform collection APIs, as well as `dpctl.SyclDevice.sub_group_sizes`, return a `tuple` instead of a `list` [gh-2322](https://github.com/IntelPython/dpctl/pull/2322)
+* `dpctl.SyclDevice.sub_group_independent_forward_progress` property and `DPCTLDevice_GetSubGroupIndependentForwardProgress` C-API function were removed [gh-2353](https://github.com/IntelPython/dpctl/pull/2353)
+* The signature of `DPCTLKernelBundle_CreateFromSpirv` C-API function changed [gh-2304](https://github.com/IntelPython/dpctl/pull/2304)
+* The values of `DPCTLPartitionAffinityDomainType` enumerators shifted, as `DPCTL_PARTITION_AFFINITY_DOMAIN_UNKNOWN` was added as the zero value [gh-2324](https://github.com/IntelPython/dpctl/pull/2324)
+* `SyclProgram` names in the `dpctl` Python C-API and `dpctl4pybind11.hpp` were renamed to `SyclKernelBundle` ones (e.g. `PySyclProgramObject` to `PySyclKernelBundleObject`, `SyclProgram_Make` to `SyclKernelBundle_Make`) without keeping aliases, while the Python names remain available as deprecated aliases [gh-2291](https://github.com/IntelPython/dpctl/pull/2291)
+* The Cython API of the `dpctl.program` submodule was removed [gh-2317](https://github.com/IntelPython/dpctl/pull/2317)
+* Minimum required versions were raised: NumPy to 1.26 and Cython to 3.1.0 for building the project, and the DPC++ compiler to 2026.0.0 [gh-2192](https://github.com/IntelPython/dpctl/pull/2192), [gh-2250](https://github.com/IntelPython/dpctl/pull/2250), [gh-2360](https://github.com/IntelPython/dpctl/pull/2360)
+
+### Added
+* Added `dpctl.compiler.create_kernel_bundle_from_sycl_source`, `dpctl.compiler.is_sycl_source_compilation_available`, and `dpctl.SyclDevice.can_compile` for creating `dpctl.compiler.SyclKernelBundle` objects from SYCL source strings via the DPC++ `kernel_compiler` extension, as well as corresponding C-API functions [gh-2206](https://github.com/IntelPython/dpctl/pull/2206)
+* Added support for free-threaded builds of CPython 3.14 [gh-2250](https://github.com/IntelPython/dpctl/pull/2250)
+* Added `dpctl.SyclQueue.copy` and `dpctl.SyclQueue.copy_async` methods [gh-2273](https://github.com/IntelPython/dpctl/pull/2273)
+* Added `DPCTLQueue_CopyData` and `DPCTLQueue_CopyDataWithEvents` C-API functions to support `dpctl.SyclQueue.copy` and `dpctl.SyclQueue.copy_async` [gh-2273](https://github.com/IntelPython/dpctl/pull/2273)
+* Added support for SPIR-V specialization constants via `dpctl.compiler.SpecializationConstant` and the `specializations` keyword of `dpctl.compiler.create_kernel_bundle_from_spirv`, as well as `dpctl.compiler.utils` submodule for inspecting them [gh-2304](https://github.com/IntelPython/dpctl/pull/2304)
 * Added a number of `sycl::device` info queries to `dpctl.SyclDevice` [gh-2324](https://github.com/IntelPython/dpctl/pull/2324)
+* Added `dpctl.memory.MemoryIPCDevice` and `dpctl.memory.IPCMemoryHandle`, along with `SyclIPCGetMemHandle`, `SyclIPCOpenMemHandle`, and `SyclIPCCloseMemHandle` functions, for sharing USM-device allocations between processes, as well as supporting C-API functions and the `dpctl.SyclDevice.has_aspect_ext_oneapi_ipc_memory` aspect query [gh-2331](https://github.com/IntelPython/dpctl/pull/2331)
 * Added `sycl::info::context` queries `sycl_platform`, `atomic_memory_order_capabilities`, `atomic_fence_order_capabilities`, `atomic_memory_scope_capabilities`, and `atomic_fence_scope_capabilities` to `dpctl.SyclContext` [gh-2354](https://github.com/IntelPython/dpctl/pull/2354)
-* Added `create_kernel_bundle_from_sycl_source`, `is_sycl_source_compilation_available`, and `dpctl.SyclDevice.can_compile` for supporting the creation of `dpctl.SyclKernelBundle`s from SYCL source strings via DPC++ extension, as well as corresponding C-API functions to support it [gh-2206](https://github.com/IntelPython/dpctl/pull/2206)
 * Added `dpctl.SyclQueue.memset` and `dpctl.SyclQueue.memset_async` methods [gh-2361](https://github.com/IntelPython/dpctl/pull/2361)
 * Added `DPCTLQueue_MemsetWithEvents` C-API function to support `dpctl.SyclQueue.memset_async` [gh-2361](https://github.com/IntelPython/dpctl/pull/2361)
 * Added `dpctl.SyclQueue.fill` and `dpctl.SyclQueue.fill_async` methods [gh-2365](https://github.com/IntelPython/dpctl/pull/2365)
 * Added `DPCTLQueue_Fill8/16/32/64/128WithEvents` C-API functions to support `dpctl.SyclQueue.fill_async` [gh-2365](https://github.com/IntelPython/dpctl/pull/2365)
+* Added support for Python 3.15 [gh-2377](https://github.com/IntelPython/dpctl/pull/2377)
 
 ### Changed
-* Bump minimum NumPy version to 1.26 [gh-2192](https://github.com/IntelPython/dpctl/pull/2192)
+* Bumped the minimum required NumPy version to 1.26 [gh-2192](https://github.com/IntelPython/dpctl/pull/2192)
+* Bumped the minimum required Cython version to 3.1.0 [gh-2250](https://github.com/IntelPython/dpctl/pull/2250)
+* Renamed `dpctl.program.SyclProgram` to `dpctl.compiler.SyclKernelBundle`, `SyclProgramCompilationError` to `SyclKernelBundleCompilationError`, and `create_program_from_source`/`create_program_from_spirv` to `create_kernel_bundle_from_source`/`create_kernel_bundle_from_spirv`, with corresponding renaming in the `dpctl` Python C-API (e.g. `PySyclKernelBundleObject`, `SyclKernelBundle_Make`) and `dpctl4pybind11.hpp` [gh-2291](https://github.com/IntelPython/dpctl/pull/2291), [gh-2317](https://github.com/IntelPython/dpctl/pull/2317)
 * Rewrote USM Python examples into a single example [gh-2292](https://github.com/IntelPython/dpctl/pull/2292)
-* Registered `DPCTL_PARTITION_AFFINITY_DOMAIN_UNKNOWN` enumerator when `DPCTLDevice_GetPartitionAffinityDomains` receives an unrecognized value from the SYCL runtime [gh-2324](https://github.com/IntelPython/dpctl/pull/2324)
+* `dpctl.SyclPlatform.get_devices` now queries `automatic` and `custom` device types instead of returning no devices, as the work-around for the DPC++ bug is no longer needed [gh-2303](https://github.com/IntelPython/dpctl/pull/2303)
+* `DPCTLKernelBundle_CreateFromSpirv` C-API function now also takes an array of `DPCTLSpecConst` specialization constants [gh-2304](https://github.com/IntelPython/dpctl/pull/2304)
+* Device and platform collection APIs, such as `dpctl.get_devices` and `dpctl.SyclPlatform.get_devices`, as well as `dpctl.SyclDevice.sub_group_sizes`, now return a `tuple` instead of a `list` [gh-2322](https://github.com/IntelPython/dpctl/pull/2322)
+* Added `DPCTL_PARTITION_AFFINITY_DOMAIN_UNKNOWN` as the first enumerator (`= 0`) of `DPCTLPartitionAffinityDomainType`, used when the SYCL runtime reports an unrecognized partition affinity domain; this shifts the values of the existing enumerators [gh-2324](https://github.com/IntelPython/dpctl/pull/2324)
+* Bumped the minimum required DPC++ compiler version to 2026.0.0 [gh-2360](https://github.com/IntelPython/dpctl/pull/2360)
 
 ### Deprecated
+* Deprecated `dpctl.program.SyclProgram` and `dpctl.program.SyclProgramCompilationError` in favor of `dpctl.compiler.SyclKernelBundle` and `dpctl.compiler.SyclKernelBundleCompilationError`; the old names are kept as aliases that emit a `DeprecationWarning` [gh-2291](https://github.com/IntelPython/dpctl/pull/2291), [gh-2317](https://github.com/IntelPython/dpctl/pull/2317)
+* Deprecated `dpctl.program.create_program_from_source` and `dpctl.program.create_program_from_spirv` in favor of `dpctl.compiler.create_kernel_bundle_from_source` and `dpctl.compiler.create_kernel_bundle_from_spirv`; the old functions are kept as aliases that emit a `DeprecationWarning` [gh-2291](https://github.com/IntelPython/dpctl/pull/2291), [gh-2317](https://github.com/IntelPython/dpctl/pull/2317)
 * Deprecated `dpctl.program` submodule in favor of `dpctl.compiler`, which provides a better description of the purpose of the submodule in exposing DPC++ compilation-related functionality [gh-2317](https://github.com/IntelPython/dpctl/pull/2317)
 * Deprecated `DPCTL_ENABLE_L0_PROGRAM_CREATION` CMake option in favor of `DPCTL_ENABLE_L0_KERNEL_BUNDLE_CREATION` [gh-2317](https://github.com/IntelPython/dpctl/pull/2317)
 
 ### Removed
+* Removed unused `platform_typeid_lookup` from `dpctl4pybind11.hpp` [gh-2286](https://github.com/IntelPython/dpctl/pull/2286)
 * Removed Cython API for `dpctl.program` submodule, as the submodule is now deprecated, with functionality migrated to `dpctl.compiler` [gh-2317](https://github.com/IntelPython/dpctl/pull/2317)
+* Removed `dpctl.SyclDevice.sub_group_independent_forward_progress` property and the corresponding `DPCTLDevice_GetSubGroupIndependentForwardProgress` C-API function [gh-2353](https://github.com/IntelPython/dpctl/pull/2353)
 
 ### Fixed
+* Fixed a typo in the error message and the docstring of `dpctl.SyclDevice.create_sub_devices` [gh-2285](https://github.com/IntelPython/dpctl/pull/2285)
+* Fixed formatting of `TypeError` messages raised by `dpctl.WorkGroupMemory` and `dpctl.RawKernelArg` constructors, as well as of error messages raised by `dpctl.SyclQueue` methods [gh-2290](https://github.com/IntelPython/dpctl/pull/2290)
+* Fixed rendering issues and warnings in the documentation build [gh-2333](https://github.com/IntelPython/dpctl/pull/2333)
+* Fixed search for the OpenCL loader in CMake [gh-2356](https://github.com/IntelPython/dpctl/pull/2356)
 * Fixed incorrect paths in `GetLevelZeroHeaders.cmake` [gh-2366](https://github.com/IntelPython/dpctl/pull/2366)
+* Fixed an incorrect `dpctl.memory.MemoryUSMShared.memset` call in the "Heterogeneous Systems and Programming Concepts" user guide [gh-2368](https://github.com/IntelPython/dpctl/pull/2368)
+* Fixed bugs in kernel creation and submission: `dpctl.compiler.SyclKernelBundle.get_sycl_kernel` now raises `ValueError` instead of returning a kernel wrapping a null reference, which deferred the failure to the submission of the kernel; `dpctl.SyclQueue.submit` and `dpctl.SyclQueue.submit_async` now raise `ValueError` when the number of arguments does not match the number of kernel arguments, instead of appearing to succeed; and submitting an invalid kernel now raises `dpctl.SyclKernelSubmitError` [gh-2382](https://github.com/IntelPython/dpctl/pull/2382)
 
 ### Maintenance
+* Added an example of using `dpctl.utils.SequentialOrderManager` [gh-2250](https://github.com/IntelPython/dpctl/pull/2250)
+* Replaced uses of `str.format` with f-strings [gh-2282](https://github.com/IntelPython/dpctl/pull/2282), and constructors of empty Python containers with literals [gh-2289](https://github.com/IntelPython/dpctl/pull/2289)
+* Added more `pre-commit` hooks, including `codespell`, `shellcheck`, `gitleaks`, and `actionlint` [gh-2285](https://github.com/IntelPython/dpctl/pull/2285)
+* Added documentation of older releases to the version drop-down, along with a workflow to backfill it [gh-2312](https://github.com/IntelPython/dpctl/pull/2312), [gh-2380](https://github.com/IntelPython/dpctl/pull/2380)
+* Removed copyright year ranges from file headers [gh-2319](https://github.com/IntelPython/dpctl/pull/2319)
+* Marked SYCL compiler include directories as system ones in `IntelSYCLConfig.cmake` and `dpctl` targets to suppress deprecation warnings coming from compiler headers on Windows [gh-2334](https://github.com/IntelPython/dpctl/pull/2334)
+* Added `opencl-headers` as a Windows host requirement of the conda recipe [gh-2349](https://github.com/IntelPython/dpctl/pull/2349)
 * Updated pybind11 version used by `dpctl` and examples [gh-2357](https://github.com/IntelPython/dpctl/pull/2357)
-* Added a weekly `Coverity Scan` workflow that builds `dpctl` with the DPC++ compiler under `cov-build` and submits the results to Coverity Scan
+* Added a `conda-recipe-cf` recipe and a workflow for building and testing `dpctl` with conda-forge packages only [gh-2367](https://github.com/IntelPython/dpctl/pull/2367), [gh-2383](https://github.com/IntelPython/dpctl/pull/2383)
+* Added an `asv` benchmark suite for `dpctl`, along with a `benchmark` optional dependency group in `pyproject.toml` [gh-2378](https://github.com/IntelPython/dpctl/pull/2378)
+* Added a weekly `Coverity Scan` workflow that builds `dpctl` with the DPC++ compiler under `cov-build` and submits the results to Coverity Scan [gh-2379](https://github.com/IntelPython/dpctl/pull/2379)
+* Miscellaneous changes to continuous integration/delivery (CI/CD) supporting scripts:
+[gh-2300](https://github.com/IntelPython/dpctl/pull/2300),
+[gh-2308](https://github.com/IntelPython/dpctl/pull/2308),
+[gh-2310](https://github.com/IntelPython/dpctl/pull/2310),
+[gh-2311](https://github.com/IntelPython/dpctl/pull/2311),
+[gh-2340](https://github.com/IntelPython/dpctl/pull/2340),
+[gh-2346](https://github.com/IntelPython/dpctl/pull/2346),
+[gh-2347](https://github.com/IntelPython/dpctl/pull/2347),
+[gh-2350](https://github.com/IntelPython/dpctl/pull/2350),
+[gh-2352](https://github.com/IntelPython/dpctl/pull/2352),
+[gh-2362](https://github.com/IntelPython/dpctl/pull/2362),
+[gh-2363](https://github.com/IntelPython/dpctl/pull/2363),
+[gh-2373](https://github.com/IntelPython/dpctl/pull/2373),
+[gh-2374](https://github.com/IntelPython/dpctl/pull/2374),
+[gh-2381](https://github.com/IntelPython/dpctl/pull/2381)
 
 ## [0.22.1] - Apr. 24, 2026
 
diff --git a/CMakeLists.txt b/CMakeLists.txt
index 0d27c9d6c3..594dd0bc24 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -1,7 +1,7 @@
 cmake_minimum_required(VERSION 3.21...3.27 FATAL_ERROR)
 
 project(dpctl
-    VERSION 0.23
+    VERSION 0.24
     LANGUAGES CXX
     DESCRIPTION "Python interface for XPU programming"
 )
diff --git a/docs/doc_versions.txt b/docs/doc_versions.txt
index e8317e29ad..391830ad95 100644
--- a/docs/doc_versions.txt
+++ b/docs/doc_versions.txt
@@ -1,4 +1,5 @@
 latest
+0.23.0
 0.22.1
 0.22.0
 0.21.1