Breaking change: Enable NX (DEP) and ASLR for the Windows Python extension built with MinGW.

The upb-based Python extension for Windows is now
linked with -Wl,--dynamicbase and -Wl,--nxcompat (plus
-Wl,--high-entropy-va on x86_64) when built with the MinGW toolchain, so the
NX (DEP) and ASLR security features are enabled for the DLL.

Fixes #28688

https://protobuf.dev/news/2026-09-22/#enable-nx-and-aslr

PiperOrigin-RevId: 1002513467

python/dist/BUILD.bazel

diff --git a/python/dist/BUILD.bazel b/python/dist/BUILD.bazel
index 556ae34..96403a8 100644
--- a/python/dist/BUILD.bazel
+++ b/python/dist/BUILD.bazel
@@ -233,6 +233,24 @@
     ],
 )
 
+selects.config_setting_group(
+    name = "windows_x86_64_mingw",
+    match_all = [
+        ":windows_x86_64",
+        "@bazel_tools//tools/cpp:mingw",
+    ],
+    visibility = ["//python:__subpackages__"],
+)
+
+selects.config_setting_group(
+    name = "windows_x86_32_mingw",
+    match_all = [
+        ":windows_x86_32",
+        "@bazel_tools//tools/cpp:mingw",
+    ],
+    visibility = ["//python:__subpackages__"],
+)
+
 pkg_files(
     name = "generated_bootstrap",
     srcs = [

python/py_extension.bzl

diff --git a/python/py_extension.bzl b/python/py_extension.bzl
index 93bc28f..da48b5f 100644
--- a/python/py_extension.bzl
+++ b/python/py_extension.bzl
@@ -25,6 +25,15 @@
             "//python/dist:windows_x86_32": ["-static-libgcc"],
             "//conditions:default": [],
         }) + select({
+            "//python/dist:windows_x86_64_mingw": [
+                "-Wl,--dynamicbase",
+                "-Wl,--nxcompat",
+                "-Wl,--high-entropy-va",
+            ],
+            "//python/dist:windows_x86_32_mingw": [
+                "-Wl,--dynamicbase",
+                "-Wl,--nxcompat",
+            ],
             "//conditions:default": [],
         }),
         linkshared = True,