diff --git a/Doc/c-api/capsule.rst b/Doc/c-api/capsule.rst
index 6da020efc7f27c..03a848d68ed7ab 100644
--- a/Doc/c-api/capsule.rst
+++ b/Doc/c-api/capsule.rst
@@ -22,6 +22,12 @@ Refer to :ref:`using-capsules` for more information on using these objects.
    loaded modules.
 
 
+.. c:var:: PyTypeObject PyCapsule_Type
+
+   The type object corresponding to capsule objects. This is the same object
+   as :class:`types.CapsuleType` in the Python layer.
+
+
 .. c:type:: PyCapsule_Destructor
 
    The type of a destructor callback for a capsule.  Defined as::
diff --git a/Doc/c-api/float.rst b/Doc/c-api/float.rst
index 1085c32a537071..edee498a0b80f3 100644
--- a/Doc/c-api/float.rst
+++ b/Doc/c-api/float.rst
@@ -113,8 +113,8 @@ NaNs (if such things exist on the platform) isn't handled correctly, and
 attempting to unpack a bytes string containing an IEEE INF or NaN will raise an
 exception.
 
-Note that NaNs type may not be preserved on IEEE platforms (silent NaN become
-quiet), for example on x86 systems in 32-bit mode.
+Note that NaNs type may not be preserved on IEEE platforms (signaling NaN become
+quiet NaN), for example on x86 systems in 32-bit mode.
 
 On non-IEEE platforms with more precision, or larger dynamic range, than IEEE
 754 supports, not all values can be packed; on non-IEEE platforms with less
diff --git a/Doc/c-api/module.rst b/Doc/c-api/module.rst
index ed2a7663375920..1994a3c7d01ca7 100644
--- a/Doc/c-api/module.rst
+++ b/Doc/c-api/module.rst
@@ -13,7 +13,7 @@ Module Objects
    .. index:: single: ModuleType (in module types)
 
    This instance of :c:type:`PyTypeObject` represents the Python module type.  This
-   is exposed to Python programs as ``types.ModuleType``.
+   is exposed to Python programs as :py:class:`types.ModuleType`.
 
 
 .. c:function:: int PyModule_Check(PyObject *p)
@@ -71,6 +71,9 @@ Module Objects
    ``PyObject_*`` functions rather than directly manipulate a module's
    :attr:`~object.__dict__`.
 
+   The returned reference is borrowed from the module; it is valid until
+   the module is destroyed.
+
 
 .. c:function:: PyObject* PyModule_GetNameObject(PyObject *module)
 
@@ -90,6 +93,10 @@ Module Objects
    Similar to :c:func:`PyModule_GetNameObject` but return the name encoded to
    ``'utf-8'``.
 
+   The returned buffer is only valid until the module is renamed or destroyed.
+   Note that Python code may rename a module by setting its :py:attr:`~module.__name__`
+   attribute.
+
 .. c:function:: void* PyModule_GetState(PyObject *module)
 
    Return the "state" of the module, that is, a pointer to the block of memory
@@ -126,6 +133,9 @@ Module Objects
    Similar to :c:func:`PyModule_GetFilenameObject` but return the filename
    encoded to 'utf-8'.
 
+   The returned buffer is only valid until the module's :py:attr:`~module.__file__` attribute
+   is reassigned or the module is destroyed.
+
    .. deprecated:: 3.2
       :c:func:`PyModule_GetFilename` raises :exc:`UnicodeEncodeError` on
       unencodable filenames, use :c:func:`PyModule_GetFilenameObject` instead.
@@ -671,6 +681,9 @@ or code that creates modules dynamically.
    :c:type:`PyMethodDef` arrays; in that case they should call this function
    directly.
 
+   The *functions* array must be statically allocated (or otherwise guaranteed
+   to outlive the module object).
+
    .. versionadded:: 3.5
 
 .. c:function:: int PyModule_SetDocString(PyObject *module, const char *docstring)
diff --git a/Lib/base64.py b/Lib/base64.py
index 5d78cc09f40cd3..cfc57626c40ba9 100644
--- a/Lib/base64.py
+++ b/Lib/base64.py
@@ -462,9 +462,12 @@ def b85decode(b):
     # Delay the initialization of tables to not waste memory
     # if the function is never called
     if _b85dec is None:
-        _b85dec = [None] * 256
+        # we don't assign to _b85dec directly to avoid issues when
+        # multiple threads call this function simultaneously
+        b85dec_tmp = [None] * 256
         for i, c in enumerate(_b85alphabet):
-            _b85dec[c] = i
+            b85dec_tmp[c] = i
+        _b85dec = b85dec_tmp
 
     b = _bytes_from_decode_data(b)
     padding = (-len(b)) % 5
diff --git a/Lib/multiprocessing/util.py b/Lib/multiprocessing/util.py
index a1a537dd48dea7..549fb07c27549e 100644
--- a/Lib/multiprocessing/util.py
+++ b/Lib/multiprocessing/util.py
@@ -126,12 +126,14 @@ def is_abstract_socket_namespace(address):
 # Function returning a temp directory which will be removed on exit
 #
 
-# Maximum length of a socket file path is usually between 92 and 108 [1],
-# but Linux is known to use a size of 108 [2]. BSD-based systems usually
-# use a size of 104 or 108 and Windows does not create AF_UNIX sockets.
+# Maximum length of a NULL-terminated [1] socket file path is usually
+# between 92 and 108 [2], but Linux is known to use a size of 108 [3].
+# BSD-based systems usually use a size of 104 or 108 and Windows does
+# not create AF_UNIX sockets.
 #
-# [1]: https://pubs.opengroup.org/onlinepubs/9799919799/basedefs/sys_un.h.html
-# [2]: https://man7.org/linux/man-pages/man7/unix.7.html.
+# [1]: https://github.com/python/cpython/issues/140734
+# [2]: https://pubs.opengroup.org/onlinepubs/9799919799/basedefs/sys_un.h.html
+# [3]: https://man7.org/linux/man-pages/man7/unix.7.html
 
 if sys.platform == 'linux':
     _SUN_PATH_MAX = 108
@@ -171,11 +173,13 @@ def _get_base_temp_dir(tempfile):
     # generated by tempfile._RandomNameSequence, which, by design,
     # is 8 characters long.
     #
-    # Thus, the length of socket filename will be:
+    # Thus, the socket file path length (without NULL terminator) will be:
     #
     #   len(base_tempdir + '/pymp-XXXXXXXX' + '/sock-XXXXXXXX')
     sun_path_len = len(base_tempdir) + 14 + 14
-    if sun_path_len <= _SUN_PATH_MAX:
+    # Strict inequality to account for the NULL terminator.
+    # See https://github.com/python/cpython/issues/140734.
+    if sun_path_len < _SUN_PATH_MAX:
         return base_tempdir
     # Fallback to the default system-wide temporary directory.
     # This ignores user-defined environment variables.
@@ -201,7 +205,7 @@ def _get_base_temp_dir(tempfile):
         return base_tempdir
     warn("Ignoring user-defined temporary directory: %s", base_tempdir)
     # at most max(map(len, dirlist)) + 14 + 14 = 36 characters
-    assert len(base_system_tempdir) + 14 + 14 <= _SUN_PATH_MAX
+    assert len(base_system_tempdir) + 14 + 14 < _SUN_PATH_MAX
     return base_system_tempdir
 
 def get_temp_dir():
diff --git a/Misc/NEWS.d/next/Library/2025-11-02-09-37-22.gh-issue-140734.f8gST9.rst b/Misc/NEWS.d/next/Library/2025-11-02-09-37-22.gh-issue-140734.f8gST9.rst
new file mode 100644
index 00000000000000..46582f7fcf417c
--- /dev/null
+++ b/Misc/NEWS.d/next/Library/2025-11-02-09-37-22.gh-issue-140734.f8gST9.rst
@@ -0,0 +1,2 @@
+:mod:`multiprocessing`: fix off-by-one error when checking the length
+of a temporary socket file path. Patch by Bénédikt Tran.
diff --git a/Misc/NEWS.d/next/Library/2025-11-06-15-11-50.gh-issue-141141.tgIfgH.rst b/Misc/NEWS.d/next/Library/2025-11-06-15-11-50.gh-issue-141141.tgIfgH.rst
new file mode 100644
index 00000000000000..f59ccfb33e7669
--- /dev/null
+++ b/Misc/NEWS.d/next/Library/2025-11-06-15-11-50.gh-issue-141141.tgIfgH.rst
@@ -0,0 +1 @@
+Fix a thread safety issue with :func:`base64.b85decode`. Contributed by Benel Tayar.