diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
new file mode 100644
index 0000000..123824d
--- /dev/null
+++ b/.github/workflows/build.yml
@@ -0,0 +1,113 @@
+# The "build" workflow produces wheels (and the sdist) for all python
+# versions/platforms. Where possible (i.e. the build is not a cross-compile),
+# the test suite is also run for the wheel (this test covers fewer
+# configurations than the "test" workflow and tox.ini).
+name: Build
+
+on:
+  push:
+    branches:
+      # Run on release branches. This gives us a chance to detect rot in this
+      # configuration before pushing a tag (which we'd rather not have to undo).
+      - "branch[0-9]*"
+    tags:
+      # The main purpose of this workflow is to build wheels for release tags.
+      # It runs automatically on tags matching this pattern and pushes to pypi.
+      - "v*"
+  workflow_dispatch:
+    # Allow this workflow to be run manually (pushing to testpypi instead of pypi)
+
+permissions: {}
+
+env:
+  python-version: '3.9'
+
+jobs:
+  build_sdist:
+    name: Build sdist
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@v5
+        name: Install Python
+        with:
+          python-version: ${{ env.python-version }}
+
+      - name: Check metadata
+        run: "python setup.py check"
+      - name: Build sdist
+        run: "python setup.py sdist && ls -l dist"
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: artifacts-sdist
+          path: ./dist/tornado-*.tar.gz
+
+  build_wheels:
+    name: Build wheels on ${{ matrix.os }}
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-22.04, ubuntu-22.04-arm, windows-2022, macos-15]
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@v5
+        name: Install Python
+        with:
+          python-version: ${{ env.python-version }}
+
+      - name: Build wheels
+        uses: pypa/cibuildwheel@v3.4.0
+
+      - name: Audit ABI3 compliance
+        # This may be moved into cibuildwheel itself in the future. See
+        # https://github.com/pypa/cibuildwheel/issues/1342
+        run: "pip install abi3audit && abi3audit --verbose --summary ./wheelhouse/*.whl"
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: artifacts-${{ matrix.os }}
+          path: ./wheelhouse/*.whl
+
+  upload_pypi_test:
+    name: Upload to PyPI (test)
+    needs: [build_wheels, build_sdist]
+    runs-on: ubuntu-22.04
+    if: github.repository == 'tornadoweb/tornado' && github.event_name == 'workflow_dispatch'
+    permissions:
+      # This permission is required for pypi's "trusted publisher" feature
+      id-token: write
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          pattern: artifacts-*
+          path: dist
+          merge-multiple: true
+
+      - uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          repository-url: https://test.pypi.org/legacy/
+          skip-existing: true
+
+  upload_pypi:
+    name: Upload to PyPI (prod)
+    needs: [build_wheels, build_sdist]
+    runs-on: ubuntu-22.04
+    if: github.repository == 'tornadoweb/tornado' && github.event_name == 'push' && github.ref_type == 'tag' && startsWith(github.ref_name, 'v')
+    permissions:
+      # This permission is required for pypi's "trusted publisher" feature
+      id-token: write
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          pattern: artifacts-*
+          path: dist
+          merge-multiple: true
+
+      - uses: pypa/gh-action-pypi-publish@release/v1
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
new file mode 100644
index 0000000..6741867
--- /dev/null
+++ b/.github/workflows/test.yml
@@ -0,0 +1,152 @@
+# The "test" workflow is run on every PR and runs tests across all
+# supported python versions and a range of configurations
+# specified in tox.ini. Also see the "build" workflow which is only
+# run for release branches and covers platforms other than linux-amd64
+# (Platform-specific issues are rare these days so we don't want to
+# take that time on every build).
+
+name: Test
+
+on: pull_request
+
+permissions: {}
+
+jobs:
+  # Before starting the full build matrix, run one test configuration
+  # and the linter (the `black` linter is especially likely to catch
+  # first-time contributors).
+  test_quick:
+    name: Run quick tests
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@v5
+        name: Install Python
+        with:
+          # Lint python version must be synced with tox.ini
+          python-version: '3.11'
+      - name: Install tox
+        run: python -m pip install tox -c requirements.txt
+
+      - name: Run test suite
+        run: python -m tox -e py311,lint
+
+  test_tox:
+    name: Run full tests
+    needs: test_quick
+    runs-on: ubuntu-22.04
+    strategy:
+      matrix:
+        include:
+          - python: '3.9'
+            tox_env: py39-full
+          - python: '3.10'
+            tox_env: py310-full
+          - python: '3.10.8'
+            # Early versions of 3.10 and 3.11 had different deprecation
+            # warnings in asyncio. Test with them too to make sure everything
+            # works the same way.
+            tox_env: py310-full
+          - python: '3.11'
+            tox_env: py311-full
+          - python: '3.11.0'
+            tox_env: py311-full
+          - python: '3.12'
+            tox_env: py312-full
+          - python: '3.13'
+            tox_env: py313-full
+          - python: '3.14.0-beta.1 - 3.14'
+            tox_env: py314-full
+          - python: 'pypy-3.10'
+            # Pypy is a lot slower due to jit warmup costs, so don't run the
+            # "full" test config there.
+            tox_env: pypy3
+          - python: '3.11'
+            # Docs python version must be synced with tox.ini
+            tox_env: docs
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@v5
+        name: Install Python
+        with:
+          python-version: ${{ matrix.python}}
+      - name: Install apt packages
+        run: sudo apt-get update && sudo apt-get install libcurl4-openssl-dev
+      - name: Install tox
+        run: python -m pip install tox -c requirements.txt
+
+      - name: Run test suite
+        run: python -m tox -e ${{ matrix.tox_env }}
+
+  test_win:
+    # Windows tests are fairly slow, so only run one configuration here.
+    # We test on windows but not mac because even though mac is a more
+    # fully-supported platform, it's similar enough to linux that we
+    # don't generally need to test it separately. Windows is different
+    # enough that we'll break it if we don't test it in CI.
+    name: Run windows tests
+    needs: test_quick
+    runs-on: windows-2022
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@v5
+        name: Install Python
+        with:
+          python-version: '3.11'
+      - name: Run test suite
+        # TODO: figure out what's up with these log messages
+        run: py -m tornado.test --fail-if-logs=false
+
+  zizmor:
+    name: Analyze action configs with zizmor
+    runs-on: ubuntu-22.04
+    needs: test_quick
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@v5
+        name: Install uv
+      - name: Run zizmor
+        run: uvx zizmor .github/workflows
+
+  test_cibw:
+    # cibuildwheel is the tool that we use for release builds in build.yml.
+    # Run it in the every-PR workflow because it's slightly different from our
+    # regular build and this gives us easier ways to test freethreading changes.
+    #
+    # Note that test_cibw and test_tox both take about a minute to run, but test_tox runs
+    # more tests; test_cibw spends a lot of its time installing dependencies. Replacing
+    # test_tox with test_cibw would entail either increasing test runtime or reducing
+    # test coverage.
+    name: Test with cibuildwheel
+    runs-on: ubuntu-22.04
+    needs: test_quick
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - name: Run cibuildwheel
+        uses: pypa/cibuildwheel@v2.22
+        env:
+          # For speed, we only build one python version and one arch. We throw away the wheels
+          # built here; the real build is defined in build.yml.
+          CIBW_ARCHS: native
+          CIBW_BUILD: cp313-manylinux*
+
+          # Alternatively, uncomment the following lines (and replace the previous CIBW_BUILD)
+          # to test a freethreading build of python.
+          #CIBW_BUILD: cp313t-manylinux*
+          #CIBW_ENABLE: cpython-freethreading
+          # I don't understand what this does but auditwheel seems to fail in this configuration.
+          # Since we're throwing away the wheels here, just skip it.
+          # TODO: When we no longer need to disable this, we can enable freethreading in
+          # build.yml.
+          #CIBW_REPAIR_WHEEL_COMMAND: ""
diff --git a/.github/zizmor.yml b/.github/zizmor.yml
new file mode 100644
index 0000000..a71e19f
--- /dev/null
+++ b/.github/zizmor.yml
@@ -0,0 +1,14 @@
+rules:
+  unpinned-uses:
+    config:
+      policies:
+        # Allow trusted repositories to use ref-pinning instead of hash-pinning.
+        #
+        # Defaults, from 
+        # https://github.com/woodruffw/zizmor/blob/7b4e76e94be2f4d7b455664ba5252b2b4458b91d/src/audit/unpinned_uses.rs#L172-L193
+        actions/*: ref-pin
+        github/*: ref-pin
+        dependabot/*: ref-pin
+        # Additional trusted repositories
+        pypa/*: ref-pin
+        astral-sh/setup-uv: ref-pin
\ No newline at end of file
diff --git a/.readthedocs.yaml b/.readthedocs.yaml
index d9b6cb2..aff82f8 100644
--- a/.readthedocs.yaml
+++ b/.readthedocs.yaml
@@ -3,7 +3,7 @@ version: 2
 build:
   os: ubuntu-22.04
   tools:
-    python: "3.8"
+    python: "3.11"
 
 sphinx:
   configuration: docs/conf.py
diff --git a/debian/changelog b/debian/changelog
index 202de20..ee8a80e 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,65 @@
+python-tornado (6.5.5-1) unstable; urgency=medium
+
+  * Team upload.
+  * New upstream release.
+    - CVE-2026-31958: Introduces new limits on the size and complexity of
+      multipart bodies, including a default limit of 100 parts per request
+      to mitigate a possible DoS. It is also possible to disable parsing
+      multipart/form-data entirely if not required (closes: #1130507).
+    - The domain, path, and samesite arguments to RequestHandler.set_cookie
+      are now validated for illegal characters, which could be abused to
+      inject other attributes on the cookie.
+    - Carriage return characters are no longer accepted in multipart/form-data
+      headers.
+  * d/python3-tornado.lintian-overrides: Fix matches.
+
+ -- Daniel Leidert <dleidert@debian.org>  Tue, 31 Mar 2026 01:01:46 +0200
+
+python-tornado (6.5.4-1) unstable; urgency=medium
+
+  * Team upload.
+  * debian/patches/Make-tests-compatible-with-curl-8.19.0.patch: new patch.
+    (Closes: #1129145)
+
+ -- Carlos Henrique Lima Melara <charlesmelara@riseup.net>  Fri, 06 Mar 2026 01:04:28 -0300
+
+python-tornado (6.5.4-0.1) unstable; urgency=medium
+
+  * Non-maintainer upload.
+  * New upstream release.
+    - CVE-2025-67724: Header injection and XSS via reason argument.
+      (Closes: #1122660)
+    - CVE-2025-67725: Quadratic DoS via Repeated Header Coalescing.
+      (Closes: #1122661)
+    - CVE-2025-67726: Quadratic DoS via Crafted Multipart Parameters.
+      (Closes: #1122663)
+
+ -- Adrian Bunk <bunk@debian.org>  Mon, 05 Jan 2026 13:12:01 +0200
+
+python-tornado (6.5.2-3) unstable; urgency=medium
+
+  * Team upload.
+  * Increase timeout to fix ftbfs issue on slow architectures.
+    Thanks to Aurelien Jarno <aurel32@debian.org>. (Closes: #1117144)
+
+ -- Bo YU <vimer@debian.org>  Sat, 04 Oct 2025 18:42:36 +0800
+
+python-tornado (6.5.2-2) unstable; urgency=medium
+
+  * Uploading to unstable.
+
+ -- Thomas Goirand <zigo@debian.org>  Sun, 28 Sep 2025 11:43:57 +0200
+
+python-tornado (6.5.2-1) experimental; urgency=medium
+
+  * Team upload.
+  * New upstream release.
+  * Refreshed some patches.
+  * Removed pythonpath-autoreload-test.patch now useless.
+  * Removed CVE-2025-47287.patch applied upstream.
+
+ -- Thomas Goirand <zigo@debian.org>  Tue, 26 Aug 2025 11:13:28 +0200
+
 python-tornado (6.4.2-3) unstable; urgency=medium
 
   * Team upload.
diff --git a/debian/patches/0006-Use-local-objects.inv-for-intersphinx-mapping.patch b/debian/patches/0006-Use-local-objects.inv-for-intersphinx-mapping.patch
index 7f28a7a..109c57f 100644
--- a/debian/patches/0006-Use-local-objects.inv-for-intersphinx-mapping.patch
+++ b/debian/patches/0006-Use-local-objects.inv-for-intersphinx-mapping.patch
@@ -9,9 +9,11 @@ Forwarded: not-needed
  docs/conf.py | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)
 
+Index: python-tornado/docs/conf.py
+===================================================================
 --- python-tornado.orig/docs/conf.py
 +++ python-tornado/docs/conf.py
-@@ -84,7 +84,7 @@
+@@ -85,7 +85,7 @@ latex_documents = [
      )
  ]
  
diff --git a/debian/patches/0007-Higher-test_gc-timeout.patch b/debian/patches/0007-Higher-test_gc-timeout.patch
index 2152d72..02b52fe 100644
--- a/debian/patches/0007-Higher-test_gc-timeout.patch
+++ b/debian/patches/0007-Higher-test_gc-timeout.patch
@@ -7,9 +7,11 @@ Forwarded: not-needed
  tornado/test/gen_test.py | 5 ++++-
  1 file changed, 4 insertions(+), 1 deletion(-)
 
+Index: python-tornado/tornado/test/gen_test.py
+===================================================================
 --- python-tornado.orig/tornado/test/gen_test.py
 +++ python-tornado/tornado/test/gen_test.py
-@@ -967,7 +967,10 @@
+@@ -961,7 +961,10 @@ class RunnerGCTest(AsyncTestCase):
              self.io_loop.add_callback(callback)
              yield fut
  
diff --git a/debian/patches/CVE-2025-47287.patch b/debian/patches/CVE-2025-47287.patch
deleted file mode 100644
index 209722e..0000000
--- a/debian/patches/CVE-2025-47287.patch
+++ /dev/null
@@ -1,231 +0,0 @@
-From: Ben Darnell <ben@bendarnell.com>
-Date: Thu, 8 May 2025 13:29:43 -0400
-Subject: httputil: Raise errors instead of logging in multipart/form-data
- parsing
-
-We used to continue after logging an error, which allowed repeated
-errors to spam the logs. The error raised here will still be logged,
-but only once per request, consistent with other error handling in
-Tornado.
-
-Origin: backport, https://github.com/tornadoweb/tornado/pull/3497
-Bug-Debian: https://bugs.debian.org/1105886
-Last-Update: 2025-05-18
----
- tornado/httputil.py             | 30 +++++++++++-------------------
- tornado/test/httpserver_test.py |  4 ++--
- tornado/test/httputil_test.py   | 13 ++++++++-----
- tornado/web.py                  | 17 +++++++++++++----
- 4 files changed, 34 insertions(+), 30 deletions(-)
-
-diff --git a/tornado/httputil.py b/tornado/httputil.py
-index ebdc805..090a977 100644
---- a/tornado/httputil.py
-+++ b/tornado/httputil.py
-@@ -34,7 +34,6 @@ import unicodedata
- from urllib.parse import urlencode, urlparse, urlunparse, parse_qsl
- 
- from tornado.escape import native_str, parse_qs_bytes, utf8
--from tornado.log import gen_log
- from tornado.util import ObjectDict, unicode_type
- 
- 
-@@ -762,25 +761,22 @@ def parse_body_arguments(
-     """
-     if content_type.startswith("application/x-www-form-urlencoded"):
-         if headers and "Content-Encoding" in headers:
--            gen_log.warning(
--                "Unsupported Content-Encoding: %s", headers["Content-Encoding"]
-+            raise HTTPInputError(
-+                "Unsupported Content-Encoding: %s" % headers["Content-Encoding"]
-             )
--            return
-         try:
-             # real charset decoding will happen in RequestHandler.decode_argument()
-             uri_arguments = parse_qs_bytes(body, keep_blank_values=True)
-         except Exception as e:
--            gen_log.warning("Invalid x-www-form-urlencoded body: %s", e)
--            uri_arguments = {}
-+            raise HTTPInputError("Invalid x-www-form-urlencoded body: %s" % e) from e
-         for name, values in uri_arguments.items():
-             if values:
-                 arguments.setdefault(name, []).extend(values)
-     elif content_type.startswith("multipart/form-data"):
-         if headers and "Content-Encoding" in headers:
--            gen_log.warning(
--                "Unsupported Content-Encoding: %s", headers["Content-Encoding"]
-+            raise HTTPInputError(
-+                "Unsupported Content-Encoding: %s" % headers["Content-Encoding"]
-             )
--            return
-         try:
-             fields = content_type.split(";")
-             for field in fields:
-@@ -789,9 +785,9 @@ def parse_body_arguments(
-                     parse_multipart_form_data(utf8(v), body, arguments, files)
-                     break
-             else:
--                raise ValueError("multipart boundary not found")
-+                raise HTTPInputError("multipart boundary not found")
-         except Exception as e:
--            gen_log.warning("Invalid multipart/form-data: %s", e)
-+            raise HTTPInputError("Invalid multipart/form-data: %s" % e) from e
- 
- 
- def parse_multipart_form_data(
-@@ -820,26 +816,22 @@ def parse_multipart_form_data(
-         boundary = boundary[1:-1]
-     final_boundary_index = data.rfind(b"--" + boundary + b"--")
-     if final_boundary_index == -1:
--        gen_log.warning("Invalid multipart/form-data: no final boundary")
--        return
-+        raise HTTPInputError("Invalid multipart/form-data: no final boundary found")
-     parts = data[:final_boundary_index].split(b"--" + boundary + b"\r\n")
-     for part in parts:
-         if not part:
-             continue
-         eoh = part.find(b"\r\n\r\n")
-         if eoh == -1:
--            gen_log.warning("multipart/form-data missing headers")
--            continue
-+            raise HTTPInputError("multipart/form-data missing headers")
-         headers = HTTPHeaders.parse(part[:eoh].decode("utf-8"))
-         disp_header = headers.get("Content-Disposition", "")
-         disposition, disp_params = _parse_header(disp_header)
-         if disposition != "form-data" or not part.endswith(b"\r\n"):
--            gen_log.warning("Invalid multipart/form-data")
--            continue
-+            raise HTTPInputError("Invalid multipart/form-data")
-         value = part[eoh + 4 : -2]
-         if not disp_params.get("name"):
--            gen_log.warning("multipart/form-data value missing name")
--            continue
-+            raise HTTPInputError("multipart/form-data missing name")
-         name = disp_params["name"]
-         if disp_params.get("filename"):
-             ctype = headers.get("Content-Type", "application/unknown")
-diff --git a/tornado/test/httpserver_test.py b/tornado/test/httpserver_test.py
-index 0b29a39..5d5fb13 100644
---- a/tornado/test/httpserver_test.py
-+++ b/tornado/test/httpserver_test.py
-@@ -1131,9 +1131,9 @@ class GzipUnsupportedTest(GzipBaseTest, AsyncHTTPTestCase):
-         # Gzip support is opt-in; without it the server fails to parse
-         # the body (but parsing form bodies is currently just a log message,
-         # not a fatal error).
--        with ExpectLog(gen_log, "Unsupported Content-Encoding"):
-+        with ExpectLog(gen_log, ".*Unsupported Content-Encoding"):
-             response = self.post_gzip("foo=bar")
--        self.assertEqual(json_decode(response.body), {})
-+        self.assertEqual(response.code, 400)
- 
- 
- class StreamingChunkSizeTest(AsyncHTTPTestCase):
-diff --git a/tornado/test/httputil_test.py b/tornado/test/httputil_test.py
-index 975900a..9494d0c 100644
---- a/tornado/test/httputil_test.py
-+++ b/tornado/test/httputil_test.py
-@@ -12,7 +12,6 @@ from tornado.httputil import (
- )
- from tornado.escape import utf8, native_str
- from tornado.log import gen_log
--from tornado.testing import ExpectLog
- from tornado.test.util import ignore_deprecation
- 
- import copy
-@@ -195,7 +194,9 @@ Foo
-             b"\n", b"\r\n"
-         )
-         args, files = form_data_args()
--        with ExpectLog(gen_log, "multipart/form-data missing headers"):
-+        with self.assertRaises(
-+            HTTPInputError, msg="multipart/form-data missing headers"
-+        ):
-             parse_multipart_form_data(b"1234", data, args, files)
-         self.assertEqual(files, {})
- 
-@@ -209,7 +210,7 @@ Foo
-             b"\n", b"\r\n"
-         )
-         args, files = form_data_args()
--        with ExpectLog(gen_log, "Invalid multipart/form-data"):
-+        with self.assertRaises(HTTPInputError, msg="Invalid multipart/form-data"):
-             parse_multipart_form_data(b"1234", data, args, files)
-         self.assertEqual(files, {})
- 
-@@ -222,7 +223,7 @@ Foo--1234--""".replace(
-             b"\n", b"\r\n"
-         )
-         args, files = form_data_args()
--        with ExpectLog(gen_log, "Invalid multipart/form-data"):
-+        with self.assertRaises(HTTPInputError, msg="Invalid multipart/form-data"):
-             parse_multipart_form_data(b"1234", data, args, files)
-         self.assertEqual(files, {})
- 
-@@ -236,7 +237,9 @@ Foo
-             b"\n", b"\r\n"
-         )
-         args, files = form_data_args()
--        with ExpectLog(gen_log, "multipart/form-data value missing name"):
-+        with self.assertRaises(
-+            HTTPInputError, msg="multipart/form-data value missing name"
-+        ):
-             parse_multipart_form_data(b"1234", data, args, files)
-         self.assertEqual(files, {})
- 
-diff --git a/tornado/web.py b/tornado/web.py
-index 0393964..8ec5601 100644
---- a/tornado/web.py
-+++ b/tornado/web.py
-@@ -1751,6 +1751,14 @@ class RequestHandler(object):
-         try:
-             if self.request.method not in self.SUPPORTED_METHODS:
-                 raise HTTPError(405)
-+
-+            # If we're not in stream_request_body mode, this is the place where we parse the body.
-+            if not _has_stream_request_body(self.__class__):
-+                try:
-+                    self.request._parse_body()
-+                except httputil.HTTPInputError as e:
-+                    raise HTTPError(400, "Invalid body: %s" % e) from e
-+
-             self.path_args = [self.decode_argument(arg) for arg in args]
-             self.path_kwargs = dict(
-                 (k, self.decode_argument(v, name=k)) for (k, v) in kwargs.items()
-@@ -1941,7 +1949,7 @@ def _has_stream_request_body(cls: Type[RequestHandler]) -> bool:
- 
- 
- def removeslash(
--    method: Callable[..., Optional[Awaitable[None]]]
-+    method: Callable[..., Optional[Awaitable[None]]],
- ) -> Callable[..., Optional[Awaitable[None]]]:
-     """Use this decorator to remove trailing slashes from the request path.
- 
-@@ -1970,7 +1978,7 @@ def removeslash(
- 
- 
- def addslash(
--    method: Callable[..., Optional[Awaitable[None]]]
-+    method: Callable[..., Optional[Awaitable[None]]],
- ) -> Callable[..., Optional[Awaitable[None]]]:
-     """Use this decorator to add a missing trailing slash to the request path.
- 
-@@ -2394,8 +2402,9 @@ class _HandlerDelegate(httputil.HTTPMessageDelegate):
-         if self.stream_request_body:
-             future_set_result_unless_cancelled(self.request._body_future, None)
-         else:
-+            # Note that the body gets parsed in RequestHandler._execute so it can be in
-+            # the right exception handler scope.
-             self.request.body = b"".join(self.chunks)
--            self.request._parse_body()
-             self.execute()
- 
-     def on_connection_close(self) -> None:
-@@ -3267,7 +3276,7 @@ class GZipContentEncoding(OutputTransform):
- 
- 
- def authenticated(
--    method: Callable[..., Optional[Awaitable[None]]]
-+    method: Callable[..., Optional[Awaitable[None]]],
- ) -> Callable[..., Optional[Awaitable[None]]]:
-     """Decorate methods with this to require that the user be logged in.
- 
diff --git a/debian/patches/Make-tests-compatible-with-curl-8.19.0.patch b/debian/patches/Make-tests-compatible-with-curl-8.19.0.patch
new file mode 100644
index 0000000..32be9df
--- /dev/null
+++ b/debian/patches/Make-tests-compatible-with-curl-8.19.0.patch
@@ -0,0 +1,41 @@
+From: Carlos Henrique Lima Melara <charlesmelara@riseup.net>
+Date: Fri, 6 Mar 2026 00:56:17 -0300
+Subject: Make tests compatible with curl 8.19.0
+
+In 8.19.0-rc2, the error logic has been changed so any later errors are
+preserved. This changes what is returned by curl and therefore what tornado
+sees. For HTTPError variant of the test, which uses CurlAsyncHTTPClient, we get
+the error from pycurl and now it contains "Failed binding local connection
+end". This logic handles both the old version of libcurl and also the newer
+one.
+
+Co-Authored-By: Samuel Henrique <samueloph@debian.org>
+
+Forwarded: yes, https://github.com/tornadoweb/tornado/pull/3582
+Last-Update: 2026-03-07
+---
+ tornado/test/httpclient_test.py | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/tornado/test/httpclient_test.py b/tornado/test/httpclient_test.py
+index 77c0d6e..060e16f 100644
+--- a/tornado/test/httpclient_test.py
++++ b/tornado/test/httpclient_test.py
+@@ -622,7 +622,16 @@ X-XSS-Protection: 1;
+         with self.assertRaises((ValueError, HTTPError)) as context:  # type: ignore
+             request = HTTPRequest(url, network_interface="not-interface-or-ip")
+             yield self.http_client.fetch(request)
+-        self.assertIn("not-interface-or-ip", str(context.exception))
++        assert (
++            any(
++                error_message in str(context.exception)
++                for error_message in [
++                    "Failed binding local connection end",
++                    "not-interface-or-ip",
++                ]
++            )
++            == True
++        )
+ 
+     def test_all_methods(self):
+         for method in ["GET", "DELETE", "OPTIONS"]:
diff --git a/debian/patches/disable-domain-tests.patch b/debian/patches/disable-domain-tests.patch
index 987f89c..435d76b 100644
--- a/debian/patches/disable-domain-tests.patch
+++ b/debian/patches/disable-domain-tests.patch
@@ -7,15 +7,15 @@ Forwarded: not-needed
  tornado/test/netutil_test.py | 1 +
  1 file changed, 1 insertion(+)
 
-diff --git a/tornado/test/netutil_test.py b/tornado/test/netutil_test.py
-index b35b794..383d482 100644
---- a/tornado/test/netutil_test.py
-+++ b/tornado/test/netutil_test.py
-@@ -59,6 +59,7 @@ class _ResolverTestMixin(object):
- class _ResolverErrorTestMixin(object):
+Index: python-tornado/tornado/test/netutil_test.py
+===================================================================
+--- python-tornado.orig/tornado/test/netutil_test.py
++++ python-tornado/tornado/test/netutil_test.py
+@@ -49,6 +49,7 @@ class _ResolverTestMixin(AsyncTestCase):
+ class _ResolverErrorTestMixin(AsyncTestCase):
      resolver = None  # type: typing.Any
  
 +    @unittest.skip("Prevent internet access during build")
      @gen_test
-     def test_bad_host(self: typing.Any):
+     def test_bad_host(self):
          with self.assertRaises(IOError):
diff --git a/debian/patches/disable-should-be-failing-test.patch b/debian/patches/disable-should-be-failing-test.patch
index 70d86b2..4a6fa17 100644
--- a/debian/patches/disable-should-be-failing-test.patch
+++ b/debian/patches/disable-should-be-failing-test.patch
@@ -1,6 +1,8 @@
---- a/tornado/test/tcpclient_test.py
-+++ b/tornado/test/tcpclient_test.py
-@@ -155,6 +155,7 @@
+Index: python-tornado/tornado/test/tcpclient_test.py
+===================================================================
+--- python-tornado.orig/tornado/test/tcpclient_test.py
++++ python-tornado/tornado/test/tcpclient_test.py
+@@ -150,6 +150,7 @@ class TCPClientTest(AsyncTestCase):
          self.do_test_connect(socket.AF_INET, "127.0.0.1", source_ip="127.0.0.1")
  
      @skipIfNonUnix
diff --git a/debian/patches/ignoreuserwarning.patch b/debian/patches/ignoreuserwarning.patch
index eafb325..3ec004b 100644
--- a/debian/patches/ignoreuserwarning.patch
+++ b/debian/patches/ignoreuserwarning.patch
@@ -10,9 +10,11 @@ Forwarded: not-needed
  tornado/test/runtests.py | 1 +
  1 file changed, 1 insertion(+)
 
+Index: python-tornado/tornado/test/runtests.py
+===================================================================
 --- python-tornado.orig/tornado/test/runtests.py
 +++ python-tornado/tornado/test/runtests.py
-@@ -121,6 +121,7 @@
+@@ -133,6 +133,7 @@ def main():
      # setuptools sometimes gives ImportWarnings about things that are on
      # sys.path even if they're not being used.
      warnings.filterwarnings("ignore", category=ImportWarning)
diff --git a/debian/patches/increase-timeout-httpclinet-test.patch b/debian/patches/increase-timeout-httpclinet-test.patch
new file mode 100644
index 0000000..03d652c
--- /dev/null
+++ b/debian/patches/increase-timeout-httpclinet-test.patch
@@ -0,0 +1,18 @@
+Description: increase timeout on simple_httpclient_test
+Author:  Aurelien Jarno <aurel32@debian.org>
+Bug: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1117144
+Forwarded: not-needed
+Last-Update: 2025-10-04
+---
+This patch header follows DEP-3: http://dep.debian.net/deps/dep3/
+--- a/tornado/test/simple_httpclient_test.py
++++ b/tornado/test/simple_httpclient_test.py
+@@ -316,7 +316,7 @@
+         yield gen.sleep(0.2)
+ 
+     def test_request_timeout(self):
+-        timeout = 0.1
++        timeout = 0.2
+         if os.name == "nt":
+             timeout = 0.5
+ 
diff --git a/debian/patches/increase-timeout-rv64.patch b/debian/patches/increase-timeout-rv64.patch
index 4381ced..8bdbf0b 100644
--- a/debian/patches/increase-timeout-rv64.patch
+++ b/debian/patches/increase-timeout-rv64.patch
@@ -5,9 +5,11 @@ Forwarded: not-needed
 Last-Update: 2025-05-19
 ---
 This patch header follows DEP-3: http://dep.debian.net/deps/dep3/
---- a/tornado/test/autoreload_test.py
-+++ b/tornado/test/autoreload_test.py
-@@ -7,6 +7,7 @@
+Index: python-tornado/tornado/test/autoreload_test.py
+===================================================================
+--- python-tornado.orig/tornado/test/autoreload_test.py
++++ python-tornado/tornado/test/autoreload_test.py
+@@ -7,6 +7,7 @@ from tempfile import mkdtemp
  import textwrap
  import time
  import unittest
@@ -15,7 +17,7 @@ This patch header follows DEP-3: http://dep.debian.net/deps/dep3/
  
  
  class AutoreloadTest(unittest.TestCase):
-@@ -91,7 +92,10 @@
+@@ -95,7 +96,10 @@ class AutoreloadTest(unittest.TestCase):
          for i in range(40):
              if p.poll() is not None:
                  break
diff --git a/debian/patches/pythonpath-autoreload-test.patch b/debian/patches/pythonpath-autoreload-test.patch
deleted file mode 100644
index 00000b9..0000000
--- a/debian/patches/pythonpath-autoreload-test.patch
+++ /dev/null
@@ -1,23 +0,0 @@
-From: Stefano Rivera <stefano@rivera.za.net>
-Date: Sun, 21 Jan 2024 15:55:16 -0400
-Subject: autoreload_test: Handle a relative PYTHONPATH
-
-This came up in the Debian package build of tornado, where we run the
-tests from a staged build of the module.
-
-Forwarded: https://github.com/tornadoweb/tornado/pull/3358
----
- tornado/test/autoreload_test.py | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
---- python-tornado.orig/tornado/test/autoreload_test.py
-+++ python-tornado/tornado/test/autoreload_test.py
-@@ -75,7 +75,7 @@
-         # application
-         pythonpath = os.getcwd()
-         if "PYTHONPATH" in os.environ:
--            pythonpath += os.pathsep + os.environ["PYTHONPATH"]
-+            pythonpath += os.pathsep + os.path.join(os.getcwd(), os.environ["PYTHONPATH"])
- 
-         p = Popen(
-             args,
diff --git a/debian/patches/series b/debian/patches/series
index d9af7fc..2ef7940 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -2,7 +2,7 @@ disable-domain-tests.patch
 ignoreuserwarning.patch
 0006-Use-local-objects.inv-for-intersphinx-mapping.patch
 0007-Higher-test_gc-timeout.patch
-pythonpath-autoreload-test.patch
 disable-should-be-failing-test.patch
-CVE-2025-47287.patch
 increase-timeout-rv64.patch
+increase-timeout-httpclinet-test.patch
+Make-tests-compatible-with-curl-8.19.0.patch
diff --git a/debian/python3-tornado.lintian-overrides b/debian/python3-tornado.lintian-overrides
index 0f11445..c5042ca 100644
--- a/debian/python3-tornado.lintian-overrides
+++ b/debian/python3-tornado.lintian-overrides
@@ -1,9 +1,9 @@
 # webserver belongs to web (#665854)
 python3-tornado binary: wrong-section-according-to-package-name
 # test sample, so duplication shouldn't be a problem
-python3-tornado: compressed-duplicate usr/lib/python3/dist-packages/tornado/test/static/sample.xml.bz2
-python3-tornado: compressed-duplicate usr/lib/python3/dist-packages/tornado/test/static/sample.xml.gz
+python3-tornado: compressed-duplicate [usr/lib/python3/dist-packages/tornado/test/static/sample.xml.bz2]
+python3-tornado: compressed-duplicate [usr/lib/python3/dist-packages/tornado/test/static/sample.xml.gz]
 # it's not documentation just because it has a .html/.txt suffix!
-python3-tornado: package-contains-documentation-outside-usr-share-doc usr/lib/python3/dist-packages/tornado/test/static/dir/index.html
-python3-tornado: package-contains-documentation-outside-usr-share-doc usr/lib/python3/dist-packages/tornado/test/static/robots.txt
-python3-tornado: package-contains-documentation-outside-usr-share-doc usr/lib/python3/dist-packages/tornado/test/static_foo.txt
+python3-tornado: package-contains-documentation-outside-usr-share-doc [usr/lib/python3/dist-packages/tornado/test/static/dir/index.html]
+python3-tornado: package-contains-documentation-outside-usr-share-doc [usr/lib/python3/dist-packages/tornado/test/static/robots.txt]
+python3-tornado: package-contains-documentation-outside-usr-share-doc [usr/lib/python3/dist-packages/tornado/test/static_foo.txt]
diff --git a/demos/README.rst b/demos/README.rst
index 0429761..cf7cdb3 100644
--- a/demos/README.rst
+++ b/demos/README.rst
@@ -5,16 +5,6 @@ This directory contains several example apps that illustrate the usage of
 various Tornado features. If you're not sure where to start, try the ``chat``,
 ``blog``, or ``websocket`` demos.
 
-.. note::
-
-    These applications require features due to be introduced in Tornado 6.3
-    which is not yet released. Unless you are testing the new release,
-    use the GitHub branch selector to access the ``stable`` branch
-    (or the ``branchX.y`` branch corresponding to the version of Tornado you
-    are using) to get a suitable version of the demos.
-
-    TODO: remove this when 6.3 ships.
-
 Web Applications
 ~~~~~~~~~~~~~~~~
 
@@ -24,7 +14,6 @@ Web Applications
 - ``websocket``: Similar to ``chat`` but with WebSockets instead of
   long polling.
 - ``helloworld``: The simplest possible Tornado web page.
-- ``s3server``: Implements a basic subset of the Amazon S3 API.
 
 Feature demos
 ~~~~~~~~~~~~~
diff --git a/demos/blog/blog.py b/demos/blog/blog.py
index e6e23f8..cfa84f9 100755
--- a/demos/blog/blog.py
+++ b/demos/blog/blog.py
@@ -132,6 +132,14 @@ async def prepare(self):
     async def any_author_exists(self):
         return bool(await self.query("SELECT * FROM authors LIMIT 1"))
 
+    def redirect_to_next(self):
+        next = self.get_argument("next", "/")
+        if next.startswith("//") or not next.startswith("/"):
+            # Absolute URLs are not allowed because this would be an open redirect
+            # vulnerability (https://cwe.mitre.org/data/definitions/601.html).
+            raise tornado.web.HTTPError(400)
+        self.redirect(next)
+
 
 class HomeHandler(BaseHandler):
     async def get(self):
@@ -243,7 +251,7 @@ async def post(self):
             tornado.escape.to_unicode(hashed_password),
         )
         self.set_signed_cookie("blogdemo_user", str(author.id))
-        self.redirect(self.get_argument("next", "/"))
+        self.redirect_to_next()
 
 
 class AuthLoginHandler(BaseHandler):
@@ -270,7 +278,7 @@ async def post(self):
         )
         if password_equal:
             self.set_signed_cookie("blogdemo_user", str(author.id))
-            self.redirect(self.get_argument("next", "/"))
+            self.redirect_to_next()
         else:
             self.render("login.html", error="incorrect password")
 
@@ -278,7 +286,7 @@ async def post(self):
 class AuthLogoutHandler(BaseHandler):
     def get(self):
         self.clear_cookie("blogdemo_user")
-        self.redirect(self.get_argument("next", "/"))
+        self.redirect_to_next()
 
 
 class EntryModule(tornado.web.UIModule):
diff --git a/demos/blog/templates/base.html b/demos/blog/templates/base.html
index e21f29a..0c94e52 100644
--- a/demos/blog/templates/base.html
+++ b/demos/blog/templates/base.html
@@ -1,27 +1,31 @@
 <!DOCTYPE html>
 <html>
-  <head>
-    <meta charset="UTF-8">
-    <title>{{ escape(handler.settings["blog_title"]) }}</title>
-    <link rel="stylesheet" href="{{ static_url("blog.css") }}" type="text/css">
-    <link rel="alternate" href="/feed" type="application/atom+xml" title="{{ escape(handler.settings["blog_title"]) }}">
-    {% block head %}{% end %}
-  </head>
-  <body>
-    <div id="body">
-      <div id="header">
-        <div style="float:right">
-          {% if current_user %}
-            <a href="/compose">{{ _("New post") }}</a> -
-            <a href="/auth/logout?next={{ url_escape(request.uri) }}">{{ _("Sign out") }}</a>
-          {% else %}
-            {% raw _('<a href="%(url)s">Sign in</a> to compose/edit') % {"url": "/auth/login?next=" + url_escape(request.uri)} %}
-          {% end %}
-        </div>
-        <h1><a href="/">{{ escape(handler.settings["blog_title"]) }}</a></h1>
+
+<head>
+  <meta charset="UTF-8">
+  <title>{{ escape(handler.settings["blog_title"]) }}</title>
+  <link rel="stylesheet" href="{{ static_url(" blog.css") }}" type="text/css">
+  <link rel="alternate" href="/feed" type="application/atom+xml" title="{{ escape(handler.settings[" blog_title"]) }}">
+  {% block head %}{% end %}
+</head>
+
+<body>
+  <div id="body">
+    <div id="header">
+      <div style="float:right">
+        {% if current_user %}
+        <a href="/compose">{{ _("New post") }}</a> -
+        <a href="/auth/logout?next={{ url_escape(request.path) }}">{{ _("Sign out") }}</a>
+        {% else %}
+        {% raw _('<a href="%(url)s">Sign in</a> to compose/edit') % {"url": "/auth/login?next=" +
+        url_escape(request.path)} %}
+        {% end %}
       </div>
-      <div id="content">{% block body %}{% end %}</div>
+      <h1><a href="/">{{ escape(handler.settings["blog_title"]) }}</a></h1>
     </div>
-    {% block bottom %}{% end %}
-  </body>
-</html>
+    <div id="content">{% block body %}{% end %}</div>
+  </div>
+  {% block bottom %}{% end %}
+</body>
+
+</html>
\ No newline at end of file
diff --git a/demos/chat/chatdemo.py b/demos/chat/chatdemo.py
index 28c1210..9878b3b 100755
--- a/demos/chat/chatdemo.py
+++ b/demos/chat/chatdemo.py
@@ -25,7 +25,7 @@
 define("debug", default=True, help="run in debug mode")
 
 
-class MessageBuffer(object):
+class MessageBuffer:
     def __init__(self):
         # cond is notified whenever the message cache is updated
         self.cond = tornado.locks.Condition()
@@ -71,8 +71,12 @@ def post(self):
         message["html"] = tornado.escape.to_unicode(
             self.render_string("message.html", message=message)
         )
-        if self.get_argument("next", None):
-            self.redirect(self.get_argument("next"))
+        if next := self.get_argument("next", None):
+            if next.startswith("//") or not next.startswith("/"):
+                # Absolute URLs are not allowed because this would be an open redirect
+                # vulnerability (https://cwe.mitre.org/data/definitions/601.html).
+                raise tornado.web.HTTPError(400)
+            self.redirect(next)
         else:
             self.write(message)
         global_message_buffer.add_message(message)
diff --git a/demos/facebook/facebook.py b/demos/facebook/facebook.py
index 9b608aa..84e87ff 100755
--- a/demos/facebook/facebook.py
+++ b/demos/facebook/facebook.py
@@ -70,13 +70,7 @@ async def get(self):
 
 class AuthLoginHandler(BaseHandler, tornado.auth.FacebookGraphMixin):
     async def get(self):
-        my_url = (
-            self.request.protocol
-            + "://"
-            + self.request.host
-            + "/auth/login?next="
-            + tornado.escape.url_escape(self.get_argument("next", "/"))
-        )
+        my_url = self.request.protocol + "://" + self.request.host + "/auth/login"
         if self.get_argument("code", False):
             user = await self.get_authenticated_user(
                 redirect_uri=my_url,
@@ -85,7 +79,7 @@ async def get(self):
                 code=self.get_argument("code"),
             )
             self.set_signed_cookie("fbdemo_user", tornado.escape.json_encode(user))
-            self.redirect(self.get_argument("next", "/"))
+            self.redirect("/")
             return
         self.authorize_redirect(
             redirect_uri=my_url,
@@ -97,7 +91,7 @@ async def get(self):
 class AuthLogoutHandler(BaseHandler, tornado.auth.FacebookGraphMixin):
     def get(self):
         self.clear_cookie("fbdemo_user")
-        self.redirect(self.get_argument("next", "/"))
+        self.redirect("/")
 
 
 class PostModule(tornado.web.UIModule):
diff --git a/demos/s3server/s3server.py b/demos/s3server/s3server.py
deleted file mode 100644
index b798c6b..0000000
--- a/demos/s3server/s3server.py
+++ /dev/null
@@ -1,270 +0,0 @@
-#
-# Copyright 2009 Facebook
-#
-# Licensed under the Apache License, Version 2.0 (the "License"); you may
-# not use this file except in compliance with the License. You may obtain
-# a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-# License for the specific language governing permissions and limitations
-# under the License.
-
-"""Implementation of an S3-like storage server based on local files.
-
-Useful to test features that will eventually run on S3, or if you want to
-run something locally that was once running on S3.
-
-We don't support all the features of S3, but it does work with the
-standard S3 client for the most basic semantics. To use the standard
-S3 client with this module:
-
-    c = S3.AWSAuthConnection("", "", server="localhost", port=8888,
-                             is_secure=False)
-    c.create_bucket("mybucket")
-    c.put("mybucket", "mykey", "a value")
-    print c.get("mybucket", "mykey").body
-
-"""
-
-import asyncio
-import bisect
-import datetime
-import hashlib
-import os
-import os.path
-import urllib
-
-from tornado import escape
-from tornado import httpserver
-from tornado import web
-from tornado.util import unicode_type
-from tornado.options import options, define
-
-try:
-    long
-except NameError:
-    long = int
-
-define("port", default=9888, help="TCP port to listen on")
-define("root_directory", default="/tmp/s3", help="Root storage directory")
-define("bucket_depth", default=0, help="Bucket file system depth limit")
-
-
-async def start(port, root_directory, bucket_depth):
-    """Starts the mock S3 server on the given port at the given path."""
-    application = S3Application(root_directory, bucket_depth)
-    http_server = httpserver.HTTPServer(application)
-    http_server.listen(port)
-    await asyncio.Event().wait()
-
-
-class S3Application(web.Application):
-    """Implementation of an S3-like storage server based on local files.
-
-    If bucket depth is given, we break files up into multiple directories
-    to prevent hitting file system limits for number of files in each
-    directories. 1 means one level of directories, 2 means 2, etc.
-    """
-
-    def __init__(self, root_directory, bucket_depth=0):
-        web.Application.__init__(
-            self,
-            [
-                (r"/", RootHandler),
-                (r"/([^/]+)/(.+)", ObjectHandler),
-                (r"/([^/]+)/", BucketHandler),
-            ],
-        )
-        self.directory = os.path.abspath(root_directory)
-        if not os.path.exists(self.directory):
-            os.makedirs(self.directory)
-        self.bucket_depth = bucket_depth
-
-
-class BaseRequestHandler(web.RequestHandler):
-    SUPPORTED_METHODS = ("PUT", "GET", "DELETE")
-
-    def render_xml(self, value):
-        assert isinstance(value, dict) and len(value) == 1
-        self.set_header("Content-Type", "application/xml; charset=UTF-8")
-        name = list(value.keys())[0]
-        parts = []
-        parts.append("<" + name + ' xmlns="http://doc.s3.amazonaws.com/2006-03-01">')
-        self._render_parts(value[name], parts)
-        parts.append("</" + name + ">")
-        self.finish('<?xml version="1.0" encoding="UTF-8"?>\n' + "".join(parts))
-
-    def _render_parts(self, value, parts=[]):
-        if isinstance(value, (unicode_type, bytes)):
-            parts.append(escape.xhtml_escape(value))
-        elif isinstance(value, (int, long)):
-            parts.append(str(value))
-        elif isinstance(value, datetime.datetime):
-            parts.append(value.strftime("%Y-%m-%dT%H:%M:%S.000Z"))
-        elif isinstance(value, dict):
-            for name, subvalue in value.items():
-                if not isinstance(subvalue, list):
-                    subvalue = [subvalue]
-                for subsubvalue in subvalue:
-                    parts.append("<" + name + ">")
-                    self._render_parts(subsubvalue, parts)
-                    parts.append("</" + name + ">")
-        else:
-            raise Exception("Unknown S3 value type %r", value)
-
-    def _object_path(self, bucket, object_name):
-        if self.application.bucket_depth < 1:
-            return os.path.abspath(
-                os.path.join(self.application.directory, bucket, object_name)
-            )
-        hash = hashlib.md5(object_name).hexdigest()
-        path = os.path.abspath(os.path.join(self.application.directory, bucket))
-        for i in range(self.application.bucket_depth):
-            path = os.path.join(path, hash[: 2 * (i + 1)])
-        return os.path.join(path, object_name)
-
-
-class RootHandler(BaseRequestHandler):
-    def get(self):
-        names = os.listdir(self.application.directory)
-        buckets = []
-        for name in names:
-            path = os.path.join(self.application.directory, name)
-            info = os.stat(path)
-            buckets.append(
-                {
-                    "Name": name,
-                    "CreationDate": datetime.datetime.fromtimestamp(
-                        info.st_ctime, datetime.timezone.utc
-                    ),
-                }
-            )
-        self.render_xml({"ListAllMyBucketsResult": {"Buckets": {"Bucket": buckets}}})
-
-
-class BucketHandler(BaseRequestHandler):
-    def get(self, bucket_name):
-        prefix = self.get_argument("prefix", "")
-        marker = self.get_argument("marker", "")
-        max_keys = int(self.get_argument("max-keys", 50000))
-        path = os.path.abspath(os.path.join(self.application.directory, bucket_name))
-        terse = int(self.get_argument("terse", 0))
-        if not path.startswith(self.application.directory) or not os.path.isdir(path):
-            raise web.HTTPError(404)
-        object_names = []
-        for root, dirs, files in os.walk(path):
-            for file_name in files:
-                object_names.append(os.path.join(root, file_name))
-        skip = len(path) + 1
-        for i in range(self.application.bucket_depth):
-            skip += 2 * (i + 1) + 1
-        object_names = [n[skip:] for n in object_names]
-        object_names.sort()
-        contents = []
-
-        start_pos = 0
-        if marker:
-            start_pos = bisect.bisect_right(object_names, marker, start_pos)
-        if prefix:
-            start_pos = bisect.bisect_left(object_names, prefix, start_pos)
-
-        truncated = False
-        for object_name in object_names[start_pos:]:
-            if not object_name.startswith(prefix):
-                break
-            if len(contents) >= max_keys:
-                truncated = True
-                break
-            object_path = self._object_path(bucket_name, object_name)
-            c = {"Key": object_name}
-            if not terse:
-                info = os.stat(object_path)
-                c.update(
-                    {
-                        "LastModified": datetime.datetime.utcfromtimestamp(
-                            info.st_mtime
-                        ),
-                        "Size": info.st_size,
-                    }
-                )
-            contents.append(c)
-            marker = object_name
-        self.render_xml(
-            {
-                "ListBucketResult": {
-                    "Name": bucket_name,
-                    "Prefix": prefix,
-                    "Marker": marker,
-                    "MaxKeys": max_keys,
-                    "IsTruncated": truncated,
-                    "Contents": contents,
-                }
-            }
-        )
-
-    def put(self, bucket_name):
-        path = os.path.abspath(os.path.join(self.application.directory, bucket_name))
-        if not path.startswith(self.application.directory) or os.path.exists(path):
-            raise web.HTTPError(403)
-        os.makedirs(path)
-        self.finish()
-
-    def delete(self, bucket_name):
-        path = os.path.abspath(os.path.join(self.application.directory, bucket_name))
-        if not path.startswith(self.application.directory) or not os.path.isdir(path):
-            raise web.HTTPError(404)
-        if len(os.listdir(path)) > 0:
-            raise web.HTTPError(403)
-        os.rmdir(path)
-        self.set_status(204)
-        self.finish()
-
-
-class ObjectHandler(BaseRequestHandler):
-    def get(self, bucket, object_name):
-        object_name = urllib.unquote(object_name)
-        path = self._object_path(bucket, object_name)
-        if not path.startswith(self.application.directory) or not os.path.isfile(path):
-            raise web.HTTPError(404)
-        info = os.stat(path)
-        self.set_header("Content-Type", "application/unknown")
-        self.set_header(
-            "Last-Modified", datetime.datetime.utcfromtimestamp(info.st_mtime)
-        )
-        with open(path, "rb") as object_file:
-            self.finish(object_file.read())
-
-    def put(self, bucket, object_name):
-        object_name = urllib.unquote(object_name)
-        bucket_dir = os.path.abspath(os.path.join(self.application.directory, bucket))
-        if not bucket_dir.startswith(self.application.directory) or not os.path.isdir(
-            bucket_dir
-        ):
-            raise web.HTTPError(404)
-        path = self._object_path(bucket, object_name)
-        if not path.startswith(bucket_dir) or os.path.isdir(path):
-            raise web.HTTPError(403)
-        directory = os.path.dirname(path)
-        if not os.path.exists(directory):
-            os.makedirs(directory)
-        with open(path, "w") as object_file:
-            object_file.write(self.request.body)
-        self.finish()
-
-    def delete(self, bucket, object_name):
-        object_name = urllib.unquote(object_name)
-        path = self._object_path(bucket, object_name)
-        if not path.startswith(self.application.directory) or not os.path.isfile(path):
-            raise web.HTTPError(404)
-        os.unlink(path)
-        self.set_status(204)
-        self.finish()
-
-
-if __name__ == "__main__":
-    options.parse_command_line()
-    asyncio.run(start(options.port, options.root_directory, options.bucket_depth))
diff --git a/demos/webspider/webspider.py b/demos/webspider/webspider.py
index d775791..0c62a70 100755
--- a/demos/webspider/webspider.py
+++ b/demos/webspider/webspider.py
@@ -74,7 +74,7 @@ async def worker():
             try:
                 await fetch_url(url)
             except Exception as e:
-                print("Exception: %s %s" % (e, url))
+                print(f"Exception: {e} {url}")
                 dead.add(url)
             finally:
                 q.task_done()
diff --git a/docs/asyncio.rst b/docs/asyncio.rst
index fc73745..1f90bf6 100644
--- a/docs/asyncio.rst
+++ b/docs/asyncio.rst
@@ -3,3 +3,13 @@
 
 .. automodule:: tornado.platform.asyncio
    :members:
+
+
+   ..
+      AnyThreadEventLoopPolicy is created dynamically in getattr, so
+      introspection won't find it automatically. This has the unfortunate
+      side effect of moving it to the top of the page but it's better than
+      having it missing entirely.
+
+   .. autoclass:: AnyThreadEventLoopPolicy
+      :members:
\ No newline at end of file
diff --git a/docs/caresresolver.rst b/docs/caresresolver.rst
index 4e0058e..57caa7d 100644
--- a/docs/caresresolver.rst
+++ b/docs/caresresolver.rst
@@ -19,6 +19,9 @@ wrapper ``pycares``).
     the default for ``tornado.simple_httpclient``, but other libraries
     may default to ``AF_UNSPEC``.
 
+    This class requires ``pycares`` version 4. Since this class is deprecated, it will not be
+    updated to support ``pycares`` version 5.
+
     .. deprecated:: 6.2
        This class is deprecated and will be removed in Tornado 7.0. Use the default
        thread-based resolver instead.
diff --git a/docs/conf.py b/docs/conf.py
index 424d844..c2c81b5 100644
--- a/docs/conf.py
+++ b/docs/conf.py
@@ -21,7 +21,6 @@
     "sphinx.ext.doctest",
     "sphinx.ext.intersphinx",
     "sphinx.ext.viewcode",
-    "sphinxcontrib.asyncio",
 ]
 
 primary_domain = "py"
@@ -37,7 +36,9 @@
 autodoc_docstring_signature = False
 
 coverage_skip_undoc_in_source = True
+coverage_show_missing_items = True
 coverage_ignore_modules = [
+    "tornado.curl_httpclient",
     "tornado.platform.asyncio",
     "tornado.platform.caresresolver",
     "tornado.platform.twisted",
@@ -107,6 +108,7 @@
     "concurrent.futures._base.Future",
     "futures.Future",
     "socket.socket",
+    "unittest.case.TestCase",
     "TextIO",
     # Other stuff. I'm not sure why some of these are showing up, but
     # I'm just listing everything here to avoid blocking the upgrade of sphinx.
@@ -144,3 +146,16 @@ def missing_reference_handler(app, env, node, contnode):
 
 def setup(app):
     app.connect("missing-reference", missing_reference_handler)
+
+
+# Read the Docs configuration updates from
+# https://about.readthedocs.com/blog/2024/07/addons-by-default/
+
+# Define the canonical URL if you are using a custom domain on Read the Docs
+html_baseurl = os.environ.get("READTHEDOCS_CANONICAL_URL", "")
+
+# Tell Jinja2 templates the build is running on Read the Docs
+if os.environ.get("READTHEDOCS", "") == "True":
+    if "html_context" not in globals():
+        html_context = {}
+    html_context["READTHEDOCS"] = True
diff --git a/docs/guide/async.rst b/docs/guide/async.rst
index 1b5526f..5e545df 100644
--- a/docs/guide/async.rst
+++ b/docs/guide/async.rst
@@ -73,9 +73,6 @@ Here is a sample synchronous function:
         response = http_client.fetch(url)
         return response.body
 
-.. testoutput::
-   :hide:
-
 And here is the same function rewritten asynchronously as a native coroutine:
 
 .. testcode::
@@ -87,9 +84,6 @@ And here is the same function rewritten asynchronously as a native coroutine:
        response = await http_client.fetch(url)
        return response.body
 
-.. testoutput::
-   :hide:
-
 Or for compatibility with older versions of Python, using the `tornado.gen` module:
 
 ..  testcode::
@@ -118,9 +112,6 @@ Coroutines are a little magical, but what they do internally is something like t
         fetch_future.add_done_callback(on_fetch)
         return my_future
 
-.. testoutput::
-   :hide:
-
 Notice that the coroutine returns its `.Future` before the fetch is
 done. This is what makes coroutines *asynchronous*.
 
diff --git a/docs/guide/coroutines.rst b/docs/guide/coroutines.rst
index 811c084..691fa30 100644
--- a/docs/guide/coroutines.rst
+++ b/docs/guide/coroutines.rst
@@ -207,9 +207,6 @@ The `.multi` function accepts lists and dicts whose values are
                                  for url in urls})
         # responses is a dict {url: HTTPResponse}
 
-.. testoutput::
-   :hide:
-
 In decorated coroutines, it is possible to ``yield`` the list or dict directly::
 
     @gen.coroutine
@@ -238,9 +235,6 @@ immediately, so you can start another operation before waiting.
             fetch_future = convert_yielded(self.fetch_next_chunk())
             await self.flush()
 
-.. testoutput::
-   :hide:
-
 This is a little easier to do with decorated coroutines, because they
 start immediately when called:
 
@@ -256,9 +250,6 @@ start immediately when called:
             fetch_future = self.fetch_next_chunk()
             yield self.flush()
 
-.. testoutput::
-   :hide:
-
 Looping
 ^^^^^^^
 
diff --git a/docs/guide/running.rst b/docs/guide/running.rst
index 99d1827..8c7fda8 100644
--- a/docs/guide/running.rst
+++ b/docs/guide/running.rst
@@ -18,9 +18,6 @@ configuring a WSGI container to find your application, you write a
     if __name__ == '__main__':
         asyncio.run(main())
 
-.. testoutput::
-   :hide:
-
 Configure your operating system or process manager to run this program to
 start the server. Please note that it may be necessary to increase the number 
 of open files per process (to avoid "Too many open files"-Error). 
@@ -53,9 +50,6 @@ alterations to application startup.
             await asyncio.Event().wait()
         asyncio.run(post_fork_main())
 
-.. testoutput::
-   :hide:
-
 This is another way to start multiple processes and have them all
 share the same port, although it has some limitations.  First, each
 child process will have its own ``IOLoop``, so it is important that
diff --git a/docs/guide/security.rst b/docs/guide/security.rst
index ee33141..859ed67 100644
--- a/docs/guide/security.rst
+++ b/docs/guide/security.rst
@@ -21,9 +21,6 @@ method:
             else:
                 self.write("Your cookie was set!")
 
-.. testoutput::
-   :hide:
-
 Cookies are not secure and can easily be modified by clients.  If you
 need to set cookies to, e.g., identify the currently logged in user,
 you need to sign your cookies to prevent forgery. Tornado supports
@@ -39,9 +36,6 @@ keyword arguments to your application:
         (r"/", MainHandler),
     ], cookie_secret="__TODO:_GENERATE_YOUR_OWN_RANDOM_VALUE_HERE__")
 
-.. testoutput::
-   :hide:
-
 Signed cookies contain the encoded value of the cookie in addition to a
 timestamp and an `HMAC <http://en.wikipedia.org/wiki/HMAC>`_ signature.
 If the cookie is old or if the signature doesn't match,
@@ -58,9 +52,6 @@ set. The secure version of the example above:
             else:
                 self.write("Your cookie was set!")
 
-.. testoutput::
-   :hide:
-
 Tornado's signed cookies guarantee integrity but not confidentiality.
 That is, the cookie cannot be modified but its contents can be seen by the
 user.  The ``cookie_secret`` is a symmetric key and must be kept secret --
@@ -129,9 +120,6 @@ specifying a nickname, which is then saved in a cookie:
         (r"/login", LoginHandler),
     ], cookie_secret="__TODO:_GENERATE_YOUR_OWN_RANDOM_VALUE_HERE__")
 
-.. testoutput::
-   :hide:
-
 You can require that the user be logged in using the `Python
 decorator <http://www.python.org/dev/peps/pep-0318/>`_
 `tornado.web.authenticated`. If a request goes to a method with this
@@ -156,9 +144,6 @@ rewritten:
         (r"/login", LoginHandler),
     ], **settings)
 
-.. testoutput::
-   :hide:
-
 If you decorate ``post()`` methods with the ``authenticated``
 decorator, and the user is not logged in, the server will send a
 ``403`` response.  The ``@authenticated`` decorator is simply
@@ -202,9 +187,6 @@ the Google credentials in a cookie for later access:
                     response_type='code',
                     extra_params={'approval_prompt': 'auto'})
 
-.. testoutput::
-   :hide:
-
 See the `tornado.auth` module documentation for more details.
 
 .. _xsrf:
@@ -237,9 +219,6 @@ include the application setting ``xsrf_cookies``:
         (r"/login", LoginHandler),
     ], **settings)
 
-.. testoutput::
-   :hide:
-
 If ``xsrf_cookies`` is set, the Tornado web application will set the
 ``_xsrf`` cookie for all users and reject all ``POST``, ``PUT``, and
 ``DELETE`` requests that do not contain a correct ``_xsrf`` value. If
diff --git a/docs/guide/structure.rst b/docs/guide/structure.rst
index d120ea4..100ad6b 100644
--- a/docs/guide/structure.rst
+++ b/docs/guide/structure.rst
@@ -37,9 +37,6 @@ A minimal "hello world" example looks something like this:
     if __name__ == "__main__":
         asyncio.run(main())
 
-.. testoutput::
-   :hide:
-
 The ``main`` coroutine
 ~~~~~~~~~~~~~~~~~~~~~~
 
@@ -153,9 +150,6 @@ and `~.RequestHandler.get_body_argument`.
             self.set_header("Content-Type", "text/plain")
             self.write("You wrote " + self.get_body_argument("message"))
 
-.. testoutput::
-   :hide:
-
 Since the HTML form encoding is ambiguous as to whether an argument is
 a single value or a list with one element, `.RequestHandler` has
 distinct methods to allow the application to indicate whether or not
@@ -332,9 +326,6 @@ For example, here is a simple handler using a coroutine:
             self.write("Fetched " + str(len(json["entries"])) + " entries "
                        "from the FriendFeed API")
 
-.. testoutput::
-   :hide:
-
 For a more advanced asynchronous example, take a look at the `chat
 example application
 <https://github.com/tornadoweb/tornado/tree/stable/demos/chat>`_, which
diff --git a/docs/guide/templates.rst b/docs/guide/templates.rst
index 7c5a8f4..036aec2 100644
--- a/docs/guide/templates.rst
+++ b/docs/guide/templates.rst
@@ -62,9 +62,6 @@ directory as your Python file, you could render this template with:
             items = ["Item 1", "Item 2", "Item 3"]
             self.render("template.html", title="My title", items=items)
 
-.. testoutput::
-   :hide:
-
 Tornado templates support *control statements* and *expressions*.
 Control statements are surrounded by ``{%`` and ``%}``, e.g.
 ``{% if len(items) > 2 %}``. Expressions are surrounded by ``{{`` and
@@ -121,8 +118,25 @@ Consequently, if you write random stuff inside of your template
 expressions, you will get random Python errors when you execute the
 template.
 
-All template output is escaped by default, using the
-`tornado.escape.xhtml_escape` function. This behavior can be changed
+Security
+~~~~~~~~
+
+Inserting untrusted content into a web page can lead to security vulnerabilities such as cross-site
+scripting (XSS). All data that is passed to a template should be *escaped* to prevent these
+vulnerabilities. The correct form of escaping is context-dependent; Tornado's templates are not
+aware of the syntax of HTML, JavaScript, etc, and so the template developer must sometimes
+explicitly apply the correct escaping function.
+
+The default escaping function is `tornado.escape.xhtml_escape`, which is appropriate for HTML body
+content (but not attribute values). In other cases, other functions should be used. In JavaScript,
+use the `.json_encode` function, e.g. ``<script>var x = {{ json_encode(some_object) }};</script>``.
+`.json_encode` can be used to escape strings, numbers, lists, and dicts. In this example, the
+JavaScript variable ``x`` will be the corresponding JavaScript type (string, number, array, or
+object), and not the JSON-encoded string representation. Note that it is unsafe to use
+`.json_encode` in the context of a JavaScript string literal (including template strings), only in
+the top-level syntactic context.
+
+The automatic escaping behavior can be disabled
 globally by passing ``autoescape=None`` to the `.Application` or
 `.tornado.template.Loader` constructors, for a template file with the
 ``{% autoescape None %}`` directive, or for a single expression by
@@ -202,9 +216,6 @@ by overriding `.RequestHandler.get_user_locale`:
                 return None
             return self.current_user.prefs["locale"]
 
-.. testoutput::
-   :hide:
-
 If ``get_user_locale`` returns ``None``, we fall back on the
 ``Accept-Language`` header.
 
diff --git a/docs/index.rst b/docs/index.rst
index c33fb0b..9b12186 100644
--- a/docs/index.rst
+++ b/docs/index.rst
@@ -99,7 +99,7 @@ installed in this way, so you may wish to download a copy of the
 source tarball or clone the `git repository
 <https://github.com/tornadoweb/tornado>`_ as well.
 
-**Prerequisites**: Tornado 6.3 requires Python 3.8 or newer. The following
+**Prerequisites**: Tornado 6.3 requires Python 3.9 or newer. The following
 optional packages may be useful:
 
 * `pycurl <http://pycurl.io/>`_ is used by the optional
diff --git a/docs/releases.rst b/docs/releases.rst
index 5c7a106..da95c99 100644
--- a/docs/releases.rst
+++ b/docs/releases.rst
@@ -4,6 +4,12 @@ Release notes
 .. toctree::
    :maxdepth: 2
 
+   releases/v6.5.5
+   releases/v6.5.4
+   releases/v6.5.3
+   releases/v6.5.2
+   releases/v6.5.1
+   releases/v6.5.0
    releases/v6.4.2
    releases/v6.4.1
    releases/v6.4.0
diff --git a/docs/releases/v3.0.0.rst b/docs/releases/v3.0.0.rst
index 53c9771..ab8e984 100644
--- a/docs/releases/v3.0.0.rst
+++ b/docs/releases/v3.0.0.rst
@@ -264,7 +264,7 @@ Multiple modules
   of three optional dependencies: `~tornado.netutil.ThreadedResolver`
   using the `concurrent.futures` thread pool,
   `tornado.platform.caresresolver.CaresResolver` using the ``pycares``
-  library, or `tornado.platform.twisted.TwistedResolver` using ``twisted``
+  library, or ``tornado.platform.twisted.TwistedResolver`` using ``twisted``
 * New function `tornado.netutil.is_valid_ip` returns true if a given string
   is a valid IP (v4 or v6) address.
 * `tornado.netutil.bind_sockets` has a new ``flags`` argument that can
@@ -314,7 +314,7 @@ Multiple modules
 * New class ``tornado.platform.twisted.TwistedIOLoop`` allows Tornado
   code to be run on the Twisted reactor (as opposed to the existing
   ``TornadoReactor``, which bridges the gap in the other direction).
-* New class `tornado.platform.twisted.TwistedResolver` is an asynchronous
+* New class ``tornado.platform.twisted.TwistedResolver``` is an asynchronous
   implementation of the `.Resolver` interface.
 
 `tornado.process`
diff --git a/docs/releases/v3.2.0.rst b/docs/releases/v3.2.0.rst
index f0be999..d223224 100644
--- a/docs/releases/v3.2.0.rst
+++ b/docs/releases/v3.2.0.rst
@@ -125,7 +125,7 @@ New modules
 `tornado.platform.twisted`
 ~~~~~~~~~~~~~~~~~~~~~~~~~~
 
-* `.TwistedResolver` now has better error handling.
+* ``.TwistedResolver``` now has better error handling.
 
 `tornado.process`
 ~~~~~~~~~~~~~~~~~
diff --git a/docs/releases/v5.0.0.rst b/docs/releases/v5.0.0.rst
index 950b2e1..2734648 100644
--- a/docs/releases/v5.0.0.rst
+++ b/docs/releases/v5.0.0.rst
@@ -257,7 +257,7 @@ Other notes
 `tornado.platform.twisted`
 ~~~~~~~~~~~~~~~~~~~~~~~~~~
 
-- The ``io_loop`` arguments to ``TornadoReactor``, `.TwistedResolver`,
+- The ``io_loop`` arguments to ``TornadoReactor``, ``TwistedResolver``,
   and ``tornado.platform.twisted.install`` have been removed.
 
 `tornado.process`
diff --git a/docs/releases/v6.5.0.rst b/docs/releases/v6.5.0.rst
new file mode 100644
index 0000000..e8dd02c
--- /dev/null
+++ b/docs/releases/v6.5.0.rst
@@ -0,0 +1,107 @@
+What's new in Tornado 6.5.0
+===========================
+
+May 15, 2025
+------------
+
+Security Improvements
+~~~~~~~~~~~~~~~~~~~~~
+
+- Previously, malformed ``multipart-form-data`` requests could log multiple warnings and
+  constitute a denial-of-service attack. Now an exception is raised at the first error, so there
+  is only one log message per request. This fixes
+  `CVE-2025-47287 <https://github.com/tornadoweb/tornado/security/advisories/GHSA-7cx3-6m66-7c5m>`_.
+
+General Changes
+~~~~~~~~~~~~~~~
+
+- Python 3.14 is now supported. Older versions of Tornado will work on Python 3.14 but may log
+  deprecation warnings.
+- The free-threading mode of Python 3.13 is now supported on an experimental basis. Prebuilt
+  wheels are not yet available for this configuration, but it can be built from source.
+- The minimum supported Python version is 3.9.
+
+Deprecation Notices
+~~~~~~~~~~~~~~~~~~~
+
+- Support for ``obs-fold`` continuation lines in HTTP headers is deprecated and will be removed in
+  Tornado 7.0, as is the use of carriage returns without line feeds as header separators.
+- The ``callback`` argument to `.websocket_connect` is deprecated and will be removed in
+  Tornado 7.0. Note that ``on_message_callback`` is not deprecated.
+- The ``log_message`` and ``args`` attributes of `tornado.web.HTTPError` are deprecated. Use the
+  new ``get_message`` method instead.
+
+Type Annotation Changes
+~~~~~~~~~~~~~~~~~~~~~~~
+
+- `tornado.concurrent.chain_future` is now typed as accepting both asyncio and concurrent Futures.
+- `tornado.gen.multi` and ``multi_future`` now take ``Sequences`` and ``Mappings`` instead of
+  ``List`` and ``Dict``.
+- `tornado.httputil.RequestStartLine` and `.ResponseStartLine` now have type annotations for
+  their attributes.
+- `.HTTPHeaders` now has type annotations for its elements.
+- The ``autoescape`` argument to `tornado.template.BaseLoader` is now marked as optional.
+- ``tornado.routing._RuleList`` is now a ``Sequence`` for more flexibility.
+- ``.RequestHandler.SUPPPORTED_METHODS`` is now typed to support overriding in a subclass.
+- Types for `.RequestHandler.get_body_argument` and ``get_query_argument`` are improved and now
+  match the ``get_argument`` method.
+- `.RequestHandler.get_cookie` now has more accurate types.
+- The return type of `.UIModule.render` may now be either `str` or `bytes`.
+
+`tornado.httputil`
+~~~~~~~~~~~~~~~~~~
+
+- Support for ``obs-fold`` continuation lines in HTTP headers is deprecated and will be removed in
+  Tornado 7.0, as is the use of carriage returns without line feeds as header separators.
+- Request start lines may no longer include control characters.
+- Method names containing invalid characters now return error code 400 instead of 405.
+- Header names are now restricted to the set of characters permitted by the RFCs.
+- Control characters are no longer allowed in (incoming) header values.
+- Handling of trailing whitespace in headers has been improved, especially with ``obs-fold``
+  continuation lines.
+- The ``Host`` header is now restricted to the set of characters permitted by the RFCs. It is now an
+  error to send more than one ``Host`` header, or to omit a ``Host`` header for a request that is
+  not using HTTP/1.0.
+
+`tornado.ioloop`
+~~~~~~~~~~~~~~~~
+
+- Fixed a bug in which `contextvars` that were set when the event loop was created were not
+  available inside the event loop on Windows.
+
+`tornado.netutil`
+~~~~~~~~~~~~~~~~~
+
+- `.bind_unix_socket` now supports the Linux abstract namespace.
+
+
+`tornado.platform.twisted`
+~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+- ``TwistedResolver`` has been deleted. It was already deprecated and scheduled for removal
+  in Tornado 7.0, but due to the adoption of RFC 8482 it no longer works for most
+  domain names. This class was primarily intended to provide thread-free non-blocking
+  DNS resolution. If that is still required, ``tornado.platform.caresresolver`` is the
+  next best option, although it has its own limitations which differ from TwistedResolver,
+  and it is also deprecated. Most users should switch to the default resolver, which uses
+  threads.
+
+`tornado.web`
+~~~~~~~~~~~~~
+
+- The set of characters allowed in (outgoing) HTTP headers now matches the RFCs. Specifically, tab
+  characters are now allowed and DEL is not.
+- Invalid ``If-Modified-Since`` headers are now ignored instead of causing a 500 error.
+- ``%`` characters in the log message of `tornado.web.HTTPError` are no longer doubled when no
+  additional arguments are passed. This matches the behavior of `logging.LogRecord`. A new method
+  ``get_message`` has been added to ``HTTPError`` to allow access to the fully-substituted message;
+  directly accessing ``log_message`` and ``args`` is deprecated.
+
+`tornado.websocket`
+~~~~~~~~~~~~~~~~~~~
+
+- Some bugs involving ``ping_interval`` and ``ping_timeout`` have been fixed. Setting the
+  ``ping_timeout`` greater than the ``ping_interval`` is no longer supported. The default
+  ``ping_timeout`` is now equal to the ``ping_interval``. 
+- The ``callback`` argument to ``websocket_connect`` is deprecated and will be removed in
+  Tornado 7.0. Note that ``on_message_callback`` is not deprecated.
diff --git a/docs/releases/v6.5.1.rst b/docs/releases/v6.5.1.rst
new file mode 100644
index 0000000..17a7549
--- /dev/null
+++ b/docs/releases/v6.5.1.rst
@@ -0,0 +1,11 @@
+What's new in Tornado 6.5.1
+===========================
+
+May 22, 2025
+------------
+
+Bug fixes
+~~~~~~~~~
+
+- Fixed a bug in ``multipart/form-data`` parsing that could incorrectly reject filenames containing
+  characters above U+00FF (i.e. most characters outside the Latin alphabet).
diff --git a/docs/releases/v6.5.2.rst b/docs/releases/v6.5.2.rst
new file mode 100644
index 0000000..5f3b171
--- /dev/null
+++ b/docs/releases/v6.5.2.rst
@@ -0,0 +1,17 @@
+What's new in Tornado 6.5.2
+===========================
+
+Aug 8, 2025
+-----------
+
+Bug fixes
+~~~~~~~~~
+
+- Fixed a bug that resulted in WebSocket pings not being sent at the configured interval.
+- Improved logging for invalid ``Host`` headers. This was previously logged as an uncaught
+  exception with a stack trace, now it is simply a 400 response (logged as a warning in the
+  access log).
+- Restored the ``host`` argument to `.HTTPServerRequest`. This argument is deprecated
+  and will be removed in the future, but its removal with no warning in 6.5.0 was a mistake.
+- Removed a debugging print statement that was left in the code.
+- Improved type hints for ``gen.multi``.
\ No newline at end of file
diff --git a/docs/releases/v6.5.3.rst b/docs/releases/v6.5.3.rst
new file mode 100644
index 0000000..33b4f66
--- /dev/null
+++ b/docs/releases/v6.5.3.rst
@@ -0,0 +1,33 @@
+What's new in Tornado 6.5.3
+===========================
+
+Dec 10, 2025
+------------
+
+Security fixes
+~~~~~~~~~~~~~~
+- Fixed a denial-of-service vulnerability involving quadratic computation when parsing
+  ``multipart/form-data`` request bodies.
+  `CVE-2025-67726 <https://github.com/tornadoweb/tornado/security/advisories/GHSA-jhmp-mqwm-3gq8>`_
+  Thanks to `Finder16 <https://github.com/Finder16>`_ for reporting this issue.
+- Fixed a denial-of-service vulnerability involving quadratic computation when parsing repeated HTTP
+  headers.
+  `CVE-2025-67725 <https://github.com/tornadoweb/tornado/security/advisories/GHSA-c98p-7wgm-6p64>`_.
+  Thanks to `Finder16 <https://github.com/Finder16>`_ for reporting this issue.
+- Fixed a header injection and XSS vulnerability involving the ``reason`` argument to
+  `.RequestHandler.set_status` and `tornado.web.HTTPError`.
+  `CVE-2025-67724 <https://github.com/tornadoweb/tornado/security/advisories/GHSA-pr2v-jx2c-wg9f>`_.
+  Thanks to `Finder16 <https://github.com/Finder16>`_ and
+  `Cheshire1225 <https://github.com/Cheshire1225>`_ for reporting this issue.
+
+Demo changes
+~~~~~~~~~~~~
+- Several demo applications bundled with the Tornado repo (``blog``, ``chat``, ``facebook``) had an
+  open redirect vulnerability which has been fixed. This is not covered by a CVE or security
+  advisory since the demo applications are not included as a part of the Tornado package when
+  installed, but developers who have copied code from these demos may which to review their own
+  applications for open redirects. Thanks to `J1vvoo <https://github.com/J1vvoo>`_ for reporting this
+  issue.
+- The ``s3server`` demo application contained some path traversal vulnerabilities. Since this demo
+  application was not demonstrating any interesting aspects of Tornado, it has been deleted rather
+  than being fixed. Thanks to `J1vvoo <https://github.com/J1vvoo>`_ for reporting this issue.
diff --git a/docs/releases/v6.5.4.rst b/docs/releases/v6.5.4.rst
new file mode 100644
index 0000000..7f3819f
--- /dev/null
+++ b/docs/releases/v6.5.4.rst
@@ -0,0 +1,13 @@
+What's new in Tornado 6.5.4
+===========================
+
+Dec 15, 2025
+------------
+
+Bug fixes
+~~~~~~~~~
+
+- The ``in`` operator for ``HTTPHeaders`` was incorrectly case-sensitive, causing
+  lookups to fail for headers with different casing than the original header name.
+  This was a regression in version 6.5.3 and has been fixed to restore the intended
+  case-insensitive behavior from version 6.5.2 and earlier.
diff --git a/docs/releases/v6.5.5.rst b/docs/releases/v6.5.5.rst
new file mode 100644
index 0000000..87cc9ff
--- /dev/null
+++ b/docs/releases/v6.5.5.rst
@@ -0,0 +1,19 @@
+What's new in Tornado 6.5.5
+===========================
+
+Mar 10, 2026
+------------
+
+Security fixes
+~~~~~~~~~~~~~~
+
+- ``multipart/form-data`` requests are now limited to 100 parts by default, to prevent a
+  denial-of-service attack via very large requests with many parts. This limit is configurable
+  via `tornado.httputil.ParseMultipartConfig`. Multipart parsing can also be disabled completely
+  if not required for the application. Thanks to [0x-Apollyon](https://github.com/0x-Apollyon) and
+  [bekkaze](https://github.com/bekkaze) for reporting this issue.
+- The ``domain``, ``path``, and ``samesite`` arguments to `.RequestHandler.set_cookie` are now
+  validated for illegal characters, which could be abused to inject other attributes on the cookie.
+  Thanks to Dhiral Vyas (Praetorian) for reporting this issue.
+- Carriage return characters are no longer accepted in ``multipart/form-data`` headers. Thanks to 
+  [sergeykochanov](https://github.com/sergeykochanov) for reporting this issue.
\ No newline at end of file
diff --git a/docs/testing.rst b/docs/testing.rst
index d23ebd0..87fd205 100644
--- a/docs/testing.rst
+++ b/docs/testing.rst
@@ -34,3 +34,5 @@
    .. autofunction:: bind_unused_port
 
    .. autofunction:: get_async_test_timeout
+
+   .. autofunction:: setup_with_context_manager
diff --git a/docs/twisted.rst b/docs/twisted.rst
index 5d8fe8f..9304032 100644
--- a/docs/twisted.rst
+++ b/docs/twisted.rst
@@ -32,29 +32,3 @@ no effect on native coroutines using ``async def``).
        implementation was removed in Tornado 6.0.0, this function was
        removed as well. It was restored in Tornado 6.0.3 using the
        ``asyncio`` reactor instead.
-
-Twisted DNS resolver
---------------------
-
-.. class:: TwistedResolver
-
-    Twisted-based asynchronous resolver.
-
-    This is a non-blocking and non-threaded resolver.  It is
-    recommended only when threads cannot be used, since it has
-    limitations compared to the standard ``getaddrinfo``-based
-    `~tornado.netutil.Resolver` and
-    `~tornado.netutil.DefaultExecutorResolver`.  Specifically, it returns at
-    most one result, and arguments other than ``host`` and ``family``
-    are ignored.  It may fail to resolve when ``family`` is not
-    ``socket.AF_UNSPEC``.
-
-    Requires Twisted 12.1 or newer.
-
-    .. versionchanged:: 5.0
-       The ``io_loop`` argument (deprecated since version 4.1) has been removed.
-
-    .. deprecated:: 6.2
-       This class is deprecated and will be removed in Tornado 7.0. Use the default
-       thread-based resolver instead.
-
diff --git a/docs/web.rst b/docs/web.rst
index 956336b..00066cc 100644
--- a/docs/web.rst
+++ b/docs/web.rst
@@ -224,14 +224,22 @@
            of `UIModule` or UI methods to be made available to templates.
            May be set to a module, dictionary, or a list of modules
            and/or dicts.  See :ref:`ui-modules` for more details.
-         * ``websocket_ping_interval``: If set to a number, all websockets will
-           be pinged every n seconds. This can help keep the connection alive
-           through certain proxy servers which close idle connections, and it
-           can detect if the websocket has failed without being properly closed.
-         * ``websocket_ping_timeout``: If the ping interval is set, and the
-           server doesn't receive a 'pong' in this many seconds, it will close
-           the websocket. The default is three times the ping interval, with a
-           minimum of 30 seconds. Ignored if the ping interval is not set.
+         * ``websocket_ping_interval``: If the ping interval has a non-zero
+           value, a ping will be sent periodically every
+           ``websocket_ping_interval`` seconds, and the connection will be
+           closed if a response is not received before the
+           ``websocket_ping_timeout``.
+           This can help keep the connection alive through certain proxy
+           servers which close idle connections, and it can detect if the
+           websocket has failed without being properly closed.
+         * ``websocket_ping_timeout``: For use with ``websocket_ping_interval``,
+           if the server does not receive a pong within this many seconds, it
+           will close the websocket_ping_timeout.
+           The default timeout is equal to the ping interval. The ping timeout
+           will be turned off if the ping interval is not set or if the
+           timeout is set to ``0``.
+           This can help to detect disconnected clients to avoid keeping
+           inactive connections open.
 
          Authentication and security settings:
 
diff --git a/maint/scripts/test_resolvers.py b/maint/scripts/test_resolvers.py
index aea3a61..eb382b7 100755
--- a/maint/scripts/test_resolvers.py
+++ b/maint/scripts/test_resolvers.py
@@ -1,4 +1,13 @@
 #!/usr/bin/env python
+"""Basic test for Tornado resolvers.
+
+Queries real domain names and prints the results from each resolver.
+Requires a working internet connection, which is why it's not in a
+unit test.
+
+Will be removed in Tornado 7.0 when the pluggable resolver system is
+removed.
+"""
 import pprint
 import socket
 
@@ -7,18 +16,14 @@
 from tornado.netutil import Resolver, ThreadedResolver, DefaultExecutorResolver
 from tornado.options import parse_command_line, define, options
 
-try:
-    import twisted
-except ImportError:
-    twisted = None
-
 try:
     import pycares
 except ImportError:
     pycares = None
 
-define('family', default='unspec',
-       help='Address family to query: unspec, inet, or inet6')
+define(
+    "family", default="unspec", help="Address family to query: unspec, inet, or inet6"
+)
 
 
 @gen.coroutine
@@ -26,33 +31,34 @@ def main():
     args = parse_command_line()
 
     if not args:
-        args = ['localhost', 'www.google.com',
-                'www.facebook.com', 'www.dropbox.com']
+        args = ["localhost", "www.google.com", "www.facebook.com", "www.dropbox.com"]
 
     resolvers = [Resolver(), ThreadedResolver(), DefaultExecutorResolver()]
 
-    if twisted is not None:
-        from tornado.platform.twisted import TwistedResolver
-        resolvers.append(TwistedResolver())
-
     if pycares is not None:
         from tornado.platform.caresresolver import CaresResolver
+
         resolvers.append(CaresResolver())
 
     family = {
-        'unspec': socket.AF_UNSPEC,
-        'inet': socket.AF_INET,
-        'inet6': socket.AF_INET6,
+        "unspec": socket.AF_UNSPEC,
+        "inet": socket.AF_INET,
+        "inet6": socket.AF_INET6,
     }[options.family]
 
     for host in args:
-        print('Resolving %s' % host)
+        print("Resolving %s" % host)
         for resolver in resolvers:
-            addrinfo = yield resolver.resolve(host, 80, family)
-            print('%s: %s' % (resolver.__class__.__name__,
-                              pprint.pformat(addrinfo)))
+            try:
+                addrinfo = yield resolver.resolve(host, 80, family)
+            except Exception as e:
+                print("%s: %s: %s" % (resolver.__class__.__name__, type(e), e))
+            else:
+                print(
+                    "%s: %s" % (resolver.__class__.__name__, pprint.pformat(addrinfo))
+                )
         print()
 
 
-if __name__ == '__main__':
+if __name__ == "__main__":
     IOLoop.instance().run_sync(main)
diff --git a/pyproject.toml b/pyproject.toml
index fa75e06..a4a7999 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -2,29 +2,30 @@
 requires = ["setuptools", "wheel"]
 build-backend = "setuptools.build_meta"
 
+[tool.black]
+target-version = ['py39', 'py310', 'py311', 'py312', 'py313']
+
 [tool.cibuildwheel]
-build = "cp3[89]* cp310* cp311* cp312*"
+build = "cp39* cp310* cp311* cp312* cp313*"
 test-command = "python -m tornado.test"
 
 [tool.cibuildwheel.macos]
 archs = "x86_64 universal2"
-# The arm portion of a universal wheel is a cross-compile and cannot
-# be tested on an x86 host. This must be configured explicitly to silence
-# a warning.
-test-skip = "*_universal2:arm64"
 
 [tool.cibuildwheel.windows]
+archs = "AMD64 x86 ARM64"
 # TODO: figure out what's going on with these occasional log messages.
 test-command = "python -m tornado.test --fail-if-logs=false"
+# Arm builds are cross-compiled and cannot be tested on the x86 host
+test-skip = "*-win_arm64"
 
 [tool.cibuildwheel.linux]
-# Build wheels for the native platform (i.e. x86) as well as an emulated
-# build for aarch64.
-archs = "auto aarch64"
-
-[[tool.cibuildwheel.overrides]]
-# The emulated arm build is quite slow, so only run a portion of the test
-# suite. websocket_test is the most platform-dependent part of the tests
-# because it uses the C speedups module.
-select = "*linux_aarch64"
-test-command = "python -m tornado.test tornado.test.websocket_test"
+# This configuration has a bug which appears unrelated to Tornado:
+# https://github.com/python/cpython/issues/130522
+# If the underlying bug is not fixed by the time 3.14 is released,
+# we may need to skip that in musllinux_i686 as well.
+#
+# Note that because we use the stable ABI, the wheels built for
+# cp39-musllinux_i686 will still be available for users of 3.13, this just
+# means we won't be testing them in this configuration.
+test-skip = "cp313-musllinux_i686"
diff --git a/requirements.in b/requirements.in
index 997f895..417afeb 100644
--- a/requirements.in
+++ b/requirements.in
@@ -2,8 +2,7 @@ black
 flake8
 mypy>=0.941
 pip-tools
-sphinx<6
-sphinxcontrib-asyncio
+sphinx
 sphinx_rtd_theme
 types-pycurl
 tox
diff --git a/requirements.txt b/requirements.txt
index 9118bdf..b32a556 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -4,122 +4,122 @@
 #
 #    pip-compile
 #
-alabaster==0.7.13
+alabaster==0.7.16
     # via sphinx
-babel==2.11.0
+babel==2.15.0
     # via sphinx
 black==24.4.2
     # via -r requirements.in
-build==0.10.0
+build==1.2.1
     # via pip-tools
-cachetools==5.3.1
+cachetools==5.5.2
     # via tox
-certifi==2023.7.22
+certifi==2024.7.4
     # via requests
-chardet==5.1.0
+chardet==5.2.0
     # via tox
-charset-normalizer==3.0.1
+charset-normalizer==3.3.2
     # via requests
-click==8.1.3
+click==8.1.7
     # via
     #   black
     #   pip-tools
 colorama==0.4.6
     # via tox
-distlib==0.3.6
+distlib==0.3.8
     # via virtualenv
-docutils==0.17.1
+docutils==0.20.1
     # via
     #   sphinx
     #   sphinx-rtd-theme
-filelock==3.12.0
+filelock==3.18.0
     # via
     #   tox
     #   virtualenv
-flake8==6.0.0
+flake8==7.0.0
     # via -r requirements.in
 idna==3.7
     # via requests
 imagesize==1.4.1
     # via sphinx
-jinja2==3.1.4
+jinja2==3.1.6
     # via sphinx
-markupsafe==2.1.2
+markupsafe==2.1.5
     # via jinja2
 mccabe==0.7.0
     # via flake8
-mypy==1.0.1
+mypy==1.10.0
     # via -r requirements.in
-mypy-extensions==0.4.3
+mypy-extensions==1.0.0
     # via
     #   black
     #   mypy
-packaging==23.1
+packaging==25.0
     # via
     #   black
     #   build
     #   pyproject-api
     #   sphinx
     #   tox
-pathspec==0.10.3
+pathspec==0.12.1
     # via black
-pip-tools==7.1.0
+pip-tools==7.4.1
     # via -r requirements.in
-platformdirs==3.5.1
+platformdirs==4.3.8
     # via
     #   black
     #   tox
     #   virtualenv
-pluggy==1.0.0
+pluggy==1.5.0
     # via tox
-pycodestyle==2.10.0
+pycodestyle==2.11.1
     # via flake8
-pyflakes==3.0.1
+pyflakes==3.2.0
     # via flake8
-pygments==2.15.0
+pygments==2.18.0
     # via sphinx
-pyproject-api==1.5.1
+pyproject-api==1.9.1
     # via tox
-pyproject-hooks==1.0.0
-    # via build
-pytz==2022.7.1
-    # via babel
-requests==2.32.2
+pyproject-hooks==1.1.0
+    # via
+    #   build
+    #   pip-tools
+requests==2.32.3
     # via sphinx
 snowballstemmer==2.2.0
     # via sphinx
-sphinx==5.3.0
+sphinx==7.3.7
     # via
     #   -r requirements.in
     #   sphinx-rtd-theme
-    #   sphinxcontrib-asyncio
-sphinx-rtd-theme==1.1.1
+    #   sphinxcontrib-jquery
+sphinx-rtd-theme==2.0.0
     # via -r requirements.in
-sphinxcontrib-applehelp==1.0.3
+sphinxcontrib-applehelp==1.0.8
     # via sphinx
-sphinxcontrib-asyncio==0.3.0
-    # via -r requirements.in
-sphinxcontrib-devhelp==1.0.2
+sphinxcontrib-devhelp==1.0.6
     # via sphinx
-sphinxcontrib-htmlhelp==2.0.0
+sphinxcontrib-htmlhelp==2.0.5
     # via sphinx
+sphinxcontrib-jquery==4.1
+    # via sphinx-rtd-theme
 sphinxcontrib-jsmath==1.0.1
     # via sphinx
-sphinxcontrib-qthelp==1.0.3
+sphinxcontrib-qthelp==1.0.7
     # via sphinx
-sphinxcontrib-serializinghtml==1.1.5
+sphinxcontrib-serializinghtml==1.1.10
     # via sphinx
-tox==4.6.0
+tox==4.26.0
     # via -r requirements.in
-types-pycurl==7.45.2.0
+types-pycurl==7.45.3.20240421
     # via -r requirements.in
-typing-extensions==4.4.0
+typing-extensions==4.12.2
     # via mypy
-urllib3==1.26.18
+urllib3==2.2.2
     # via requests
-virtualenv==20.23.0
+virtualenv==20.31.2
     # via tox
-wheel==0.38.4
+wheel==0.43.0
     # via pip-tools
 
 # The following packages are considered to be unsafe in a requirements file:
diff --git a/setup.cfg b/setup.cfg
index 53b16df..f1d2b31 100644
--- a/setup.cfg
+++ b/setup.cfg
@@ -2,7 +2,7 @@
 license_file = LICENSE
 
 [mypy]
-python_version = 3.8
+python_version = 3.9
 no_implicit_optional = True
 
 [mypy-tornado.*,tornado.platform.*]
diff --git a/setup.py b/setup.py
index 8025ad9..e2a6991 100644
--- a/setup.py
+++ b/setup.py
@@ -18,11 +18,7 @@
 import os
 import platform
 import setuptools
-
-try:
-    import wheel.bdist_wheel
-except ImportError:
-    wheel = None
+import sysconfig
 
 
 kwargs = {}
@@ -40,6 +36,9 @@
     platform.python_implementation() == "CPython"
     and os.environ.get("TORNADO_EXTENSION") != "0"
 ):
+
+    can_use_limited_api = not sysconfig.get_config_var("Py_GIL_DISABLED")
+
     # This extension builds and works on pypy as well, although pypy's jit
     # produces equivalent performance.
     kwargs["ext_modules"] = [
@@ -51,28 +50,19 @@
             optional=os.environ.get("TORNADO_EXTENSION") != "1",
             # Use the stable ABI so our wheels are compatible across python
             # versions.
-            py_limited_api=True,
-            define_macros=[("Py_LIMITED_API", "0x03080000")],
+            py_limited_api=can_use_limited_api,
+            define_macros=[("Py_LIMITED_API", "0x03090000")] if can_use_limited_api else [],
         )
     ]
 
-if wheel is not None:
-    # From https://github.com/joerick/python-abi3-package-sample/blob/main/setup.py
-    class bdist_wheel_abi3(wheel.bdist_wheel.bdist_wheel):
-        def get_tag(self):
-            python, abi, plat = super().get_tag()
-
-            if python.startswith("cp"):
-                return "cp38", "abi3", plat
-            return python, abi, plat
-
-    kwargs["cmdclass"] = {"bdist_wheel": bdist_wheel_abi3}
+    if can_use_limited_api:
+        kwargs["options"] = {"bdist_wheel": {"py_limited_api": "cp39"}}
 
 
 setuptools.setup(
     name="tornado",
     version=version,
-    python_requires=">= 3.8",
+    python_requires=">= 3.9",
     packages=["tornado", "tornado.test", "tornado.platform"],
     package_data={
         # data files need to be listed both here (which determines what gets
@@ -112,12 +102,13 @@ def get_tag(self):
     classifiers=[
         "License :: OSI Approved :: Apache Software License",
         "Programming Language :: Python :: 3",
-        "Programming Language :: Python :: 3.8",
         "Programming Language :: Python :: 3.9",
         "Programming Language :: Python :: 3.10",
         "Programming Language :: Python :: 3.11",
+        "Programming Language :: Python :: 3.12",
+        "Programming Language :: Python :: 3.13",
         "Programming Language :: Python :: Implementation :: CPython",
         "Programming Language :: Python :: Implementation :: PyPy",
     ],
-    **kwargs
+    **kwargs,
 )
diff --git a/tornado/__init__.py b/tornado/__init__.py
index 91e4cde..b5911fe 100644
--- a/tornado/__init__.py
+++ b/tornado/__init__.py
@@ -22,8 +22,8 @@
 # is zero for an official release, positive for a development branch,
 # or negative for a release candidate or beta (after the base version
 # number has been incremented)
-version = "6.4.2"
-version_info = (6, 4, 2, 0)
+version = "6.5.5"
+version_info = (6, 5, 5, 0)
 
 import importlib
 import typing
diff --git a/tornado/auth.py b/tornado/auth.py
index d1edcc6..64428c5 100644
--- a/tornado/auth.py
+++ b/tornado/auth.py
@@ -67,9 +67,6 @@ async def get(self):
                         response_type='code',
                         extra_params={'approval_prompt': 'auto'})
 
-.. testoutput::
-   :hide:
-
 """
 
 import base64
@@ -94,7 +91,7 @@ class AuthError(Exception):
     pass
 
 
-class OpenIdMixin(object):
+class OpenIdMixin:
     """Abstract implementation of OpenID and Attribute Exchange.
 
     Class attributes:
@@ -150,9 +147,9 @@ async def get_authenticated_user(
         """
         handler = cast(RequestHandler, self)
         # Verify the OpenID response via direct request to the OP
-        args = dict(
-            (k, v[-1]) for k, v in handler.request.arguments.items()
-        )  # type: Dict[str, Union[str, bytes]]
+        args = {
+            k: v[-1] for k, v in handler.request.arguments.items()
+        }  # type: Dict[str, Union[str, bytes]]
         args["openid.mode"] = "check_authentication"
         url = self._OPENID_ENDPOINT  # type: ignore
         if http_client is None:
@@ -188,7 +185,7 @@ def _openid_args(
             ax_attrs = set(ax_attrs)
             required = []  # type: List[str]
             if "name" in ax_attrs:
-                ax_attrs -= set(["name", "firstname", "fullname", "lastname"])
+                ax_attrs -= {"name", "firstname", "fullname", "lastname"}
                 required += ["firstname", "fullname", "lastname"]
                 args.update(
                     {
@@ -287,7 +284,7 @@ def get_auth_http_client(self) -> httpclient.AsyncHTTPClient:
         return httpclient.AsyncHTTPClient()
 
 
-class OAuthMixin(object):
+class OAuthMixin:
     """Abstract implementation of OAuth 1.0 and 1.0a.
 
     See `TwitterMixin` below for an example implementation.
@@ -378,9 +375,9 @@ async def get_authenticated_user(
         if not request_cookie:
             raise AuthError("Missing OAuth request token cookie")
         handler.clear_cookie("_oauth_request_token")
-        cookie_key, cookie_secret = [
+        cookie_key, cookie_secret = (
             base64.b64decode(escape.utf8(i)) for i in request_cookie.split("|")
-        ]
+        )
         if cookie_key != request_key:
             raise AuthError("Request token does not match cookie")
         token = dict(
@@ -555,7 +552,7 @@ def get_auth_http_client(self) -> httpclient.AsyncHTTPClient:
         return httpclient.AsyncHTTPClient()
 
 
-class OAuth2Mixin(object):
+class OAuth2Mixin:
     """Abstract implementation of OAuth 2.0.
 
     See `FacebookGraphMixin` or `GoogleOAuth2Mixin` below for example
@@ -635,7 +632,7 @@ async def oauth2_request(
         url: str,
         access_token: Optional[str] = None,
         post_args: Optional[Dict[str, Any]] = None,
-        **args: Any
+        **args: Any,
     ) -> Any:
         """Fetches the given URL auth an OAuth2 access token.
 
@@ -661,9 +658,6 @@ async def get(self):
                         return
                     self.finish("Posted a message!")
 
-        .. testoutput::
-           :hide:
-
         .. versionadded:: 4.3
 
         .. versionchanged::: 6.0
@@ -721,9 +715,6 @@ async def get(self):
                 else:
                     await self.authorize_redirect()
 
-    .. testoutput::
-       :hide:
-
     The user object returned by `~OAuthMixin.get_authenticated_user`
     includes the attributes ``username``, ``name``, ``access_token``,
     and all of the custom Twitter user attributes described at
@@ -770,7 +761,7 @@ async def twitter_request(
         path: str,
         access_token: Dict[str, Any],
         post_args: Optional[Dict[str, Any]] = None,
-        **args: Any
+        **args: Any,
     ) -> Any:
         """Fetches the given API path, e.g., ``statuses/user_timeline/btaylor``
 
@@ -805,9 +796,6 @@ async def get(self):
                         return
                     self.finish("Posted a message!")
 
-        .. testoutput::
-           :hide:
-
         .. versionchanged:: 6.0
 
            The ``callback`` argument was removed. Use the returned
@@ -959,9 +947,6 @@ async def get(self):
                                 response_type='code',
                                 extra_params={'approval_prompt': 'auto'})
 
-        .. testoutput::
-           :hide:
-
         .. versionchanged:: 6.0
 
            The ``callback`` argument was removed. Use the returned awaitable object instead.
@@ -1034,9 +1019,6 @@ async def get(self):
                         client_id=self.settings["facebook_api_key"],
                         extra_params={"scope": "user_posts"})
 
-        .. testoutput::
-           :hide:
-
         This method returns a dictionary which may contain the following fields:
 
         * ``access_token``, a string which may be passed to `facebook_request`
@@ -1065,9 +1047,7 @@ async def get(self):
             "client_secret": client_secret,
         }
 
-        fields = set(
-            ["id", "name", "first_name", "last_name", "locale", "picture", "link"]
-        )
+        fields = {"id", "name", "first_name", "last_name", "locale", "picture", "link"}
         if extra_fields:
             fields.update(extra_fields)
 
@@ -1116,7 +1096,7 @@ async def facebook_request(
         path: str,
         access_token: Optional[str] = None,
         post_args: Optional[Dict[str, Any]] = None,
-        **args: Any
+        **args: Any,
     ) -> Any:
         """Fetches the given relative API path, e.g., "/btaylor/picture"
 
@@ -1151,9 +1131,6 @@ async def get(self):
                         return
                     self.finish("Posted a message!")
 
-        .. testoutput::
-           :hide:
-
         The given path is relative to ``self._FACEBOOK_BASE_URL``,
         by default "https://graph.facebook.com".
 
@@ -1193,9 +1170,7 @@ def _oauth_signature(
     base_elems.append(method.upper())
     base_elems.append(normalized_url)
     base_elems.append(
-        "&".join(
-            "%s=%s" % (k, _oauth_escape(str(v))) for k, v in sorted(parameters.items())
-        )
+        "&".join(f"{k}={_oauth_escape(str(v))}" for k, v in sorted(parameters.items()))
     )
     base_string = "&".join(_oauth_escape(e) for e in base_elems)
 
@@ -1226,9 +1201,7 @@ def _oauth10a_signature(
     base_elems.append(method.upper())
     base_elems.append(normalized_url)
     base_elems.append(
-        "&".join(
-            "%s=%s" % (k, _oauth_escape(str(v))) for k, v in sorted(parameters.items())
-        )
+        "&".join(f"{k}={_oauth_escape(str(v))}" for k, v in sorted(parameters.items()))
     )
 
     base_string = "&".join(_oauth_escape(e) for e in base_elems)
diff --git a/tornado/concurrent.py b/tornado/concurrent.py
index 5047c53..e98093f 100644
--- a/tornado/concurrent.py
+++ b/tornado/concurrent.py
@@ -145,7 +145,10 @@ def wrapper(self: Any, *args: Any, **kwargs: Any) -> Future:
 _NO_RESULT = object()
 
 
-def chain_future(a: "Future[_T]", b: "Future[_T]") -> None:
+def chain_future(
+    a: Union["Future[_T]", "futures.Future[_T]"],
+    b: Union["Future[_T]", "futures.Future[_T]"],
+) -> None:
     """Chain two futures together so that when one completes, so does the other.
 
     The result (success or failure) of ``a`` will be copied to ``b``, unless
diff --git a/tornado/curl_httpclient.py b/tornado/curl_httpclient.py
index 397c3a9..dde7003 100644
--- a/tornado/curl_httpclient.py
+++ b/tornado/curl_httpclient.py
@@ -448,7 +448,7 @@ def write_function(b: Union[bytes, bytearray]) -> int:
             "PUT": pycurl.UPLOAD,
             "HEAD": pycurl.NOBODY,
         }
-        custom_methods = set(["DELETE", "OPTIONS", "PATCH"])
+        custom_methods = {"DELETE", "OPTIONS", "PATCH"}
         for o in curl_options.values():
             curl.setopt(o, False)
         if request.method in curl_options:
@@ -556,7 +556,9 @@ def _curl_header_callback(
         if header_line.startswith("HTTP/"):
             headers.clear()
             try:
-                (__, __, reason) = httputil.parse_response_start_line(header_line)
+                (_version, _code, reason) = httputil.parse_response_start_line(
+                    header_line
+                )
                 header_line = "X-Http-Reason: %s" % reason
             except httputil.HTTPInputError:
                 return
diff --git a/tornado/escape.py b/tornado/escape.py
index 84abfca..8515bf5 100644
--- a/tornado/escape.py
+++ b/tornado/escape.py
@@ -271,9 +271,7 @@ def recursive_unicode(obj: Any) -> Any:
     Supports lists, tuples, and dictionaries.
     """
     if isinstance(obj, dict):
-        return dict(
-            (recursive_unicode(k), recursive_unicode(v)) for (k, v) in obj.items()
-        )
+        return {recursive_unicode(k): recursive_unicode(v) for (k, v) in obj.items()}
     elif isinstance(obj, list):
         return list(recursive_unicode(i) for i in obj)
     elif isinstance(obj, tuple):
@@ -394,7 +392,7 @@ def make_link(m: typing.Match) -> str:
                     # have a status bar, such as Safari by default)
                     params += ' title="%s"' % href
 
-        return '<a href="%s"%s>%s</a>' % (href, params, url)
+        return f'<a href="{href}"{params}>{url}</a>'
 
     # First HTML-escape so that our strings are all safe.
     # The regex is modified to avoid character entites other than &amp; so
diff --git a/tornado/gen.py b/tornado/gen.py
index 0e3c7a6..01e7f8a 100644
--- a/tornado/gen.py
+++ b/tornado/gen.py
@@ -29,9 +29,6 @@ def get(self):
             do_something_with_response(response)
             self.render("template.html")
 
-.. testoutput::
-   :hide:
-
 Asynchronous functions in Tornado return an ``Awaitable`` or `.Future`;
 yielding this object returns its result.
 
@@ -51,9 +48,6 @@ def get(self):
         response3 = response_dict['response3']
         response4 = response_dict['response4']
 
-.. testoutput::
-   :hide:
-
 If ``tornado.platform.twisted`` is imported, it is also possible to
 yield Twisted's ``Deferred`` objects. See the `convert_yielded`
 function to extend this mechanism.
@@ -97,10 +91,22 @@ def get(self):
     contextvars = None  # type: ignore
 
 import typing
-from typing import Union, Any, Callable, List, Type, Tuple, Awaitable, Dict, overload
+from typing import (
+    Mapping,
+    Union,
+    Any,
+    Callable,
+    List,
+    Type,
+    Tuple,
+    Awaitable,
+    Dict,
+    Sequence,
+    overload,
+)
 
 if typing.TYPE_CHECKING:
-    from typing import Sequence, Deque, Optional, Set, Iterable  # noqa: F401
+    from typing import Deque, Optional, Set, Iterable  # noqa: F401
 
 _T = typing.TypeVar("_T")
 
@@ -281,6 +287,10 @@ def is_coroutine_function(func: Any) -> bool:
 class Return(Exception):
     """Special exception to return a value from a `coroutine`.
 
+    This exception exists for compatibility with older versions of
+    Python (before 3.3). In newer code use the ``return`` statement
+    instead.
+
     If this exception is raised, its value argument is used as the
     result of the coroutine::
 
@@ -289,14 +299,7 @@ def fetch_json(url):
             response = yield AsyncHTTPClient().fetch(url)
             raise gen.Return(json_decode(response.body))
 
-    In Python 3.3, this exception is no longer necessary: the ``return``
-    statement can be used directly to return a value (previously
-    ``yield`` and ``return`` with a value could not be combined in the
-    same function).
-
-    By analogy with the return statement, the value argument is optional,
-    but it is never necessary to ``raise gen.Return()``.  The ``return``
-    statement can be used with no arguments instead.
+    By analogy with the return statement, the value argument is optional.
     """
 
     def __init__(self, value: Any = None) -> None:
@@ -306,7 +309,7 @@ def __init__(self, value: Any = None) -> None:
         self.args = (value,)
 
 
-class WaitIterator(object):
+class WaitIterator:
     """Provides an iterator to yield the results of awaitables as they finish.
 
     Yielding a set of awaitables like this:
@@ -343,7 +346,7 @@ class WaitIterator(object):
     arguments were used in the construction of the `WaitIterator`,
     ``current_index`` will use the corresponding keyword).
 
-    On Python 3.5, `WaitIterator` implements the async iterator
+    `WaitIterator` implements the async iterator
     protocol, so it can be used with the ``async for`` statement (note
     that in this version the entire iteration is aborted if any value
     raises an exception, while the previous example can continue past
@@ -368,10 +371,10 @@ def __init__(self, *args: Future, **kwargs: Future) -> None:
             raise ValueError("You must provide args or kwargs, not both")
 
         if kwargs:
-            self._unfinished = dict((f, k) for (k, f) in kwargs.items())
+            self._unfinished = {f: k for (k, f) in kwargs.items()}
             futures = list(kwargs.values())  # type: Sequence[Future]
         else:
-            self._unfinished = dict((f, i) for (i, f) in enumerate(args))
+            self._unfinished = {f: i for (i, f) in enumerate(args)}
             futures = args
 
         self._finished = collections.deque()  # type: Deque[Future]
@@ -434,8 +437,22 @@ def __anext__(self) -> Future:
         return self.next()
 
 
+@overload
+def multi(
+    children: Sequence[_Yieldable],
+    quiet_exceptions: Union[Type[Exception], Tuple[Type[Exception], ...]] = (),
+) -> Future[List]: ...
+
+
+@overload
+def multi(
+    children: Mapping[Any, _Yieldable],
+    quiet_exceptions: Union[Type[Exception], Tuple[Type[Exception], ...]] = (),
+) -> Future[Dict]: ...
+
+
 def multi(
-    children: Union[List[_Yieldable], Dict[Any, _Yieldable]],
+    children: Union[Sequence[_Yieldable], Mapping[Any, _Yieldable]],
     quiet_exceptions: "Union[Type[Exception], Tuple[Type[Exception], ...]]" = (),
 ) -> "Union[Future[List], Future[Dict]]":
     """Runs multiple asynchronous operations in parallel.
@@ -489,7 +506,7 @@ def multi(
 
 
 def multi_future(
-    children: Union[List[_Yieldable], Dict[Any, _Yieldable]],
+    children: Union[Sequence[_Yieldable], Mapping[Any, _Yieldable]],
     quiet_exceptions: "Union[Type[Exception], Tuple[Type[Exception], ...]]" = (),
 ) -> "Union[Future[List], Future[Dict]]":
     """Wait for multiple asynchronous futures in parallel.
@@ -674,7 +691,7 @@ def sleep(duration: float) -> "Future[None]":
     return f
 
 
-class _NullFuture(object):
+class _NullFuture:
     """_NullFuture resembles a Future that finished with a result of None.
 
     It's not actually a `Future` to avoid depending on a particular event loop.
@@ -719,7 +736,7 @@ def done(self) -> bool:
 """
 
 
-class Runner(object):
+class Runner:
     """Internal implementation of `tornado.gen.coroutine`.
 
     Maintains information about pending callbacks and their results.
@@ -880,7 +897,7 @@ def _(asyncio_future):
     elif isawaitable(yielded):
         return _wrap_awaitable(yielded)  # type: ignore
     else:
-        raise BadYieldError("yielded unknown object %r" % (yielded,))
+        raise BadYieldError(f"yielded unknown object {yielded!r}")
 
 
 convert_yielded = singledispatch(convert_yielded)
diff --git a/tornado/http1connection.py b/tornado/http1connection.py
index 1a23f5c..5b0dd1b 100644
--- a/tornado/http1connection.py
+++ b/tornado/http1connection.py
@@ -46,7 +46,7 @@ def __init__(self) -> None:
         pass
 
 
-class _ExceptionLoggingContext(object):
+class _ExceptionLoggingContext:
     """Used with the ``with`` statement when calling delegate methods to
     log any exceptions with the given logger.  Any exceptions caught are
     converted to _QuietException
@@ -66,11 +66,14 @@ def __exit__(
     ) -> None:
         if value is not None:
             assert typ is not None
+            # Let HTTPInputError pass through to higher-level handler
+            if isinstance(value, httputil.HTTPInputError):
+                return None
             self.logger.error("Uncaught exception", exc_info=(typ, value, tb))
             raise _QuietException
 
 
-class HTTP1ConnectionParameters(object):
+class HTTP1ConnectionParameters:
     """Parameters for `.HTTP1Connection` and `.HTTP1ServerConnection`."""
 
     def __init__(
@@ -389,7 +392,7 @@ def write_headers(
         if self.is_client:
             assert isinstance(start_line, httputil.RequestStartLine)
             self._request_start_line = start_line
-            lines.append(utf8("%s %s HTTP/1.1" % (start_line[0], start_line[1])))
+            lines.append(utf8(f"{start_line[0]} {start_line[1]} HTTP/1.1"))
             # Client requests with a non-empty body must have either a
             # Content-Length or a Transfer-Encoding. If Content-Length is not
             # present we'll add our Transfer-Encoding below.
@@ -761,7 +764,7 @@ def on_connection_close(self) -> None:
         return self._delegate.on_connection_close()
 
 
-class HTTP1ServerConnection(object):
+class HTTP1ServerConnection:
     """An HTTP/1.x server."""
 
     def __init__(
diff --git a/tornado/httpclient.py b/tornado/httpclient.py
index 3011c37..3a45ffd 100644
--- a/tornado/httpclient.py
+++ b/tornado/httpclient.py
@@ -56,7 +56,7 @@
 from typing import Type, Any, Union, Dict, Callable, Optional, cast
 
 
-class HTTPClient(object):
+class HTTPClient:
     """A blocking HTTP client.
 
     This interface is provided to make it easier to share code between
@@ -89,7 +89,7 @@ class HTTPClient(object):
     def __init__(
         self,
         async_client_class: "Optional[Type[AsyncHTTPClient]]" = None,
-        **kwargs: Any
+        **kwargs: Any,
     ) -> None:
         # Initialize self._closed at the beginning of the constructor
         # so that an exception raised here doesn't lead to confusing
@@ -203,7 +203,7 @@ def __new__(cls, force_instance: bool = False, **kwargs: Any) -> "AsyncHTTPClien
             instance_cache = cls._async_clients()
         if instance_cache is not None and io_loop in instance_cache:
             return instance_cache[io_loop]
-        instance = super(AsyncHTTPClient, cls).__new__(cls, **kwargs)  # type: ignore
+        instance = super().__new__(cls, **kwargs)  # type: ignore
         # Make sure the instance knows which cache to remove itself from.
         # It can't simply call _async_clients() because we may be in
         # __new__(AsyncHTTPClient) but instance.__class__ may be
@@ -250,7 +250,7 @@ def fetch(
         self,
         request: Union[str, "HTTPRequest"],
         raise_error: bool = True,
-        **kwargs: Any
+        **kwargs: Any,
     ) -> "Future[HTTPResponse]":
         """Executes a request, asynchronously returning an `HTTPResponse`.
 
@@ -333,10 +333,10 @@ def configure(
 
            AsyncHTTPClient.configure("tornado.curl_httpclient.CurlAsyncHTTPClient")
         """
-        super(AsyncHTTPClient, cls).configure(impl, **kwargs)
+        super().configure(impl, **kwargs)
 
 
-class HTTPRequest(object):
+class HTTPRequest:
     """HTTP client request object."""
 
     _headers = None  # type: Union[Dict[str, str], httputil.HTTPHeaders]
@@ -571,7 +571,7 @@ def body(self, value: Union[bytes, str]) -> None:
         self._body = utf8(value)
 
 
-class HTTPResponse(object):
+class HTTPResponse:
     """HTTP Response object.
 
     Attributes:
@@ -684,7 +684,7 @@ def rethrow(self) -> None:
 
     def __repr__(self) -> str:
         args = ",".join("%s=%r" % i for i in sorted(self.__dict__.items()))
-        return "%s(%s)" % (self.__class__.__name__, args)
+        return f"{self.__class__.__name__}({args})"
 
 
 class HTTPClientError(Exception):
@@ -732,7 +732,7 @@ def __str__(self) -> str:
 HTTPError = HTTPClientError
 
 
-class _RequestProxy(object):
+class _RequestProxy:
     """Combines an object with a dictionary of defaults.
 
     Used internally by AsyncHTTPClient implementations.
diff --git a/tornado/httpserver.py b/tornado/httpserver.py
index 757f711..68c6301 100644
--- a/tornado/httpserver.py
+++ b/tornado/httpserver.py
@@ -89,7 +89,7 @@ class HTTPServer(TCPServer, Configurable, httputil.HTTPServerConnectionDelegate)
             async def main():
                 server = HTTPServer()
                 server.listen(8888)
-                await asyncio.Event.wait()
+                await asyncio.Event().wait()
 
             asyncio.run(main())
 
@@ -295,7 +295,7 @@ def on_connection_close(self) -> None:
         del self._chunks
 
 
-class _HTTPRequestContext(object):
+class _HTTPRequestContext:
     def __init__(
         self,
         stream: iostream.IOStream,
diff --git a/tornado/httputil.py b/tornado/httputil.py
index ebdc805..0c9ad83 100644
--- a/tornado/httputil.py
+++ b/tornado/httputil.py
@@ -22,6 +22,7 @@
 import calendar
 import collections.abc
 import copy
+import dataclasses
 import datetime
 import email.utils
 from functools import lru_cache
@@ -33,8 +34,7 @@
 import unicodedata
 from urllib.parse import urlencode, urlparse, urlunparse, parse_qsl
 
-from tornado.escape import native_str, parse_qs_bytes, utf8
-from tornado.log import gen_log
+from tornado.escape import native_str, parse_qs_bytes, utf8, to_unicode
 from tornado.util import ObjectDict, unicode_type
 
 
@@ -62,9 +62,75 @@
     from asyncio import Future  # noqa: F401
     import unittest  # noqa: F401
 
+    # This can be done unconditionally in the base class of HTTPHeaders
+    # after we drop support for Python 3.8.
+    StrMutableMapping = collections.abc.MutableMapping[str, str]
+else:
+    StrMutableMapping = collections.abc.MutableMapping
+
 # To be used with str.strip() and related methods.
 HTTP_WHITESPACE = " \t"
 
+# Roughly the inverse of RequestHandler._VALID_HEADER_CHARS, but permits
+# chars greater than \xFF (which may appear after decoding utf8).
+_FORBIDDEN_HEADER_CHARS_RE = re.compile(r"[\x00-\x08\x0A-\x1F\x7F]")
+
+
+class _ABNF:
+    """Class that holds a subset of ABNF rules from RFC 9110 and friends.
+
+    Class attributes are re.Pattern objects, with the same name as in the RFC
+    (with hyphens changed to underscores). Currently contains only the subset
+    we use (which is why this class is not public). Unfortunately the fields
+    cannot be alphabetized as they are in the RFCs because of dependencies.
+    """
+
+    # RFC 3986 (URI)
+    # The URI hostname ABNF is both complex (including detailed vaildation of IPv4 and IPv6
+    # literals) and not strict enough (a lot of punctuation is allowed by the ABNF even though
+    # it is not allowed by DNS). We simplify it by allowing square brackets and colons in any
+    # position, not only for their use in IPv6 literals.
+    uri_unreserved = re.compile(r"[A-Za-z0-9\-._~]")
+    uri_sub_delims = re.compile(r"[!$&'()*+,;=]")
+    uri_pct_encoded = re.compile(r"%[0-9A-Fa-f]{2}")
+    uri_host = re.compile(
+        rf"(?:[\[\]:]|{uri_unreserved.pattern}|{uri_sub_delims.pattern}|{uri_pct_encoded.pattern})*"
+    )
+    uri_port = re.compile(r"[0-9]*")
+
+    # RFC 5234 (ABNF)
+    VCHAR = re.compile(r"[\x21-\x7E]")
+
+    # RFC 9110 (HTTP Semantics)
+    obs_text = re.compile(r"[\x80-\xFF]")
+    field_vchar = re.compile(rf"(?:{VCHAR.pattern}|{obs_text.pattern})")
+    # Not exactly from the RFC to simplify and combine field-content and field-value.
+    field_value = re.compile(
+        rf"|"
+        rf"{field_vchar.pattern}|"
+        rf"{field_vchar.pattern}(?:{field_vchar.pattern}| |\t)*{field_vchar.pattern}"
+    )
+    tchar = re.compile(r"[!#$%&'*+\-.^_`|~0-9A-Za-z]")
+    token = re.compile(rf"{tchar.pattern}+")
+    field_name = token
+    method = token
+    host = re.compile(rf"(?:{uri_host.pattern})(?::{uri_port.pattern})?")
+
+    # RFC 9112 (HTTP/1.1)
+    HTTP_version = re.compile(r"HTTP/[0-9]\.[0-9]")
+    reason_phrase = re.compile(rf"(?:[\t ]|{VCHAR.pattern}|{obs_text.pattern})+")
+    # request_target delegates to the URI RFC 3986, which is complex and may be
+    # too restrictive (for example, the WHATWG version of the URL spec allows non-ASCII
+    # characters). Instead, we allow everything but control chars and whitespace.
+    request_target = re.compile(rf"{field_vchar.pattern}+")
+    request_line = re.compile(
+        rf"({method.pattern}) ({request_target.pattern}) ({HTTP_version.pattern})"
+    )
+    status_code = re.compile(r"[0-9]{3}")
+    status_line = re.compile(
+        rf"({HTTP_version.pattern}) ({status_code.pattern}) ({reason_phrase.pattern})?"
+    )
+
 
 @lru_cache(1000)
 def _normalize_header(name: str) -> str:
@@ -76,7 +142,7 @@ def _normalize_header(name: str) -> str:
     return "-".join([w.capitalize() for w in name.split("-")])
 
 
-class HTTPHeaders(collections.abc.MutableMapping):
+class HTTPHeaders(StrMutableMapping):
     """A dictionary that maintains ``Http-Header-Case`` for all keys.
 
     Supports multiple values per key via a pair of new methods,
@@ -122,8 +188,14 @@ def __init__(self, **kwargs: str) -> None:
         pass
 
     def __init__(self, *args: typing.Any, **kwargs: str) -> None:  # noqa: F811
-        self._dict = {}  # type: typing.Dict[str, str]
-        self._as_list = {}  # type: typing.Dict[str, typing.List[str]]
+        # Formally, HTTP headers are a mapping from a field name to a "combined field value",
+        # which may be constructed from multiple field lines by joining them with commas.
+        # In practice, however, some headers (notably Set-Cookie) do not follow this convention,
+        # so we maintain a mapping from field name to a list of field lines in self._as_list.
+        # self._combined_cache is a cache of the combined field values derived from self._as_list
+        # on demand (and cleared whenever the list is modified).
+        self._as_list: dict[str, list[str]] = {}
+        self._combined_cache: dict[str, str] = {}
         self._last_key = None  # type: Optional[str]
         if len(args) == 1 and len(kwargs) == 0 and isinstance(args[0], HTTPHeaders):
             # Copy constructor
@@ -135,14 +207,22 @@ def __init__(self, *args: typing.Any, **kwargs: str) -> None:  # noqa: F811
 
     # new public methods
 
-    def add(self, name: str, value: str) -> None:
+    def add(self, name: str, value: str, *, _chars_are_bytes: bool = True) -> None:
         """Adds a new value for the given key."""
+        if not _ABNF.field_name.fullmatch(name):
+            raise HTTPInputError("Invalid header name %r" % name)
+        if _chars_are_bytes:
+            if not _ABNF.field_value.fullmatch(to_unicode(value)):
+                # TODO: the fact we still support bytes here (contrary to type annotations)
+                # and still test for it should probably be changed.
+                raise HTTPInputError("Invalid header value %r" % value)
+        else:
+            if _FORBIDDEN_HEADER_CHARS_RE.search(value):
+                raise HTTPInputError("Invalid header value %r" % value)
         norm_name = _normalize_header(name)
         self._last_key = norm_name
         if norm_name in self:
-            self._dict[norm_name] = (
-                native_str(self[norm_name]) + "," + native_str(value)
-            )
+            self._combined_cache.pop(norm_name, None)
             self._as_list[norm_name].append(value)
         else:
             self[norm_name] = value
@@ -162,30 +242,59 @@ def get_all(self) -> Iterable[Tuple[str, str]]:
             for value in values:
                 yield (name, value)
 
-    def parse_line(self, line: str) -> None:
-        """Updates the dictionary with a single header line.
+    def parse_line(self, line: str, *, _chars_are_bytes: bool = True) -> None:
+        r"""Updates the dictionary with a single header line.
 
         >>> h = HTTPHeaders()
         >>> h.parse_line("Content-Type: text/html")
         >>> h.get('content-type')
         'text/html'
+        >>> h.parse_line("Content-Length: 42\r\n")
+        >>> h.get('content-type')
+        'text/html'
+
+        .. versionchanged:: 6.5
+            Now supports lines with or without the trailing CRLF, making it possible
+            to pass lines from AsyncHTTPClient's header_callback directly to this method.
+
+        .. deprecated:: 6.5
+           In Tornado 7.0, certain deprecated features of HTTP will become errors.
+           Specifically, line folding and the use of LF (with CR) as a line separator
+           will be removed.
         """
-        if line[0].isspace():
+        if m := re.search(r"\r?\n$", line):
+            # RFC 9112 section 2.2: a recipient MAY recognize a single LF as a line
+            # terminator and ignore any preceding CR.
+            # TODO(7.0): Remove this support for LF-only line endings.
+            line = line[: m.start()]
+        if not line:
+            # Empty line, or the final CRLF of a header block.
+            return
+        if line[0] in HTTP_WHITESPACE:
             # continuation of a multi-line header
+            # TODO(7.0): Remove support for line folding.
             if self._last_key is None:
                 raise HTTPInputError("first header line cannot start with whitespace")
-            new_part = " " + line.lstrip(HTTP_WHITESPACE)
+            new_part = " " + line.strip(HTTP_WHITESPACE)
+            if _chars_are_bytes:
+                if not _ABNF.field_value.fullmatch(new_part[1:]):
+                    raise HTTPInputError("Invalid header continuation %r" % new_part)
+            else:
+                if _FORBIDDEN_HEADER_CHARS_RE.search(new_part):
+                    raise HTTPInputError("Invalid header value %r" % new_part)
             self._as_list[self._last_key][-1] += new_part
-            self._dict[self._last_key] += new_part
+            self._combined_cache.pop(self._last_key, None)
         else:
             try:
                 name, value = line.split(":", 1)
             except ValueError:
                 raise HTTPInputError("no colon in header line")
-            self.add(name, value.strip(HTTP_WHITESPACE))
+            self.add(
+                name, value.strip(HTTP_WHITESPACE), _chars_are_bytes=_chars_are_bytes
+            )
 
     @classmethod
-    def parse(cls, headers: str) -> "HTTPHeaders":
+    def parse(cls, headers: str, *, _chars_are_bytes: bool = True) -> "HTTPHeaders":
         """Returns a dictionary from HTTP header text.
 
         >>> h = HTTPHeaders.parse("Content-Type: text/html\\r\\nContent-Length: 42\\r\\n")
@@ -198,36 +307,64 @@ def parse(cls, headers: str) -> "HTTPHeaders":
            mix of `KeyError`, and `ValueError`.
 
         """
+        # _chars_are_bytes is a hack. This method is used in two places, HTTP headers (in which
+        # non-ascii characters are to be interpreted as latin-1) and multipart/form-data (in which
+        # they are to be interpreted as utf-8). For historical reasons, this method handled this by
+        # expecting both callers to decode the headers to strings before parsing them. This wasn't a
+        # problem until we started doing stricter validation of the characters allowed in HTTP
+        # headers (using ABNF rules defined in terms of byte values), which inadvertently started
+        # disallowing non-latin1 characters in multipart/form-data filenames.
+        #
+        # This method should have accepted bytes and a desired encoding, but this change is being
+        # introduced in a patch release that shouldn't change the API. Instead, the _chars_are_bytes
+        # flag decides whether to use HTTP-style ABNF validation (treating the string as bytes
+        # smuggled through the latin1 encoding) or to accept any non-control unicode characters
+        # as required by multipart/form-data. This method will change to accept bytes in a future
+        # release.
         h = cls()
-        # RFC 7230 section 3.5: a recipient MAY recognize a single LF as a line
-        # terminator and ignore any preceding CR.
-        for line in headers.split("\n"):
-            if line.endswith("\r"):
-                line = line[:-1]
-            if line:
-                h.parse_line(line)
+
+        start = 0
+        while True:
+            lf = headers.find("\n", start)
+            if lf == -1:
+                h.parse_line(headers[start:], _chars_are_bytes=_chars_are_bytes)
+                break
+            line = headers[start : lf + 1]
+            start = lf + 1
+            h.parse_line(line, _chars_are_bytes=_chars_are_bytes)
         return h
 
     # MutableMapping abstract method implementations.
 
     def __setitem__(self, name: str, value: str) -> None:
         norm_name = _normalize_header(name)
-        self._dict[norm_name] = value
+        self._combined_cache[norm_name] = value
         self._as_list[norm_name] = [value]
 
+    def __contains__(self, name: object) -> bool:
+        # This is an important optimization to avoid the expensive concatenation
+        # in __getitem__ when it's not needed.
+        if not isinstance(name, str):
+            return False
+        norm_name = _normalize_header(name)
+        return norm_name in self._as_list
+
     def __getitem__(self, name: str) -> str:
-        return self._dict[_normalize_header(name)]
+        header = _normalize_header(name)
+        if header not in self._combined_cache:
+            self._combined_cache[header] = ",".join(self._as_list[header])
+        return self._combined_cache[header]
 
     def __delitem__(self, name: str) -> None:
         norm_name = _normalize_header(name)
-        del self._dict[norm_name]
+        del self._combined_cache[norm_name]
         del self._as_list[norm_name]
 
     def __len__(self) -> int:
-        return len(self._dict)
+        return len(self._as_list)
 
     def __iter__(self) -> Iterator[typing.Any]:
-        return iter(self._dict)
+        return iter(self._as_list)
 
     def copy(self) -> "HTTPHeaders":
         # defined in dict but not in MutableMapping.
@@ -241,13 +378,13 @@ def copy(self) -> "HTTPHeaders":
     def __str__(self) -> str:
         lines = []
         for name, value in self.get_all():
-            lines.append("%s: %s\n" % (name, value))
+            lines.append(f"{name}: {value}\n")
         return "".join(lines)
 
     __unicode__ = __str__
 
 
-class HTTPServerRequest(object):
+class HTTPServerRequest:
     """A single HTTP request.
 
     All attributes are type `str` unless otherwise noted.
@@ -338,6 +475,11 @@ class HTTPServerRequest(object):
 
     .. versionchanged:: 4.0
        Moved from ``tornado.httpserver.HTTPRequest``.
+
+    .. deprecated:: 6.5.2
+       The ``host`` argument to the ``HTTPServerRequest`` constructor is deprecated. Use
+       ``headers["Host"]`` instead. This argument was mistakenly removed in Tornado 6.5.0 and
+       temporarily restored in 6.5.2.
     """
 
     path = None  # type: str
@@ -372,7 +514,34 @@ def __init__(
         self.remote_ip = getattr(context, "remote_ip", None)
         self.protocol = getattr(context, "protocol", "http")
 
-        self.host = host or self.headers.get("Host") or "127.0.0.1"
+        try:
+            self.host = host or self.headers["Host"]
+        except KeyError:
+            if version == "HTTP/1.0":
+                # HTTP/1.0 does not require the Host header.
+                self.host = "127.0.0.1"
+            else:
+                raise HTTPInputError("Missing Host header")
+        if not _ABNF.host.fullmatch(self.host):
+            raise HTTPInputError("Invalid Host header: %r" % self.host)
+        if "," in self.host:
+            # https://www.rfc-editor.org/rfc/rfc9112.html#name-request-target
+            # Server MUST respond with 400 Bad Request if multiple
+            # Host headers are present.
+            #
+            # We test for the presence of a comma instead of the number of
+            # headers received because a proxy may have converted
+            # multiple headers into a single comma-separated value
+            # (per RFC 9110 section 5.3).
+            #
+            # This is technically a departure from the RFC since the ABNF
+            # does not forbid commas in the host header. However, since
+            # commas are not allowed in DNS names, it is appropriate to
+            # disallow them. (The same argument could be made for other special
+            # characters, but commas are the most problematic since they could
+            # be used to exploit differences between proxies when multiple headers
+            # are supplied).
+            raise HTTPInputError("Multiple host headers not allowed: %r" % self.host)
         self.host_name = split_host_and_port(self.host.lower())[0]
         self.files = files or {}
         self.connection = connection
@@ -465,8 +634,8 @@ def _parse_body(self) -> None:
 
     def __repr__(self) -> str:
         attrs = ("protocol", "host", "method", "uri", "version", "remote_ip")
-        args = ", ".join(["%s=%r" % (n, getattr(self, n)) for n in attrs])
-        return "%s(%s)" % (self.__class__.__name__, args)
+        args = ", ".join([f"{n}={getattr(self, n)!r}" for n in attrs])
+        return f"{self.__class__.__name__}({args})"
 
 
 class HTTPInputError(Exception):
@@ -488,7 +657,7 @@ class HTTPOutputError(Exception):
     pass
 
 
-class HTTPServerConnectionDelegate(object):
+class HTTPServerConnectionDelegate:
     """Implement this interface to handle requests from `.HTTPServer`.
 
     .. versionadded:: 4.0
@@ -517,7 +686,7 @@ def on_close(self, server_conn: object) -> None:
         pass
 
 
-class HTTPMessageDelegate(object):
+class HTTPMessageDelegate:
     """Implement this interface to handle an HTTP request or response.
 
     .. versionadded:: 4.0
@@ -563,7 +732,7 @@ def on_connection_close(self) -> None:
         pass
 
 
-class HTTPConnection(object):
+class HTTPConnection:
     """Applications use this interface to write their responses.
 
     .. versionadded:: 4.0
@@ -735,7 +904,7 @@ def _get_content_range(start: Optional[int], end: Optional[int], total: int) ->
     """
     start = start or 0
     end = (end or total) - 1
-    return "bytes %s-%s/%s" % (start, end, total)
+    return f"bytes {start}-{end}/{total}"
 
 
 def _int_or_none(val: str) -> Optional[int]:
@@ -745,12 +914,90 @@ def _int_or_none(val: str) -> Optional[int]:
     return int(val)
 
 
+@dataclasses.dataclass
+class ParseMultipartConfig:
+    """This class configures the parsing of ``multipart/form-data`` request bodies.
+
+    Its primary purpose is to place limits on the size and complexity of request messages
+    to avoid potential denial-of-service attacks.
+
+    .. versionadded:: 6.5.5
+    """
+
+    enabled: bool = True
+    """Set this to false to disable the parsing of ``multipart/form-data`` requests entirely.
+
+    This may be desirable for applications that do not need to handle this format, since
+    multipart request have a history of DoS vulnerabilities in Tornado. Multipart requests
+    are used primarily for ``<input type="file">`` in HTML forms, or in APIs that mimic this
+    format. File uploads that use the HTTP ``PUT`` method generally do not use the multipart
+    format.
+    """
+
+    max_parts: int = 100
+    """The maximum number of parts accepted in a multipart request.
+
+    Each ``<input>`` element in an HTML form corresponds to at least one "part".
+    """
+
+    max_part_header_size: int = 10 * 1024
+    """The maximum size of the headers for each part of a multipart request.
+
+    The header for a part contains the name of the form field and optionally the filename
+    and content type of the uploaded file.
+    """
+
+
+@dataclasses.dataclass
+class ParseBodyConfig:
+    """This class configures the parsing of request bodies.
+
+    .. versionadded:: 6.5.5
+    """
+
+    multipart: ParseMultipartConfig = dataclasses.field(
+        default_factory=ParseMultipartConfig
+    )
+    """Configuration for ``multipart/form-data`` request bodies."""
+
+
+_DEFAULT_PARSE_BODY_CONFIG = ParseBodyConfig()
+
+
+def set_parse_body_config(config: ParseBodyConfig) -> None:
+    r"""Sets the **global** default configuration for parsing request bodies.
+
+    This global setting is provided as a stopgap for applications that need to raise the limits
+    introduced in Tornado 6.5.5, or who wish to disable the parsing of multipart/form-data bodies
+    entirely. Non-global configuration for this functionality will be introduced in a future
+    release.
+
+    >>> content_type = "multipart/form-data; boundary=foo"
+    >>> multipart_body = b"--foo--\r\n"
+    >>> parse_body_arguments(content_type, multipart_body, {}, {})
+    >>> multipart_config = ParseMultipartConfig(enabled=False)
+    >>> config = ParseBodyConfig(multipart=multipart_config)
+    >>> set_parse_body_config(config)
+    >>> parse_body_arguments(content_type, multipart_body, {}, {})
+    Traceback (most recent call last):
+        ...
+    tornado.httputil.HTTPInputError: ...: multipart/form-data parsing is disabled
+    >>> set_parse_body_config(ParseBodyConfig())  # reset to defaults
+
+    .. versionadded:: 6.5.5
+    """
+    global _DEFAULT_PARSE_BODY_CONFIG
+    _DEFAULT_PARSE_BODY_CONFIG = config
+
+
 def parse_body_arguments(
     content_type: str,
     body: bytes,
     arguments: Dict[str, List[bytes]],
     files: Dict[str, List[HTTPFile]],
     headers: Optional[HTTPHeaders] = None,
+    *,
+    config: Optional[ParseBodyConfig] = None,
 ) -> None:
     """Parses a form request body.
 
@@ -760,38 +1007,42 @@ def parse_body_arguments(
     and ``files`` parameters are dictionaries that will be updated
     with the parsed contents.
     """
+    if config is None:
+        config = _DEFAULT_PARSE_BODY_CONFIG
     if content_type.startswith("application/x-www-form-urlencoded"):
         if headers and "Content-Encoding" in headers:
-            gen_log.warning(
-                "Unsupported Content-Encoding: %s", headers["Content-Encoding"]
+            raise HTTPInputError(
+                "Unsupported Content-Encoding: %s" % headers["Content-Encoding"]
             )
-            return
         try:
             # real charset decoding will happen in RequestHandler.decode_argument()
             uri_arguments = parse_qs_bytes(body, keep_blank_values=True)
         except Exception as e:
-            gen_log.warning("Invalid x-www-form-urlencoded body: %s", e)
-            uri_arguments = {}
+            raise HTTPInputError("Invalid x-www-form-urlencoded body: %s" % e) from e
         for name, values in uri_arguments.items():
             if values:
                 arguments.setdefault(name, []).extend(values)
     elif content_type.startswith("multipart/form-data"):
         if headers and "Content-Encoding" in headers:
-            gen_log.warning(
-                "Unsupported Content-Encoding: %s", headers["Content-Encoding"]
+            raise HTTPInputError(
+                "Unsupported Content-Encoding: %s" % headers["Content-Encoding"]
             )
-            return
         try:
             fields = content_type.split(";")
+            if fields[0].strip() != "multipart/form-data":
+                # This catches "Content-Type: multipart/form-dataxyz"
+                raise HTTPInputError("Invalid content type")
             for field in fields:
                 k, sep, v = field.strip().partition("=")
                 if k == "boundary" and v:
-                    parse_multipart_form_data(utf8(v), body, arguments, files)
+                    parse_multipart_form_data(
+                        utf8(v), body, arguments, files, config=config.multipart
+                    )
                     break
             else:
-                raise ValueError("multipart boundary not found")
+                raise HTTPInputError("multipart boundary not found")
         except Exception as e:
-            gen_log.warning("Invalid multipart/form-data: %s", e)
+            raise HTTPInputError("Invalid multipart/form-data: %s" % e) from e
 
 
 def parse_multipart_form_data(
@@ -799,6 +1050,8 @@ def parse_multipart_form_data(
     data: bytes,
     arguments: Dict[str, List[bytes]],
     files: Dict[str, List[HTTPFile]],
+    *,
+    config: Optional[ParseMultipartConfig] = None,
 ) -> None:
     """Parses a ``multipart/form-data`` body.
 
@@ -811,6 +1064,10 @@ def parse_multipart_form_data(
        Now recognizes non-ASCII filenames in RFC 2231/5987
        (``filename*=``) format.
     """
+    if config is None:
+        config = _DEFAULT_PARSE_BODY_CONFIG.multipart
+    if not config.enabled:
+        raise HTTPInputError("multipart/form-data parsing is disabled")
     # The standard allows for the boundary to be quoted in the header,
     # although it's rare (it happens at least for google app engine
     # xmpp).  I think we're also supposed to handle backslash-escapes
@@ -820,26 +1077,26 @@ def parse_multipart_form_data(
         boundary = boundary[1:-1]
     final_boundary_index = data.rfind(b"--" + boundary + b"--")
     if final_boundary_index == -1:
-        gen_log.warning("Invalid multipart/form-data: no final boundary")
-        return
+        raise HTTPInputError("Invalid multipart/form-data: no final boundary found")
     parts = data[:final_boundary_index].split(b"--" + boundary + b"\r\n")
+    if len(parts) > config.max_parts:
+        raise HTTPInputError("multipart/form-data has too many parts")
     for part in parts:
         if not part:
             continue
         eoh = part.find(b"\r\n\r\n")
         if eoh == -1:
-            gen_log.warning("multipart/form-data missing headers")
-            continue
-        headers = HTTPHeaders.parse(part[:eoh].decode("utf-8"))
+            raise HTTPInputError("multipart/form-data missing headers")
+        if eoh > config.max_part_header_size:
+            raise HTTPInputError("multipart/form-data part header too large")
+        headers = HTTPHeaders.parse(part[:eoh].decode("utf-8"), _chars_are_bytes=False)
         disp_header = headers.get("Content-Disposition", "")
         disposition, disp_params = _parse_header(disp_header)
         if disposition != "form-data" or not part.endswith(b"\r\n"):
-            gen_log.warning("Invalid multipart/form-data")
-            continue
+            raise HTTPInputError("Invalid multipart/form-data")
         value = part[eoh + 4 : -2]
         if not disp_params.get("name"):
-            gen_log.warning("multipart/form-data value missing name")
-            continue
+            raise HTTPInputError("multipart/form-data missing name")
         name = disp_params["name"]
         if disp_params.get("filename"):
             ctype = headers.get("Content-Type", "application/unknown")
@@ -853,7 +1110,7 @@ def parse_multipart_form_data(
 
 
 def format_timestamp(
-    ts: Union[int, float, tuple, time.struct_time, datetime.datetime]
+    ts: Union[int, float, tuple, time.struct_time, datetime.datetime],
 ) -> str:
     """Formats a timestamp in the format used by HTTP.
 
@@ -876,56 +1133,56 @@ def format_timestamp(
     return email.utils.formatdate(time_num, usegmt=True)
 
 
-RequestStartLine = collections.namedtuple(
-    "RequestStartLine", ["method", "path", "version"]
-)
-
-
-_http_version_re = re.compile(r"^HTTP/1\.[0-9]$")
+class RequestStartLine(typing.NamedTuple):
+    method: str
+    path: str
+    version: str
 
 
 def parse_request_start_line(line: str) -> RequestStartLine:
     """Returns a (method, path, version) tuple for an HTTP 1.x request line.
 
-    The response is a `collections.namedtuple`.
+    The response is a `typing.NamedTuple`.
 
     >>> parse_request_start_line("GET /foo HTTP/1.1")
     RequestStartLine(method='GET', path='/foo', version='HTTP/1.1')
     """
-    try:
-        method, path, version = line.split(" ")
-    except ValueError:
+    match = _ABNF.request_line.fullmatch(line)
+    if not match:
         # https://tools.ietf.org/html/rfc7230#section-3.1.1
         # invalid request-line SHOULD respond with a 400 (Bad Request)
         raise HTTPInputError("Malformed HTTP request line")
-    if not _http_version_re.match(version):
-        raise HTTPInputError(
-            "Malformed HTTP version in HTTP Request-Line: %r" % version
-        )
-    return RequestStartLine(method, path, version)
-
-
-ResponseStartLine = collections.namedtuple(
-    "ResponseStartLine", ["version", "code", "reason"]
-)
+    r = RequestStartLine(match.group(1), match.group(2), match.group(3))
+    if not r.version.startswith("HTTP/1"):
+        # HTTP/2 and above doesn't use parse_request_start_line.
+        # This could be folded into the regex but we don't want to deviate
+        # from the ABNF in the RFCs.
+        raise HTTPInputError("Unexpected HTTP version %r" % r.version)
+    return r
 
 
-_http_response_line_re = re.compile(r"(HTTP/1.[0-9]) ([0-9]+) ([^\r]*)")
+class ResponseStartLine(typing.NamedTuple):
+    version: str
+    code: int
+    reason: str
 
 
 def parse_response_start_line(line: str) -> ResponseStartLine:
     """Returns a (version, code, reason) tuple for an HTTP 1.x response line.
 
-    The response is a `collections.namedtuple`.
+    The response is a `typing.NamedTuple`.
 
     >>> parse_response_start_line("HTTP/1.1 200 OK")
     ResponseStartLine(version='HTTP/1.1', code=200, reason='OK')
     """
-    line = native_str(line)
-    match = _http_response_line_re.match(line)
+    match = _ABNF.status_line.fullmatch(line)
     if not match:
         raise HTTPInputError("Error parsing response start line")
-    return ResponseStartLine(match.group(1), int(match.group(2)), match.group(3))
+    r = ResponseStartLine(match.group(1), int(match.group(2)), match.group(3))
+    if not r.version.startswith("HTTP/1"):
+        # HTTP/2 and above doesn't use parse_response_start_line.
+        raise HTTPInputError("Unexpected HTTP version %r" % r.version)
+    return r
 
 
 # _parseparam and _parse_header are copied and modified from python2.7's cgi.py
@@ -934,19 +1191,34 @@ def parse_response_start_line(line: str) -> ResponseStartLine:
 # It has also been modified to support valueless parameters as seen in
 # websocket extension negotiations, and to support non-ascii values in
 # RFC 2231/5987 format.
+#
+# _parseparam has been further modified with the logic from
+# https://github.com/python/cpython/pull/136072/files
+# to avoid quadratic behavior when parsing semicolons in quoted strings.
+#
+# TODO: See if we can switch to email.message.Message for this functionality.
+# This is the suggested replacement for the cgi.py module now that cgi has
+# been removed from recent versions of Python.  We need to verify that
+# the email module is consistent with our existing behavior (and all relevant
+# RFCs for multipart/form-data) before making this change.
 
 
 def _parseparam(s: str) -> Generator[str, None, None]:
-    while s[:1] == ";":
-        s = s[1:]
-        end = s.find(";")
-        while end > 0 and (s.count('"', 0, end) - s.count('\\"', 0, end)) % 2:
-            end = s.find(";", end + 1)
+    start = 0
+    while s.find(";", start) == start:
+        start += 1
+        end = s.find(";", start)
+        ind, diff = start, 0
+        while end > 0:
+            diff += s.count('"', ind, end) - s.count('\\"', ind, end)
+            if diff % 2 == 0:
+                break
+            end, ind = ind, s.find(";", end + 1)
         if end < 0:
             end = len(s)
-        f = s[:end]
+        f = s[start:end]
         yield f.strip()
-        s = s[end:]
+        start = end
 
 
 def _parse_header(line: str) -> Tuple[str, Dict[str, str]]:
@@ -1000,7 +1272,7 @@ def _encode_header(key: str, pdict: Dict[str, str]) -> str:
             out.append(k)
         else:
             # TODO: quote if necessary.
-            out.append("%s=%s" % (k, v))
+            out.append(f"{k}={v}")
     return "; ".join(out)
 
 
@@ -1024,7 +1296,7 @@ def doctests():
     # type: () -> unittest.TestSuite
     import doctest
 
-    return doctest.DocTestSuite()
+    return doctest.DocTestSuite(optionflags=doctest.ELLIPSIS)
 
 
 _netloc_re = re.compile(r"^(.+):(\d+)$")
@@ -1106,13 +1378,13 @@ def parse_cookie(cookie: str) -> Dict[str, str]:
     .. versionadded:: 4.4.2
     """
     cookiedict = {}
-    for chunk in cookie.split(str(";")):
-        if str("=") in chunk:
-            key, val = chunk.split(str("="), 1)
+    for chunk in cookie.split(";"):
+        if "=" in chunk:
+            key, val = chunk.split("=", 1)
         else:
             # Assume an empty name per
             # https://bugzilla.mozilla.org/show_bug.cgi?id=169091
-            key, val = str(""), chunk
+            key, val = "", chunk
         key, val = key.strip(), val.strip()
         if key or val:
             # unquote using Python's algorithm.
diff --git a/tornado/ioloop.py b/tornado/ioloop.py
index 3fb1359..647b8a7 100644
--- a/tornado/ioloop.py
+++ b/tornado/ioloop.py
@@ -50,7 +50,7 @@
 from typing import Union, Any, Type, Optional, Callable, TypeVar, Tuple, Awaitable
 
 if typing.TYPE_CHECKING:
-    from typing import Dict, List, Set  # noqa: F401
+    from typing import Dict, List, Set, TypedDict  # noqa: F401
 
     from typing_extensions import Protocol
 else:
@@ -116,9 +116,6 @@ async def main():
         if __name__ == "__main__":
             asyncio.run(main())
 
-    .. testoutput::
-       :hide:
-
     Most applications should not attempt to construct an `IOLoop` directly,
     and instead initialize the `asyncio` event loop and use `IOLoop.current()`.
     In some cases, such as in test frameworks when initializing an `IOLoop`
@@ -181,7 +178,7 @@ def configure(
             impl = import_object(impl)
         if isinstance(impl, type) and not issubclass(impl, BaseAsyncIOLoop):
             raise RuntimeError("only AsyncIOLoop is allowed when asyncio is available")
-        super(IOLoop, cls).configure(impl, **kwargs)
+        super().configure(impl, **kwargs)
 
     @staticmethod
     def instance() -> "IOLoop":
@@ -494,7 +491,11 @@ async def main():
         .. versionchanged:: 6.2
            ``tornado.util.TimeoutError`` is now an alias to ``asyncio.TimeoutError``.
         """
-        future_cell = [None]  # type: List[Optional[Future]]
+        if typing.TYPE_CHECKING:
+            FutureCell = TypedDict(  # noqa: F841
+                "FutureCell", {"future": Optional[Future], "timeout_called": bool}
+            )
+        future_cell = {"future": None, "timeout_called": False}  # type: FutureCell
 
         def run() -> None:
             try:
@@ -505,38 +506,45 @@ def run() -> None:
                     result = convert_yielded(result)
             except Exception:
                 fut = Future()  # type: Future[Any]
-                future_cell[0] = fut
+                future_cell["future"] = fut
                 future_set_exc_info(fut, sys.exc_info())
             else:
                 if is_future(result):
-                    future_cell[0] = result
+                    future_cell["future"] = result
                 else:
                     fut = Future()
-                    future_cell[0] = fut
+                    future_cell["future"] = fut
                     fut.set_result(result)
-            assert future_cell[0] is not None
-            self.add_future(future_cell[0], lambda future: self.stop())
+            assert future_cell["future"] is not None
+            self.add_future(future_cell["future"], lambda future: self.stop())
 
         self.add_callback(run)
         if timeout is not None:
 
             def timeout_callback() -> None:
+                # signal that timeout is triggered
+                future_cell["timeout_called"] = True
                 # If we can cancel the future, do so and wait on it. If not,
                 # Just stop the loop and return with the task still pending.
                 # (If we neither cancel nor wait for the task, a warning
                 # will be logged).
-                assert future_cell[0] is not None
-                if not future_cell[0].cancel():
+                assert future_cell["future"] is not None
+                if not future_cell["future"].cancel():
                     self.stop()
 
             timeout_handle = self.add_timeout(self.time() + timeout, timeout_callback)
         self.start()
         if timeout is not None:
             self.remove_timeout(timeout_handle)
-        assert future_cell[0] is not None
-        if future_cell[0].cancelled() or not future_cell[0].done():
-            raise TimeoutError("Operation timed out after %s seconds" % timeout)
-        return future_cell[0].result()
+        assert future_cell["future"] is not None
+        if future_cell["future"].cancelled() or not future_cell["future"].done():
+            if future_cell["timeout_called"]:
+                raise TimeoutError("Operation timed out after %s seconds" % timeout)
+            else:
+                # timeout not called; maybe stop() was called explicitly
+                # or some other cancellation
+                raise RuntimeError("Event loop stopped before Future completed.")
+        return future_cell["future"].result()
 
     def time(self) -> float:
         """Returns the current time according to the `IOLoop`'s clock.
@@ -557,7 +565,7 @@ def add_timeout(
         deadline: Union[float, datetime.timedelta],
         callback: Callable,
         *args: Any,
-        **kwargs: Any
+        **kwargs: Any,
     ) -> object:
         """Runs the ``callback`` at the time ``deadline`` from the I/O loop.
 
@@ -708,7 +716,7 @@ def run_in_executor(
         self,
         executor: Optional[concurrent.futures.Executor],
         func: Callable[..., _T],
-        *args: Any
+        *args: Any,
     ) -> "Future[_T]":
         """Runs a function in a ``concurrent.futures.Executor``. If
         ``executor`` is ``None``, the IO loop's default executor will be used.
@@ -822,7 +830,7 @@ def _unregister_task(self, f: Future) -> None:
         self._pending_tasks.discard(f)
 
 
-class _Timeout(object):
+class _Timeout:
     """An IOLoop timeout, a UNIX timestamp and a callback"""
 
     # Reduce memory overhead when there are lots of pending callbacks
@@ -851,7 +859,7 @@ def __le__(self, other: "_Timeout") -> bool:
         return self.tdeadline <= other.tdeadline
 
 
-class PeriodicCallback(object):
+class PeriodicCallback:
     """Schedules the given callback to be called periodically.
 
     The callback is called every ``callback_time`` milliseconds when
diff --git a/tornado/iostream.py b/tornado/iostream.py
index ee57759..dd2111e 100644
--- a/tornado/iostream.py
+++ b/tornado/iostream.py
@@ -114,7 +114,7 @@ class StreamBufferFullError(Exception):
     """Exception raised by `IOStream` methods when the buffer is full."""
 
 
-class _StreamBuffer(object):
+class _StreamBuffer:
     """
     A specialized buffer that tries to avoid copies when large pieces
     of data are encountered.
@@ -204,7 +204,7 @@ def advance(self, size: int) -> None:
         self._first_pos = pos
 
 
-class BaseIOStream(object):
+class BaseIOStream:
     """A utility class to write to and read from a non-blocking file or socket.
 
     We support a non-blocking ``write()`` and a family of ``read_*()``
@@ -859,7 +859,7 @@ def _read_to_buffer(self) -> Optional[int]:
                     else:
                         buf = bytearray(self.read_chunk_size)
                     bytes_read = self.read_from_fd(buf)
-                except (socket.error, IOError, OSError) as e:
+                except OSError as e:
                     # ssl.SSLError is a subclass of socket.error
                     if self._is_connreset(e):
                         # Treat ECONNRESET as a connection close rather than
@@ -966,7 +966,7 @@ def _handle_write(self) -> None:
                 self._total_write_done_index += num_bytes
             except BlockingIOError:
                 break
-            except (socket.error, IOError, OSError) as e:
+            except OSError as e:
                 if not self._is_connreset(e):
                     # Broken pipe errors are usually caused by connection
                     # reset, and its better to not log EPIPE errors to
@@ -1090,9 +1090,6 @@ async def main():
         if __name__ == '__main__':
             asyncio.run(main())
 
-    .. testoutput::
-       :hide:
-
     """
 
     def __init__(self, socket: socket.socket, *args: Any, **kwargs: Any) -> None:
@@ -1150,8 +1147,7 @@ class is recommended instead of calling this method directly.
 
         In SSL mode, the ``server_hostname`` parameter will be used
         for certificate validation (unless disabled in the
-        ``ssl_options``) and SNI (if supported; requires Python
-        2.7.9+).
+        ``ssl_options``) and SNI.
 
         Note that it is safe to call `IOStream.write
         <BaseIOStream.write>` while the connection is pending, in
@@ -1183,7 +1179,7 @@ class is recommended instead of calling this method directly.
             # In non-blocking mode we expect connect() to raise an
             # exception with EINPROGRESS or EWOULDBLOCK.
             pass
-        except socket.error as e:
+        except OSError as e:
             # On freebsd, other errors such as ECONNREFUSED may be
             # returned immediately when attempting to connect to
             # localhost, so handle them the same way as an error
@@ -1274,7 +1270,7 @@ def start_tls(
     def _handle_connect(self) -> None:
         try:
             err = self.socket.getsockopt(socket.SOL_SOCKET, socket.SO_ERROR)
-        except socket.error as e:
+        except OSError as e:
             # Hurd doesn't allow SO_ERROR for loopback sockets because all
             # errors for such sockets are reported synchronously.
             if errno_from_exception(e) == errno.ENOPROTOOPT:
@@ -1308,7 +1304,7 @@ def set_nodelay(self, value: bool) -> None:
                 self.socket.setsockopt(
                     socket.IPPROTO_TCP, socket.TCP_NODELAY, 1 if value else 0
                 )
-            except socket.error as e:
+            except OSError as e:
                 # Sometimes setsockopt will fail if the socket is closed
                 # at the wrong time.  This can happen with HTTPServer
                 # resetting the value to ``False`` between requests.
@@ -1345,7 +1341,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None:
         # If the socket is already connected, attempt to start the handshake.
         try:
             self.socket.getpeername()
-        except socket.error:
+        except OSError:
             pass
         else:
             # Indirectly start the handshake, which will run on the next
@@ -1384,13 +1380,7 @@ def _do_ssl_handshake(self) -> None:
                 )
                 return self.close(exc_info=err)
             raise
-        except ssl.CertificateError as err:
-            # CertificateError can happen during handshake (hostname
-            # verification) and should be passed to user. Starting
-            # in Python 3.7, this error is a subclass of SSLError
-            # and will be handled by the previous block instead.
-            return self.close(exc_info=err)
-        except socket.error as err:
+        except OSError as err:
             # Some port scans (e.g. nmap in -sT mode) have been known
             # to cause do_handshake to raise EBADF and ENOTCONN, so make
             # those errors quiet as well.
@@ -1609,7 +1599,7 @@ def write_to_fd(self, data: memoryview) -> int:
     def read_from_fd(self, buf: Union[bytearray, memoryview]) -> Optional[int]:
         try:
             return self._fio.readinto(buf)  # type: ignore
-        except (IOError, OSError) as e:
+        except OSError as e:
             if errno_from_exception(e) == errno.EBADF:
                 # If the writing half of a pipe is closed, select will
                 # report it as readable but reads will fail with EBADF.
diff --git a/tornado/locale.py b/tornado/locale.py
index c552670..abd8668 100644
--- a/tornado/locale.py
+++ b/tornado/locale.py
@@ -221,7 +221,7 @@ def get_supported_locales() -> Iterable[str]:
     return _supported_locales
 
 
-class Locale(object):
+class Locale:
     """Object representing a locale.
 
     After calling one of `load_translations` or `load_gettext_translations`,
@@ -569,8 +569,8 @@ def pgettext(
         if plural_message is not None:
             assert count is not None
             msgs_with_ctxt = (
-                "%s%s%s" % (context, CONTEXT_SEPARATOR, message),
-                "%s%s%s" % (context, CONTEXT_SEPARATOR, plural_message),
+                f"{context}{CONTEXT_SEPARATOR}{message}",
+                f"{context}{CONTEXT_SEPARATOR}{plural_message}",
                 count,
             )
             result = self.ngettext(*msgs_with_ctxt)
@@ -579,7 +579,7 @@ def pgettext(
                 result = self.ngettext(message, plural_message, count)
             return result
         else:
-            msg_with_ctxt = "%s%s%s" % (context, CONTEXT_SEPARATOR, message)
+            msg_with_ctxt = f"{context}{CONTEXT_SEPARATOR}{message}"
             result = self.gettext(msg_with_ctxt)
             if CONTEXT_SEPARATOR in result:
                 # Translation not found
diff --git a/tornado/locks.py b/tornado/locks.py
index 1bcec1b..9ee1f2f 100644
--- a/tornado/locks.py
+++ b/tornado/locks.py
@@ -28,7 +28,7 @@
 __all__ = ["Condition", "Event", "Semaphore", "BoundedSemaphore", "Lock"]
 
 
-class _TimeoutGarbageCollector(object):
+class _TimeoutGarbageCollector:
     """Base class for objects that periodically clean up timed-out waiters.
 
     Avoids memory leak in a common pattern like:
@@ -111,7 +111,7 @@ async def runner():
     """
 
     def __repr__(self) -> str:
-        result = "<%s" % (self.__class__.__name__,)
+        result = f"<{self.__class__.__name__}"
         if self._waiters:
             result += " waiters[%s]" % len(self._waiters)
         return result + ">"
@@ -155,7 +155,7 @@ def notify_all(self) -> None:
         self.notify(len(self._waiters))
 
 
-class Event(object):
+class Event:
     """An event blocks coroutines until its internal flag is set to True.
 
     Similar to `threading.Event`.
@@ -200,7 +200,7 @@ def __init__(self) -> None:
         self._waiters = set()  # type: Set[Future[None]]
 
     def __repr__(self) -> str:
-        return "<%s %s>" % (
+        return "<{} {}>".format(
             self.__class__.__name__,
             "set" if self.is_set() else "clear",
         )
@@ -255,7 +255,7 @@ def wait(
             return timeout_fut
 
 
-class _ReleasingContextManager(object):
+class _ReleasingContextManager:
     """Releases a Lock or Semaphore at the end of a "with" statement.
 
     with (yield semaphore.acquire()):
@@ -389,12 +389,10 @@ def __init__(self, value: int = 1) -> None:
 
     def __repr__(self) -> str:
         res = super().__repr__()
-        extra = (
-            "locked" if self._value == 0 else "unlocked,value:{0}".format(self._value)
-        )
+        extra = "locked" if self._value == 0 else f"unlocked,value:{self._value}"
         if self._waiters:
-            extra = "{0},waiters:{1}".format(extra, len(self._waiters))
-        return "<{0} [{1}]>".format(res[1:-1], extra)
+            extra = f"{extra},waiters:{len(self._waiters)}"
+        return f"<{res[1:-1]} [{extra}]>"
 
     def release(self) -> None:
         """Increment the counter and wake one waiter."""
@@ -484,7 +482,7 @@ def release(self) -> None:
         super().release()
 
 
-class Lock(object):
+class Lock:
     """A lock for coroutines.
 
     A Lock begins unlocked, and `acquire` locks it immediately. While it is
@@ -525,7 +523,7 @@ def __init__(self) -> None:
         self._block = BoundedSemaphore(value=1)
 
     def __repr__(self) -> str:
-        return "<%s _block=%s>" % (self.__class__.__name__, self._block)
+        return f"<{self.__class__.__name__} _block={self._block}>"
 
     def acquire(
         self, timeout: Optional[Union[float, datetime.timedelta]] = None
diff --git a/tornado/log.py b/tornado/log.py
index 8699896..f5ca5c0 100644
--- a/tornado/log.py
+++ b/tornado/log.py
@@ -187,7 +187,7 @@ def format(self, record: Any) -> str:
             # byte strings wherever possible).
             record.message = _safe_unicode(message)
         except Exception as e:
-            record.message = "Bad message (%r): %r" % (e, record.__dict__)
+            record.message = f"Bad message ({e!r}): {record.__dict__!r}"
 
         record.asctime = self.formatTime(record, cast(str, self.datefmt))
 
diff --git a/tornado/netutil.py b/tornado/netutil.py
index 18c91e6..3ec76af 100644
--- a/tornado/netutil.py
+++ b/tornado/netutil.py
@@ -126,14 +126,14 @@ def bind_sockets(
             continue
         try:
             sock = socket.socket(af, socktype, proto)
-        except socket.error as e:
+        except OSError as e:
             if errno_from_exception(e) == errno.EAFNOSUPPORT:
                 continue
             raise
         if os.name != "nt":
             try:
                 sock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
-            except socket.error as e:
+            except OSError as e:
                 if errno_from_exception(e) != errno.ENOPROTOOPT:
                     # Hurd doesn't support SO_REUSEADDR.
                     raise
@@ -204,22 +204,28 @@ def bind_unix_socket(
         sock = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
         try:
             sock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
-        except socket.error as e:
+        except OSError as e:
             if errno_from_exception(e) != errno.ENOPROTOOPT:
                 # Hurd doesn't support SO_REUSEADDR
                 raise
         sock.setblocking(False)
-        try:
-            st = os.stat(file)
-        except FileNotFoundError:
-            pass
-        else:
-            if stat.S_ISSOCK(st.st_mode):
-                os.remove(file)
+        # File names comprising of an initial null-byte denote an abstract
+        # namespace, on Linux, and therefore are not subject to file system
+        # orientated processing.
+        if not file.startswith("\0"):
+            try:
+                st = os.stat(file)
+            except FileNotFoundError:
+                pass
             else:
-                raise ValueError("File %s exists and is not a socket", file)
-        sock.bind(file)
-        os.chmod(file, mode)
+                if stat.S_ISSOCK(st.st_mode):
+                    os.remove(file)
+                else:
+                    raise ValueError("File %s exists and is not a socket", file)
+            sock.bind(file)
+            os.chmod(file, mode)
+        else:
+            sock.bind(file)
         sock.listen(backlog)
         return sock
 
@@ -328,7 +334,6 @@ class method::
     * `tornado.netutil.BlockingResolver` (deprecated)
     * `tornado.netutil.ThreadedResolver` (deprecated)
     * `tornado.netutil.OverrideResolver`
-    * `tornado.platform.twisted.TwistedResolver` (deprecated)
     * `tornado.platform.caresresolver.CaresResolver` (deprecated)
 
     .. versionchanged:: 5.0
@@ -496,10 +501,6 @@ def initialize(self) -> None:  # type: ignore
 class ThreadedResolver(ExecutorResolver):
     """Multithreaded non-blocking `Resolver` implementation.
 
-    Requires the `concurrent.futures` package to be installed
-    (available in the standard library since Python 3.2,
-    installable with ``pip install futures`` in older versions).
-
     The thread pool size can be configured with::
 
         Resolver.configure('tornado.netutil.ThreadedResolver',
@@ -593,17 +594,15 @@ def ssl_options_to_context(
     """Try to convert an ``ssl_options`` dictionary to an
     `~ssl.SSLContext` object.
 
-    The ``ssl_options`` dictionary contains keywords to be passed to
-    ``ssl.SSLContext.wrap_socket``.  In Python 2.7.9+, `ssl.SSLContext` objects can
-    be used instead.  This function converts the dict form to its
-    `~ssl.SSLContext` equivalent, and may be used when a component which
-    accepts both forms needs to upgrade to the `~ssl.SSLContext` version
-    to use features like SNI or NPN.
+    The ``ssl_options`` argument may be either an `ssl.SSLContext` object or a dictionary containing
+    keywords to be passed to ``ssl.SSLContext.wrap_socket``.  This function converts the dict form
+    to its `~ssl.SSLContext` equivalent, and may be used when a component which accepts both forms
+    needs to upgrade to the `~ssl.SSLContext` version to use features like SNI or ALPN.
 
     .. versionchanged:: 6.2
 
-       Added server_side argument. Omitting this argument will
-       result in a DeprecationWarning on Python 3.10.
+       Added server_side argument. Omitting this argument will result in a DeprecationWarning on
+       Python 3.10.
 
     """
     if isinstance(ssl_options, ssl.SSLContext):
@@ -646,7 +645,7 @@ def ssl_wrap_socket(
     ssl_options: Union[Dict[str, Any], ssl.SSLContext],
     server_hostname: Optional[str] = None,
     server_side: Optional[bool] = None,
-    **kwargs: Any
+    **kwargs: Any,
 ) -> ssl.SSLSocket:
     """Returns an ``ssl.SSLSocket`` wrapping the given socket.
 
diff --git a/tornado/options.py b/tornado/options.py
index b829669..b6578bb 100644
--- a/tornado/options.py
+++ b/tornado/options.py
@@ -130,7 +130,7 @@ class Error(Exception):
     pass
 
 
-class OptionParser(object):
+class OptionParser:
     """A collection of options, a dictionary with object-like access.
 
     Normally accessed via static functions in the `tornado.options` module,
@@ -188,7 +188,7 @@ def groups(self) -> Set[str]:
 
         .. versionadded:: 3.1
         """
-        return set(opt.group_name for opt in self._options.values())
+        return {opt.group_name for opt in self._options.values()}
 
     def group_dict(self, group: str) -> Dict[str, Any]:
         """The names and values of options in a group.
@@ -207,18 +207,18 @@ def group_dict(self, group: str) -> Dict[str, Any]:
 
         .. versionadded:: 3.1
         """
-        return dict(
-            (opt.name, opt.value())
+        return {
+            opt.name: opt.value()
             for name, opt in self._options.items()
             if not group or group == opt.group_name
-        )
+        }
 
     def as_dict(self) -> Dict[str, Any]:
         """The names and values of all options.
 
         .. versionadded:: 3.1
         """
-        return dict((opt.name, opt.value()) for name, opt in self._options.items())
+        return {opt.name: opt.value() for name, opt in self._options.items()}
 
     def define(
         self,
@@ -427,8 +427,8 @@ def parse_config_file(self, path: str, final: bool = True) -> None:
                             % (option.name, option.type.__name__)
                         )
 
-                if type(config[name]) == str and (
-                    option.type != str or option.multiple
+                if type(config[name]) is str and (
+                    option.type is not str or option.multiple
                 ):
                     option.parse(config[name])
                 else:
@@ -482,15 +482,11 @@ def run_parse_callbacks(self) -> None:
 
     def mockable(self) -> "_Mockable":
         """Returns a wrapper around self that is compatible with
-        `mock.patch <unittest.mock.patch>`.
+        `unittest.mock.patch`.
 
-        The `mock.patch <unittest.mock.patch>` function (included in
-        the standard library `unittest.mock` package since Python 3.3,
-        or in the third-party ``mock`` package for older versions of
-        Python) is incompatible with objects like ``options`` that
-        override ``__getattr__`` and ``__setattr__``.  This function
-        returns an object that can be used with `mock.patch.object
-        <unittest.mock.patch.object>` to modify option values::
+        The `unittest.mock.patch` function is incompatible with objects like ``options`` that
+        override ``__getattr__`` and ``__setattr__``.  This function returns an object that can be
+        used with `mock.patch.object <unittest.mock.patch.object>` to modify option values::
 
             with mock.patch.object(options.mockable(), 'name', value):
                 assert options.name == value
@@ -498,7 +494,7 @@ def mockable(self) -> "_Mockable":
         return _Mockable(self)
 
 
-class _Mockable(object):
+class _Mockable:
     """`mock.patch` compatible wrapper for `OptionParser`.
 
     As of ``mock`` version 1.0.1, when an object uses ``__getattr__``
@@ -528,7 +524,7 @@ def __delattr__(self, name: str) -> None:
         setattr(self._options, name, self._originals.pop(name))
 
 
-class _Option(object):
+class _Option:
     # This class could almost be made generic, but the way the types
     # interact with the multiple argument makes this tricky. (default
     # and the callback use List[T], but type is still Type[T]).
@@ -664,9 +660,8 @@ def _parse_timedelta(self, value: str) -> datetime.timedelta:
                 num = float(m.group(1))
                 units = m.group(2) or "seconds"
                 units = self._TIMEDELTA_ABBREV_DICT.get(units, units)
-                # This line confuses mypy when setup.py sets python_version=3.6
-                # https://github.com/python/mypy/issues/9676
-                sum += datetime.timedelta(**{units: num})  # type: ignore
+
+                sum += datetime.timedelta(**{units: num})
                 start = m.end()
             return sum
         except Exception:
diff --git a/tornado/platform/asyncio.py b/tornado/platform/asyncio.py
index 79e6084..a7a2e70 100644
--- a/tornado/platform/asyncio.py
+++ b/tornado/platform/asyncio.py
@@ -25,6 +25,7 @@
 import asyncio
 import atexit
 import concurrent.futures
+import contextvars
 import errno
 import functools
 import select
@@ -49,6 +50,9 @@
     Union,
 )
 
+if typing.TYPE_CHECKING:
+    from typing_extensions import TypeVarTuple, Unpack
+
 
 class _HasFileno(Protocol):
     def fileno(self) -> int:
@@ -59,6 +63,8 @@ def fileno(self) -> int:
 
 _T = TypeVar("_T")
 
+if typing.TYPE_CHECKING:
+    _Ts = TypeVarTuple("_Ts")
 
 # Collection of selector thread event loops to shut down on exit.
 _selector_loops: Set["SelectorThread"] = set()
@@ -381,58 +387,76 @@ def to_asyncio_future(tornado_future: asyncio.Future) -> asyncio.Future:
     return convert_yielded(tornado_future)
 
 
-if sys.platform == "win32" and hasattr(asyncio, "WindowsSelectorEventLoopPolicy"):
-    # "Any thread" and "selector" should be orthogonal, but there's not a clean
-    # interface for composing policies so pick the right base.
-    _BasePolicy = asyncio.WindowsSelectorEventLoopPolicy  # type: ignore
-else:
-    _BasePolicy = asyncio.DefaultEventLoopPolicy
+_AnyThreadEventLoopPolicy = None
 
 
-class AnyThreadEventLoopPolicy(_BasePolicy):  # type: ignore
-    """Event loop policy that allows loop creation on any thread.
+def __getattr__(name: str) -> typing.Any:
+    # The event loop policy system is deprecated in Python 3.14; simply accessing
+    # the name asyncio.DefaultEventLoopPolicy will raise a warning. Lazily create
+    # the AnyThreadEventLoopPolicy class so that the warning is only raised if
+    # the policy is used.
+    if name != "AnyThreadEventLoopPolicy":
+        raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
 
-    The default `asyncio` event loop policy only automatically creates
-    event loops in the main threads. Other threads must create event
-    loops explicitly or `asyncio.get_event_loop` (and therefore
-    `.IOLoop.current`) will fail. Installing this policy allows event
-    loops to be created automatically on any thread, matching the
-    behavior of Tornado versions prior to 5.0 (or 5.0 on Python 2).
+    global _AnyThreadEventLoopPolicy
+    if _AnyThreadEventLoopPolicy is None:
+        if sys.platform == "win32" and hasattr(
+            asyncio, "WindowsSelectorEventLoopPolicy"
+        ):
+            # "Any thread" and "selector" should be orthogonal, but there's not a clean
+            # interface for composing policies so pick the right base.
+            _BasePolicy = asyncio.WindowsSelectorEventLoopPolicy  # type: ignore
+        else:
+            _BasePolicy = asyncio.DefaultEventLoopPolicy
 
-    Usage::
+        class AnyThreadEventLoopPolicy(_BasePolicy):  # type: ignore
+            """Event loop policy that allows loop creation on any thread.
 
-        asyncio.set_event_loop_policy(AnyThreadEventLoopPolicy())
+            The default `asyncio` event loop policy only automatically creates
+            event loops in the main threads. Other threads must create event
+            loops explicitly or `asyncio.get_event_loop` (and therefore
+            `.IOLoop.current`) will fail. Installing this policy allows event
+            loops to be created automatically on any thread, matching the
+            behavior of Tornado versions prior to 5.0 (or 5.0 on Python 2).
 
-    .. versionadded:: 5.0
+            Usage::
 
-    .. deprecated:: 6.2
+                asyncio.set_event_loop_policy(AnyThreadEventLoopPolicy())
 
-        ``AnyThreadEventLoopPolicy`` affects the implicit creation
-        of an event loop, which is deprecated in Python 3.10 and
-        will be removed in a future version of Python. At that time
-        ``AnyThreadEventLoopPolicy`` will no longer be useful.
-        If you are relying on it, use `asyncio.new_event_loop`
-        or `asyncio.run` explicitly in any non-main threads that
-        need event loops.
-    """
+            .. versionadded:: 5.0
 
-    def __init__(self) -> None:
-        super().__init__()
-        warnings.warn(
-            "AnyThreadEventLoopPolicy is deprecated, use asyncio.run "
-            "or asyncio.new_event_loop instead",
-            DeprecationWarning,
-            stacklevel=2,
-        )
+            .. deprecated:: 6.2
 
-    def get_event_loop(self) -> asyncio.AbstractEventLoop:
-        try:
-            return super().get_event_loop()
-        except RuntimeError:
-            # "There is no current event loop in thread %r"
-            loop = self.new_event_loop()
-            self.set_event_loop(loop)
-            return loop
+                ``AnyThreadEventLoopPolicy`` affects the implicit creation
+                of an event loop, which is deprecated in Python 3.10 and
+                will be removed in a future version of Python. At that time
+                ``AnyThreadEventLoopPolicy`` will no longer be useful.
+                If you are relying on it, use `asyncio.new_event_loop`
+                or `asyncio.run` explicitly in any non-main threads that
+                need event loops.
+            """
+
+            def __init__(self) -> None:
+                super().__init__()
+                warnings.warn(
+                    "AnyThreadEventLoopPolicy is deprecated, use asyncio.run "
+                    "or asyncio.new_event_loop instead",
+                    DeprecationWarning,
+                    stacklevel=2,
+                )
+
+            def get_event_loop(self) -> asyncio.AbstractEventLoop:
+                try:
+                    return super().get_event_loop()
+                except RuntimeError:
+                    # "There is no current event loop in thread %r"
+                    loop = self.new_event_loop()
+                    self.set_event_loop(loop)
+                    return loop
+
+        _AnyThreadEventLoopPolicy = AnyThreadEventLoopPolicy
+
+    return _AnyThreadEventLoopPolicy
 
 
 class SelectorThread:
@@ -449,6 +473,8 @@ class SelectorThread:
     _closed = False
 
     def __init__(self, real_loop: asyncio.AbstractEventLoop) -> None:
+        self._main_thread_ctx = contextvars.copy_context()
+
         self._real_loop = real_loop
 
         self._select_cond = threading.Condition()
@@ -468,7 +494,8 @@ async def thread_manager_anext() -> None:
         # clean up if we get to this point but the event loop is closed without
         # starting.
         self._real_loop.call_soon(
-            lambda: self._real_loop.create_task(thread_manager_anext())
+            lambda: self._real_loop.create_task(thread_manager_anext()),
+            context=self._main_thread_ctx,
         )
 
         self._readers: Dict[_FileDescriptorLike, Callable] = {}
@@ -595,7 +622,9 @@ def _run_select(self) -> None:
                     raise
 
             try:
-                self._real_loop.call_soon_threadsafe(self._handle_select, rs, ws)
+                self._real_loop.call_soon_threadsafe(
+                    self._handle_select, rs, ws, context=self._main_thread_ctx
+                )
             except RuntimeError:
                 # "Event loop is closed". Swallow the exception for
                 # consistency with PollIOLoop (and logical consistency
@@ -702,12 +731,18 @@ def close(self) -> None:
         self._real_loop.close()
 
     def add_reader(
-        self, fd: "_FileDescriptorLike", callback: Callable[..., None], *args: Any
+        self,
+        fd: "_FileDescriptorLike",
+        callback: Callable[..., None],
+        *args: "Unpack[_Ts]",
     ) -> None:
         return self._selector.add_reader(fd, callback, *args)
 
     def add_writer(
-        self, fd: "_FileDescriptorLike", callback: Callable[..., None], *args: Any
+        self,
+        fd: "_FileDescriptorLike",
+        callback: Callable[..., None],
+        *args: "Unpack[_Ts]",
     ) -> None:
         return self._selector.add_writer(fd, callback, *args)
 
diff --git a/tornado/platform/caresresolver.py b/tornado/platform/caresresolver.py
index 1ba45c9..d53cf83 100644
--- a/tornado/platform/caresresolver.py
+++ b/tornado/platform/caresresolver.py
@@ -73,7 +73,7 @@ def resolve(
             )
             result, error = yield fut
             if error:
-                raise IOError(
+                raise OSError(
                     "C-Ares returned error %s: %s while resolving %s"
                     % (error, pycares.errno.strerror(error), host)
                 )
@@ -87,7 +87,7 @@ def resolve(
             else:
                 address_family = socket.AF_UNSPEC
             if family != socket.AF_UNSPEC and family != address_family:
-                raise IOError(
+                raise OSError(
                     "Requested socket family %d but got %d" % (family, address_family)
                 )
             addrinfo.append((typing.cast(int, address_family), (address, port)))
diff --git a/tornado/platform/twisted.py b/tornado/platform/twisted.py
index 153fe43..fc57e8d 100644
--- a/tornado/platform/twisted.py
+++ b/tornado/platform/twisted.py
@@ -9,103 +9,17 @@
 # WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
 # License for the specific language governing permissions and limitations
 # under the License.
-"""Bridges between the Twisted package and Tornado.
-"""
+"""Bridges between the Twisted package and Tornado."""
 
-import socket
 import sys
 
-import twisted.internet.abstract  # type: ignore
-import twisted.internet.asyncioreactor  # type: ignore
 from twisted.internet.defer import Deferred  # type: ignore
 from twisted.python import failure  # type: ignore
-import twisted.names.cache  # type: ignore
-import twisted.names.client  # type: ignore
-import twisted.names.hosts  # type: ignore
-import twisted.names.resolve  # type: ignore
-
 
 from tornado.concurrent import Future, future_set_exc_info
-from tornado.escape import utf8
 from tornado import gen
-from tornado.netutil import Resolver
-
-import typing
-
-if typing.TYPE_CHECKING:
-    from typing import Generator, Any, List, Tuple  # noqa: F401
-
-
-class TwistedResolver(Resolver):
-    """Twisted-based asynchronous resolver.
-
-    This is a non-blocking and non-threaded resolver.  It is
-    recommended only when threads cannot be used, since it has
-    limitations compared to the standard ``getaddrinfo``-based
-    `~tornado.netutil.Resolver` and
-    `~tornado.netutil.DefaultExecutorResolver`.  Specifically, it returns at
-    most one result, and arguments other than ``host`` and ``family``
-    are ignored.  It may fail to resolve when ``family`` is not
-    ``socket.AF_UNSPEC``.
-
-    Requires Twisted 12.1 or newer.
-
-    .. versionchanged:: 5.0
-       The ``io_loop`` argument (deprecated since version 4.1) has been removed.
-
-    .. deprecated:: 6.2
-       This class is deprecated and will be removed in Tornado 7.0. Use the default
-       thread-based resolver instead.
-    """
 
-    def initialize(self) -> None:
-        # partial copy of twisted.names.client.createResolver, which doesn't
-        # allow for a reactor to be passed in.
-        self.reactor = twisted.internet.asyncioreactor.AsyncioSelectorReactor()
-
-        host_resolver = twisted.names.hosts.Resolver("/etc/hosts")
-        cache_resolver = twisted.names.cache.CacheResolver(reactor=self.reactor)
-        real_resolver = twisted.names.client.Resolver(
-            "/etc/resolv.conf", reactor=self.reactor
-        )
-        self.resolver = twisted.names.resolve.ResolverChain(
-            [host_resolver, cache_resolver, real_resolver]
-        )
-
-    @gen.coroutine
-    def resolve(
-        self, host: str, port: int, family: int = 0
-    ) -> "Generator[Any, Any, List[Tuple[int, Any]]]":
-        # getHostByName doesn't accept IP addresses, so if the input
-        # looks like an IP address just return it immediately.
-        if twisted.internet.abstract.isIPAddress(host):
-            resolved = host
-            resolved_family = socket.AF_INET
-        elif twisted.internet.abstract.isIPv6Address(host):
-            resolved = host
-            resolved_family = socket.AF_INET6
-        else:
-            deferred = self.resolver.getHostByName(utf8(host))
-            fut = Future()  # type: Future[Any]
-            deferred.addBoth(fut.set_result)
-            resolved = yield fut
-            if isinstance(resolved, failure.Failure):
-                try:
-                    resolved.raiseException()
-                except twisted.names.error.DomainError as e:
-                    raise IOError(e)
-            elif twisted.internet.abstract.isIPAddress(resolved):
-                resolved_family = socket.AF_INET
-            elif twisted.internet.abstract.isIPv6Address(resolved):
-                resolved_family = socket.AF_INET6
-            else:
-                resolved_family = socket.AF_UNSPEC
-        if family != socket.AF_UNSPEC and family != resolved_family:
-            raise Exception(
-                "Requested socket family %d but got %d" % (family, resolved_family)
-            )
-        result = [(typing.cast(int, resolved_family), (resolved, port))]
-        return result
+import typing  # noqa: F401
 
 
 def install() -> None:
@@ -127,16 +41,16 @@ def install() -> None:
        ``asyncio`` reactor instead.
 
     """
-    from twisted.internet.asyncioreactor import install
+    from twisted.internet.asyncioreactor import install  # type: ignore
 
     install()
 
 
 if hasattr(gen.convert_yielded, "register"):
 
-    @gen.convert_yielded.register(Deferred)  # type: ignore
+    @gen.convert_yielded.register(Deferred)
     def _(d: Deferred) -> Future:
-        f = Future()  # type: Future[Any]
+        f = Future()  # type: Future[typing.Any]
 
         def errback(failure: failure.Failure) -> None:
             try:
diff --git a/tornado/process.py b/tornado/process.py
index 12e3eb6..339ef65 100644
--- a/tornado/process.py
+++ b/tornado/process.py
@@ -185,7 +185,7 @@ def task_id() -> Optional[int]:
     return _task_id
 
 
-class Subprocess(object):
+class Subprocess:
     """Wraps ``subprocess.Popen`` with IOStream support.
 
     The constructor is the same as ``subprocess.Popen`` with the following
diff --git a/tornado/queues.py b/tornado/queues.py
index 1358d0e..9552633 100644
--- a/tornado/queues.py
+++ b/tornado/queues.py
@@ -328,13 +328,13 @@ def _consume_expired(self) -> None:
             self._getters.popleft()
 
     def __repr__(self) -> str:
-        return "<%s at %s %s>" % (type(self).__name__, hex(id(self)), self._format())
+        return f"<{type(self).__name__} at {hex(id(self))} {self._format()}>"
 
     def __str__(self) -> str:
-        return "<%s %s>" % (type(self).__name__, self._format())
+        return f"<{type(self).__name__} {self._format()}>"
 
     def _format(self) -> str:
-        result = "maxsize=%r" % (self.maxsize,)
+        result = f"maxsize={self.maxsize!r}"
         if getattr(self, "_queue", None):
             result += " queue=%r" % self._queue
         if self._getters:
diff --git a/tornado/routing.py b/tornado/routing.py
index a145d71..ff833d5 100644
--- a/tornado/routing.py
+++ b/tornado/routing.py
@@ -184,7 +184,18 @@ def request_callable(request):
 from tornado.log import app_log
 from tornado.util import basestring_type, import_object, re_unescape, unicode_type
 
-from typing import Any, Union, Optional, Awaitable, List, Dict, Pattern, Tuple, overload
+from typing import (
+    Any,
+    Union,
+    Optional,
+    Awaitable,
+    List,
+    Dict,
+    Pattern,
+    Tuple,
+    overload,
+    Sequence,
+)
 
 
 class Router(httputil.HTTPServerConnectionDelegate):
@@ -268,8 +279,8 @@ def finish(self) -> None:
         self.delegate.finish()
 
     def on_connection_close(self) -> None:
-        assert self.delegate is not None
-        self.delegate.on_connection_close()
+        if self.delegate is not None:
+            self.delegate.on_connection_close()
 
 
 class _DefaultMessageDelegate(httputil.HTTPMessageDelegate):
@@ -286,7 +297,7 @@ def finish(self) -> None:
 
 # _RuleList can either contain pre-constructed Rules or a sequence of
 # arguments to be passed to the Rule constructor.
-_RuleList = List[
+_RuleList = Sequence[
     Union[
         "Rule",
         List[Any],  # Can't do detailed typechecking of lists.
@@ -438,7 +449,7 @@ def reverse_url(self, name: str, *args: Any) -> Optional[str]:
         return None
 
 
-class Rule(object):
+class Rule:
     """A routing rule."""
 
     def __init__(
@@ -478,7 +489,7 @@ def reverse(self, *args: Any) -> Optional[str]:
         return self.matcher.reverse(*args)
 
     def __repr__(self) -> str:
-        return "%s(%r, %s, kwargs=%r, name=%r)" % (
+        return "{}({!r}, {}, kwargs={!r}, name={!r})".format(
             self.__class__.__name__,
             self.matcher,
             self.target,
@@ -487,7 +498,7 @@ def __repr__(self) -> str:
         )
 
 
-class Matcher(object):
+class Matcher:
     """Represents a matcher for request features."""
 
     def match(self, request: httputil.HTTPServerRequest) -> Optional[Dict[str, Any]]:
@@ -582,9 +593,9 @@ def match(self, request: httputil.HTTPServerRequest) -> Optional[Dict[str, Any]]
         # unnamed groups, we want to use either groups
         # or groupdict but not both.
         if self.regex.groupindex:
-            path_kwargs = dict(
-                (str(k), _unquote_or_none(v)) for (k, v) in match.groupdict().items()
-            )
+            path_kwargs = {
+                str(k): _unquote_or_none(v) for (k, v) in match.groupdict().items()
+            }
         else:
             path_args = [_unquote_or_none(s) for s in match.groups()]
 
@@ -686,7 +697,7 @@ def __init__(
         self.kwargs = kwargs
 
     def __repr__(self) -> str:
-        return "%s(%r, %s, kwargs=%r, name=%r)" % (
+        return "{}({!r}, {}, kwargs={!r}, name={!r})".format(
             self.__class__.__name__,
             self.regex.pattern,
             self.handler_class,
diff --git a/tornado/simple_httpclient.py b/tornado/simple_httpclient.py
index 5b2d4dc..cc16376 100644
--- a/tornado/simple_httpclient.py
+++ b/tornado/simple_httpclient.py
@@ -238,7 +238,7 @@ def _on_timeout(self, key: object, info: Optional[str] = None) -> None:
         request, callback, timeout_handle = self.waiting[key]
         self.queue.remove((key, request, callback))
 
-        error_message = "Timeout {0}".format(info) if info else "Timeout"
+        error_message = f"Timeout {info}" if info else "Timeout"
         timeout_response = HTTPResponse(
             request,
             599,
@@ -250,9 +250,7 @@ def _on_timeout(self, key: object, info: Optional[str] = None) -> None:
 
 
 class _HTTPConnection(httputil.HTTPMessageDelegate):
-    _SUPPORTED_METHODS = set(
-        ["GET", "HEAD", "POST", "PUT", "DELETE", "PATCH", "OPTIONS"]
-    )
+    _SUPPORTED_METHODS = {"GET", "HEAD", "POST", "PUT", "DELETE", "PATCH", "OPTIONS"}
 
     def __init__(
         self,
@@ -401,7 +399,7 @@ async def run(self) -> None:
             if self.request.user_agent:
                 self.request.headers["User-Agent"] = self.request.user_agent
             elif self.request.headers.get("User-Agent") is None:
-                self.request.headers["User-Agent"] = "Tornado/{}".format(version)
+                self.request.headers["User-Agent"] = f"Tornado/{version}"
             if not self.request.allow_nonstandard_methods:
                 # Some HTTP methods nearly always have bodies while others
                 # almost never do. Fail in this case unless the user has
@@ -487,7 +485,7 @@ def _on_timeout(self, info: Optional[str] = None) -> None:
         :info string key: More detailed timeout information.
         """
         self._timeout = None
-        error_message = "Timeout {0}".format(info) if info else "Timeout"
+        error_message = f"Timeout {info}" if info else "Timeout"
         if self.final_callback is not None:
             self._handle_exception(
                 HTTPTimeoutError, HTTPTimeoutError(error_message), None
@@ -607,7 +605,7 @@ async def headers_received(
             # Reassemble the start line.
             self.request.header_callback("%s %s %s\r\n" % first_line)
             for k, v in self.headers.get_all():
-                self.request.header_callback("%s: %s\r\n" % (k, v))
+                self.request.header_callback(f"{k}: {v}\r\n")
             self.request.header_callback("\r\n")
 
     def _should_follow_redirect(self) -> bool:
diff --git a/tornado/speedups.c b/tornado/speedups.c
index 525d660..992c29c 100644
--- a/tornado/speedups.c
+++ b/tornado/speedups.c
@@ -51,20 +51,36 @@ static PyObject* websocket_mask(PyObject* self, PyObject* args) {
     return result;
 }
 
+static int speedups_exec(PyObject *module) {
+    return 0;
+}
+
 static PyMethodDef methods[] = {
     {"websocket_mask",  websocket_mask, METH_VARARGS, ""},
     {NULL, NULL, 0, NULL}
 };
 
+static PyModuleDef_Slot slots[] = {
+    {Py_mod_exec, speedups_exec},
+#if (!defined(Py_LIMITED_API) && PY_VERSION_HEX >= 0x030c0000) || Py_LIMITED_API >= 0x030c0000
+    {Py_mod_multiple_interpreters, Py_MOD_PER_INTERPRETER_GIL_SUPPORTED},
+#endif
+#if (!defined(Py_LIMITED_API) && PY_VERSION_HEX >= 0x030d0000) || Py_LIMITED_API >= 0x030d0000
+    {Py_mod_gil, Py_MOD_GIL_NOT_USED},
+#endif
+    {0, NULL}
+};
+
 static struct PyModuleDef speedupsmodule = {
    PyModuleDef_HEAD_INIT,
    "speedups",
    NULL,
-   -1,
-   methods
+   0,
+   methods,
+   slots,
 };
 
 PyMODINIT_FUNC
 PyInit_speedups(void) {
-    return PyModule_Create(&speedupsmodule);
+    return PyModuleDef_Init(&speedupsmodule);
 }
diff --git a/tornado/tcpclient.py b/tornado/tcpclient.py
index 0a82906..2e4b284 100644
--- a/tornado/tcpclient.py
+++ b/tornado/tcpclient.py
@@ -38,7 +38,7 @@
 _INITIAL_CONNECT_TIMEOUT = 0.3
 
 
-class _Connector(object):
+class _Connector:
     """A stateless implementation of the "Happy Eyeballs" algorithm.
 
     "Happy Eyeballs" is documented in RFC6555 as the recommended practice
@@ -199,7 +199,7 @@ def close_streams(self) -> None:
             stream.close()
 
 
-class TCPClient(object):
+class TCPClient:
     """A non-blocking TCP connection factory.
 
     .. versionchanged:: 5.0
@@ -318,13 +318,13 @@ def _create_stream(
             # If the user requires binding also to a specific IP/port.
             try:
                 socket_obj.bind((source_ip_bind, source_port_bind))
-            except socket.error:
+            except OSError:
                 socket_obj.close()
                 # Fail loudly if unable to use the IP/port.
                 raise
         try:
             stream = IOStream(socket_obj, max_buffer_size=max_buffer_size)
-        except socket.error as e:
+        except OSError as e:
             fu = Future()  # type: Future[IOStream]
             fu.set_exception(e)
             return stream, fu
diff --git a/tornado/tcpserver.py b/tornado/tcpserver.py
index 02c0ca0..4bf9f79 100644
--- a/tornado/tcpserver.py
+++ b/tornado/tcpserver.py
@@ -40,7 +40,7 @@
     from typing import Callable, List  # noqa: F401
 
 
-class TCPServer(object):
+class TCPServer:
     r"""A non-blocking, single-threaded TCP server.
 
     To use `TCPServer`, define a subclass which overrides the `handle_stream`
@@ -75,7 +75,7 @@ async def handle_stream(self, stream, address):
             async def main():
                 server = TCPServer()
                 server.listen(8888)
-                await asyncio.Event.wait()
+                await asyncio.Event().wait()
 
             asyncio.run(main())
 
@@ -339,7 +339,7 @@ def handle_stream(
 
     def _handle_connection(self, connection: socket.socket, address: Any) -> None:
         if self.ssl_options is not None:
-            assert ssl, "Python 2.6+ and OpenSSL required for SSL"
+            assert ssl, "OpenSSL required for SSL"
             try:
                 connection = ssl_wrap_socket(
                     connection,
@@ -352,7 +352,7 @@ def _handle_connection(self, connection: socket.socket, address: Any) -> None:
                     return connection.close()
                 else:
                     raise
-            except socket.error as err:
+            except OSError as err:
                 # If the connection is closed immediately after it is created
                 # (as in a port scan), we can get one of several errors.
                 # wrap_socket makes an internal call to getpeername,
diff --git a/tornado/template.py b/tornado/template.py
index d53e977..0064c6f 100644
--- a/tornado/template.py
+++ b/tornado/template.py
@@ -249,7 +249,7 @@ def filter_whitespace(mode: str, text: str) -> str:
         raise Exception("invalid whitespace mode %s" % mode)
 
 
-class Template(object):
+class Template:
     """A compiled template.
 
     We compile into Python from the given template_string. You can generate
@@ -389,7 +389,7 @@ def _get_ancestors(self, loader: Optional["BaseLoader"]) -> List["_File"]:
         return ancestors
 
 
-class BaseLoader(object):
+class BaseLoader:
     """Base class for template loaders.
 
     You must use a template loader to use template constructs like
@@ -399,7 +399,7 @@ class BaseLoader(object):
 
     def __init__(
         self,
-        autoescape: str = _DEFAULT_AUTOESCAPE,
+        autoescape: Optional[str] = _DEFAULT_AUTOESCAPE,
         namespace: Optional[Dict[str, Any]] = None,
         whitespace: Optional[str] = None,
     ) -> None:
@@ -500,7 +500,7 @@ def _create_template(self, name: str) -> Template:
         return Template(self.dict[name], name=name, loader=self)
 
 
-class _Node(object):
+class _Node:
     def each_child(self) -> Iterable["_Node"]:
         return ()
 
@@ -610,7 +610,7 @@ def generate(self, writer: "_CodeWriter") -> None:
             self.body.generate(writer)
             writer.write_line("return _tt_utf8('').join(_tt_buffer)", self.line)
         writer.write_line(
-            "_tt_append(_tt_utf8(%s(%s())))" % (self.method, method_name), self.line
+            f"_tt_append(_tt_utf8({self.method}({method_name}())))", self.line
         )
 
 
@@ -720,7 +720,7 @@ def __str__(self) -> str:
         return "%s at %s:%d" % (self.message, self.filename, self.lineno)
 
 
-class _CodeWriter(object):
+class _CodeWriter:
     def __init__(
         self,
         file: TextIO,
@@ -740,7 +740,7 @@ def indent_size(self) -> int:
         return self._indent
 
     def indent(self) -> "ContextManager":
-        class Indenter(object):
+        class Indenter:
             def __enter__(_) -> "_CodeWriter":
                 self._indent += 1
                 return self
@@ -755,7 +755,7 @@ def include(self, template: Template, line: int) -> "ContextManager":
         self.include_stack.append((self.current_template, line))
         self.current_template = template
 
-        class IncludeTemplate(object):
+        class IncludeTemplate:
             def __enter__(_) -> "_CodeWriter":
                 return self
 
@@ -778,7 +778,7 @@ def write_line(
         print("    " * indent + line + line_comment, file=self.file)
 
 
-class _TemplateReader(object):
+class _TemplateReader:
     def __init__(self, name: str, text: str, whitespace: str) -> None:
         self.name = name
         self.text = text
@@ -936,20 +936,18 @@ def _parse(
 
         # Intermediate ("else", "elif", etc) blocks
         intermediate_blocks = {
-            "else": set(["if", "for", "while", "try"]),
-            "elif": set(["if"]),
-            "except": set(["try"]),
-            "finally": set(["try"]),
+            "else": {"if", "for", "while", "try"},
+            "elif": {"if"},
+            "except": {"try"},
+            "finally": {"try"},
         }
         allowed_parents = intermediate_blocks.get(operator)
         if allowed_parents is not None:
             if not in_block:
-                reader.raise_parse_error(
-                    "%s outside %s block" % (operator, allowed_parents)
-                )
+                reader.raise_parse_error(f"{operator} outside {allowed_parents} block")
             if in_block not in allowed_parents:
                 reader.raise_parse_error(
-                    "%s block cannot be attached to %s block" % (operator, in_block)
+                    f"{operator} block cannot be attached to {in_block} block"
                 )
             body.chunks.append(_IntermediateControlBlock(contents, line))
             continue
@@ -1038,7 +1036,7 @@ def _parse(
         elif operator in ("break", "continue"):
             if not in_loop:
                 reader.raise_parse_error(
-                    "%s outside %s block" % (operator, set(["for", "while"]))
+                    "{} outside {} block".format(operator, {"for", "while"})
                 )
             body.chunks.append(_Statement(contents, line))
             continue
diff --git a/tornado/test/__main__.py b/tornado/test/__main__.py
index 890bd50..65b794d 100644
--- a/tornado/test/__main__.py
+++ b/tornado/test/__main__.py
@@ -1,6 +1,4 @@
 """Shim to allow python -m tornado.test.
-
-This only works in python 2.7+.
 """
 
 from tornado.test.runtests import all, main
diff --git a/tornado/test/asyncio_test.py b/tornado/test/asyncio_test.py
index bb6416a..f33c5f5 100644
--- a/tornado/test/asyncio_test.py
+++ b/tornado/test/asyncio_test.py
@@ -11,21 +11,29 @@
 # under the License.
 
 import asyncio
+import contextvars
 import threading
 import time
 import unittest
 import warnings
 
 from concurrent.futures import ThreadPoolExecutor
+import tornado.platform.asyncio
 from tornado import gen
 from tornado.ioloop import IOLoop
 from tornado.platform.asyncio import (
     AsyncIOLoop,
     to_asyncio_future,
-    AnyThreadEventLoopPolicy,
     AddThreadSelectorEventLoop,
 )
-from tornado.testing import AsyncTestCase, gen_test
+from tornado.testing import (
+    AsyncTestCase,
+    gen_test,
+    setup_with_context_manager,
+    AsyncHTTPTestCase,
+)
+from tornado.test.util import ignore_deprecation
+from tornado.web import Application, RequestHandler
 
 
 class AsyncIOLoopTest(AsyncTestCase):
@@ -111,10 +119,6 @@ class LeakTest(unittest.TestCase):
     def setUp(self):
         # Trigger a cleanup of the mapping so we start with a clean slate.
         AsyncIOLoop(make_current=False).close()
-        # If we don't clean up after ourselves other tests may fail on
-        # py34.
-        self.orig_policy = asyncio.get_event_loop_policy()
-        asyncio.set_event_loop_policy(asyncio.DefaultEventLoopPolicy())
 
     def tearDown(self):
         try:
@@ -124,7 +128,6 @@ def tearDown(self):
             pass
         else:
             loop.close()
-        asyncio.set_event_loop_policy(self.orig_policy)
 
     def test_ioloop_close_leak(self):
         orig_count = len(IOLoop._ioloop_for_asyncio)
@@ -205,6 +208,12 @@ def test_tornado(self):
 
 class AnyThreadEventLoopPolicyTest(unittest.TestCase):
     def setUp(self):
+        setup_with_context_manager(self, ignore_deprecation())
+        # Referencing the event loop policy attributes raises deprecation warnings,
+        # so instead of importing this at the top of the file we capture it here.
+        self.AnyThreadEventLoopPolicy = (
+            tornado.platform.asyncio.AnyThreadEventLoopPolicy
+        )
         self.orig_policy = asyncio.get_event_loop_policy()
         self.executor = ThreadPoolExecutor(1)
 
@@ -237,7 +246,7 @@ def test_asyncio_accessor(self):
                 RuntimeError, self.executor.submit(asyncio.get_event_loop).result
             )
             # Set the policy and we can get a loop.
-            asyncio.set_event_loop_policy(AnyThreadEventLoopPolicy())
+            asyncio.set_event_loop_policy(self.AnyThreadEventLoopPolicy())
             self.assertIsInstance(
                 self.executor.submit(asyncio.get_event_loop).result(),
                 asyncio.AbstractEventLoop,
@@ -256,6 +265,34 @@ def test_tornado_accessor(self):
             # IOLoop doesn't (currently) close the underlying loop.
             self.executor.submit(lambda: asyncio.get_event_loop().close()).result()  # type: ignore
 
-            asyncio.set_event_loop_policy(AnyThreadEventLoopPolicy())
+            asyncio.set_event_loop_policy(self.AnyThreadEventLoopPolicy())
             self.assertIsInstance(self.executor.submit(IOLoop.current).result(), IOLoop)
             self.executor.submit(lambda: asyncio.get_event_loop().close()).result()  # type: ignore
+
+
+class SelectorThreadContextvarsTest(AsyncHTTPTestCase):
+    ctx_value = "foo"
+    test_endpoint = "/"
+    tornado_test_ctx = contextvars.ContextVar("tornado_test_ctx", default="default")
+    tornado_test_ctx.set(ctx_value)
+
+    def get_app(self) -> Application:
+        tornado_test_ctx = self.tornado_test_ctx
+
+        class Handler(RequestHandler):
+            async def get(self):
+                # On the Windows platform,
+                # when a asyncio.events.Handle is created
+                # in the SelectorThread without providing a context,
+                # it will copy the current thread's context,
+                # which can lead to the loss of the main thread's context
+                # when executing the handle.
+                # Therefore, it is necessary to
+                # save a copy of the main thread's context in the SelectorThread
+                # for creating the handle.
+                self.write(tornado_test_ctx.get())
+
+        return Application([(self.test_endpoint, Handler)])
+
+    def test_context_vars(self):
+        self.assertEqual(self.ctx_value, self.fetch(self.test_endpoint).body.decode())
diff --git a/tornado/test/auth_test.py b/tornado/test/auth_test.py
index 5eddb98..834f04e 100644
--- a/tornado/test/auth_test.py
+++ b/tornado/test/auth_test.py
@@ -341,7 +341,7 @@ def get_app(self):
     def test_openid_redirect(self):
         response = self.fetch("/openid/client/login", follow_redirects=False)
         self.assertEqual(response.code, 302)
-        self.assertTrue("/openid/server/authenticate?" in response.headers["Location"])
+        self.assertIn("/openid/server/authenticate?", response.headers["Location"])
 
     def test_openid_get_user(self):
         response = self.fetch(
@@ -363,9 +363,9 @@ def test_oauth10_redirect(self):
             )
         )
         # the cookie is base64('zxcv')|base64('1234')
-        self.assertTrue(
-            '_oauth_request_token="enhjdg==|MTIzNA=="'
-            in response.headers["Set-Cookie"],
+        self.assertIn(
+            '_oauth_request_token="enhjdg==|MTIzNA=="',
+            response.headers["Set-Cookie"],
             response.headers["Set-Cookie"],
         )
 
@@ -385,8 +385,8 @@ def test_oauth10_request_parameters(self):
         parsed = json_decode(response.body)
         self.assertEqual(parsed["oauth_consumer_key"], "asdf")
         self.assertEqual(parsed["oauth_token"], "uiop")
-        self.assertTrue("oauth_nonce" in parsed)
-        self.assertTrue("oauth_signature" in parsed)
+        self.assertIn("oauth_nonce", parsed)
+        self.assertIn("oauth_signature", parsed)
 
     def test_oauth10a_redirect(self):
         response = self.fetch("/oauth10a/client/login", follow_redirects=False)
@@ -427,8 +427,8 @@ def test_oauth10a_request_parameters(self):
         parsed = json_decode(response.body)
         self.assertEqual(parsed["oauth_consumer_key"], "asdf")
         self.assertEqual(parsed["oauth_token"], "uiop")
-        self.assertTrue("oauth_nonce" in parsed)
-        self.assertTrue("oauth_signature" in parsed)
+        self.assertIn("oauth_nonce", parsed)
+        self.assertIn("oauth_signature", parsed)
 
     def test_oauth10a_get_user_coroutine_exception(self):
         response = self.fetch(
@@ -440,7 +440,7 @@ def test_oauth10a_get_user_coroutine_exception(self):
     def test_oauth2_redirect(self):
         response = self.fetch("/oauth2/client/login", follow_redirects=False)
         self.assertEqual(response.code, 302)
-        self.assertTrue("/oauth2/server/authorize?" in response.headers["Location"])
+        self.assertIn("/oauth2/server/authorize?", response.headers["Location"])
 
     def test_facebook_login(self):
         response = self.fetch("/facebook/client/login", follow_redirects=False)
@@ -464,9 +464,9 @@ def base_twitter_redirect(self, url):
             )
         )
         # the cookie is base64('zxcv')|base64('1234')
-        self.assertTrue(
-            '_oauth_request_token="enhjdg==|MTIzNA=="'
-            in response.headers["Set-Cookie"],
+        self.assertIn(
+            '_oauth_request_token="enhjdg==|MTIzNA=="',
+            response.headers["Set-Cookie"],
             response.headers["Set-Cookie"],
         )
 
@@ -486,9 +486,9 @@ def test_twitter_authenticate_redirect(self):
             response.headers["Location"],
         )
         # the cookie is base64('zxcv')|base64('1234')
-        self.assertTrue(
-            '_oauth_request_token="enhjdg==|MTIzNA=="'
-            in response.headers["Set-Cookie"],
+        self.assertIn(
+            '_oauth_request_token="enhjdg==|MTIzNA=="',
+            response.headers["Set-Cookie"],
             response.headers["Set-Cookie"],
         )
 
diff --git a/tornado/test/autoreload_test.py b/tornado/test/autoreload_test.py
index 5675faa..60fb30c 100644
--- a/tornado/test/autoreload_test.py
+++ b/tornado/test/autoreload_test.py
@@ -73,9 +73,13 @@ def write_files(self, tree, base_path=None):
     def run_subprocess(self, args):
         # Make sure the tornado module under test is available to the test
         # application
-        pythonpath = os.getcwd()
+        parts = [os.getcwd()]
         if "PYTHONPATH" in os.environ:
-            pythonpath += os.pathsep + os.environ["PYTHONPATH"]
+            parts += [
+                os.path.join(os.getcwd(), part)
+                for part in os.environ["PYTHONPATH"].split(os.pathsep)
+            ]
+        pythonpath = os.pathsep.join(parts)
 
         p = Popen(
             args,
@@ -114,7 +118,7 @@ def test_reload(self):
 
 spec = getattr(sys.modules[__name__], '__spec__', None)
 print(f"Starting {__name__=}, __spec__.name={getattr(spec, 'name', None)}")
-exec(open("run_twice_magic.py").read())
+exec(open("run_twice_magic.py", encoding="utf-8").read())
 """
 
         # Create temporary test application
@@ -195,7 +199,7 @@ def test_reload_wrapper_preservation(self):
     raise Exception('started without autoreload wrapper')
 
 print('Starting')
-exec(open("run_twice_magic.py").read())
+exec(open("run_twice_magic.py", encoding="utf-8").read())
 """
 
         self.write_files(
@@ -219,7 +223,7 @@ def test_reload_wrapper_args(self):
 
 print(os.path.basename(sys.argv[0]))
 print(f'argv={sys.argv[1:]}')
-exec(open("run_twice_magic.py").read())
+exec(open("run_twice_magic.py", encoding="utf-8").read())
 """
         # Create temporary test application
         self.write_files({"main.py": main})
@@ -251,7 +255,7 @@ def test_reload_wrapper_until_success(self):
     sys.exit(0)
 else:
     print("reloading")
-    exec(open("run_twice_magic.py").read())
+    exec(open("run_twice_magic.py", encoding="utf-8").read())
 """
 
         # Create temporary test application
diff --git a/tornado/test/circlerefs_test.py b/tornado/test/circlerefs_test.py
index 5c25adf..d5f7e96 100644
--- a/tornado/test/circlerefs_test.py
+++ b/tornado/test/circlerefs_test.py
@@ -105,7 +105,7 @@ def assert_no_cycle_garbage():
 class CircleRefsTest(unittest.TestCase):
     def test_known_leak(self):
         # Construct a known leak scenario to make sure the test harness works.
-        class C(object):
+        class C:
             def __init__(self, name):
                 self.name = name
                 self.a: typing.Optional[C] = None
@@ -199,7 +199,7 @@ def test_run_on_executor(self):
 
         with concurrent.futures.ThreadPoolExecutor(1) as thread_pool:
 
-            class Factory(object):
+            class Factory:
                 executor = thread_pool
 
                 @tornado.concurrent.run_on_executor
diff --git a/tornado/test/concurrent_test.py b/tornado/test/concurrent_test.py
index 33fcb65..90fbcb1 100644
--- a/tornado/test/concurrent_test.py
+++ b/tornado/test/concurrent_test.py
@@ -16,11 +16,11 @@
 import logging
 import re
 import socket
-import typing
 import unittest
 
 from tornado.concurrent import (
     Future,
+    chain_future,
     run_on_executor,
     future_set_result_unless_cancelled,
 )
@@ -47,6 +47,31 @@ def test_future_set_result_unless_cancelled(self):
             self.assertEqual(fut.result(), 42)
 
 
+class ChainFutureTest(AsyncTestCase):
+    @gen_test
+    async def test_asyncio_futures(self):
+        fut: Future[int] = Future()
+        fut2: Future[int] = Future()
+        chain_future(fut, fut2)
+        fut.set_result(42)
+        result = await fut2
+        self.assertEqual(result, 42)
+
+    @gen_test
+    async def test_concurrent_futures(self):
+        # A three-step chain: two concurrent futures (showing that both arguments to chain_future
+        # can be concurrent futures), and then one from a concurrent future to an asyncio future so
+        # we can use it in await.
+        fut: futures.Future[int] = futures.Future()
+        fut2: futures.Future[int] = futures.Future()
+        fut3: Future[int] = Future()
+        chain_future(fut, fut2)
+        chain_future(fut2, fut3)
+        fut.set_result(42)
+        result = await fut3
+        self.assertEqual(result, 42)
+
+
 # The following series of classes demonstrate and test various styles
 # of use, with and without generators and futures.
 
@@ -68,7 +93,7 @@ class CapError(Exception):
     pass
 
 
-class BaseCapClient(object):
+class BaseCapClient:
     def __init__(self, port):
         self.port = port
 
@@ -98,33 +123,31 @@ def capitalize(self, request_data):
         raise gen.Return(self.process_response(data))
 
 
-class ClientTestMixin(object):
-    client_class = None  # type: typing.Callable
-
+class GeneratorCapClientTest(AsyncTestCase):
     def setUp(self):
-        super().setUp()  # type: ignore
+        super().setUp()
         self.server = CapServer()
         sock, port = bind_unused_port()
         self.server.add_sockets([sock])
-        self.client = self.client_class(port=port)
+        self.client = GeneratorCapClient(port=port)
 
     def tearDown(self):
         self.server.stop()
-        super().tearDown()  # type: ignore
+        super().tearDown()
 
-    def test_future(self: typing.Any):
+    def test_future(self):
         future = self.client.capitalize("hello")
         self.io_loop.add_future(future, self.stop)
         self.wait()
         self.assertEqual(future.result(), "HELLO")
 
-    def test_future_error(self: typing.Any):
+    def test_future_error(self):
         future = self.client.capitalize("HELLO")
         self.io_loop.add_future(future, self.stop)
         self.wait()
-        self.assertRaisesRegex(CapError, "already capitalized", future.result)  # type: ignore
+        self.assertRaisesRegex(CapError, "already capitalized", future.result)
 
-    def test_generator(self: typing.Any):
+    def test_generator(self):
         @gen.coroutine
         def f():
             result = yield self.client.capitalize("hello")
@@ -132,7 +155,7 @@ def f():
 
         self.io_loop.run_sync(f)
 
-    def test_generator_error(self: typing.Any):
+    def test_generator_error(self):
         @gen.coroutine
         def f():
             with self.assertRaisesRegex(CapError, "already capitalized"):
@@ -141,14 +164,10 @@ def f():
         self.io_loop.run_sync(f)
 
 
-class GeneratorClientTest(ClientTestMixin, AsyncTestCase):
-    client_class = GeneratorCapClient
-
-
 class RunOnExecutorTest(AsyncTestCase):
     @gen_test
     def test_no_calling(self):
-        class Object(object):
+        class Object:
             def __init__(self):
                 self.executor = futures.thread.ThreadPoolExecutor(1)
 
@@ -162,7 +181,7 @@ def f(self):
 
     @gen_test
     def test_call_with_no_args(self):
-        class Object(object):
+        class Object:
             def __init__(self):
                 self.executor = futures.thread.ThreadPoolExecutor(1)
 
@@ -176,7 +195,7 @@ def f(self):
 
     @gen_test
     def test_call_with_executor(self):
-        class Object(object):
+        class Object:
             def __init__(self):
                 self.__executor = futures.thread.ThreadPoolExecutor(1)
 
@@ -190,7 +209,7 @@ def f(self):
 
     @gen_test
     def test_async_await(self):
-        class Object(object):
+        class Object:
             def __init__(self):
                 self.executor = futures.thread.ThreadPoolExecutor(1)
 
diff --git a/tornado/test/curl_httpclient_test.py b/tornado/test/curl_httpclient_test.py
index 99af293..ce3f68d 100644
--- a/tornado/test/curl_httpclient_test.py
+++ b/tornado/test/curl_httpclient_test.py
@@ -51,13 +51,9 @@ def get(self):
             assert param_dict["nonce"] == nonce
             assert param_dict["username"] == self.username
             assert param_dict["uri"] == self.request.path
-            h1 = md5(
-                utf8("%s:%s:%s" % (self.username, realm, self.password))
-            ).hexdigest()
-            h2 = md5(
-                utf8("%s:%s" % (self.request.method, self.request.path))
-            ).hexdigest()
-            digest = md5(utf8("%s:%s:%s" % (h1, nonce, h2))).hexdigest()
+            h1 = md5(utf8(f"{self.username}:{realm}:{self.password}")).hexdigest()
+            h2 = md5(utf8(f"{self.request.method}:{self.request.path}")).hexdigest()
+            digest = md5(utf8(f"{h1}:{nonce}:{h2}")).hexdigest()
             if digest == param_dict["response"]:
                 self.write("ok")
             else:
@@ -66,7 +62,7 @@ def get(self):
             self.set_status(401)
             self.set_header(
                 "WWW-Authenticate",
-                'Digest realm="%s", nonce="%s", opaque="%s"' % (realm, nonce, opaque),
+                f'Digest realm="{realm}", nonce="{nonce}", opaque="{opaque}"',
             )
 
 
diff --git a/tornado/test/escape_test.py b/tornado/test/escape_test.py
index 3115a19..b9614dc 100644
--- a/tornado/test/escape_test.py
+++ b/tornado/test/escape_test.py
@@ -247,7 +247,7 @@ def test_xhtml_unescape_numeric(self):
     def test_url_escape_unicode(self):
         tests = [
             # byte strings are passed through as-is
-            ("\u00e9".encode("utf8"), "%C3%A9"),
+            ("\u00e9".encode(), "%C3%A9"),
             ("\u00e9".encode("latin1"), "%E9"),
             # unicode strings become utf8
             ("\u00e9", "%C3%A9"),
diff --git a/tornado/test/gen_test.py b/tornado/test/gen_test.py
index c17bf65..71fdceb 100644
--- a/tornado/test/gen_test.py
+++ b/tornado/test/gen_test.py
@@ -11,7 +11,7 @@
 from tornado.concurrent import Future
 from tornado.log import app_log
 from tornado.testing import AsyncHTTPTestCase, AsyncTestCase, ExpectLog, gen_test
-from tornado.test.util import skipOnTravis, skipNotCPython
+from tornado.test.util import skipNotCPython
 from tornado.web import Application, RequestHandler, HTTPError
 
 from tornado import gen
@@ -139,7 +139,6 @@ def f():
 
         self.io_loop.run_sync(f)
 
-    @skipOnTravis
     @gen_test
     def test_multi_performance(self):
         # Yielding a list used to have quadratic performance; make
@@ -437,19 +436,18 @@ def f():
             return
 
         result = yield f()
-        self.assertEqual(result, None)
+        self.assertIsNone(result)
         self.finished = True
 
     @gen_test
     def test_async_return_no_value(self):
-        # Without a return value we don't need python 3.3.
         @gen.coroutine
         def f():
             yield gen.moment
             return
 
         result = yield f()
-        self.assertEqual(result, None)
+        self.assertIsNone(result)
         self.finished = True
 
     @gen_test
@@ -573,15 +571,12 @@ def inner(iteration):
         self.finished = True
 
     @skipNotCPython
-    @unittest.skipIf(
-        (3,) < sys.version_info < (3, 6), "asyncio.Future has reference cycles"
-    )
     def test_coroutine_refcounting(self):
         # On CPython, tasks and their arguments should be released immediately
         # without waiting for garbage collection.
         @gen.coroutine
         def inner():
-            class Foo(object):
+            class Foo:
                 pass
 
             local_var = Foo()
@@ -602,7 +597,7 @@ def inner2():
 
         self.io_loop.run_sync(inner2, timeout=3)
 
-        self.assertIs(self.local_ref(), None)
+        self.assertIsNone(self.local_ref())
         self.finished = True
 
     def test_asyncio_future_debug_info(self):
@@ -803,8 +798,8 @@ def test_empty_iterator(self):
         with self.assertRaises(ValueError):
             g = gen.WaitIterator(Future(), bar=Future())
 
-        self.assertEqual(g.current_index, None, "bad nil current index")
-        self.assertEqual(g.current_future, None, "bad nil current future")
+        self.assertIsNone(g.current_index, "bad nil current index")
+        self.assertIsNone(g.current_future, "bad nil current future")
 
     @gen_test
     def test_already_done(self):
@@ -835,8 +830,8 @@ def test_already_done(self):
                 self.assertEqual(r, 84)
             i += 1
 
-        self.assertEqual(g.current_index, None, "bad nil current index")
-        self.assertEqual(g.current_future, None, "bad nil current future")
+        self.assertIsNone(g.current_index, "bad nil current index")
+        self.assertIsNone(g.current_future, "bad nil current future")
 
         dg = gen.WaitIterator(f1=f1, f2=f2)
 
@@ -853,12 +848,11 @@ def test_already_done(self):
                     "WaitIterator dict status incorrect",
                 )
             else:
-                self.fail("got bad WaitIterator index {}".format(dg.current_index))
+                self.fail(f"got bad WaitIterator index {dg.current_index}")
 
             i += 1
-
-        self.assertEqual(dg.current_index, None, "bad nil current index")
-        self.assertEqual(dg.current_future, None, "bad nil current future")
+        self.assertIsNone(g.current_index, "bad nil current index")
+        self.assertIsNone(g.current_future, "bad nil current future")
 
     def finish_coroutines(self, iteration, futures):
         if iteration == 3:
@@ -998,12 +992,12 @@ def do_something():
         loop.close()
         gc.collect()
         # Future was collected
-        self.assertIs(wfut[0](), None)
+        self.assertIsNone(wfut[0]())
         # At least one wakeup
         self.assertGreaterEqual(len(result), 2)
         if not self.is_pypy3():
             # coroutine finalizer was called (not on PyPy3 apparently)
-            self.assertIs(result[-1], None)
+            self.assertIsNone(result[-1])
 
     def test_gc_infinite_async_await(self):
         # Same as test_gc_infinite_coro, but with a `async def` function
@@ -1034,12 +1028,12 @@ def do_something():
             loop.close()
             gc.collect()
         # Future was collected
-        self.assertIs(wfut[0](), None)
+        self.assertIsNone(wfut[0]())
         # At least one wakeup and one finally
         self.assertGreaterEqual(len(result), 2)
         if not self.is_pypy3():
             # coroutine finalizer was called (not on PyPy3 apparently)
-            self.assertIs(result[-1], None)
+            self.assertIsNone(result[-1])
 
     def test_multi_moment(self):
         # Test gen.multi with moment
diff --git a/tornado/test/httpclient_test.py b/tornado/test/httpclient_test.py
index 17291f8..77c0d6e 100644
--- a/tornado/test/httpclient_test.py
+++ b/tornado/test/httpclient_test.py
@@ -28,7 +28,7 @@
 from tornado.log import gen_log, app_log
 from tornado import netutil
 from tornado.testing import AsyncHTTPTestCase, bind_unused_port, gen_test, ExpectLog
-from tornado.test.util import skipOnTravis, ignore_deprecation
+from tornado.test.util import ignore_deprecation
 from tornado.web import Application, RequestHandler, url
 from tornado.httputil import format_timestamp, HTTPHeaders
 
@@ -146,7 +146,7 @@ def get(self) -> None:
         # Triggering the potential bug seems to depend on input length.
         # This length is taken from the bad-response example reported in
         # https://github.com/tornadoweb/tornado/pull/2875 (uncompressed).
-        text = "".join("Hello World {}\n".format(i) for i in range(9000))[:149051]
+        text = "".join(f"Hello World {i}\n" for i in range(9000))[:149051]
         body = gzip.compress(text.encode(), compresslevel=6) + b"\00"
         self.write(body)
 
@@ -191,7 +191,6 @@ def test_patch_receives_payload(self):
         self.assertEqual(response.code, 200)
         self.assertEqual(response.body, body)
 
-    @skipOnTravis
     def test_hello_world(self):
         response = self.fetch("/hello")
         self.assertEqual(response.code, 200)
@@ -443,7 +442,7 @@ def test_invalid_gzip(self):
         # test if client hangs on tricky invalid gzip
         # curl/simple httpclient have different behavior (exception, logging)
         with ExpectLog(
-            app_log, "(Uncaught exception|Exception in callback)", required=False
+            gen_log, ".*Malformed HTTP message.*unconsumed gzip data", required=False
         ):
             try:
                 response = self.fetch("/invalid_gzip")
@@ -483,6 +482,23 @@ def streaming_callback(chunk):
         self.assertRegex(first_line[0], "HTTP/[0-9]\\.[0-9] 200.*\r\n")
         self.assertEqual(chunks, [b"asdf", b"qwer"])
 
+    def test_header_callback_to_parse_line(self):
+        # Make a request with header_callback and feed the headers to HTTPHeaders.parse_line.
+        # (Instead of HTTPHeaders.parse which is used in normal cases). Ensure that the resulting
+        # headers are as expected, and in particular do not have trailing whitespace added
+        # due to the final CRLF line.
+        headers = HTTPHeaders()
+
+        def header_callback(line):
+            if line.startswith("HTTP/"):
+                # Ignore the first status line
+                return
+            headers.parse_line(line)
+
+        self.fetch("/hello", header_callback=header_callback)
+        for k, v in headers.get_all():
+            self.assertTrue(v == v.strip(), (k, v))
+
     @gen_test
     def test_configure_defaults(self):
         defaults = dict(user_agent="TestDefaultUserAgent", allow_ipv6=False)
@@ -690,16 +706,18 @@ def test_response_times(self):
         start_time = time.time()
         response = self.fetch("/hello")
         response.rethrow()
-        assert response.request_time is not None
+        self.assertIsNotNone(response.request_time)
+        assert response.request_time is not None  # for mypy
         self.assertGreaterEqual(response.request_time, 0)
         self.assertLess(response.request_time, 1.0)
         # A very crude check to make sure that start_time is based on
         # wall time and not the monotonic clock.
-        assert response.start_time is not None
+        self.assertIsNotNone(response.start_time)
+        assert response.start_time is not None  # for mypy
         self.assertLess(abs(response.start_time - start_time), 1.0)
 
         for k, v in response.time_info.items():
-            self.assertTrue(0 <= v < 1.0, "time_info[%s] out of bounds: %s" % (k, v))
+            self.assertTrue(0 <= v < 1.0, f"time_info[{k}] out of bounds: {v}")
 
     def test_zero_timeout(self):
         response = self.fetch("/hello", connect_timeout=0)
@@ -763,7 +781,7 @@ def test_both_set(self):
 
     def test_neither_set(self):
         proxy = _RequestProxy(HTTPRequest("http://example.com/"), dict())
-        self.assertIs(proxy.auth_username, None)
+        self.assertIsNone(proxy.auth_username)
 
     def test_bad_attribute(self):
         proxy = _RequestProxy(HTTPRequest("http://example.com/"), dict())
@@ -772,7 +790,7 @@ def test_bad_attribute(self):
 
     def test_defaults_none(self):
         proxy = _RequestProxy(HTTPRequest("http://example.com/"), None)
-        self.assertIs(proxy.auth_username, None)
+        self.assertIsNone(proxy.auth_username)
 
 
 class HTTPResponseTestCase(unittest.TestCase):
diff --git a/tornado/test/httpserver_test.py b/tornado/test/httpserver_test.py
index 0b29a39..008078e 100644
--- a/tornado/test/httpserver_test.py
+++ b/tornado/test/httpserver_test.py
@@ -19,7 +19,6 @@
 from tornado.iostream import IOStream
 from tornado.locks import Event
 from tornado.log import gen_log, app_log
-from tornado.netutil import ssl_options_to_context
 from tornado.simple_httpclient import SimpleAsyncHTTPClient
 from tornado.testing import (
     AsyncHTTPTestCase,
@@ -28,10 +27,10 @@
     ExpectLog,
     gen_test,
 )
-from tornado.test.util import skipOnTravis
+from tornado.test.util import abstract_base_test
 from tornado.web import Application, RequestHandler, stream_request_body
 
-from contextlib import closing
+from contextlib import closing, contextmanager
 import datetime
 import gzip
 import logging
@@ -44,6 +43,7 @@
 import textwrap
 import unittest
 import urllib.parse
+import uuid
 from io import BytesIO
 
 import typing
@@ -99,41 +99,25 @@ def post(self):
         self.finish("Got %d bytes in POST" % len(self.request.body))
 
 
-# In pre-1.0 versions of openssl, SSLv23 clients always send SSLv2
-# ClientHello messages, which are rejected by SSLv3 and TLSv1
-# servers.  Note that while the OPENSSL_VERSION_INFO was formally
-# introduced in python3.2, it was present but undocumented in
-# python 2.7
-skipIfOldSSL = unittest.skipIf(
-    getattr(ssl, "OPENSSL_VERSION_INFO", (0, 0)) < (1, 0),
-    "old version of ssl module and/or openssl",
-)
-
-
-class BaseSSLTest(AsyncHTTPSTestCase):
+class SSLTest(AsyncHTTPSTestCase):
     def get_app(self):
         return Application([("/", HelloWorldRequestHandler, dict(protocol="https"))])
 
-
-class SSLTestMixin(object):
     def get_ssl_options(self):
         return dict(
-            ssl_version=self.get_ssl_version(),
+            ssl_version=ssl.PROTOCOL_TLS_SERVER,
             **AsyncHTTPSTestCase.default_ssl_options(),
         )
 
-    def get_ssl_version(self):
-        raise NotImplementedError()
-
-    def test_ssl(self: typing.Any):
+    def test_ssl(self):
         response = self.fetch("/")
         self.assertEqual(response.body, b"Hello world")
 
-    def test_large_post(self: typing.Any):
+    def test_large_post(self):
         response = self.fetch("/", method="POST", body="A" * 5000)
         self.assertEqual(response.body, b"Got 5000 bytes in POST")
 
-    def test_non_ssl_request(self: typing.Any):
+    def test_non_ssl_request(self):
         # Make sure the server closes the connection when it gets a non-ssl
         # connection, rather than waiting for a timeout or otherwise
         # misbehaving.
@@ -147,7 +131,7 @@ def test_non_ssl_request(self: typing.Any):
                         raise_error=True,
                     )
 
-    def test_error_logging(self: typing.Any):
+    def test_error_logging(self):
         # No stack traces are logged for SSL errors.
         with ExpectLog(gen_log, "SSL Error") as expect_log:
             with self.assertRaises((IOError, HTTPError)):  # type: ignore
@@ -157,38 +141,6 @@ def test_error_logging(self: typing.Any):
         self.assertFalse(expect_log.logged_stack)
 
 
-# Python's SSL implementation differs significantly between versions.
-# For example, SSLv3 and TLSv1 throw an exception if you try to read
-# from the socket before the handshake is complete, but the default
-# of SSLv23 allows it.
-
-
-class SSLv23Test(BaseSSLTest, SSLTestMixin):
-    def get_ssl_version(self):
-        return ssl.PROTOCOL_SSLv23
-
-
-@skipIfOldSSL
-class SSLv3Test(BaseSSLTest, SSLTestMixin):
-    def get_ssl_version(self):
-        return ssl.PROTOCOL_SSLv3
-
-
-@skipIfOldSSL
-class TLSv1Test(BaseSSLTest, SSLTestMixin):
-    def get_ssl_version(self):
-        return ssl.PROTOCOL_TLSv1
-
-
-class SSLContextTest(BaseSSLTest, SSLTestMixin):
-    def get_ssl_options(self):
-        context = ssl_options_to_context(
-            AsyncHTTPSTestCase.get_ssl_options(self), server_side=True
-        )
-        assert isinstance(context, ssl.SSLContext)
-        return context
-
-
 class BadSSLOptionsTest(unittest.TestCase):
     def test_missing_arguments(self):
         application = Application()
@@ -282,13 +234,11 @@ def test_multipart_form(self):
                 [
                     b"Content-Disposition: form-data; name=argument",
                     b"",
-                    "\u00e1".encode("utf-8"),
+                    "\u00e1".encode(),
                     b"--1234567890",
-                    'Content-Disposition: form-data; name="files"; filename="\u00f3"'.encode(
-                        "utf8"
-                    ),
+                    'Content-Disposition: form-data; name="files"; filename="\u00f3"'.encode(),
                     b"",
-                    "\u00fa".encode("utf-8"),
+                    "\u00fa".encode(),
                     b"--1234567890--",
                     b"",
                 ]
@@ -317,6 +267,7 @@ def test_100_continue(self):
             b"\r\n".join(
                 [
                     b"POST /hello HTTP/1.1",
+                    b"Host: 127.0.0.1",
                     b"Content-Length: 1024",
                     b"Expect: 100-continue",
                     b"Connection: close",
@@ -382,7 +333,7 @@ def get(self):
     def check_type(self, name, obj, expected_type):
         actual_type = type(obj)
         if expected_type != actual_type:
-            self.errors[name] = "expected %s, got %s" % (expected_type, actual_type)
+            self.errors[name] = f"expected {expected_type}, got {actual_type}"
 
 
 class PostEchoHandler(RequestHandler):
@@ -511,12 +462,25 @@ def test_malformed_headers(self):
             self.io_loop.add_timeout(datetime.timedelta(seconds=0.05), self.stop)
             self.wait()
 
+    def test_invalid_host_header_with_whitespace(self):
+        with ExpectLog(
+            gen_log, ".*Malformed HTTP message.*Invalid Host header", level=logging.INFO
+        ):
+            self.stream.write(b"GET / HTTP/1.0\r\nHost: foo bar\r\n\r\n")
+            start_line, headers, response = self.io_loop.run_sync(
+                lambda: read_stream_body(self.stream)
+            )
+            self.assertEqual("HTTP/1.1", start_line.version)
+            self.assertEqual(400, start_line.code)
+            self.assertEqual("Bad Request", start_line.reason)
+
     def test_chunked_request_body(self):
         # Chunked requests are not widely supported and we don't have a way
         # to generate them in AsyncHTTPClient, but HTTPServer will read them.
         self.stream.write(
             b"""\
 POST /echo HTTP/1.1
+Host: 127.0.0.1
 Transfer-Encoding: chunked
 Content-Type: application/x-www-form-urlencoded
 
@@ -541,6 +505,7 @@ def test_chunked_request_uppercase(self):
         self.stream.write(
             b"""\
 POST /echo HTTP/1.1
+Host: 127.0.0.1
 Transfer-Encoding: Chunked
 Content-Type: application/x-www-form-urlencoded
 
@@ -565,6 +530,7 @@ def test_chunked_request_body_invalid_size(self):
         self.stream.write(
             b"""\
 POST /echo HTTP/1.1
+Host: 127.0.0.1
 Transfer-Encoding: chunked
 
 1_a
@@ -587,6 +553,7 @@ def test_chunked_request_body_duplicate_header(self):
         self.stream.write(
             b"""\
 POST /echo HTTP/1.1
+Host: 127.0.0.1
 Transfer-Encoding: chunked
 Transfer-encoding: chunked
 
@@ -611,6 +578,7 @@ def test_chunked_request_body_unsupported_transfer_encoding(self):
         self.stream.write(
             b"""\
 POST /echo HTTP/1.1
+Host: 127.0.0.1
 Transfer-Encoding: gzip, chunked
 
 2
@@ -632,6 +600,7 @@ def test_chunked_request_body_transfer_encoding_and_content_length(self):
         self.stream.write(
             b"""\
 POST /echo HTTP/1.1
+Host: 127.0.0.1
 Transfer-Encoding: chunked
 Content-Length: 2
 
@@ -674,6 +643,7 @@ def test_invalid_content_length(self):
                             textwrap.dedent(
                                 f"""\
                             POST /echo HTTP/1.1
+                            Host: 127.0.0.1
                             Content-Length: {value}
                             Connection: close
 
@@ -684,6 +654,38 @@ def test_invalid_content_length(self):
                     )
                     yield stream.read_until_close()
 
+    @gen_test
+    def test_invalid_methods(self):
+        # RFC 9110 distinguishes between syntactically invalid methods and those that are
+        # valid but unknown. The former must give a 400 status code, while the latter should
+        # give a 405.
+        test_cases = [
+            ("FOO", 405, None),
+            ("FOO,BAR", 400, ".*Malformed HTTP request line"),
+        ]
+        for method, code, log_msg in test_cases:
+            if log_msg is not None:
+                expect_log = ExpectLog(gen_log, log_msg, level=logging.INFO)
+            else:
+
+                @contextmanager
+                def noop_context():
+                    yield
+
+                expect_log = noop_context()  # type: ignore
+            with (
+                self.subTest(method=method),
+                closing(IOStream(socket.socket())) as stream,
+                expect_log,
+            ):
+                yield stream.connect(("127.0.0.1", self.get_http_port()))
+                stream.write(utf8(f"{method} /echo HTTP/1.1\r\nHost:127.0.0.1\r\n\r\n"))
+                resp = yield stream.read_until(b"\r\n\r\n")
+                self.assertTrue(
+                    resp.startswith(b"HTTP/1.1 %d" % code),
+                    f"expected status code {code} in {resp!r}",
+                )
+
 
 class XHeaderTest(HandlerBaseTestCase):
     class Handler(RequestHandler):
@@ -815,10 +817,7 @@ def test_manual_protocol(self):
         self.assertEqual(self.fetch_json("/")["protocol"], "https")
 
 
-@unittest.skipIf(
-    not hasattr(socket, "AF_UNIX") or sys.platform == "cygwin",
-    "unix sockets not supported on this platform",
-)
+@abstract_base_test
 class UnixSocketTest(AsyncTestCase):
     """HTTPServers can listen on Unix sockets too.
 
@@ -830,44 +829,68 @@ class UnixSocketTest(AsyncTestCase):
     an HTTP client, so we have to test this by hand.
     """
 
+    address = ""
+
     def setUp(self):
         super().setUp()
-        self.tmpdir = tempfile.mkdtemp()
-        self.sockfile = os.path.join(self.tmpdir, "test.sock")
-        sock = netutil.bind_unix_socket(self.sockfile)
         app = Application([("/hello", HelloWorldRequestHandler)])
         self.server = HTTPServer(app)
-        self.server.add_socket(sock)
-        self.stream = IOStream(socket.socket(socket.AF_UNIX))
-        self.io_loop.run_sync(lambda: self.stream.connect(self.sockfile))
+        self.server.add_socket(netutil.bind_unix_socket(self.address))
 
     def tearDown(self):
-        self.stream.close()
         self.io_loop.run_sync(self.server.close_all_connections)
         self.server.stop()
-        shutil.rmtree(self.tmpdir)
         super().tearDown()
 
     @gen_test
     def test_unix_socket(self):
-        self.stream.write(b"GET /hello HTTP/1.0\r\n\r\n")
-        response = yield self.stream.read_until(b"\r\n")
-        self.assertEqual(response, b"HTTP/1.1 200 OK\r\n")
-        header_data = yield self.stream.read_until(b"\r\n\r\n")
-        headers = HTTPHeaders.parse(header_data.decode("latin1"))
-        body = yield self.stream.read_bytes(int(headers["Content-Length"]))
-        self.assertEqual(body, b"Hello world")
+        with closing(IOStream(socket.socket(socket.AF_UNIX))) as stream:
+            stream.connect(self.address)
+            stream.write(b"GET /hello HTTP/1.0\r\n\r\n")
+            response = yield stream.read_until(b"\r\n")
+            self.assertEqual(response, b"HTTP/1.1 200 OK\r\n")
+            header_data = yield stream.read_until(b"\r\n\r\n")
+            headers = HTTPHeaders.parse(header_data.decode("latin1"))
+            body = yield stream.read_bytes(int(headers["Content-Length"]))
+            self.assertEqual(body, b"Hello world")
 
     @gen_test
     def test_unix_socket_bad_request(self):
         # Unix sockets don't have remote addresses so they just return an
         # empty string.
         with ExpectLog(gen_log, "Malformed HTTP message from", level=logging.INFO):
-            self.stream.write(b"garbage\r\n\r\n")
-            response = yield self.stream.read_until_close()
+            with closing(IOStream(socket.socket(socket.AF_UNIX))) as stream:
+                stream.connect(self.address)
+                stream.write(b"garbage\r\n\r\n")
+                response = yield stream.read_until_close()
         self.assertEqual(response, b"HTTP/1.1 400 Bad Request\r\n\r\n")
 
 
+@unittest.skipIf(
+    not hasattr(socket, "AF_UNIX") or sys.platform == "cygwin",
+    "unix sockets not supported on this platform",
+)
+class UnixSocketTestFile(UnixSocketTest):
+    def setUp(self):
+        self.tmpdir = tempfile.mkdtemp()
+        self.address = os.path.join(self.tmpdir, "test.sock")
+        super().setUp()
+
+    def tearDown(self):
+        super().tearDown()
+        shutil.rmtree(self.tmpdir)
+
+
+@unittest.skipIf(
+    not (hasattr(socket, "AF_UNIX") and sys.platform.startswith("linux")),
+    "abstract namespace unix sockets not supported on this platform",
+)
+class UnixSocketTestAbstract(UnixSocketTest):
+    def setUp(self):
+        self.address = "\0" + uuid.uuid4().hex
+        super().setUp()
+
+
 class KeepAliveTest(AsyncHTTPTestCase):
     """Tests various scenarios for HTTP 1.1 keep-alive support.
 
@@ -965,16 +988,18 @@ def close(self):
     @gen_test
     def test_two_requests(self):
         yield self.connect()
-        self.stream.write(b"GET / HTTP/1.1\r\n\r\n")
+        self.stream.write(b"GET / HTTP/1.1\r\nHost:127.0.0.1\r\n\r\n")
         yield self.read_response()
-        self.stream.write(b"GET / HTTP/1.1\r\n\r\n")
+        self.stream.write(b"GET / HTTP/1.1\r\nHost:127.0.0.1\r\n\r\n")
         yield self.read_response()
         self.close()
 
     @gen_test
     def test_request_close(self):
         yield self.connect()
-        self.stream.write(b"GET / HTTP/1.1\r\nConnection: close\r\n\r\n")
+        self.stream.write(
+            b"GET / HTTP/1.1\r\nHost:127.0.0.1\r\nConnection: close\r\n\r\n"
+        )
         yield self.read_response()
         data = yield self.stream.read_until_close()
         self.assertTrue(not data)
@@ -989,8 +1014,8 @@ def test_http10(self):
         self.stream.write(b"GET / HTTP/1.0\r\n\r\n")
         yield self.read_response()
         data = yield self.stream.read_until_close()
-        self.assertTrue(not data)
-        self.assertTrue("Connection" not in self.headers)
+        self.assertFalse(data)
+        self.assertNotIn("Connection", self.headers)
         self.close()
 
     @gen_test
@@ -1020,7 +1045,9 @@ def test_http10_keepalive_extra_crlf(self):
     @gen_test
     def test_pipelined_requests(self):
         yield self.connect()
-        self.stream.write(b"GET / HTTP/1.1\r\n\r\nGET / HTTP/1.1\r\n\r\n")
+        self.stream.write(
+            b"GET / HTTP/1.1\r\nHost:127.0.0.1\r\n\r\nGET / HTTP/1.1\r\nHost:127.0.0.1\r\n\r\n"
+        )
         yield self.read_response()
         yield self.read_response()
         self.close()
@@ -1028,7 +1055,9 @@ def test_pipelined_requests(self):
     @gen_test
     def test_pipelined_cancel(self):
         yield self.connect()
-        self.stream.write(b"GET / HTTP/1.1\r\n\r\nGET / HTTP/1.1\r\n\r\n")
+        self.stream.write(
+            b"GET / HTTP/1.1\r\nHost:127.0.0.1\r\n\r\nGET / HTTP/1.1\r\nHost:127.0.0.1\r\n\r\n"
+        )
         # only read once
         yield self.read_response()
         self.close()
@@ -1036,7 +1065,7 @@ def test_pipelined_cancel(self):
     @gen_test
     def test_cancel_during_download(self):
         yield self.connect()
-        self.stream.write(b"GET /large HTTP/1.1\r\n\r\n")
+        self.stream.write(b"GET /large HTTP/1.1\r\nHost:127.0.0.1\r\n\r\n")
         yield self.read_headers()
         yield self.stream.read_bytes(1024)
         self.close()
@@ -1044,7 +1073,7 @@ def test_cancel_during_download(self):
     @gen_test
     def test_finish_while_closed(self):
         yield self.connect()
-        self.stream.write(b"GET /finish_on_close HTTP/1.1\r\n\r\n")
+        self.stream.write(b"GET /finish_on_close HTTP/1.1\r\nHost:127.0.0.1\r\n\r\n")
         yield self.read_headers()
         self.close()
         # Let the hanging coroutine clean up after itself
@@ -1072,10 +1101,10 @@ def test_keepalive_chunked(self):
     @gen_test
     def test_keepalive_chunked_head_no_body(self):
         yield self.connect()
-        self.stream.write(b"HEAD /chunked HTTP/1.1\r\n\r\n")
+        self.stream.write(b"HEAD /chunked HTTP/1.1\r\nHost:127.0.0.1\r\n\r\n")
         yield self.read_headers()
 
-        self.stream.write(b"HEAD /chunked HTTP/1.1\r\n\r\n")
+        self.stream.write(b"HEAD /chunked HTTP/1.1\r\nHost:127.0.0.1\r\n\r\n")
         yield self.read_headers()
         self.close()
 
@@ -1131,9 +1160,9 @@ def test_gzip_unsupported(self):
         # Gzip support is opt-in; without it the server fails to parse
         # the body (but parsing form bodies is currently just a log message,
         # not a fatal error).
-        with ExpectLog(gen_log, "Unsupported Content-Encoding"):
+        with ExpectLog(gen_log, ".*Unsupported Content-Encoding"):
             response = self.post_gzip("foo=bar")
-        self.assertEqual(json_decode(response.body), {})
+        self.assertEqual(response.code, 400)
 
 
 class StreamingChunkSizeTest(AsyncHTTPTestCase):
@@ -1296,7 +1325,6 @@ def test_large_headers(self):
                     self.assertIn(e.response.code, (431, 599))
 
 
-@skipOnTravis
 class IdleTimeoutTest(AsyncHTTPTestCase):
     def get_app(self):
         return Application([("/", HelloWorldRequestHandler)])
@@ -1335,7 +1363,7 @@ def test_idle_after_use(self):
 
         # Use the connection twice to make sure keep-alives are working
         for i in range(2):
-            stream.write(b"GET / HTTP/1.1\r\n\r\n")
+            stream.write(b"GET / HTTP/1.1\r\nHost: 127.0.0.1\r\n\r\n")
             yield stream.read_until(b"\r\n\r\n")
             data = yield stream.read_bytes(11)
             self.assertEqual(data, b"Hello world")
@@ -1457,6 +1485,7 @@ def test_body_size_override_reset(self):
             # Use a raw stream so we can make sure it's all on one connection.
             stream.write(
                 b"PUT /streaming?expected_size=10240 HTTP/1.1\r\n"
+                b"Host: 127.0.0.1\r\n"
                 b"Content-Length: 10240\r\n\r\n"
             )
             stream.write(b"a" * 10240)
@@ -1464,7 +1493,9 @@ def test_body_size_override_reset(self):
             self.assertEqual(response, b"10240")
             # Without the ?expected_size parameter, we get the old default value
             stream.write(
-                b"PUT /streaming HTTP/1.1\r\n" b"Content-Length: 10240\r\n\r\n"
+                b"PUT /streaming HTTP/1.1\r\n"
+                b"Host: 127.0.0.1\r\n"
+                b"Content-Length: 10240\r\n\r\n"
             )
             with ExpectLog(gen_log, ".*Content-Length too long", level=logging.INFO):
                 data = yield stream.read_until_close()
diff --git a/tornado/test/httputil_test.py b/tornado/test/httputil_test.py
index 975900a..92683ae 100644
--- a/tornado/test/httputil_test.py
+++ b/tornado/test/httputil_test.py
@@ -9,10 +9,10 @@
     qs_to_qsl,
     HTTPInputError,
     HTTPFile,
+    ParseMultipartConfig,
 )
 from tornado.escape import utf8, native_str
 from tornado.log import gen_log
-from tornado.testing import ExpectLog
 from tornado.test.util import ignore_deprecation
 
 import copy
@@ -136,6 +136,8 @@ def test_special_filenames(self):
             'a";";.txt',
             'a\\"b.txt',
             "a\\b.txt",
+            "a b.txt",
+            "a\tb.txt",
         ]
         for filename in filenames:
             logging.debug("trying filename %r", filename)
@@ -156,7 +158,30 @@ def test_special_filenames(self):
             self.assertEqual(file["filename"], filename)
             self.assertEqual(file["body"], b"Foo")
 
-    def test_non_ascii_filename(self):
+    def test_invalid_chars(self):
+        filenames = [
+            "a\rb.txt",
+            "a\0b.txt",
+            "a\x08b.txt",
+        ]
+        for filename in filenames:
+            str_data = """\
+--1234
+Content-Disposition: form-data; name="files"; filename="%s"
+
+Foo
+--1234--""" % filename.replace(
+                "\\", "\\\\"
+            ).replace(
+                '"', '\\"'
+            )
+            data = utf8(str_data.replace("\n", "\r\n"))
+            args, files = form_data_args()
+            with self.assertRaises(HTTPInputError) as cm:
+                parse_multipart_form_data(b"1234", data, args, files)
+            self.assertIn("Invalid header value", str(cm.exception))
+
+    def test_non_ascii_filename_rfc5987(self):
         data = b"""\
 --1234
 Content-Disposition: form-data; name="files"; filename="ab.txt"; filename*=UTF-8''%C3%A1b.txt
@@ -171,6 +196,23 @@ def test_non_ascii_filename(self):
         self.assertEqual(file["filename"], "áb.txt")
         self.assertEqual(file["body"], b"Foo")
 
+    def test_non_ascii_filename_raw(self):
+        data = """\
+--1234
+Content-Disposition: form-data; name="files"; filename="测试.txt"
+
+Foo
+--1234--""".encode(
+            "utf-8"
+        ).replace(
+            b"\n", b"\r\n"
+        )
+        args, files = form_data_args()
+        parse_multipart_form_data(b"1234", data, args, files)
+        file = files["files"][0]
+        self.assertEqual(file["filename"], "测试.txt")
+        self.assertEqual(file["body"], b"Foo")
+
     def test_boundary_starts_and_ends_with_quotes(self):
         data = b"""\
 --1234
@@ -195,7 +237,9 @@ def test_missing_headers(self):
             b"\n", b"\r\n"
         )
         args, files = form_data_args()
-        with ExpectLog(gen_log, "multipart/form-data missing headers"):
+        with self.assertRaises(
+            HTTPInputError, msg="multipart/form-data missing headers"
+        ):
             parse_multipart_form_data(b"1234", data, args, files)
         self.assertEqual(files, {})
 
@@ -209,7 +253,7 @@ def test_invalid_content_disposition(self):
             b"\n", b"\r\n"
         )
         args, files = form_data_args()
-        with ExpectLog(gen_log, "Invalid multipart/form-data"):
+        with self.assertRaises(HTTPInputError, msg="Invalid multipart/form-data"):
             parse_multipart_form_data(b"1234", data, args, files)
         self.assertEqual(files, {})
 
@@ -222,7 +266,7 @@ def test_line_does_not_end_with_correct_line_break(self):
             b"\n", b"\r\n"
         )
         args, files = form_data_args()
-        with ExpectLog(gen_log, "Invalid multipart/form-data"):
+        with self.assertRaises(HTTPInputError, msg="Invalid multipart/form-data"):
             parse_multipart_form_data(b"1234", data, args, files)
         self.assertEqual(files, {})
 
@@ -236,7 +280,9 @@ def test_content_disposition_header_without_name_parameter(self):
             b"\n", b"\r\n"
         )
         args, files = form_data_args()
-        with ExpectLog(gen_log, "multipart/form-data value missing name"):
+        with self.assertRaises(
+            HTTPInputError, msg="multipart/form-data value missing name"
+        ):
             parse_multipart_form_data(b"1234", data, args, files)
         self.assertEqual(files, {})
 
@@ -259,6 +305,64 @@ def test_data_after_final_boundary(self):
         self.assertEqual(file["filename"], "ab.txt")
         self.assertEqual(file["body"], b"Foo")
 
+    def test_disposition_param_linear_performance(self):
+        # This is a regression test for performance of parsing parameters
+        # to the content-disposition header, specifically for semicolons within
+        # quoted strings.
+        def f(n):
+            start = time.perf_counter()
+            message = (
+                b"--1234\r\nContent-Disposition: form-data; "
+                + b'x="'
+                + b";" * n
+                + b'"; '
+                + b'name="files"; filename="a.txt"\r\n\r\nFoo\r\n--1234--\r\n'
+            )
+            args: dict[str, list[bytes]] = {}
+            files: dict[str, list[HTTPFile]] = {}
+            parse_multipart_form_data(b"1234", message, args, files)
+            return time.perf_counter() - start
+
+        d1 = f(1_000)
+        # Note that headers larger than this are blocked by the default configuration.
+        d2 = f(10_000)
+        if d2 / d1 > 20:
+            self.fail(f"Disposition param parsing is not linear: {d1=} vs {d2=}")
+
+    def test_multipart_config(self):
+        boundary = b"1234"
+        body = b"""--1234
+Content-Disposition: form-data; name="files"; filename="ab.txt"
+
+--1234--""".replace(
+            b"\n", b"\r\n"
+        )
+        config = ParseMultipartConfig()
+        args, files = form_data_args()
+        parse_multipart_form_data(boundary, body, args, files, config=config)
+        self.assertEqual(files["files"][0]["filename"], "ab.txt")
+
+        config_no_parts = ParseMultipartConfig(max_parts=0)
+        with self.assertRaises(HTTPInputError) as cm:
+            parse_multipart_form_data(
+                boundary, body, args, files, config=config_no_parts
+            )
+        self.assertIn("too many parts", str(cm.exception))
+
+        config_small_headers = ParseMultipartConfig(max_part_header_size=10)
+        with self.assertRaises(HTTPInputError) as cm:
+            parse_multipart_form_data(
+                boundary, body, args, files, config=config_small_headers
+            )
+        self.assertIn("header too large", str(cm.exception))
+
+        config_disabled = ParseMultipartConfig(enabled=False)
+        with self.assertRaises(HTTPInputError) as cm:
+            parse_multipart_form_data(
+                boundary, body, args, files, config=config_disabled
+            )
+        self.assertIn("multipart/form-data parsing is disabled", str(cm.exception))
+
 
 class HTTPHeadersTest(unittest.TestCase):
     def test_multi_line(self):
@@ -286,14 +390,37 @@ def test_multi_line(self):
             sorted(list(headers.get_all())),
             [("Asdf", "qwer zxcv"), ("Foo", "bar baz"), ("Foo", "even more lines")],
         )
+        # Verify case insensitivity in-operator
+        self.assertTrue("asdf" in headers)
+        self.assertTrue("Asdf" in headers)
+
+    def test_continuation(self):
+        data = "Foo: bar\r\n\tasdf"
+        headers = HTTPHeaders.parse(data)
+        self.assertEqual(headers["Foo"], "bar asdf")
 
-    def test_malformed_continuation(self):
         # If the first line starts with whitespace, it's a
         # continuation line with nothing to continue, so reject it
         # (with a proper error).
         data = " Foo: bar"
         self.assertRaises(HTTPInputError, HTTPHeaders.parse, data)
 
+        # \f (formfeed) is whitespace according to str.isspace, but
+        # not according to the HTTP spec.
+        data = "Foo: bar\r\n\fasdf"
+        self.assertRaises(HTTPInputError, HTTPHeaders.parse, data)
+
+    def test_forbidden_ascii_characters(self):
+        # Control characters and ASCII whitespace other than space, tab, and CRLF are not allowed in
+        # headers.
+        for c in range(0xFF):
+            data = f"Foo: bar{chr(c)}baz\r\n"
+            if c == 0x09 or (c >= 0x20 and c != 0x7F):
+                headers = HTTPHeaders.parse(data)
+                self.assertEqual(headers["Foo"], f"bar{chr(c)}baz")
+            else:
+                self.assertRaises(HTTPInputError, HTTPHeaders.parse, data)
+
     def test_unicode_newlines(self):
         # Ensure that only \r\n is recognized as a header separator, and not
         # the other newline-like unicode characters.
@@ -302,10 +429,13 @@ def test_unicode_newlines(self):
         # and cpython's unicodeobject.c (which defines the implementation
         # of unicode_type.splitlines(), and uses a different list than TR13).
         newlines = [
-            "\u001b",  # VERTICAL TAB
-            "\u001c",  # FILE SEPARATOR
-            "\u001d",  # GROUP SEPARATOR
-            "\u001e",  # RECORD SEPARATOR
+            # The following ascii characters are sometimes treated as newline-like,
+            # but they're disallowed in HTTP headers. This test covers unicode
+            # characters that are permitted in headers (under the obs-text rule).
+            # "\u001b",  # VERTICAL TAB
+            # "\u001c",  # FILE SEPARATOR
+            # "\u001d",  # GROUP SEPARATOR
+            # "\u001e",  # RECORD SEPARATOR
             "\u0085",  # NEXT LINE
             "\u2028",  # LINE SEPARATOR
             "\u2029",  # PARAGRAPH SEPARATOR
@@ -354,13 +484,16 @@ def test_unicode_whitespace(self):
             self.assertEqual(expected, list(headers.get_all()))
 
     def test_optional_cr(self):
+        # Bare CR is  not a valid line separator
+        with self.assertRaises(HTTPInputError):
+            HTTPHeaders.parse("CRLF: crlf\r\nLF: lf\nCR: cr\rMore: more\r\n")
+
         # Both CRLF and LF should be accepted as separators. CR should not be
-        # part of the data when followed by LF, but it is a normal char
-        # otherwise (or should bare CR be an error?)
-        headers = HTTPHeaders.parse("CRLF: crlf\r\nLF: lf\nCR: cr\rMore: more\r\n")
+        # part of the data when followed by LF.
+        headers = HTTPHeaders.parse("CRLF: crlf\r\nLF: lf\nMore: more\r\n")
         self.assertEqual(
             sorted(headers.get_all()),
-            [("Cr", "cr\rMore: more"), ("Crlf", "crlf"), ("Lf", "lf")],
+            [("Crlf", "crlf"), ("Lf", "lf"), ("More", "more")],
         )
 
     def test_copy(self):
@@ -409,6 +542,37 @@ def test_string(self):
         headers2 = HTTPHeaders.parse(str(headers))
         self.assertEqual(headers, headers2)
 
+    def test_invalid_header_names(self):
+        invalid_names = [
+            "",
+            "foo bar",
+            "foo\tbar",
+            "foo\nbar",
+            "foo\x00bar",
+            "foo ",
+            " foo",
+            "é",
+        ]
+        for name in invalid_names:
+            headers = HTTPHeaders()
+            with self.assertRaises(HTTPInputError):
+                headers.add(name, "bar")
+
+    def test_linear_performance(self):
+        def f(n):
+            start = time.perf_counter()
+            headers = HTTPHeaders()
+            for i in range(n):
+                headers.add("X-Foo", "bar")
+            return time.perf_counter() - start
+
+        # This runs under 50ms on my laptop as of 2025-12-09.
+        d1 = f(10_000)
+        d2 = f(100_000)
+        if d2 / d1 > 20:
+            # d2 should be about 10x d1 but allow a wide margin for variability.
+            self.fail(f"HTTPHeaders.add() does not scale linearly: {d1=} vs {d2=}")
+
 
 class FormatTimestampTest(unittest.TestCase):
     # Make sure that all the input types are supported.
@@ -467,14 +631,14 @@ def test_default_constructor(self):
         HTTPServerRequest(uri="/")
 
     def test_body_is_a_byte_string(self):
-        requets = HTTPServerRequest(uri="/")
-        self.assertIsInstance(requets.body, bytes)
+        request = HTTPServerRequest(uri="/")
+        self.assertIsInstance(request.body, bytes)
 
     def test_repr_does_not_contain_headers(self):
         request = HTTPServerRequest(
             uri="/", headers=HTTPHeaders({"Canary": ["Coal Mine"]})
         )
-        self.assertTrue("Canary" not in repr(request))
+        self.assertNotIn("Canary", repr(request))
 
 
 class ParseRequestStartLineTest(unittest.TestCase):
diff --git a/tornado/test/import_test.py b/tornado/test/import_test.py
index 1ff5220..261d3d3 100644
--- a/tornado/test/import_test.py
+++ b/tornado/test/import_test.py
@@ -9,7 +9,10 @@
 # Explicitly disallow the default event loop so that an error will be raised
 # if something tries to touch it.
 import asyncio
-asyncio.set_event_loop(None)
+import warnings
+with warnings.catch_warnings():
+    warnings.simplefilter("ignore", DeprecationWarning)
+    asyncio.set_event_loop(None)
 
 import importlib
 import tornado
diff --git a/tornado/test/ioloop_test.py b/tornado/test/ioloop_test.py
index d07438a..37ac6de 100644
--- a/tornado/test/ioloop_test.py
+++ b/tornado/test/ioloop_test.py
@@ -28,7 +28,6 @@
 from tornado.test.util import (
     ignore_deprecation,
     skipIfNonUnix,
-    skipOnTravis,
 )
 from tornado.concurrent import Future
 
@@ -58,7 +57,6 @@ def add_callback(self, callback, *args, **kwargs):
         loop.start()
         self.assertLess(self.calls, 10)
 
-    @skipOnTravis
     def test_add_callback_wakeup(self):
         # Make sure that add_callback from inside a running IOLoop
         # wakes up the IOLoop immediately instead of waiting for a timeout.
@@ -77,7 +75,6 @@ def schedule_callback():
         self.assertAlmostEqual(time.time(), self.start_time, places=2)
         self.assertTrue(self.called)
 
-    @skipOnTravis
     def test_add_callback_wakeup_other_thread(self):
         def target():
             # sleep a bit to let the ioloop go into its poll loop
@@ -135,7 +132,7 @@ def test_add_callback_from_signal_other_thread(self):
         # Very crude test, just to make sure that we cover this case.
         # This also happens to be the first test where we run an IOLoop in
         # a non-main thread.
-        other_ioloop = IOLoop()
+        other_ioloop = IOLoop(make_current=False)
         thread = threading.Thread(target=other_ioloop.start)
         thread.start()
         with ignore_deprecation():
@@ -155,7 +152,7 @@ def target():
             closing.set()
             other_ioloop.close(all_fds=True)
 
-        other_ioloop = IOLoop()
+        other_ioloop = IOLoop(make_current=False)
         thread = threading.Thread(target=target)
         thread.start()
         closing.wait()
@@ -243,17 +240,17 @@ def test_add_timeout_return(self):
         # All the timeout methods return non-None handles that can be
         # passed to remove_timeout.
         handle = self.io_loop.add_timeout(self.io_loop.time(), lambda: None)
-        self.assertFalse(handle is None)
+        self.assertIsNotNone(handle)
         self.io_loop.remove_timeout(handle)
 
     def test_call_at_return(self):
         handle = self.io_loop.call_at(self.io_loop.time(), lambda: None)
-        self.assertFalse(handle is None)
+        self.assertIsNotNone(handle)
         self.io_loop.remove_timeout(handle)
 
     def test_call_later_return(self):
         handle = self.io_loop.call_later(0, lambda: None)
-        self.assertFalse(handle is None)
+        self.assertIsNotNone(handle)
         self.io_loop.remove_timeout(handle)
 
     def test_close_file_object(self):
@@ -265,7 +262,7 @@ def test_close_file_object(self):
         # Use a socket since they are supported by IOLoop on all platforms.
         # Unfortunately, sockets don't support the .closed attribute for
         # inspecting their close status, so we must use a wrapper.
-        class SocketWrapper(object):
+        class SocketWrapper:
             def __init__(self, sockobj):
                 self.sockobj = sockobj
                 self.closed = False
@@ -279,8 +276,12 @@ def close(self):
 
         sockobj, port = bind_unused_port()
         socket_wrapper = SocketWrapper(sockobj)
-        io_loop = IOLoop()
-        io_loop.add_handler(socket_wrapper, lambda fd, events: None, IOLoop.READ)
+        io_loop = IOLoop(make_current=False)
+        io_loop.run_sync(
+            lambda: io_loop.add_handler(
+                socket_wrapper, lambda fd, events: None, IOLoop.READ
+            )
+        )
         io_loop.close(all_fds=True)
         self.assertTrue(socket_wrapper.closed)
 
@@ -503,7 +504,7 @@ def dummy():
             )
             future = self.wait()
             self.assertTrue(future.done())
-            self.assertTrue(future.result() is None)
+            self.assertIsNone(future.result())
 
     @gen_test
     def test_run_in_executor_gen(self):
@@ -626,6 +627,16 @@ async def f2():
 
         self.io_loop.run_sync(f2)
 
+    def test_stop_no_timeout(self):
+        async def f():
+            await asyncio.sleep(0.1)
+            IOLoop.current().stop()
+            await asyncio.sleep(10)
+
+        with self.assertRaises(RuntimeError) as cm:
+            self.io_loop.run_sync(f)
+        assert "Event loop stopped" in str(cm.exception)
+
 
 class TestPeriodicCallbackMath(unittest.TestCase):
     def simulate_calls(self, pc, durations):
@@ -785,6 +796,9 @@ def test_asyncio(self):
         )
         self.assertEqual(cls, "AsyncIOMainLoop")
 
+    @unittest.skipIf(
+        sys.version_info >= (3, 14), "implicit event loop creation not available"
+    )
     def test_asyncio_main(self):
         cls = self.run_python(
             "from tornado.platform.asyncio import AsyncIOMainLoop",
diff --git a/tornado/test/iostream_test.py b/tornado/test/iostream_test.py
index 02fcd3e..d55485c 100644
--- a/tornado/test/iostream_test.py
+++ b/tornado/test/iostream_test.py
@@ -9,6 +9,7 @@
     StreamClosedError,
     _StreamBuffer,
 )
+from tornado.httpclient import AsyncHTTPClient, HTTPResponse
 from tornado.httputil import HTTPHeaders
 from tornado.locks import Condition, Event
 from tornado.log import gen_log
@@ -26,8 +27,8 @@
 from tornado.test.util import (
     skipIfNonUnix,
     refusing_port,
-    skipPypy3V58,
     ignore_deprecation,
+    abstract_base_test,
 )
 from tornado.web import RequestHandler, Application
 import asyncio
@@ -56,25 +57,53 @@ def get(self):
         self.write("Hello")
 
 
-class TestIOStreamWebMixin(object):
+@abstract_base_test
+class TestIOStreamWebMixin(AsyncTestCase):
+    # We want to run these tests with both AsyncHTTPTestCase and AsyncHTTPSTestCase,
+    # but this leads to some tricky inheritance situations. We want this class's
+    # get_app, but the test classes's get_http_port and fetch. There's no way to make
+    # the method resolution order to do what we want in all cases, so the current
+    # state is that that AsyncHTTP(S)TestCase must be the first base class of the
+    # final class, and that class must define a get_app method that calls mixin_get_app.
+    #
+    # Alternatives include defining this class in a factory that can change the base class
+    # or refactoring to use composition instead of inheritance for the http components.
     def _make_client_iostream(self):
         raise NotImplementedError()
 
-    def get_app(self):
+    def mixin_get_app(self):
         return Application([("/", HelloHandler)])
 
-    def test_connection_closed(self: typing.Any):
+    def get_http_port(self) -> int:
+        raise NotImplementedError()
+
+    def fetch(
+        self, path: str, raise_error: bool = False, **kwargs: typing.Any
+    ) -> HTTPResponse:
+        # To be filled in by mixing in AsyncHTTPTestCase or AsyncHTTPSTestCase
+        raise NotImplementedError()
+
+    def test_connection_closed(self):
         # When a server sends a response and then closes the connection,
         # the client must be allowed to read the data before the IOStream
         # closes itself.  Epoll reports closed connections with a separate
         # EPOLLRDHUP event delivered at the same time as the read event,
         # while kqueue reports them as a second read/write event with an EOF
         # flag.
+        if (
+            AsyncHTTPClient.configured_class().__name__.endswith("CurlAsyncHTTPClient")
+            and platform.system() == "Darwin"
+        ):
+            # It's possible that this is Tornado's fault, either in AsyncIOLoop or in
+            # CurlAsyncHTTPClient, but we've also seen this kind of issue in libcurl itself
+            # (especially a long time ago). The error is tied to the use of Apple's
+            # SecureTransport instead of OpenSSL.
+            self.skipTest("libcurl doesn't handle closed connections cleanly on macOS")
         response = self.fetch("/", headers={"Connection": "close"})
         response.rethrow()
 
     @gen_test
-    def test_read_until_close(self: typing.Any):
+    def test_read_until_close(self):
         stream = self._make_client_iostream()
         yield stream.connect(("127.0.0.1", self.get_http_port()))
         stream.write(b"GET / HTTP/1.0\r\n\r\n")
@@ -84,7 +113,7 @@ def test_read_until_close(self: typing.Any):
         self.assertTrue(data.endswith(b"Hello"))
 
     @gen_test
-    def test_read_zero_bytes(self: typing.Any):
+    def test_read_zero_bytes(self):
         self.stream = self._make_client_iostream()
         yield self.stream.connect(("127.0.0.1", self.get_http_port()))
         self.stream.write(b"GET / HTTP/1.0\r\n\r\n")
@@ -104,7 +133,7 @@ def test_read_zero_bytes(self: typing.Any):
         self.stream.close()
 
     @gen_test
-    def test_write_while_connecting(self: typing.Any):
+    def test_write_while_connecting(self):
         stream = self._make_client_iostream()
         connect_fut = stream.connect(("127.0.0.1", self.get_http_port()))
         # unlike the previous tests, try to write before the connection
@@ -126,7 +155,7 @@ def test_write_while_connecting(self: typing.Any):
         stream.close()
 
     @gen_test
-    def test_future_interface(self: typing.Any):
+    def test_future_interface(self):
         """Basic test of IOStream's ability to return Futures."""
         stream = self._make_client_iostream()
         connect_result = yield stream.connect(("127.0.0.1", self.get_http_port()))
@@ -143,7 +172,7 @@ def test_future_interface(self: typing.Any):
         stream.close()
 
     @gen_test
-    def test_future_close_while_reading(self: typing.Any):
+    def test_future_close_while_reading(self):
         stream = self._make_client_iostream()
         yield stream.connect(("127.0.0.1", self.get_http_port()))
         yield stream.write(b"GET / HTTP/1.0\r\n\r\n")
@@ -152,7 +181,7 @@ def test_future_close_while_reading(self: typing.Any):
         stream.close()
 
     @gen_test
-    def test_future_read_until_close(self: typing.Any):
+    def test_future_read_until_close(self):
         # Ensure that the data comes through before the StreamClosedError.
         stream = self._make_client_iostream()
         yield stream.connect(("127.0.0.1", self.get_http_port()))
@@ -167,7 +196,8 @@ def test_future_read_until_close(self: typing.Any):
             stream.read_bytes(1)
 
 
-class TestReadWriteMixin(object):
+@abstract_base_test
+class TestReadWriteMixin(AsyncTestCase):
     # Tests where one stream reads and the other writes.
     # These should work for BaseIOStream implementations.
 
@@ -205,7 +235,7 @@ def test_write_zero_bytes(self):
         rs.close()
 
     @gen_test
-    def test_future_delayed_close_callback(self: typing.Any):
+    def test_future_delayed_close_callback(self):
         # Same as test_delayed_close_callback, but with the future interface.
         rs, ws = yield self.make_iostream_pair()
 
@@ -221,7 +251,7 @@ def test_future_delayed_close_callback(self: typing.Any):
             rs.close()
 
     @gen_test
-    def test_close_buffered_data(self: typing.Any):
+    def test_close_buffered_data(self):
         # Similar to the previous test, but with data stored in the OS's
         # socket buffers instead of the IOStream's read buffer.  Out-of-band
         # close notifications must be delayed until all data has been
@@ -247,7 +277,7 @@ def test_close_buffered_data(self: typing.Any):
             rs.close()
 
     @gen_test
-    def test_read_until_close_after_close(self: typing.Any):
+    def test_read_until_close_after_close(self):
         # Similar to test_delayed_close_callback, but read_until_close takes
         # a separate code path so test it separately.
         rs, ws = yield self.make_iostream_pair()
@@ -266,7 +296,7 @@ def test_read_until_close_after_close(self: typing.Any):
             rs.close()
 
     @gen_test
-    def test_large_read_until(self: typing.Any):
+    def test_large_read_until(self):
         # Performance test: read_until used to have a quadratic component
         # so a read_until of 4MB would take 8 seconds; now it takes 0.25
         # seconds.
@@ -315,7 +345,7 @@ async def test_read_until_with_close_after_second_packet(self):
             await rf
 
     @gen_test
-    async def test_read_until_unsatisfied_after_close(self: typing.Any):
+    async def test_read_until_unsatisfied_after_close(self):
         # If a stream is closed while reading, it raises
         # StreamClosedError instead of UnsatisfiableReadError (the
         # latter should only be raised when byte limits are reached).
@@ -329,7 +359,7 @@ async def test_read_until_unsatisfied_after_close(self: typing.Any):
                 await rf
 
     @gen_test
-    def test_close_callback_with_pending_read(self: typing.Any):
+    def test_close_callback_with_pending_read(self):
         # Regression test for a bug that was introduced in 2.3
         # where the IOStream._close_callback would never be called
         # if there were pending reads.
@@ -353,7 +383,7 @@ def test_close_callback_with_pending_read(self: typing.Any):
             rs.close()
 
     @gen_test
-    def test_future_close_callback(self: typing.Any):
+    def test_future_close_callback(self):
         # Regression test for interaction between the Future read interfaces
         # and IOStream._maybe_add_error_listener.
         rs, ws = yield self.make_iostream_pair()
@@ -378,7 +408,7 @@ def close_callback():
             ws.close()
 
     @gen_test
-    def test_write_memoryview(self: typing.Any):
+    def test_write_memoryview(self):
         rs, ws = yield self.make_iostream_pair()
         try:
             fut = rs.read_bytes(4)
@@ -390,7 +420,7 @@ def test_write_memoryview(self: typing.Any):
             rs.close()
 
     @gen_test
-    def test_read_bytes_partial(self: typing.Any):
+    def test_read_bytes_partial(self):
         rs, ws = yield self.make_iostream_pair()
         try:
             # Ask for more than is available with partial=True
@@ -415,7 +445,7 @@ def test_read_bytes_partial(self: typing.Any):
             rs.close()
 
     @gen_test
-    def test_read_until_max_bytes(self: typing.Any):
+    def test_read_until_max_bytes(self):
         rs, ws = yield self.make_iostream_pair()
         closed = Event()
         rs.set_close_callback(closed.set)
@@ -443,7 +473,7 @@ def test_read_until_max_bytes(self: typing.Any):
             rs.close()
 
     @gen_test
-    def test_read_until_max_bytes_inline(self: typing.Any):
+    def test_read_until_max_bytes_inline(self):
         rs, ws = yield self.make_iostream_pair()
         closed = Event()
         rs.set_close_callback(closed.set)
@@ -462,7 +492,7 @@ def test_read_until_max_bytes_inline(self: typing.Any):
             rs.close()
 
     @gen_test
-    def test_read_until_max_bytes_ignores_extra(self: typing.Any):
+    def test_read_until_max_bytes_ignores_extra(self):
         rs, ws = yield self.make_iostream_pair()
         closed = Event()
         rs.set_close_callback(closed.set)
@@ -479,7 +509,7 @@ def test_read_until_max_bytes_ignores_extra(self: typing.Any):
             rs.close()
 
     @gen_test
-    def test_read_until_regex_max_bytes(self: typing.Any):
+    def test_read_until_regex_max_bytes(self):
         rs, ws = yield self.make_iostream_pair()
         closed = Event()
         rs.set_close_callback(closed.set)
@@ -507,7 +537,7 @@ def test_read_until_regex_max_bytes(self: typing.Any):
             rs.close()
 
     @gen_test
-    def test_read_until_regex_max_bytes_inline(self: typing.Any):
+    def test_read_until_regex_max_bytes_inline(self):
         rs, ws = yield self.make_iostream_pair()
         closed = Event()
         rs.set_close_callback(closed.set)
@@ -542,7 +572,7 @@ def test_read_until_regex_max_bytes_ignores_extra(self):
             rs.close()
 
     @gen_test
-    def test_small_reads_from_large_buffer(self: typing.Any):
+    def test_small_reads_from_large_buffer(self):
         # 10KB buffer size, 100KB available to read.
         # Read 1KB at a time and make sure that the buffer is not eagerly
         # filled.
@@ -557,7 +587,7 @@ def test_small_reads_from_large_buffer(self: typing.Any):
             rs.close()
 
     @gen_test
-    def test_small_read_untils_from_large_buffer(self: typing.Any):
+    def test_small_read_untils_from_large_buffer(self):
         # 10KB buffer size, 100KB available to read.
         # Read 1KB at a time and make sure that the buffer is not eagerly
         # filled.
@@ -590,7 +620,7 @@ def test_flow_control(self):
             ws.close()
 
     @gen_test
-    def test_read_into(self: typing.Any):
+    def test_read_into(self):
         rs, ws = yield self.make_iostream_pair()
 
         def sleep_some():
@@ -632,7 +662,7 @@ def sleep_some():
             rs.close()
 
     @gen_test
-    def test_read_into_partial(self: typing.Any):
+    def test_read_into_partial(self):
         rs, ws = yield self.make_iostream_pair()
 
         try:
@@ -661,7 +691,7 @@ def test_read_into_partial(self: typing.Any):
             rs.close()
 
     @gen_test
-    def test_read_into_zero_bytes(self: typing.Any):
+    def test_read_into_zero_bytes(self):
         rs, ws = yield self.make_iostream_pair()
         try:
             buf = bytearray()
@@ -722,6 +752,7 @@ def consume():
             rs.close()
 
 
+@abstract_base_test
 class TestIOStreamMixin(TestReadWriteMixin):
     def _make_server_iostream(self, connection, **kwargs):
         raise NotImplementedError()
@@ -730,7 +761,7 @@ def _make_client_iostream(self, connection, **kwargs):
         raise NotImplementedError()
 
     @gen.coroutine
-    def make_iostream_pair(self: typing.Any, **kwargs):
+    def make_iostream_pair(self, **kwargs):
         listener, port = bind_unused_port()
         server_stream_fut = Future()  # type: Future[IOStream]
 
@@ -748,7 +779,7 @@ def accept_callback(connection, address):
         raise gen.Return((server_stream, client_stream))
 
     @gen_test
-    def test_connection_refused(self: typing.Any):
+    def test_connection_refused(self):
         # When a connection is refused, the connect callback should not
         # be run.  (The kqueue IOLoop used to behave differently from the
         # epoll IOLoop in this respect)
@@ -765,7 +796,7 @@ def test_connection_refused(self: typing.Any):
         self.assertTrue(isinstance(stream.error, ConnectionRefusedError), stream.error)
 
     @gen_test
-    def test_gaierror(self: typing.Any):
+    def test_gaierror(self):
         # Test that IOStream sets its exc_info on getaddrinfo error.
         # It's difficult to reliably trigger a getaddrinfo error;
         # some resolvers own't even return errors for malformed names,
@@ -782,7 +813,7 @@ def test_gaierror(self: typing.Any):
             self.assertTrue(isinstance(stream.error, socket.gaierror))
 
     @gen_test
-    def test_read_until_close_with_error(self: typing.Any):
+    def test_read_until_close_with_error(self):
         server, client = yield self.make_iostream_pair()
         try:
             with mock.patch(
@@ -796,9 +827,8 @@ def test_read_until_close_with_error(self: typing.Any):
             client.close()
 
     @skipIfNonUnix
-    @skipPypy3V58
     @gen_test
-    def test_inline_read_error(self: typing.Any):
+    def test_inline_read_error(self):
         # An error on an inline read is raised without logging (on the
         # assumption that it will eventually be noticed or logged further
         # up the stack).
@@ -830,7 +860,6 @@ def test_inline_read_error(self: typing.Any):
             server.close()
             client.close()
 
-    @skipPypy3V58
     @gen_test
     def test_async_read_error_logging(self):
         # Socket errors on asynchronous reads should be logged (but only
@@ -888,17 +917,23 @@ def consume():
             client.close()
 
 
-class TestIOStreamWebHTTP(TestIOStreamWebMixin, AsyncHTTPTestCase):
+class TestIOStreamWebHTTP(AsyncHTTPTestCase, TestIOStreamWebMixin):
     def _make_client_iostream(self):
         return IOStream(socket.socket())
 
+    def get_app(self):
+        return self.mixin_get_app()
+
 
-class TestIOStreamWebHTTPS(TestIOStreamWebMixin, AsyncHTTPSTestCase):
+class TestIOStreamWebHTTPS(AsyncHTTPSTestCase, TestIOStreamWebMixin):
     def _make_client_iostream(self):
         return SSLIOStream(socket.socket(), ssl_options=dict(cert_reqs=ssl.CERT_NONE))
 
+    def get_app(self):
+        return self.mixin_get_app()
+
 
-class TestIOStream(TestIOStreamMixin, AsyncTestCase):
+class TestIOStream(TestIOStreamMixin):
     def _make_server_iostream(self, connection, **kwargs):
         return IOStream(connection, **kwargs)
 
@@ -906,7 +941,7 @@ def _make_client_iostream(self, connection, **kwargs):
         return IOStream(connection, **kwargs)
 
 
-class TestIOStreamSSL(TestIOStreamMixin, AsyncTestCase):
+class TestIOStreamSSL(TestIOStreamMixin):
     def _make_server_iostream(self, connection, **kwargs):
         ssl_ctx = ssl_options_to_context(_server_ssl_options(), server_side=True)
         connection = ssl_ctx.wrap_socket(
@@ -925,7 +960,7 @@ def _make_client_iostream(self, connection, **kwargs):
 # This will run some tests that are basically redundant but it's the
 # simplest way to make sure that it works to pass an SSLContext
 # instead of an ssl_options dict to the SSLIOStream constructor.
-class TestIOStreamSSLContext(TestIOStreamMixin, AsyncTestCase):
+class TestIOStreamSSLContext(TestIOStreamMixin):
     def _make_server_iostream(self, connection, **kwargs):
         context = ssl.create_default_context(ssl.Purpose.CLIENT_AUTH)
         context.load_cert_chain(
@@ -1043,8 +1078,6 @@ def test_handshake_fail(self):
     @gen_test
     def test_check_hostname(self):
         # Test that server_hostname parameter to start_tls is being used.
-        # The check_hostname functionality is only available in python 2.7 and
-        # up and in python 3.4 and up.
         server_future = self.server_start_tls(_server_ssl_options())
         with ExpectLog(gen_log, "SSL Error"):
             client_future = self.client_start_tls(
diff --git a/tornado/test/locks_test.py b/tornado/test/locks_test.py
index 23e1c52..61e01c5 100644
--- a/tornado/test/locks_test.py
+++ b/tornado/test/locks_test.py
@@ -346,7 +346,7 @@ class SemaphoreContextManagerTest(AsyncTestCase):
     def test_context_manager(self):
         sem = locks.Semaphore()
         with (yield sem.acquire()) as yielded:
-            self.assertTrue(yielded is None)
+            self.assertIsNone(yielded)
 
         # Semaphore was released and can be acquired again.
         self.assertTrue(asyncio.ensure_future(sem.acquire()).done())
@@ -358,7 +358,7 @@ def test_context_manager_async_await(self):
 
         async def f():
             async with sem as yielded:
-                self.assertTrue(yielded is None)
+                self.assertIsNone(yielded)
 
         yield f()
 
diff --git a/tornado/test/log_test.py b/tornado/test/log_test.py
index fec4c38..5b4f991 100644
--- a/tornado/test/log_test.py
+++ b/tornado/test/log_test.py
@@ -89,7 +89,7 @@ def test_bytes_logging(self):
 
     def test_utf8_logging(self):
         with ignore_bytes_warning():
-            self.logger.error("\u00e9".encode("utf8"))
+            self.logger.error("\u00e9".encode())
         if issubclass(bytes, basestring_type):
             # on python 2, utf8 byte strings (and by extension ascii byte
             # strings) are passed through as-is.
diff --git a/tornado/test/netutil_test.py b/tornado/test/netutil_test.py
index b35b794..117a9d7 100644
--- a/tornado/test/netutil_test.py
+++ b/tornado/test/netutil_test.py
@@ -1,5 +1,4 @@
 import errno
-import os
 import signal
 import socket
 from subprocess import Popen
@@ -15,13 +14,10 @@
     bind_sockets,
 )
 from tornado.testing import AsyncTestCase, gen_test, bind_unused_port
-from tornado.test.util import skipIfNoNetwork
+from tornado.test.util import skipIfNoNetwork, abstract_base_test
 
 import typing
 
-if typing.TYPE_CHECKING:
-    from typing import List  # noqa: F401
-
 try:
     import pycares  # type: ignore
 except ImportError:
@@ -29,20 +25,13 @@
 else:
     from tornado.platform.caresresolver import CaresResolver
 
-try:
-    import twisted  # type: ignore
-    import twisted.names  # type: ignore
-except ImportError:
-    twisted = None
-else:
-    from tornado.platform.twisted import TwistedResolver
-
 
-class _ResolverTestMixin(object):
+@abstract_base_test
+class _ResolverTestMixin(AsyncTestCase):
     resolver = None  # type: typing.Any
 
     @gen_test
-    def test_localhost(self: typing.Any):
+    def test_localhost(self):
         addrinfo = yield self.resolver.resolve("localhost", 80, socket.AF_UNSPEC)
         # Most of the time localhost resolves to either the ipv4 loopback
         # address alone, or ipv4+ipv6. But some versions of pycares will only
@@ -56,11 +45,12 @@ def test_localhost(self: typing.Any):
 
 # It is impossible to quickly and consistently generate an error in name
 # resolution, so test this case separately, using mocks as needed.
-class _ResolverErrorTestMixin(object):
+@abstract_base_test
+class _ResolverErrorTestMixin(AsyncTestCase):
     resolver = None  # type: typing.Any
 
     @gen_test
-    def test_bad_host(self: typing.Any):
+    def test_bad_host(self):
         with self.assertRaises(IOError):
             yield self.resolver.resolve("an invalid domain", 80, socket.AF_UNSPEC)
 
@@ -71,7 +61,7 @@ def _failing_getaddrinfo(*args):
 
 
 @skipIfNoNetwork
-class BlockingResolverTest(AsyncTestCase, _ResolverTestMixin):
+class BlockingResolverTest(_ResolverTestMixin):
     def setUp(self):
         super().setUp()
         self.resolver = BlockingResolver()
@@ -80,7 +70,7 @@ def setUp(self):
 # getaddrinfo-based tests need mocking to reliably generate errors;
 # some configurations are slow to produce errors and take longer than
 # our default timeout.
-class BlockingResolverErrorTest(AsyncTestCase, _ResolverErrorTestMixin):
+class BlockingResolverErrorTest(_ResolverErrorTestMixin):
     def setUp(self):
         super().setUp()
         self.resolver = BlockingResolver()
@@ -92,7 +82,7 @@ def tearDown(self):
         super().tearDown()
 
 
-class OverrideResolverTest(AsyncTestCase, _ResolverTestMixin):
+class OverrideResolverTest(_ResolverTestMixin):
     def setUp(self):
         super().setUp()
         mapping = {
@@ -117,7 +107,7 @@ def test_resolve_multiaddr(self):
 
 
 @skipIfNoNetwork
-class ThreadedResolverTest(AsyncTestCase, _ResolverTestMixin):
+class ThreadedResolverTest(_ResolverTestMixin):
     def setUp(self):
         super().setUp()
         self.resolver = ThreadedResolver()
@@ -127,7 +117,7 @@ def tearDown(self):
         super().tearDown()
 
 
-class ThreadedResolverErrorTest(AsyncTestCase, _ResolverErrorTestMixin):
+class ThreadedResolverErrorTest(_ResolverErrorTestMixin):
     def setUp(self):
         super().setUp()
         self.resolver = BlockingResolver()
@@ -172,52 +162,31 @@ def test_import(self):
 @unittest.skipIf(pycares is None, "pycares module not present")
 @unittest.skipIf(sys.platform == "win32", "pycares doesn't return loopback on windows")
 @unittest.skipIf(sys.platform == "darwin", "pycares doesn't return 127.0.0.1 on darwin")
-class CaresResolverTest(AsyncTestCase, _ResolverTestMixin):
+class CaresResolverTest(_ResolverTestMixin):
     def setUp(self):
         super().setUp()
         self.resolver = CaresResolver()
 
 
-# TwistedResolver produces consistent errors in our test cases so we
-# could test the regular and error cases in the same class. However,
-# in the error cases it appears that cleanup of socket objects is
-# handled asynchronously and occasionally results in "unclosed socket"
-# warnings if not given time to shut down (and there is no way to
-# explicitly shut it down). This makes the test flaky, so we do not
-# test error cases here.
-@skipIfNoNetwork
-@unittest.skipIf(twisted is None, "twisted module not present")
-@unittest.skipIf(
-    getattr(twisted, "__version__", "0.0") < "12.1", "old version of twisted"
-)
-@unittest.skipIf(sys.platform == "win32", "twisted resolver hangs on windows")
-class TwistedResolverTest(AsyncTestCase, _ResolverTestMixin):
-    def setUp(self):
-        super().setUp()
-        self.resolver = TwistedResolver()
-
-
 class IsValidIPTest(unittest.TestCase):
     def test_is_valid_ip(self):
         self.assertTrue(is_valid_ip("127.0.0.1"))
         self.assertTrue(is_valid_ip("4.4.4.4"))
         self.assertTrue(is_valid_ip("::1"))
         self.assertTrue(is_valid_ip("2620:0:1cfe:face:b00c::3"))
-        self.assertTrue(not is_valid_ip("www.google.com"))
-        self.assertTrue(not is_valid_ip("localhost"))
-        self.assertTrue(not is_valid_ip("4.4.4.4<"))
-        self.assertTrue(not is_valid_ip(" 127.0.0.1"))
-        self.assertTrue(not is_valid_ip(""))
-        self.assertTrue(not is_valid_ip(" "))
-        self.assertTrue(not is_valid_ip("\n"))
-        self.assertTrue(not is_valid_ip("\x00"))
-        self.assertTrue(not is_valid_ip("a" * 100))
+        self.assertFalse(is_valid_ip("www.google.com"))
+        self.assertFalse(is_valid_ip("localhost"))
+        self.assertFalse(is_valid_ip("4.4.4.4<"))
+        self.assertFalse(is_valid_ip(" 127.0.0.1"))
+        self.assertFalse(is_valid_ip(""))
+        self.assertFalse(is_valid_ip(" "))
+        self.assertFalse(is_valid_ip("\n"))
+        self.assertFalse(is_valid_ip("\x00"))
+        self.assertFalse(is_valid_ip("a" * 100))
 
 
 class TestPortAllocation(unittest.TestCase):
     def test_same_port_allocation(self):
-        if "TRAVIS" in os.environ:
-            self.skipTest("dual-stack servers often have port conflicts on travis")
         sockets = bind_sockets(0, "localhost")
         try:
             port = sockets[0].getsockname()[1]
@@ -230,12 +199,12 @@ def test_same_port_allocation(self):
         not hasattr(socket, "SO_REUSEPORT"), "SO_REUSEPORT is not supported"
     )
     def test_reuse_port(self):
-        sockets = []  # type: List[socket.socket]
-        socket, port = bind_unused_port(reuse_port=True)
+        sockets: typing.List[socket.socket] = []
+        sock, port = bind_unused_port(reuse_port=True)
         try:
             sockets = bind_sockets(port, "127.0.0.1", reuse_port=True)
             self.assertTrue(all(s.getsockname()[1] == port for s in sockets))
         finally:
-            socket.close()
+            sock.close()
             for sock in sockets:
                 sock.close()
diff --git a/tornado/test/options_test.py b/tornado/test/options_test.py
index 6f4021c..67d89c2 100644
--- a/tornado/test/options_test.py
+++ b/tornado/test/options_test.py
@@ -7,7 +7,6 @@
 
 from tornado.options import OptionParser, Error
 from tornado.util import basestring_type
-from tornado.test.util import subTest
 
 import typing
 
@@ -15,7 +14,7 @@
     from typing import List  # noqa: F401
 
 
-class Email(object):
+class Email:
     def __init__(self, value):
         if isinstance(value, str) and "@" in value:
             self._value = value
@@ -135,7 +134,7 @@ def _sample_options(self):
     def test_iter(self):
         options = self._sample_options()
         # OptionParsers always define 'help'.
-        self.assertEqual(set(["a", "b", "help"]), set(iter(options)))
+        self.assertEqual({"a", "b", "help"}, set(iter(options)))
 
     def test_getitem(self):
         options = self._sample_options()
@@ -166,7 +165,7 @@ def test_group_dict(self):
 
         frame = sys._getframe(0)
         this_file = frame.f_code.co_filename
-        self.assertEqual(set(["b_group", "", this_file]), options.groups())
+        self.assertEqual({"b_group", "", this_file}, options.groups())
 
         b_group_dict = options.group_dict("b_group")
         self.assertEqual({"b": 2}, b_group_dict)
@@ -277,7 +276,7 @@ def test_error_redefine_underscore(self):
             ("foo_bar", "foo-bar"),
         ]
         for a, b in tests:
-            with subTest(self, a=a, b=b):
+            with self.subTest(self, a=a, b=b):
                 options = OptionParser()
                 options.define(a)
                 with self.assertRaises(Error) as cm:
diff --git a/tornado/test/process_test.py b/tornado/test/process_test.py
index ab29008..1c5cff3 100644
--- a/tornado/test/process_test.py
+++ b/tornado/test/process_test.py
@@ -9,7 +9,6 @@
 
 from tornado.httpclient import HTTPClient, HTTPError
 from tornado.httpserver import HTTPServer
-from tornado.ioloop import IOLoop
 from tornado.log import gen_log
 from tornado.process import fork_processes, task_id, Subprocess
 from tornado.simple_httpclient import SimpleAsyncHTTPClient
@@ -66,13 +65,13 @@ def get_url(path):
             signal.alarm(5)  # master process
             try:
                 id = fork_processes(3, max_restarts=3)
-                self.assertTrue(id is not None)
+                self.assertIsNotNone(id)
                 signal.alarm(5)  # child processes
             except SystemExit as e:
                 # if we exit cleanly from fork_processes, all the child processes
                 # finished with status 0
                 self.assertEqual(e.code, 0)
-                self.assertTrue(task_id() is None)
+                self.assertIsNone(task_id())
                 sock.close()
                 return
             try:
@@ -141,17 +140,8 @@ def term_and_wait(self, subproc):
 
     @gen_test
     def test_subprocess(self):
-        if IOLoop.configured_class().__name__.endswith("LayeredTwistedIOLoop"):
-            # This test fails non-deterministically with LayeredTwistedIOLoop.
-            # (the read_until('\n') returns '\n' instead of 'hello\n')
-            # This probably indicates a problem with either TornadoReactor
-            # or TwistedIOLoop, but I haven't been able to track it down
-            # and for now this is just causing spurious travis-ci failures.
-            raise unittest.SkipTest(
-                "Subprocess tests not compatible with " "LayeredTwistedIOLoop"
-            )
         subproc = Subprocess(
-            [sys.executable, "-u", "-i"],
+            [sys.executable, "-u", "-i", "-I"],
             stdin=Subprocess.STREAM,
             stdout=Subprocess.STREAM,
             stderr=subprocess.STDOUT,
@@ -173,7 +163,7 @@ def test_subprocess(self):
     def test_close_stdin(self):
         # Close the parent's stdin handle and see that the child recognizes it.
         subproc = Subprocess(
-            [sys.executable, "-u", "-i"],
+            [sys.executable, "-u", "-i", "-I"],
             stdin=Subprocess.STREAM,
             stdout=Subprocess.STREAM,
             stderr=subprocess.STDOUT,
diff --git a/tornado/test/runtests.py b/tornado/test/runtests.py
index f35b372..d7eb51f 100644
--- a/tornado/test/runtests.py
+++ b/tornado/test/runtests.py
@@ -13,6 +13,7 @@
 from tornado.httpserver import HTTPServer
 from tornado.netutil import Resolver
 from tornado.options import define, add_parse_callback, options
+from tornado.test.util import ABT_SKIP_MESSAGE
 
 
 TEST_MODULES = [
@@ -60,15 +61,26 @@ def all():
 
 
 def test_runner_factory(stderr):
+
+    class TornadoTextTestResult(unittest.TextTestResult):
+        def addSkip(self, test, reason):
+            if reason == ABT_SKIP_MESSAGE:
+                # Don't report abstract base tests as skips in our own tooling.
+                #
+                # See tornado.test.util.abstract_base_test.
+                return
+            super().addSkip(test, reason)
+
     class TornadoTextTestRunner(unittest.TextTestRunner):
         def __init__(self, *args, **kwargs):
             kwargs["stream"] = stderr
+            kwargs["resultclass"] = TornadoTextTestResult
             super().__init__(*args, **kwargs)
 
         def run(self, test):
             result = super().run(test)
             if result.skipped:
-                skip_reasons = set(reason for (test, reason) in result.skipped)
+                skip_reasons = {reason for (test, reason) in result.skipped}
                 self.stream.write(  # type: ignore
                     textwrap.fill(
                         "Some tests were skipped because: %s"
diff --git a/tornado/test/simple_httpclient_test.py b/tornado/test/simple_httpclient_test.py
index 593f81f..a40435e 100644
--- a/tornado/test/simple_httpclient_test.py
+++ b/tornado/test/simple_httpclient_test.py
@@ -11,7 +11,8 @@
 
 from tornado.escape import to_unicode, utf8
 from tornado import gen, version
-from tornado.httpclient import AsyncHTTPClient
+from tornado.httpclient import AsyncHTTPClient, HTTPResponse
+from tornado.httpserver import HTTPServer
 from tornado.httputil import HTTPHeaders, ResponseStartLine
 from tornado.ioloop import IOLoop
 from tornado.iostream import UnsatisfiableReadError
@@ -38,7 +39,11 @@
     ExpectLog,
     gen_test,
 )
-from tornado.test.util import skipOnTravis, skipIfNoIPv6, refusing_port
+from tornado.test.util import (
+    abstract_base_test,
+    skipIfNoIPv6,
+    refusing_port,
+)
 from tornado.web import RequestHandler, Application, url, stream_request_body
 
 
@@ -142,11 +147,31 @@ def prepare(self):
         self.finish("forbidden")
 
 
-class SimpleHTTPClientTestMixin(object):
+@abstract_base_test
+class SimpleHTTPClientTestMixin(AsyncTestCase):
+    # See comments on TestIOStreamWebMixin
+    def get_http_port(self) -> int:
+        raise NotImplementedError()
+
+    def fetch(
+        self, path: str, raise_error: bool = False, **kwargs: typing.Any
+    ) -> HTTPResponse:
+        # To be filled in by mixing in AsyncHTTPTestCase or AsyncHTTPSTestCase
+        raise NotImplementedError()
+
+    def get_url(self, path: str) -> str:
+        raise NotImplementedError()
+
+    def get_protocol(self) -> str:
+        raise NotImplementedError()
+
+    def get_http_server(self) -> HTTPServer:
+        raise NotImplementedError()
+
     def create_client(self, **kwargs):
         raise NotImplementedError()
 
-    def get_app(self: typing.Any):
+    def mixin_get_app(self):
         # callable objects to finish pending /trigger requests
         self.triggers = (
             collections.deque()
@@ -177,15 +202,15 @@ def get_app(self: typing.Any):
             gzip=True,
         )
 
-    def test_singleton(self: typing.Any):
+    def test_singleton(self):
         # Class "constructor" reuses objects on the same IOLoop
-        self.assertTrue(SimpleAsyncHTTPClient() is SimpleAsyncHTTPClient())
+        self.assertIs(SimpleAsyncHTTPClient(), SimpleAsyncHTTPClient())
         # unless force_instance is used
-        self.assertTrue(
-            SimpleAsyncHTTPClient() is not SimpleAsyncHTTPClient(force_instance=True)
+        self.assertIsNot(
+            SimpleAsyncHTTPClient(), SimpleAsyncHTTPClient(force_instance=True)
         )
         # different IOLoops use different objects
-        with closing(IOLoop()) as io_loop2:
+        with closing(IOLoop(make_current=False)) as io_loop2:
 
             async def make_client():
                 await gen.sleep(0)
@@ -193,9 +218,9 @@ async def make_client():
 
             client1 = self.io_loop.run_sync(make_client)
             client2 = io_loop2.run_sync(make_client)
-            self.assertTrue(client1 is not client2)
+            self.assertIsNot(client1, client2)
 
-    def test_connection_limit(self: typing.Any):
+    def test_connection_limit(self):
         with closing(self.create_client(max_clients=2)) as client:
             self.assertEqual(client.max_clients, 2)
             seen = []
@@ -215,24 +240,24 @@ def cb(fut, i=i):
             self.triggers.popleft()()
             self.triggers.popleft()()
             self.wait(condition=lambda: (len(self.triggers) == 2 and len(seen) == 2))
-            self.assertEqual(set(seen), set([0, 1]))
+            self.assertEqual(set(seen), {0, 1})
             self.assertEqual(len(client.queue), 0)
 
             # Finish all the pending requests
             self.triggers.popleft()()
             self.triggers.popleft()()
             self.wait(condition=lambda: len(seen) == 4)
-            self.assertEqual(set(seen), set([0, 1, 2, 3]))
+            self.assertEqual(set(seen), {0, 1, 2, 3})
             self.assertEqual(len(self.triggers), 0)
 
     @gen_test
-    def test_redirect_connection_limit(self: typing.Any):
+    def test_redirect_connection_limit(self):
         # following redirects should not consume additional connections
         with closing(self.create_client(max_clients=1)) as client:
             response = yield client.fetch(self.get_url("/countdown/3"), max_redirects=3)
             response.rethrow()
 
-    def test_max_redirects(self: typing.Any):
+    def test_max_redirects(self):
         response = self.fetch("/countdown/5", max_redirects=3)
         self.assertEqual(302, response.code)
         # We requested 5, followed three redirects for 4, 3, 2, then the last
@@ -241,19 +266,19 @@ def test_max_redirects(self: typing.Any):
         self.assertTrue(response.effective_url.endswith("/countdown/2"))
         self.assertTrue(response.headers["Location"].endswith("/countdown/1"))
 
-    def test_header_reuse(self: typing.Any):
+    def test_header_reuse(self):
         # Apps may reuse a headers object if they are only passing in constant
         # headers like user-agent.  The header object should not be modified.
         headers = HTTPHeaders({"User-Agent": "Foo"})
         self.fetch("/hello", headers=headers)
         self.assertEqual(list(headers.get_all()), [("User-Agent", "Foo")])
 
-    def test_default_user_agent(self: typing.Any):
+    def test_default_user_agent(self):
         response = self.fetch("/user_agent", method="GET")
         self.assertEqual(200, response.code)
-        self.assertEqual(response.body.decode(), "Tornado/{}".format(version))
+        self.assertEqual(response.body.decode(), f"Tornado/{version}")
 
-    def test_see_other_redirect(self: typing.Any):
+    def test_see_other_redirect(self):
         for code in (302, 303):
             response = self.fetch("/see_other_post", method="POST", body="%d" % code)
             self.assertEqual(200, response.code)
@@ -262,9 +287,8 @@ def test_see_other_redirect(self: typing.Any):
             # request is the original request, is a POST still
             self.assertEqual("POST", response.request.method)
 
-    @skipOnTravis
     @gen_test
-    def test_connect_timeout(self: typing.Any):
+    def test_connect_timeout(self):
         timeout = 0.1
 
         cleanup_event = Event()
@@ -291,8 +315,7 @@ async def resolve(self, *args, **kwargs):
         cleanup_event.set()
         yield gen.sleep(0.2)
 
-    @skipOnTravis
-    def test_request_timeout(self: typing.Any):
+    def test_request_timeout(self):
         timeout = 0.1
         if os.name == "nt":
             timeout = 0.5
@@ -304,10 +327,10 @@ def test_request_timeout(self: typing.Any):
         self.io_loop.run_sync(lambda: gen.sleep(0))
 
     @skipIfNoIPv6
-    def test_ipv6(self: typing.Any):
+    def test_ipv6(self):
         [sock] = bind_sockets(0, "::1", family=socket.AF_INET6)
         port = sock.getsockname()[1]
-        self.http_server.add_socket(sock)
+        self.get_http_server().add_socket(sock)
         url = "%s://[::1]:%d/hello" % (self.get_protocol(), port)
 
         # ipv6 is currently enabled by default but can be disabled
@@ -317,7 +340,7 @@ def test_ipv6(self: typing.Any):
         response = self.fetch(url)
         self.assertEqual(response.body, b"Hello world!")
 
-    def test_multiple_content_length_accepted(self: typing.Any):
+    def test_multiple_content_length_accepted(self):
         response = self.fetch("/content_length?value=2,2")
         self.assertEqual(response.body, b"ok")
         response = self.fetch("/content_length?value=2,%202,2")
@@ -331,20 +354,20 @@ def test_multiple_content_length_accepted(self: typing.Any):
             with self.assertRaises(HTTPStreamClosedError):
                 self.fetch("/content_length?value=2,%202,3", raise_error=True)
 
-    def test_head_request(self: typing.Any):
+    def test_head_request(self):
         response = self.fetch("/head", method="HEAD")
         self.assertEqual(response.code, 200)
         self.assertEqual(response.headers["content-length"], "7")
         self.assertFalse(response.body)
 
-    def test_options_request(self: typing.Any):
+    def test_options_request(self):
         response = self.fetch("/options", method="OPTIONS")
         self.assertEqual(response.code, 200)
         self.assertEqual(response.headers["content-length"], "2")
         self.assertEqual(response.headers["access-control-allow-origin"], "*")
         self.assertEqual(response.body, b"ok")
 
-    def test_no_content(self: typing.Any):
+    def test_no_content(self):
         response = self.fetch("/no_content")
         self.assertEqual(response.code, 204)
         # 204 status shouldn't have a content-length
@@ -353,7 +376,7 @@ def test_no_content(self: typing.Any):
         # in HTTP204NoContentTestCase.
         self.assertNotIn("Content-Length", response.headers)
 
-    def test_host_header(self: typing.Any):
+    def test_host_header(self):
         host_re = re.compile(b"^127.0.0.1:[0-9]+$")
         response = self.fetch("/host_echo")
         self.assertTrue(host_re.match(response.body))
@@ -362,7 +385,7 @@ def test_host_header(self: typing.Any):
         response = self.fetch(url)
         self.assertTrue(host_re.match(response.body), response.body)
 
-    def test_connection_refused(self: typing.Any):
+    def test_connection_refused(self):
         cleanup_func, port = refusing_port()
         self.addCleanup(cleanup_func)
         with ExpectLog(gen_log, ".*", required=False):
@@ -382,7 +405,7 @@ def test_connection_refused(self: typing.Any):
             expected_message = os.strerror(errno.ECONNREFUSED)
             self.assertTrue(expected_message in str(cm.exception), cm.exception)
 
-    def test_queue_timeout(self: typing.Any):
+    def test_queue_timeout(self):
         with closing(self.create_client(max_clients=1)) as client:
             # Wait for the trigger request to block, not complete.
             fut1 = client.fetch(self.get_url("/trigger"), request_timeout=10)
@@ -398,7 +421,7 @@ def test_queue_timeout(self: typing.Any):
             self.triggers.popleft()()
             self.io_loop.run_sync(lambda: fut1)
 
-    def test_no_content_length(self: typing.Any):
+    def test_no_content_length(self):
         response = self.fetch("/no_content_length")
         if response.body == b"HTTP/1 required":
             self.skipTest("requires HTTP/1.x")
@@ -415,14 +438,14 @@ def async_body_producer(self, write):
         yield gen.moment
         yield write(b"5678")
 
-    def test_sync_body_producer_chunked(self: typing.Any):
+    def test_sync_body_producer_chunked(self):
         response = self.fetch(
             "/echo_post", method="POST", body_producer=self.sync_body_producer
         )
         response.rethrow()
         self.assertEqual(response.body, b"12345678")
 
-    def test_sync_body_producer_content_length(self: typing.Any):
+    def test_sync_body_producer_content_length(self):
         response = self.fetch(
             "/echo_post",
             method="POST",
@@ -432,14 +455,14 @@ def test_sync_body_producer_content_length(self: typing.Any):
         response.rethrow()
         self.assertEqual(response.body, b"12345678")
 
-    def test_async_body_producer_chunked(self: typing.Any):
+    def test_async_body_producer_chunked(self):
         response = self.fetch(
             "/echo_post", method="POST", body_producer=self.async_body_producer
         )
         response.rethrow()
         self.assertEqual(response.body, b"12345678")
 
-    def test_async_body_producer_content_length(self: typing.Any):
+    def test_async_body_producer_content_length(self):
         response = self.fetch(
             "/echo_post",
             method="POST",
@@ -449,7 +472,7 @@ def test_async_body_producer_content_length(self: typing.Any):
         response.rethrow()
         self.assertEqual(response.body, b"12345678")
 
-    def test_native_body_producer_chunked(self: typing.Any):
+    def test_native_body_producer_chunked(self):
         async def body_producer(write):
             await write(b"1234")
             import asyncio
@@ -461,7 +484,7 @@ async def body_producer(write):
         response.rethrow()
         self.assertEqual(response.body, b"12345678")
 
-    def test_native_body_producer_content_length(self: typing.Any):
+    def test_native_body_producer_content_length(self):
         async def body_producer(write):
             await write(b"1234")
             import asyncio
@@ -478,13 +501,13 @@ async def body_producer(write):
         response.rethrow()
         self.assertEqual(response.body, b"12345678")
 
-    def test_100_continue(self: typing.Any):
+    def test_100_continue(self):
         response = self.fetch(
             "/echo_post", method="POST", body=b"1234", expect_100_continue=True
         )
         self.assertEqual(response.body, b"1234")
 
-    def test_100_continue_early_response(self: typing.Any):
+    def test_100_continue_early_response(self):
         def body_producer(write):
             raise Exception("should not be called")
 
@@ -496,7 +519,7 @@ def body_producer(write):
         )
         self.assertEqual(response.code, 403)
 
-    def test_streaming_follow_redirects(self: typing.Any):
+    def test_streaming_follow_redirects(self):
         # When following redirects, header and streaming callbacks
         # should only be called for the final result.
         # TODO(bdarnell): this test belongs in httpclient_test instead of
@@ -517,20 +540,26 @@ def test_streaming_follow_redirects(self: typing.Any):
         self.assertEqual(num_start_lines, 1)
 
 
-class SimpleHTTPClientTestCase(SimpleHTTPClientTestMixin, AsyncHTTPTestCase):
+class SimpleHTTPClientTestCase(AsyncHTTPTestCase, SimpleHTTPClientTestMixin):
     def setUp(self):
         super().setUp()
         self.http_client = self.create_client()
 
+    def get_app(self):
+        return self.mixin_get_app()
+
     def create_client(self, **kwargs):
         return SimpleAsyncHTTPClient(force_instance=True, **kwargs)
 
 
-class SimpleHTTPSClientTestCase(SimpleHTTPClientTestMixin, AsyncHTTPSTestCase):
+class SimpleHTTPSClientTestCase(AsyncHTTPSTestCase, SimpleHTTPClientTestMixin):
     def setUp(self):
         super().setUp()
         self.http_client = self.create_client()
 
+    def get_app(self):
+        return self.mixin_get_app()
+
     def create_client(self, **kwargs):
         return SimpleAsyncHTTPClient(
             force_instance=True, defaults=dict(validate_cert=False), **kwargs
diff --git a/tornado/test/tcpclient_test.py b/tornado/test/tcpclient_test.py
index ecfc82d..5638559 100644
--- a/tornado/test/tcpclient_test.py
+++ b/tornado/test/tcpclient_test.py
@@ -14,7 +14,6 @@
 # under the License.
 from contextlib import closing
 import getpass
-import os
 import socket
 import unittest
 
@@ -64,8 +63,6 @@ def setUp(self):
         self.client = TCPClient()
 
     def start_server(self, family):
-        if family == socket.AF_UNSPEC and "TRAVIS" in os.environ:
-            self.skipTest("dual-stack servers often have port conflicts on travis")
         self.server = TestTCPServer(family)
         return self.server.port
 
@@ -83,7 +80,7 @@ def skipIfLocalhostV4(self):
         # The port used here doesn't matter, but some systems require it
         # to be non-zero if we do not also pass AI_PASSIVE.
         addrinfo = self.io_loop.run_sync(lambda: Resolver().resolve("localhost", 80))
-        families = set(addr[0] for addr in addrinfo)
+        families = {addr[0] for addr in addrinfo}
         if socket.AF_INET6 not in families:
             self.skipTest("localhost does not resolve to ipv6")
 
@@ -118,8 +115,6 @@ def test_connect_ipv6_ipv6(self):
     @skipIfNoIPv6
     def test_connect_ipv6_dual(self):
         self.skipIfLocalhostV4()
-        if Resolver.configured_class().__name__.endswith("TwistedResolver"):
-            self.skipTest("TwistedResolver does not support multiple addresses")
         self.do_test_connect(socket.AF_INET6, "localhost")
 
     def test_connect_unspec_ipv4(self):
@@ -199,7 +194,7 @@ def test_mixed(self):
 
 
 class ConnectorTest(AsyncTestCase):
-    class FakeStream(object):
+    class FakeStream:
         def __init__(self):
             self.closed = False
 
@@ -362,7 +357,7 @@ def test_one_family_success_before_connect_timeout(self):
         self.resolve_connect(AF1, "a", True)
         conn.on_connect_timeout()
         self.assert_pending()
-        self.assertEqual(self.streams["a"].closed, False)
+        self.assertFalse(self.streams["a"].closed)
         # success stream will be pop
         self.assertEqual(len(conn.streams), 0)
         # streams in connector should be closed after connect timeout
diff --git a/tornado/test/tcpserver_test.py b/tornado/test/tcpserver_test.py
index c636c85..3c691cf 100644
--- a/tornado/test/tcpserver_test.py
+++ b/tornado/test/tcpserver_test.py
@@ -93,7 +93,7 @@ def handle_stream(self, stream, address):
         def connect(c):
             try:
                 yield c.connect(server_addr)
-            except EnvironmentError:
+            except OSError:
                 pass
             else:
                 connected_clients.append(c)
diff --git a/tornado/test/template_test.py b/tornado/test/template_test.py
index 801de50..477b762 100644
--- a/tornado/test/template_test.py
+++ b/tornado/test/template_test.py
@@ -164,22 +164,16 @@ def test_break_continue(self):
         self.assertEqual(result, b"013456")
 
     def test_break_outside_loop(self):
-        try:
+        with self.assertRaises(ParseError, msg="Did not get expected exception"):
             Template(utf8("{% break %}"))
-            raise Exception("Did not get expected exception")
-        except ParseError:
-            pass
 
     def test_break_in_apply(self):
         # This test verifies current behavior, although of course it would
         # be nice if apply didn't cause seemingly unrelated breakage
-        try:
+        with self.assertRaises(ParseError, msg="Did not get expected exception"):
             Template(
                 utf8("{% for i in [] %}{% apply foo %}{% break %}{% end %}{% end %}")
             )
-            raise Exception("Did not get expected exception")
-        except ParseError:
-            pass
 
     @unittest.skip("no testable future imports")
     def test_no_inherit_future(self):
@@ -267,7 +261,7 @@ def test_error_line_number_extends_base_error(self):
             self.fail("did not get expected exception")
         except ZeroDivisionError:
             exc_stack = traceback.format_exc()
-        self.assertTrue("# base.html:1" in exc_stack)
+        self.assertIn("# base.html:1", exc_stack)
 
     def test_error_line_number_extends_sub_error(self):
         loader = DictLoader(
@@ -285,7 +279,7 @@ def test_error_line_number_extends_sub_error(self):
             loader.load("sub.html").generate()
             self.fail("did not get expected exception")
         except ZeroDivisionError:
-            self.assertTrue("# sub.html:4 (via base.html:1)" in traceback.format_exc())
+            self.assertIn("# sub.html:4 (via base.html:1)", traceback.format_exc())
 
     def test_multi_includes(self):
         loader = DictLoader(
@@ -299,9 +293,7 @@ def test_multi_includes(self):
             loader.load("a.html").generate()
             self.fail("did not get expected exception")
         except ZeroDivisionError:
-            self.assertTrue(
-                "# c.html:1 (via b.html:1, a.html:1)" in traceback.format_exc()
-            )
+            self.assertIn("# c.html:1 (via b.html:1, a.html:1)", traceback.format_exc())
 
 
 class ParseErrorDetailTest(unittest.TestCase):
diff --git a/tornado/test/twisted_test.py b/tornado/test/twisted_test.py
index 36a541a..b1bebe6 100644
--- a/tornado/test/twisted_test.py
+++ b/tornado/test/twisted_test.py
@@ -13,6 +13,7 @@
 # License for the specific language governing permissions and limitations
 # under the License.
 
+import sys
 import unittest
 
 from tornado.testing import AsyncTestCase, gen_test
@@ -23,6 +24,14 @@
     have_twisted = True
 except ImportError:
     have_twisted = False
+except Exception:
+    # Twisted is currently incompatible with the first 3.14 alpha release; disable this
+    # test until the beta when it will hopefully be fixed (note that this requires us to
+    # update our requirements.txt to pick up a new version of twisted).
+    if sys.version_info[:2] == (3, 14) and sys.version_info.releaselevel == "alpha":
+        have_twisted = False
+    else:
+        raise
 else:
     # Not used directly but needed for `yield deferred` to work.
     import tornado.platform.twisted  # noqa: F401
diff --git a/tornado/test/util.py b/tornado/test/util.py
index bcb9bbd..c409b4c 100644
--- a/tornado/test/util.py
+++ b/tornado/test/util.py
@@ -3,39 +3,30 @@
 import platform
 import socket
 import sys
+import sysconfig
 import textwrap
-import typing  # noqa: F401
+import typing
 import unittest
 import warnings
 
 from tornado.testing import bind_unused_port
 
+_TestCaseType = typing.TypeVar("_TestCaseType", bound=typing.Type[unittest.TestCase])
+
 skipIfNonUnix = unittest.skipIf(
     os.name != "posix" or sys.platform == "cygwin", "non-unix platform"
 )
 
-# travis-ci.org runs our tests in an overworked virtual machine, which makes
-# timing-related tests unreliable.
-skipOnTravis = unittest.skipIf(
-    "TRAVIS" in os.environ, "timing tests unreliable on travis"
-)
-
 # Set the environment variable NO_NETWORK=1 to disable any tests that
 # depend on an external network.
 skipIfNoNetwork = unittest.skipIf("NO_NETWORK" in os.environ, "network access disabled")
 
 skipNotCPython = unittest.skipIf(
-    platform.python_implementation() != "CPython", "Not CPython implementation"
-)
-
-# Used for tests affected by
-# https://bitbucket.org/pypy/pypy/issues/2616/incomplete-error-handling-in
-# TODO: remove this after pypy3 5.8 is obsolete.
-skipPypy3V58 = unittest.skipIf(
-    platform.python_implementation() == "PyPy"
-    and sys.version_info > (3,)
-    and sys.pypy_version_info < (5, 9),  # type: ignore
-    "pypy3 5.8 has buggy ssl module",
+    # "CPython" here essentially refers to the traditional synchronous refcounting GC,
+    # so we skip these tests in free-threading builds of cpython too.
+    platform.python_implementation() != "CPython"
+    or sysconfig.get_config_var("Py_GIL_DISABLED"),
+    "Not CPython implementation",
 )
 
 
@@ -48,7 +39,7 @@ def _detect_ipv6():
     try:
         sock = socket.socket(socket.AF_INET6)
         sock.bind(("::1", 0))
-    except socket.error:
+    except OSError:
         return False
     finally:
         if sock is not None:
@@ -65,7 +56,7 @@ def refusing_port():
     Return value is (cleanup_func, port); the cleanup function
     must be called to free the port to be reused.
     """
-    # On travis-ci, port numbers are reassigned frequently. To avoid
+    # On travis-ci port numbers are reassigned frequently. To avoid
     # collisions with other tests, we use an open client-side socket's
     # ephemeral port number to ensure that nothing can listen on that
     # port.
@@ -94,21 +85,42 @@ def exec_test(caller_globals, caller_locals, s):
     return local_namespace
 
 
-def subTest(test, *args, **kwargs):
-    """Compatibility shim for unittest.TestCase.subTest.
-
-    Usage: ``with tornado.test.util.subTest(self, x=x):``
-    """
-    try:
-        subTest = test.subTest  # py34+
-    except AttributeError:
-        subTest = contextlib.contextmanager(lambda *a, **kw: (yield))
-    return subTest(*args, **kwargs)
-
-
 @contextlib.contextmanager
 def ignore_deprecation():
     """Context manager to ignore deprecation warnings."""
     with warnings.catch_warnings():
         warnings.simplefilter("ignore", DeprecationWarning)
         yield
+
+
+ABT_SKIP_MESSAGE = "abstract base class"
+
+
+def abstract_base_test(cls: _TestCaseType) -> _TestCaseType:
+    """Decorator to mark a test class as an "abstract" base class.
+
+    This is different from a regular abstract base class because
+    we do not limit instantiation of the class. (If we did, it would
+    interfere with test discovery). Instead, we prevent the tests from
+    being run.
+
+    Subclasses of an abstract base test are run as normal. There is
+    no support for the ``@abstractmethod`` decorator so there is no runtime
+    check that all such methods are implemented.
+
+    Note that while it is semantically cleaner to modify the test loader
+    to exclude abstract base tests, this is more complicated and would
+    interfere with third-party test runners. This approach degrades
+    gracefully to other tools such as editor-integrated testing.
+    """
+
+    # Type-checking fails due to https://github.com/python/mypy/issues/14458
+    # @functools.wraps(cls)
+    class AbstractBaseWrapper(cls):  # type: ignore
+        @classmethod
+        def setUpClass(cls):
+            if cls is AbstractBaseWrapper:
+                raise unittest.SkipTest(ABT_SKIP_MESSAGE)
+            super(AbstractBaseWrapper, cls).setUpClass()
+
+    return AbstractBaseWrapper  # type: ignore
diff --git a/tornado/test/util_test.py b/tornado/test/util_test.py
index 02cf0c1..baa2ff2 100644
--- a/tornado/test/util_test.py
+++ b/tornado/test/util_test.py
@@ -1,7 +1,7 @@
-from io import StringIO
 import re
 import sys
 import datetime
+import textwrap
 import unittest
 
 import tornado
@@ -14,14 +14,9 @@
     timedelta_to_seconds,
     import_object,
     re_unescape,
-    is_finalizing,
 )
 
-import typing
-from typing import cast
-
-if typing.TYPE_CHECKING:
-    from typing import Dict, Any  # noqa: F401
+from typing import cast, Dict, Any
 
 
 class RaiseExcInfoTest(unittest.TestCase):
@@ -114,7 +109,7 @@ def test_default(self):
         # let us access attributes of the base class.
         obj = cast(TestConfig1, TestConfigurable())
         self.assertIsInstance(obj, TestConfig1)
-        self.assertIs(obj.a, None)
+        self.assertIsNone(obj.a)
 
         obj = cast(TestConfig1, TestConfigurable(a=1))
         self.assertIsInstance(obj, TestConfig1)
@@ -126,7 +121,7 @@ def test_config_class(self):
         TestConfigurable.configure(TestConfig2)
         obj = cast(TestConfig2, TestConfigurable())
         self.assertIsInstance(obj, TestConfig2)
-        self.assertIs(obj.b, None)
+        self.assertIsNone(obj.b)
 
         obj = cast(TestConfig2, TestConfigurable(b=2))
         self.assertIsInstance(obj, TestConfig2)
@@ -138,7 +133,7 @@ def test_config_str(self):
         TestConfigurable.configure("tornado.test.util_test.TestConfig2")
         obj = cast(TestConfig2, TestConfigurable())
         self.assertIsInstance(obj, TestConfig2)
-        self.assertIs(obj.b, None)
+        self.assertIsNone(obj.b)
 
         obj = cast(TestConfig2, TestConfigurable(b=2))
         self.assertIsInstance(obj, TestConfig2)
@@ -160,7 +155,7 @@ def test_config_args(self):
         self.checkSubclasses()
         # args bound in configure don't apply when using the subclass directly
         obj = TestConfig1()
-        self.assertIs(obj.a, None)
+        self.assertIsNone(obj.a)
 
     def test_config_class_args(self):
         TestConfigurable.configure(TestConfig2, b=5)
@@ -176,7 +171,7 @@ def test_config_class_args(self):
         self.checkSubclasses()
         # args bound in configure don't apply when using the subclass directly
         obj = TestConfig2()
-        self.assertIs(obj.b, None)
+        self.assertIsNone(obj.b)
 
     def test_config_multi_level(self):
         TestConfigurable.configure(TestConfig3, a=1)
@@ -218,16 +213,35 @@ def test_unicode_escapes(self):
 
 
 class ExecInTest(unittest.TestCase):
-    # TODO(bdarnell): make a version of this test for one of the new
-    # future imports available in python 3.
-    @unittest.skip("no testable future imports")
     def test_no_inherit_future(self):
-        # This file has from __future__ import print_function...
-        f = StringIO()
-        print("hello", file=f)
-        # ...but the template doesn't
-        exec_in('print >> f, "world"', dict(f=f))
-        self.assertEqual(f.getvalue(), "hello\nworld\n")
+        # Two files: the first has "from __future__ import annotations", and it executes the second
+        # which doesn't. The second file should not be affected by the first's __future__ imports.
+        #
+        # The annotations future became available in python 3.7 but has been replaced by PEP 649, so
+        # it should remain supported but off-by-default for the foreseeable future.
+        code1 = textwrap.dedent(
+            """
+            from __future__ import annotations
+            from tornado.util import exec_in
+
+            exec_in(code2, globals())
+            """
+        )
+
+        code2 = textwrap.dedent(
+            """
+            def f(x: int) -> int:
+                return x + 1
+            output[0] = f.__annotations__
+            """
+        )
+
+        # Make a mutable container to pass the result back to the caller
+        output = [None]
+        exec_in(code1, dict(code2=code2, output=output))
+        # If the annotations future were in effect, these would be strings instead of the int type
+        # object.
+        self.assertEqual(output[0], {"x": int, "return": int})
 
 
 class ArgReplacerTest(unittest.TestCase):
@@ -239,8 +253,8 @@ def function(x, y, callback=None, z=None):
 
     def test_omitted(self):
         args = (1, 2)
-        kwargs = dict()  # type: Dict[str, Any]
-        self.assertIs(self.replacer.get_old_value(args, kwargs), None)
+        kwargs: Dict[str, Any] = dict()
+        self.assertIsNone(self.replacer.get_old_value(args, kwargs))
         self.assertEqual(
             self.replacer.replace("new", args, kwargs),
             (None, (1, 2), dict(callback="new")),
@@ -248,7 +262,7 @@ def test_omitted(self):
 
     def test_position(self):
         args = (1, 2, "old", 3)
-        kwargs = dict()  # type: Dict[str, Any]
+        kwargs: Dict[str, Any] = dict()
         self.assertEqual(self.replacer.get_old_value(args, kwargs), "old")
         self.assertEqual(
             self.replacer.replace("new", args, kwargs),
@@ -303,6 +317,57 @@ def test_re_unescape_raises_error_on_invalid_input(self):
             re_unescape("\\Z")
 
 
-class IsFinalizingTest(unittest.TestCase):
-    def test_basic(self):
-        self.assertFalse(is_finalizing())
+class VersionInfoTest(unittest.TestCase):
+    def assert_version_info_compatible(self, version, version_info):
+        # We map our version identifier string (a subset of
+        # https://packaging.python.org/en/latest/specifications/version-specifiers/#public-version-identifiers)
+        # to a 4-tuple of integers for easy comparisons. The last component is
+        # 0 for a final release, negative for a pre-release, and would be positive for a
+        # post-release if we did any of those. This test is not a promise that these are the
+        # only formats we will ever use, but it does catch accidents like
+        # https://github.com/tornadoweb/tornado/issues/3406.
+        major = minor = patch = "0"
+        is_pre = False
+        if m := re.fullmatch(r"(\d+)\.(\d+)\.(\d+)", version):
+            # Regular 3-component version number
+            major, minor, patch = m.groups()
+        elif m := re.fullmatch(r"(\d+)\.(\d+)", version):
+            # Two-component version number, equivalent to major.minor.0
+            major, minor = m.groups()
+        elif m := re.fullmatch(r"(\d+)\.(\d+)\.(\d+)(?:\.dev|a|b|rc)\d+", version):
+            # Pre-release 3-component version number.
+            major, minor, patch = m.groups()
+            is_pre = True
+        elif m := re.fullmatch(r"(\d+)\.(\d+)(?:\.dev|a|b|rc)\d+", version):
+            # Pre-release 2-component version number.
+            major, minor = m.groups()
+            is_pre = True
+        else:
+            self.fail(f"Unrecognized version format: {version}")
+
+        self.assertEqual(version_info[:3], (int(major), int(minor), int(patch)))
+        if is_pre:
+            self.assertLess(int(version_info[3]), 0)
+        else:
+            self.assertEqual(int(version_info[3]), 0)
+
+    def test_version_info_compatible(self):
+        self.assert_version_info_compatible("6.5.0", (6, 5, 0, 0))
+        self.assert_version_info_compatible("6.5", (6, 5, 0, 0))
+        self.assert_version_info_compatible("6.5.1", (6, 5, 1, 0))
+        self.assert_version_info_compatible("6.6.dev1", (6, 6, 0, -100))
+        self.assert_version_info_compatible("6.6a1", (6, 6, 0, -100))
+        self.assert_version_info_compatible("6.6b1", (6, 6, 0, -100))
+        self.assert_version_info_compatible("6.6rc1", (6, 6, 0, -100))
+        self.assertRaises(
+            AssertionError, self.assert_version_info_compatible, "6.5.0", (6, 5, 0, 1)
+        )
+        self.assertRaises(
+            AssertionError, self.assert_version_info_compatible, "6.5.0", (6, 4, 0, 0)
+        )
+        self.assertRaises(
+            AssertionError, self.assert_version_info_compatible, "6.5.1", (6, 5, 0, 1)
+        )
+
+    def test_current_version(self):
+        self.assert_version_info_compatible(tornado.version, tornado.version_info)
diff --git a/tornado/test/web_test.py b/tornado/test/web_test.py
index fec66f3..9bd1d49 100644
--- a/tornado/test/web_test.py
+++ b/tornado/test/web_test.py
@@ -1,3 +1,5 @@
+import http
+
 from tornado.concurrent import Future
 from tornado import gen
 from tornado.escape import (
@@ -131,7 +133,8 @@ def test_cookie_tampering_future_timestamp(self):
         handler.set_signed_cookie("foo", binascii.a2b_hex(b"d76df8e7aefc"), version=1)
         cookie = handler._cookies["foo"]
         match = re.match(rb"12345678\|([0-9]+)\|([0-9a-f]+)", cookie)
-        assert match is not None
+        self.assertIsNotNone(match)
+        assert match is not None  # for mypy
         timestamp = match.group(1)
         sig = match.group(2)
         self.assertEqual(
@@ -157,11 +160,11 @@ def test_cookie_tampering_future_timestamp(self):
         )
         # tamper with the cookie
         handler._cookies["foo"] = utf8(
-            "1234|5678%s|%s" % (to_basestring(timestamp), to_basestring(sig))
+            f"1234|5678{to_basestring(timestamp)}|{to_basestring(sig)}"
         )
         # it gets rejected
         with ExpectLog(gen_log, "Cookie timestamp in future"):
-            self.assertTrue(handler.get_signed_cookie("foo", min_version=1) is None)
+            self.assertIsNone(handler.get_signed_cookie("foo", min_version=1))
 
     def test_arbitrary_bytes(self):
         # Secure cookies accept arbitrary data (which is base64 encoded).
@@ -291,11 +294,67 @@ def get(self):
                 self.set_cookie("unicode_args", "blah", domain="foo.com", path="/foo")
 
         class SetCookieSpecialCharHandler(RequestHandler):
+            # "Special" characters are allowed in cookie values, but trigger special quoting.
             def get(self):
                 self.set_cookie("equals", "a=b")
                 self.set_cookie("semicolon", "a;b")
                 self.set_cookie("quote", 'a"b')
 
+        class SetCookieForbiddenCharHandler(RequestHandler):
+            def get(self):
+                # Control characters and semicolons raise errors in cookie names and attributes
+                # (but not values, which are tested in SetCookieSpecialCharHandler)
+                for char in list(map(chr, range(0x20))) + [chr(0x7F), ";"]:
+                    try:
+                        self.set_cookie("foo" + char, "bar")
+                        self.write(
+                            "Didn't get expected exception for char %r in name\n" % char
+                        )
+                    except http.cookies.CookieError as e:
+                        if "Invalid cookie attribute name" not in str(e):
+                            self.write(
+                                "unexpected exception for char %r in name: %s\n"
+                                % (char, e)
+                            )
+
+                    try:
+                        self.set_cookie("foo", "bar", domain="example" + char + ".com")
+                        self.write(
+                            "Didn't get expected exception for char %r in domain\n"
+                            % char
+                        )
+                    except http.cookies.CookieError as e:
+                        if "Invalid cookie attribute domain" not in str(e):
+                            self.write(
+                                "unexpected exception for char %r in domain: %s\n"
+                                % (char, e)
+                            )
+
+                    try:
+                        self.set_cookie("foo", "bar", path="/" + char)
+                        self.write(
+                            "Didn't get expected exception for char %r in path\n" % char
+                        )
+                    except http.cookies.CookieError as e:
+                        if "Invalid cookie attribute path" not in str(e):
+                            self.write(
+                                "unexpected exception for char %r in path: %s\n"
+                                % (char, e)
+                            )
+
+                    try:
+                        self.set_cookie("foo", "bar", samesite="a" + char)
+                        self.write(
+                            "Didn't get expected exception for char %r in samesite\n"
+                            % char
+                        )
+                    except http.cookies.CookieError as e:
+                        if "Invalid cookie attribute samesite" not in str(e):
+                            self.write(
+                                "unexpected exception for char %r in samesite: %s\n"
+                                % (char, e)
+                            )
+
         class SetCookieOverwriteHandler(RequestHandler):
             def get(self):
                 self.set_cookie("a", "b", domain="example.com")
@@ -329,6 +388,7 @@ def get(self):
             ("/get", GetCookieHandler),
             ("/set_domain", SetCookieDomainHandler),
             ("/special_char", SetCookieSpecialCharHandler),
+            ("/forbidden_char", SetCookieForbiddenCharHandler),
             ("/set_overwrite", SetCookieOverwriteHandler),
             ("/set_max_age", SetCookieMaxAgeHandler),
             ("/set_expires_days", SetCookieExpiresDaysHandler),
@@ -366,9 +426,10 @@ def test_cookie_special_char(self):
         self.assertEqual(len(headers), 3)
         self.assertEqual(headers[0], 'equals="a=b"; Path=/')
         self.assertEqual(headers[1], 'quote="a\\"b"; Path=/')
-        # python 2.7 octal-escapes the semicolon; older versions leave it alone
-        self.assertTrue(
-            headers[2] in ('semicolon="a;b"; Path=/', 'semicolon="a\\073b"; Path=/'),
+        # Semicolons are octal-escaped
+        self.assertIn(
+            headers[2],
+            ('semicolon="a;b"; Path=/', 'semicolon="a\\073b"; Path=/'),
             headers[2],
         )
 
@@ -385,6 +446,12 @@ def test_cookie_special_char(self):
             response = self.fetch("/get", headers={"Cookie": header})
             self.assertEqual(response.body, utf8(expected))
 
+    def test_set_cookie_forbidden_char(self):
+        response = self.fetch("/forbidden_char")
+        self.assertEqual(response.code, 200)
+        self.maxDiff = 10000
+        self.assertMultiLineEqual(to_unicode(response.body), "")
+
     def test_set_cookie_overwrite(self):
         response = self.fetch("/set_overwrite")
         headers = response.headers.get_list("Set-Cookie")
@@ -400,25 +467,25 @@ def test_set_cookie_max_age(self):
     def test_set_cookie_expires_days(self):
         response = self.fetch("/set_expires_days")
         header = response.headers.get("Set-Cookie")
-        assert header is not None
+        self.assertIsNotNone(header)
+        assert header is not None  # for mypy
         match = re.match("foo=bar; expires=(?P<expires>.+); Path=/", header)
-        assert match is not None
+        self.assertIsNotNone(match)
+        assert match is not None  # for mypy
 
         expires = datetime.datetime.now(datetime.timezone.utc) + datetime.timedelta(
             days=10
         )
         header_expires = email.utils.parsedate_to_datetime(match.groupdict()["expires"])
-        self.assertTrue(abs((expires - header_expires).total_seconds()) < 10)
+        self.assertLess(abs((expires - header_expires).total_seconds()), 10)
 
     def test_set_cookie_false_flags(self):
         response = self.fetch("/set_falsy_flags")
         headers = sorted(response.headers.get_list("Set-Cookie"))
-        # The secure and httponly headers are capitalized in py35 and
-        # lowercase in older versions.
-        self.assertEqual(headers[0].lower(), "a=1; path=/; secure")
-        self.assertEqual(headers[1].lower(), "b=1; path=/")
-        self.assertEqual(headers[2].lower(), "c=1; httponly; path=/")
-        self.assertEqual(headers[3].lower(), "d=1; path=/")
+        self.assertEqual(headers[0], "a=1; Path=/; Secure")
+        self.assertEqual(headers[1], "b=1; Path=/")
+        self.assertEqual(headers[2], "c=1; HttpOnly; Path=/")
+        self.assertEqual(headers[3], "d=1; Path=/")
 
     def test_set_cookie_deprecated(self):
         with ignore_deprecation():
@@ -512,16 +579,16 @@ def get(self, *path_args):
         # In httpserver.py (i.e. self.request.arguments), they're left
         # as bytes.  Keys are always native strings.
         for key in self.request.arguments:
-            if type(key) != str:
+            if type(key) is not str:
                 raise Exception("incorrect type for key: %r" % type(key))
             for bvalue in self.request.arguments[key]:
-                if type(bvalue) != bytes:
+                if type(bvalue) is not bytes:
                     raise Exception("incorrect type for value: %r" % type(bvalue))
             for svalue in self.get_arguments(key):
-                if type(svalue) != unicode_type:
+                if type(svalue) is not unicode_type:
                     raise Exception("incorrect type for value: %r" % type(svalue))
         for arg in path_args:
-            if type(arg) != unicode_type:
+            if type(arg) is not unicode_type:
                 raise Exception("incorrect type for path arg: %r" % type(arg))
         self.write(
             dict(
@@ -621,12 +688,12 @@ def post(self, path_component):
     def check_type(self, name, obj, expected_type):
         actual_type = type(obj)
         if expected_type != actual_type:
-            self.errors[name] = "expected %s, got %s" % (expected_type, actual_type)
+            self.errors[name] = f"expected {expected_type}, got {actual_type}"
 
 
 class DecodeArgHandler(RequestHandler):
     def decode_argument(self, value, name=None):
-        if type(value) != bytes:
+        if type(value) is not bytes:
             raise Exception("unexpected type for value: %r" % type(value))
         # use self.request.arguments directly to avoid recursion
         if "encoding" in self.request.arguments:
@@ -636,9 +703,9 @@ def decode_argument(self, value, name=None):
 
     def get(self, arg):
         def describe(s):
-            if type(s) == bytes:
+            if type(s) is bytes:
                 return ["bytes", native_str(binascii.b2a_hex(s))]
-            elif type(s) == unicode_type:
+            elif type(s) is unicode_type:
                 return ["unicode", s]
             raise Exception("unknown type")
 
@@ -704,6 +771,26 @@ def get(self):
                 raise
 
 
+class SetHeaderHandler(RequestHandler):
+    def get(self):
+        # tests the validity of web.RequestHandler._VALID_HEADER_CHARS
+        illegal_chars = [chr(o) for o in range(0, 0x20)]
+        illegal_chars.append(chr(0x7F))
+        illegal_chars.remove("\t")
+        for char in illegal_chars:
+            try:
+                self.set_header("X-Foo", "foo" + char + "bar")
+                raise Exception("Didn't get expected exception")
+            except ValueError as e:
+                if "Unsafe header value" not in str(e):
+                    raise
+
+        # an empty header value is valid as well
+        self.set_header("X-Foo", "")
+
+        self.finish(b"ok")
+
+
 class GetArgumentHandler(RequestHandler):
     def prepare(self):
         if self.get_argument("source", None) == "query":
@@ -788,6 +875,7 @@ def get_handlers(self):
             url("/header_injection", HeaderInjectionHandler),
             url("/get_argument", GetArgumentHandler),
             url("/get_arguments", GetArgumentsHandler),
+            url("/set_header", SetHeaderHandler),
         ]
         return urls
 
@@ -936,6 +1024,10 @@ def test_header_injection(self):
         response = self.fetch("/header_injection")
         self.assertEqual(response.body, b"ok")
 
+    def test_set_header(self):
+        response = self.fetch("/set_header")
+        self.assertEqual(response.body, b"ok")
+
     def test_get_argument(self):
         response = self.fetch("/get_argument?foo=bar")
         self.assertEqual(response.body, b"bar")
@@ -1044,15 +1136,15 @@ def test_default(self):
         with ExpectLog(app_log, "Uncaught exception"):
             response = self.fetch("/default")
             self.assertEqual(response.code, 500)
-            self.assertTrue(b"500: Internal Server Error" in response.body)
+            self.assertIn(b"500: Internal Server Error", response.body)
 
             response = self.fetch("/default?status=503")
             self.assertEqual(response.code, 503)
-            self.assertTrue(b"503: Service Unavailable" in response.body)
+            self.assertIn(b"503: Service Unavailable", response.body)
 
             response = self.fetch("/default?status=435")
             self.assertEqual(response.code, 435)
-            self.assertTrue(b"435: Unknown" in response.body)
+            self.assertIn(b"435: Unknown", response.body)
 
     def test_write_error(self):
         with ExpectLog(app_log, "Uncaught exception"):
@@ -1122,10 +1214,10 @@ def get_app_kwargs(self):
 
     def test_static_files(self):
         response = self.fetch("/robots.txt")
-        self.assertTrue(b"Disallow: /" in response.body)
+        self.assertIn(b"Disallow: /", response.body)
 
         response = self.fetch("/static/robots.txt")
-        self.assertTrue(b"Disallow: /" in response.body)
+        self.assertIn(b"Disallow: /", response.body)
         self.assertEqual(response.headers.get("Content-Type"), "text/plain")
 
     def test_static_files_cacheable(self):
@@ -1133,7 +1225,7 @@ def test_static_files_cacheable(self):
         # test is pretty weak but it gives us coverage of the code path which
         # was important for detecting the deprecation of datetime.utcnow.
         response = self.fetch("/robots.txt?v=12345")
-        self.assertTrue(b"Disallow: /" in response.body)
+        self.assertIn(b"Disallow: /", response.body)
         self.assertIn("Cache-Control", response.headers)
         self.assertIn("Expires", response.headers)
 
@@ -1146,8 +1238,8 @@ def test_static_compressed_files(self):
         )
         # make sure the uncompressed file still has the correct type
         response = self.fetch("/static/sample.xml")
-        self.assertTrue(
-            response.headers.get("Content-Type") in set(("text/xml", "application/xml"))
+        self.assertIn(
+            response.headers.get("Content-Type"), {"text/xml", "application/xml"}
         )
 
     def test_static_url(self):
@@ -1206,7 +1298,7 @@ def test_static_304_if_modified_since(self):
             headers={"If-Modified-Since": response1.headers["Last-Modified"]},
         )
         self.assertEqual(response2.code, 304)
-        self.assertTrue("Content-Length" not in response2.headers)
+        self.assertNotIn("Content-Length", response2.headers)
 
     def test_static_304_if_none_match(self):
         response1 = self.get_and_head("/static/robots.txt")
@@ -1226,6 +1318,13 @@ def test_static_304_etag_modified_bug(self):
         )
         self.assertEqual(response2.code, 200)
 
+    def test_static_304_if_modified_since_invalid(self):
+        response = self.get_and_head(
+            "/static/robots.txt",
+            headers={"If-Modified-Since": "!nv@l!d"},
+        )
+        self.assertEqual(response.code, 200)
+
     def test_static_if_modified_since_pre_epoch(self):
         # On windows, the functions that work with time_t do not accept
         # negative values, and at least one client (processing.js) seems
@@ -1283,7 +1382,7 @@ def test_static_with_range_full_file(self):
         with open(robots_file_path, encoding="utf-8") as f:
             self.assertEqual(response.body, utf8(f.read()))
         self.assertEqual(response.headers.get("Content-Length"), "26")
-        self.assertEqual(response.headers.get("Content-Range"), None)
+        self.assertIsNone(response.headers.get("Content-Range"))
 
     def test_static_with_range_full_past_end(self):
         response = self.get_and_head(
@@ -1294,7 +1393,7 @@ def test_static_with_range_full_past_end(self):
         with open(robots_file_path, encoding="utf-8") as f:
             self.assertEqual(response.body, utf8(f.read()))
         self.assertEqual(response.headers.get("Content-Length"), "26")
-        self.assertEqual(response.headers.get("Content-Range"), None)
+        self.assertIsNone(response.headers.get("Content-Range"))
 
     def test_static_with_range_partial_past_end(self):
         response = self.get_and_head(
@@ -1332,7 +1431,7 @@ def test_static_with_range_neg_past_start(self):
         with open(robots_file_path, encoding="utf-8") as f:
             self.assertEqual(response.body, utf8(f.read()))
         self.assertEqual(response.headers.get("Content-Length"), "26")
-        self.assertEqual(response.headers.get("Content-Range"), None)
+        self.assertIsNone(response.headers.get("Content-Range"))
 
     def test_static_invalid_range(self):
         response = self.get_and_head("/static/robots.txt", headers={"Range": "asdf"})
@@ -1390,7 +1489,7 @@ def test_static_range_if_none_match(self):
         )
         self.assertEqual(response.code, 304)
         self.assertEqual(response.body, b"")
-        self.assertTrue("Content-Length" not in response.headers)
+        self.assertNotIn("Content-Length", response.headers)
         self.assertEqual(
             utf8(response.headers["Etag"]), b'"' + self.robots_txt_hash + b'"'
         )
@@ -1507,7 +1606,7 @@ def make_static_url(cls, settings, path):
                 extension_index = path.rindex(".")
                 before_version = path[:extension_index]
                 after_version = path[(extension_index + 1) :]
-                return "/static/%s.%s.%s" % (
+                return "/static/{}.{}.{}".format(
                     before_version,
                     version_hash,
                     after_version,
@@ -1516,7 +1615,7 @@ def make_static_url(cls, settings, path):
             def parse_url_path(self, url_path):
                 extension_index = url_path.rindex(".")
                 version_index = url_path.rindex(".", 0, extension_index)
-                return "%s%s" % (url_path[:version_index], url_path[extension_index:])
+                return f"{url_path[:version_index]}{url_path[extension_index:]}"
 
             @classmethod
             def get_absolute_path(cls, settings, path):
@@ -1670,7 +1769,7 @@ def get(self):
 
     def test_clear_header(self):
         response = self.fetch("/")
-        self.assertTrue("h1" not in response.headers)
+        self.assertNotIn("h1", response.headers)
         self.assertEqual(response.headers["h2"], "bar")
 
 
@@ -1702,17 +1801,17 @@ def test_304_headers(self):
             "/", headers={"If-None-Match": response1.headers["Etag"]}
         )
         self.assertEqual(response2.code, 304)
-        self.assertTrue("Content-Length" not in response2.headers)
-        self.assertTrue("Content-Language" not in response2.headers)
+        self.assertNotIn("Content-Length", response2.headers)
+        self.assertNotIn("Content-Language", response2.headers)
         # Not an entity header, but should not be added to 304s by chunking
-        self.assertTrue("Transfer-Encoding" not in response2.headers)
+        self.assertNotIn("Transfer-Encoding", response2.headers)
 
 
 class StatusReasonTest(SimpleHandlerTestCase):
     class Handler(RequestHandler):
         def get(self):
             reason = self.request.arguments.get("reason", [])
-            self.set_status(
+            raise HTTPError(
                 int(self.get_argument("code")),
                 reason=to_unicode(reason[0]) if reason else None,
             )
@@ -1735,6 +1834,19 @@ def test_status(self):
         self.assertEqual(response.code, 682)
         self.assertEqual(response.reason, "Unknown")
 
+    def test_header_injection(self):
+        response = self.fetch("/?code=200&reason=OK%0D%0AX-Injection:injected")
+        self.assertEqual(response.code, 200)
+        self.assertEqual(response.reason, "Unknown")
+        self.assertNotIn("X-Injection", response.headers)
+
+    def test_reason_xss(self):
+        response = self.fetch("/?code=400&reason=<script>alert(1)</script>")
+        self.assertEqual(response.code, 400)
+        self.assertEqual(response.reason, "Unknown")
+        self.assertNotIn(b"script", response.body)
+        self.assertIn(b"Unknown", response.body)
+
 
 class DateHeaderTest(SimpleHandlerTestCase):
     class Handler(RequestHandler):
@@ -1744,9 +1856,9 @@ def get(self):
     def test_date_header(self):
         response = self.fetch("/")
         header_date = email.utils.parsedate_to_datetime(response.headers["Date"])
-        self.assertTrue(
-            header_date - datetime.datetime.now(datetime.timezone.utc)
-            < datetime.timedelta(seconds=2)
+        self.assertLess(
+            header_date - datetime.datetime.now(datetime.timezone.utc),
+            datetime.timedelta(seconds=2),
         )
 
 
@@ -1884,12 +1996,8 @@ def test_clear_all_cookies(self):
         response = self.fetch("/", headers={"Cookie": "foo=bar; baz=xyzzy"})
         set_cookies = sorted(response.headers.get_list("Set-Cookie"))
         # Python 3.5 sends 'baz="";'; older versions use 'baz=;'
-        self.assertTrue(
-            set_cookies[0].startswith("baz=;") or set_cookies[0].startswith('baz="";')
-        )
-        self.assertTrue(
-            set_cookies[1].startswith("foo=;") or set_cookies[1].startswith('foo="";')
-        )
+        self.assertTrue(set_cookies[0].startswith('baz="";'))
+        self.assertTrue(set_cookies[1].startswith('foo="";'))
 
 
 class PermissionError(Exception):
@@ -1972,11 +2080,11 @@ def value(self):
 
     def get_app_kwargs(self):
         def my_ui_method(handler, x):
-            return "In my_ui_method(%s) with handler value %s." % (x, handler.value())
+            return f"In my_ui_method({x}) with handler value {handler.value()}."
 
         class MyModule(UIModule):
             def render(self, x):
-                return "In MyModule(%s) with handler value %s." % (
+                return "In MyModule({}) with handler value {}.".format(
                     x,
                     typing.cast(UIMethodUIModuleTest.Handler, self.handler).value(),
                 )
@@ -2034,7 +2142,7 @@ def get_current_user(self):
             raise NotImplementedError()
 
         def get(self):
-            self.write("Hello %s (%s)" % (self.current_user, self.locale.code))
+            self.write(f"Hello {self.current_user} ({self.locale.code})")
 
     def test_set_properties(self):
         # Ensure that current_user can be assigned to normally for apps
@@ -2332,7 +2440,7 @@ def connect(self, url, connection_close):
         s = socket.socket(socket.AF_INET, socket.SOCK_STREAM, 0)
         s.connect(("127.0.0.1", self.get_http_port()))
         stream = IOStream(s)
-        stream.write(b"GET " + url + b" HTTP/1.1\r\n")
+        stream.write(b"GET " + url + b" HTTP/1.1\r\nHost: 127.0.0.1\r\n")
         if connection_close:
             stream.write(b"Connection: close\r\n")
         stream.write(b"Transfer-Encoding: chunked\r\n\r\n")
@@ -2396,7 +2504,7 @@ def initialize(self, test):
     @contextlib.contextmanager
     def in_method(self, method):
         if self.method is not None:
-            self.test.fail("entered method %s while in %s" % (method, self.method))
+            self.test.fail(f"entered method {method} while in {self.method}")
         self.method = method
         self.methods.append(method)
         try:
@@ -2418,7 +2526,7 @@ def post(self):
         self.write(dict(methods=self.methods))
 
 
-class BaseStreamingRequestFlowControlTest(object):
+class BaseStreamingRequestFlowControlTest:
     def get_httpserver_options(self):
         # Use a small chunk size so flow control is relevant even though
         # all the data arrives at once.
@@ -2657,11 +2765,11 @@ def test_name_swap(self):
         decoded1 = decode_signed_value(
             SignedValueTest.SECRET, "key2", signed1, clock=self.present
         )
-        self.assertIs(decoded1, None)
+        self.assertIsNone(decoded1)
         decoded2 = decode_signed_value(
             SignedValueTest.SECRET, "key1", signed2, clock=self.present
         )
-        self.assertIs(decoded2, None)
+        self.assertIsNone(decoded2)
 
     def test_expired(self):
         signed = create_signed_value(
@@ -2674,7 +2782,7 @@ def test_expired(self):
         decoded_present = decode_signed_value(
             SignedValueTest.SECRET, "key1", signed, clock=self.present
         )
-        self.assertIs(decoded_present, None)
+        self.assertIsNone(decoded_present)
 
     def test_payload_tampering(self):
         # These cookies are variants of the one in test_known_values.
@@ -2763,7 +2871,7 @@ def test_key_versioning_invalid_key(self):
         newkeys = SignedValueTest.SECRET_DICT.copy()
         newkeys.pop(0)
         decoded = decode_signed_value(newkeys, "key", signed, clock=self.present)
-        self.assertEqual(None, decoded)
+        self.assertIsNone(decoded)
 
     def test_key_version_retrieval(self):
         value = b"\xe9"
@@ -2933,7 +3041,7 @@ def test_cross_user(self):
 
     def test_refresh_token(self):
         token = self.xsrf_token
-        tokens_seen = set([token])
+        tokens_seen = {token}
         # A user's token is stable over time.  Refreshing the page in one tab
         # might update the cookie while an older tab still has the old cookie
         # in its DOM.  Simulate this scenario by passing a constant token
diff --git a/tornado/test/websocket_test.py b/tornado/test/websocket_test.py
index 4d39f37..494c4bf 100644
--- a/tornado/test/websocket_test.py
+++ b/tornado/test/websocket_test.py
@@ -1,5 +1,6 @@
 import asyncio
 import contextlib
+import datetime
 import functools
 import socket
 import traceback
@@ -14,6 +15,7 @@
 from tornado.netutil import Resolver
 from tornado.simple_httpclient import SimpleAsyncHTTPClient
 from tornado.template import DictLoader
+from tornado.test.util import abstract_base_test, ignore_deprecation
 from tornado.testing import AsyncHTTPTestCase, gen_test, bind_unused_port, ExpectLog
 from tornado.web import Application, RequestHandler
 
@@ -332,9 +334,10 @@ def test_websocket_gen(self):
         self.assertEqual(response, "hello")
 
     def test_websocket_callbacks(self):
-        websocket_connect(
-            "ws://127.0.0.1:%d/echo" % self.get_http_port(), callback=self.stop
-        )
+        with ignore_deprecation():
+            websocket_connect(
+                "ws://127.0.0.1:%d/echo" % self.get_http_port(), callback=self.stop
+            )
         ws = self.wait().result()
         ws.write_message("hello")
         ws.read_message(self.stop)
@@ -378,7 +381,7 @@ def test_error_in_on_message(self):
         ws.write_message("hello")
         with ExpectLog(app_log, "Uncaught exception"):
             response = yield ws.read_message()
-        self.assertIs(response, None)
+        self.assertIsNone(response)
 
     @gen_test
     def test_websocket_http_fail(self):
@@ -570,7 +573,7 @@ def test_check_origin_invalid_subdomains(self):
         # server is only running on ipv4. Test for this edge case and skip
         # the test if it happens.
         addrinfo = yield Resolver().resolve("localhost", port)
-        families = set(addr[0] for addr in addrinfo)
+        families = {addr[0] for addr in addrinfo}
         if socket.AF_INET not in families:
             self.skipTest("localhost does not resolve to ipv4")
             return
@@ -661,7 +664,8 @@ def test_native_coroutine(self):
         self.assertEqual(res, "hello2")
 
 
-class CompressionTestMixin(object):
+@abstract_base_test
+class CompressionTestMixin(WebSocketBaseTestCase):
     MESSAGE = "Hello world. Testing 123 123"
 
     def get_app(self):
@@ -698,7 +702,7 @@ def verify_wire_bytes(self, bytes_in: int, bytes_out: int) -> None:
         raise NotImplementedError()
 
     @gen_test
-    def test_message_sizes(self: typing.Any):
+    def test_message_sizes(self):
         ws = yield self.ws_connect(
             "/echo", compression_options=self.get_client_compression_options()
         )
@@ -713,7 +717,7 @@ def test_message_sizes(self: typing.Any):
         self.verify_wire_bytes(ws.protocol._wire_bytes_in, ws.protocol._wire_bytes_out)
 
     @gen_test
-    def test_size_limit(self: typing.Any):
+    def test_size_limit(self):
         ws = yield self.ws_connect(
             "/limited", compression_options=self.get_client_compression_options()
         )
@@ -728,31 +732,32 @@ def test_size_limit(self: typing.Any):
         self.assertIsNone(response)
 
 
+@abstract_base_test
 class UncompressedTestMixin(CompressionTestMixin):
     """Specialization of CompressionTestMixin when we expect no compression."""
 
-    def verify_wire_bytes(self: typing.Any, bytes_in, bytes_out):
+    def verify_wire_bytes(self, bytes_in, bytes_out):
         # Bytes out includes the 4-byte mask key per message.
         self.assertEqual(bytes_out, 3 * (len(self.MESSAGE) + 6))
         self.assertEqual(bytes_in, 3 * (len(self.MESSAGE) + 2))
 
 
-class NoCompressionTest(UncompressedTestMixin, WebSocketBaseTestCase):
+class NoCompressionTest(UncompressedTestMixin):
     pass
 
 
 # If only one side tries to compress, the extension is not negotiated.
-class ServerOnlyCompressionTest(UncompressedTestMixin, WebSocketBaseTestCase):
+class ServerOnlyCompressionTest(UncompressedTestMixin):
     def get_server_compression_options(self):
         return {}
 
 
-class ClientOnlyCompressionTest(UncompressedTestMixin, WebSocketBaseTestCase):
+class ClientOnlyCompressionTest(UncompressedTestMixin):
     def get_client_compression_options(self):
         return {}
 
 
-class DefaultCompressionTest(CompressionTestMixin, WebSocketBaseTestCase):
+class DefaultCompressionTest(CompressionTestMixin):
     def get_server_compression_options(self):
         return {}
 
@@ -766,7 +771,8 @@ def verify_wire_bytes(self, bytes_in, bytes_out):
         self.assertEqual(bytes_out, bytes_in + 12)
 
 
-class MaskFunctionMixin(object):
+@abstract_base_test
+class MaskFunctionMixin(unittest.TestCase):
     # Subclasses should define self.mask(mask, data)
     def mask(self, mask: bytes, data: bytes) -> bytes:
         raise NotImplementedError()
@@ -789,13 +795,13 @@ def test_mask(self: typing.Any):
         )
 
 
-class PythonMaskFunctionTest(MaskFunctionMixin, unittest.TestCase):
+class PythonMaskFunctionTest(MaskFunctionMixin):
     def mask(self, mask, data):
         return _websocket_mask_python(mask, data)
 
 
 @unittest.skipIf(speedups is None, "tornado.speedups module not present")
-class CythonMaskFunctionTest(MaskFunctionMixin, unittest.TestCase):
+class CythonMaskFunctionTest(MaskFunctionMixin):
     def mask(self, mask, data):
         return speedups.websocket_mask(mask, data)
 
@@ -806,7 +812,11 @@ class PingHandler(TestWebSocketHandler):
             def on_pong(self, data):
                 self.write_message("got pong")
 
-        return Application([("/", PingHandler)], websocket_ping_interval=0.01)
+        return Application(
+            [("/", PingHandler)],
+            websocket_ping_interval=0.01,
+            websocket_ping_timeout=0,
+        )
 
     @gen_test
     def test_server_ping(self):
@@ -827,14 +837,109 @@ def on_ping(self, data):
 
     @gen_test
     def test_client_ping(self):
-        ws = yield self.ws_connect("/", ping_interval=0.01)
+        ws = yield self.ws_connect("/", ping_interval=0.01, ping_timeout=0)
         for i in range(3):
             response = yield ws.read_message()
             self.assertEqual(response, "got ping")
-        # TODO: test that the connection gets closed if ping responses stop.
         ws.close()
 
 
+class ServerPingTimeoutTest(WebSocketBaseTestCase):
+    def get_app(self):
+        self.handlers: list[WebSocketHandler] = []
+        test = self
+
+        class PingHandler(TestWebSocketHandler):
+            def initialize(self, close_future=None, compression_options=None):
+                self.handlers = test.handlers
+                # capture the handler instance so we can interrogate it later
+                self.handlers.append(self)
+                return super().initialize(
+                    close_future=close_future, compression_options=compression_options
+                )
+
+        app = Application([("/", PingHandler)])
+        return app
+
+    @staticmethod
+    def install_hook(ws):
+        """Optionally suppress the client's "pong" response."""
+
+        ws.drop_pongs = False
+        ws.pongs_received = 0
+
+        def wrapper(fcn):
+            def _inner(opcode: int, data: bytes):
+                if opcode == 0xA:  # NOTE: 0x9=ping, 0xA=pong
+                    ws.pongs_received += 1
+                    if ws.drop_pongs:
+                        # prevent pong responses
+                        return
+                # leave all other responses unchanged
+                return fcn(opcode, data)
+
+            return _inner
+
+        ws.protocol._handle_message = wrapper(ws.protocol._handle_message)
+
+    @gen_test
+    def test_client_ping_timeout(self):
+        # websocket client
+        interval = 0.2
+        ws = yield self.ws_connect(
+            "/", ping_interval=interval, ping_timeout=interval / 4
+        )
+        self.install_hook(ws)
+
+        # websocket handler (server side)
+        handler = self.handlers[0]
+
+        for _ in range(5):
+            # wait for the ping period
+            yield gen.sleep(interval)
+
+            # connection should still be open from the server end
+            self.assertIsNone(handler.close_code)
+            self.assertIsNone(handler.close_reason)
+
+            # connection should still be open from the client end
+            assert ws.protocol.close_code is None
+
+        # Check that our hook is intercepting messages; allow for
+        # some variance in timing (due to e.g. cpu load)
+        self.assertGreaterEqual(ws.pongs_received, 4)
+
+        # suppress the pong response message
+        ws.drop_pongs = True
+
+        # give the server time to register this
+        yield gen.sleep(interval * 1.5)
+
+        # connection should be closed from the server side
+        self.assertEqual(handler.close_code, 1000)
+        self.assertEqual(handler.close_reason, "ping timed out")
+
+        # client should have received a close operation
+        self.assertEqual(ws.protocol.close_code, 1000)
+
+
+class PingCalculationTest(unittest.TestCase):
+    def test_ping_sleep_time(self):
+        from tornado.websocket import WebSocketProtocol13
+
+        now = datetime.datetime(2025, 1, 1, 12, 0, 0, tzinfo=datetime.timezone.utc)
+        interval = 10  # seconds
+        last_ping_time = datetime.datetime(
+            2025, 1, 1, 11, 59, 54, tzinfo=datetime.timezone.utc
+        )
+        sleep_time = WebSocketProtocol13.ping_sleep_time(
+            last_ping_time=last_ping_time.timestamp(),
+            interval=interval,
+            now=now.timestamp(),
+        )
+        self.assertEqual(sleep_time, 4)
+
+
 class ManualPingTest(WebSocketBaseTestCase):
     def get_app(self):
         class PingHandler(TestWebSocketHandler):
diff --git a/tornado/testing.py b/tornado/testing.py
index 4c33b3e..a397e3f 100644
--- a/tornado/testing.py
+++ b/tornado/testing.py
@@ -466,7 +466,7 @@ def get_protocol(self) -> str:
 
     def get_url(self, path: str) -> str:
         """Returns an absolute url for the given path on the test server."""
-        return "%s://127.0.0.1:%s%s" % (self.get_protocol(), self.get_http_port(), path)
+        return f"{self.get_protocol()}://127.0.0.1:{self.get_http_port()}{path}"
 
     def tearDown(self) -> None:
         self.http_server.stop()
@@ -754,7 +754,17 @@ def __exit__(
 
 # From https://nedbatchelder.com/blog/201508/using_context_managers_in_test_setup.html
 def setup_with_context_manager(testcase: unittest.TestCase, cm: Any) -> Any:
-    """Use a contextmanager to setUp a test case."""
+    """Use a context manager to setUp a test case.
+
+    Example::
+
+        def setUp(self):
+            setup_with_context_manager(self, warnings.catch_warnings())
+            warnings.filterwarnings("ignore", category=DeprecationWarning)
+            # The catch_warnings context manager will be deactivated
+            # automatically in tearDown.
+
+    """
     val = cm.__enter__()
     testcase.addCleanup(cm.__exit__, None, None, None)
     return val
diff --git a/tornado/util.py b/tornado/util.py
index 3a3a52f..2e5eee7 100644
--- a/tornado/util.py
+++ b/tornado/util.py
@@ -12,7 +12,6 @@
 
 import array
 import asyncio
-import atexit
 from inspect import getfullargspec
 import os
 import re
@@ -47,22 +46,6 @@
 unicode_type = str
 basestring_type = str
 
-try:
-    from sys import is_finalizing
-except ImportError:
-    # Emulate it
-    def _get_emulated_is_finalizing() -> Callable[[], bool]:
-        L = []  # type: List[None]
-        atexit.register(lambda: L.append(None))
-
-        def is_finalizing() -> bool:
-            # Not referencing any globals here
-            return L != []
-
-        return is_finalizing
-
-    is_finalizing = _get_emulated_is_finalizing()
-
 
 # versionchanged:: 6.2
 # no longer our own TimeoutError, use standard asyncio class
@@ -82,7 +65,7 @@ def __setattr__(self, name: str, value: Any) -> None:
         self[name] = value
 
 
-class GzipDecompressor(object):
+class GzipDecompressor:
     """Streaming gzip decompressor.
 
     The interface is like that of `zlib.decompressobj` (without some of the
@@ -218,7 +201,7 @@ def re_unescape(s: str) -> str:
     return _re_unescape_pattern.sub(_re_unescape_replacement, s)
 
 
-class Configurable(object):
+class Configurable:
     """Base class for configurable interfaces.
 
     A configurable interface is an (abstract) class whose constructor
@@ -269,7 +252,7 @@ def __new__(cls, *args: Any, **kwargs: Any) -> Any:
         if impl.configurable_base() is not base:
             # The impl class is itself configurable, so recurse.
             return impl(*args, **init_kwargs)
-        instance = super(Configurable, cls).__new__(impl)
+        instance = super().__new__(impl)
         # initialize vs __init__ chosen for compatibility with AsyncHTTPClient
         # singleton magic.  If we get rid of that we can switch to __init__
         # here too.
@@ -353,7 +336,7 @@ def _restore_configuration(cls, saved):
         base.__impl_kwargs = saved[1]
 
 
-class ArgReplacer(object):
+class ArgReplacer:
     """Replaces one value in an ``args, kwargs`` pair.
 
     Inspects the function signature to find an argument by name
diff --git a/tornado/web.py b/tornado/web.py
index 0393964..ec7ec3f 100644
--- a/tornado/web.py
+++ b/tornado/web.py
@@ -39,10 +39,6 @@ async def main():
     if __name__ == "__main__":
         asyncio.run(main())
 
-.. testoutput::
-   :hide:
-
-
 See the :doc:`guide` for additional information.
 
 Thread-safety notes
@@ -180,7 +176,7 @@ class _ArgDefaultMarker:
 _ARG_DEFAULT = _ArgDefaultMarker()
 
 
-class RequestHandler(object):
+class RequestHandler:
     """Base class for HTTP request handlers.
 
     Subclasses must define at least one of the methods defined in the
@@ -192,7 +188,15 @@ class RequestHandler(object):
 
     """
 
-    SUPPORTED_METHODS = ("GET", "HEAD", "POST", "DELETE", "PATCH", "PUT", "OPTIONS")
+    SUPPORTED_METHODS: Tuple[str, ...] = (
+        "GET",
+        "HEAD",
+        "POST",
+        "DELETE",
+        "PATCH",
+        "PUT",
+        "OPTIONS",
+    )
 
     _template_loaders = {}  # type: Dict[str, template.BaseLoader]
     _template_loader_lock = threading.Lock()
@@ -280,7 +284,8 @@ def prepare(self) -> Optional[Awaitable[None]]:
         """Called at the beginning of a request before  `get`/`post`/etc.
 
         Override this method to perform common initialization regardless
-        of the request method.
+        of the request method. There is no guarantee that ``prepare`` will
+        be called if an error occurs that is handled by the framework.
 
         Asynchronous support: Use ``async def`` or decorate this method with
         `.gen.coroutine` to make it asynchronous.
@@ -295,10 +300,14 @@ def prepare(self) -> Optional[Awaitable[None]]:
     def on_finish(self) -> None:
         """Called after the end of a request.
 
-        Override this method to perform cleanup, logging, etc.
-        This method is a counterpart to `prepare`.  ``on_finish`` may
-        not produce any output, as it is called after the response
-        has been sent to the client.
+        Override this method to perform cleanup, logging, etc. This method is primarily intended as
+        a counterpart to `prepare`. However, there are a few error cases where ``on_finish`` may be
+        called when ``prepare`` has not. (These are considered bugs and may be fixed in the future,
+        but for now you may need to check to see if the initialization work done in ``prepare`` has
+        occurred)
+
+        ``on_finish`` may not produce any output, as it is called after the response has been sent
+        to the client.
         """
         pass
 
@@ -350,8 +359,10 @@ def set_status(self, status_code: int, reason: Optional[str] = None) -> None:
 
         :arg int status_code: Response status code.
         :arg str reason: Human-readable reason phrase describing the status
-            code. If ``None``, it will be filled in from
-            `http.client.responses` or "Unknown".
+            code (for example, the "Not Found" in ``HTTP/1.1 404 Not Found``).
+            Normally determined automatically from `http.client.responses`; this
+            argument should only be used if you need to use a non-standard
+            status code.
 
         .. versionchanged:: 5.0
 
@@ -360,6 +371,14 @@ def set_status(self, status_code: int, reason: Optional[str] = None) -> None:
         """
         self._status_code = status_code
         if reason is not None:
+            if "<" in reason or not httputil._ABNF.reason_phrase.fullmatch(reason):
+                # Logically this would be better as an exception, but this method
+                # is called on error-handling paths that would need some refactoring
+                # to tolerate internal errors cleanly.
+                #
+                # The check for "<" is a defense-in-depth against XSS attacks (we also
+                # escape the reason when rendering error pages).
+                reason = "Unknown"
             self._reason = escape.native_str(reason)
         else:
             self._reason = httputil.responses.get(status_code, "Unknown")
@@ -395,7 +414,8 @@ def clear_header(self, name: str) -> None:
         if name in self._headers:
             del self._headers[name]
 
-    _INVALID_HEADER_CHAR_RE = re.compile(r"[\x00-\x1f]")
+    # https://www.rfc-editor.org/rfc/rfc9110#name-field-values
+    _VALID_HEADER_CHARS = re.compile(r"[\x09\x20-\x7e\x80-\xff]*")
 
     def _convert_header_value(self, value: _HeaderTypes) -> str:
         # Convert the input value to a str. This type check is a bit
@@ -417,7 +437,7 @@ def _convert_header_value(self, value: _HeaderTypes) -> str:
             raise TypeError("Unsupported header value %r" % value)
         # If \n is allowed into the header, it is possible to inject
         # additional headers or split the request.
-        if RequestHandler._INVALID_HEADER_CHAR_RE.search(retval):
+        if RequestHandler._VALID_HEADER_CHARS.fullmatch(retval) is None:
             raise ValueError("Unsafe header value %r", retval)
         return retval
 
@@ -470,7 +490,23 @@ def get_arguments(self, name: str, strip: bool = True) -> List[str]:
 
         return self._get_arguments(name, self.request.arguments, strip)
 
-    def get_body_argument(
+    @overload
+    def get_body_argument(self, name: str, default: str, strip: bool = True) -> str:
+        pass
+
+    @overload
+    def get_body_argument(  # noqa: F811
+        self, name: str, default: _ArgDefaultMarker = _ARG_DEFAULT, strip: bool = True
+    ) -> str:
+        pass
+
+    @overload
+    def get_body_argument(  # noqa: F811
+        self, name: str, default: None, strip: bool = True
+    ) -> Optional[str]:
+        pass
+
+    def get_body_argument(  # noqa: F811
         self,
         name: str,
         default: Union[None, str, _ArgDefaultMarker] = _ARG_DEFAULT,
@@ -498,7 +534,23 @@ def get_body_arguments(self, name: str, strip: bool = True) -> List[str]:
         """
         return self._get_arguments(name, self.request.body_arguments, strip)
 
-    def get_query_argument(
+    @overload
+    def get_query_argument(self, name: str, default: str, strip: bool = True) -> str:
+        pass
+
+    @overload
+    def get_query_argument(  # noqa: F811
+        self, name: str, default: _ArgDefaultMarker = _ARG_DEFAULT, strip: bool = True
+    ) -> str:
+        pass
+
+    @overload
+    def get_query_argument(  # noqa: F811
+        self, name: str, default: None, strip: bool = True
+    ) -> Optional[str]:
+        pass
+
+    def get_query_argument(  # noqa: F811
         self,
         name: str,
         default: Union[None, str, _ArgDefaultMarker] = _ARG_DEFAULT,
@@ -572,7 +624,7 @@ def decode_argument(self, value: bytes, name: Optional[str] = None) -> str:
             return _unicode(value)
         except UnicodeDecodeError:
             raise HTTPError(
-                400, "Invalid unicode in %s: %r" % (name or "url", value[:40])
+                400, "Invalid unicode in {}: {!r}".format(name or "url", value[:40])
             )
 
     @property
@@ -581,6 +633,14 @@ def cookies(self) -> Dict[str, http.cookies.Morsel]:
         `self.request.cookies <.httputil.HTTPServerRequest.cookies>`."""
         return self.request.cookies
 
+    @overload
+    def get_cookie(self, name: str, default: str) -> str:
+        pass
+
+    @overload
+    def get_cookie(self, name: str, default: None = None) -> Optional[str]:
+        pass
+
     def get_cookie(self, name: str, default: Optional[str] = None) -> Optional[str]:
         """Returns the value of the request cookie with the given name.
 
@@ -633,9 +693,30 @@ def set_cookie(
         # The cookie library only accepts type str, in both python 2 and 3
         name = escape.native_str(name)
         value = escape.native_str(value)
-        if re.search(r"[\x00-\x20]", name + value):
-            # Don't let us accidentally inject bad stuff
-            raise ValueError("Invalid cookie %r: %r" % (name, value))
+        if re.search(r"[\x00-\x20]", value):
+            # Legacy check for control characters in cookie values. This check is no longer needed
+            # since the cookie library escapes these characters correctly now. It will be removed
+            # in the next feature release.
+            raise ValueError(f"Invalid cookie {name!r}: {value!r}")
+        for attr_name, attr_value in [
+            ("name", name),
+            ("domain", domain),
+            ("path", path),
+            ("samesite", samesite),
+        ]:
+            # Cookie attributes may not contain control characters or semicolons (except when
+            # escaped in the value). A check for control characters was added to the http.cookies
+            # library in a Feb 2026 security release; as of March it still does not check for
+            # semicolons.
+            #
+            # When a semicolon check is added to the standard library (and the release has had time
+            # for adoption), this check may be removed, but be mindful of the fact that this may
+            # change the timing of the exception (to the generation of the Set-Cookie header in
+            # flush()). We m
+            if attr_value is not None and re.search(r"[\x00-\x20\x3b\x7f]", attr_value):
+                raise http.cookies.CookieError(
+                    f"Invalid cookie attribute {attr_name}={attr_value!r} for cookie {name!r}"
+                )
         if not hasattr(self, "_new_cookie"):
             self._new_cookie = (
                 http.cookies.SimpleCookie()
@@ -1295,7 +1376,8 @@ def send_error(self, status_code: int = 500, **kwargs: Any) -> None:
                 reason = exception.reason
         self.set_status(status_code, reason=reason)
         try:
-            self.write_error(status_code, **kwargs)
+            if status_code != 304:
+                self.write_error(status_code, **kwargs)
         except Exception:
             app_log.error("Uncaught exception in write_error", exc_info=True)
         if not self._finished:
@@ -1323,7 +1405,7 @@ def write_error(self, status_code: int, **kwargs: Any) -> None:
             self.finish(
                 "<html><title>%(code)d: %(message)s</title>"
                 "<body>%(code)d: %(message)s</body></html>"
-                % {"code": status_code, "message": self._reason}
+                % {"code": status_code, "message": escape.xhtml_escape(self._reason)}
             )
 
     @property
@@ -1596,14 +1678,14 @@ def check_xsrf_cookie(self) -> None:
         # information please see
         # http://www.djangoproject.com/weblog/2011/feb/08/security/
         # http://weblog.rubyonrails.org/2011/2/8/csrf-protection-bypass-in-ruby-on-rails
-        token = (
+        input_token = (
             self.get_argument("_xsrf", None)
             or self.request.headers.get("X-Xsrftoken")
             or self.request.headers.get("X-Csrftoken")
         )
-        if not token:
+        if not input_token:
             raise HTTPError(403, "'_xsrf' argument missing from POST")
-        _, token, _ = self._decode_xsrf_token(token)
+        _, token, _ = self._decode_xsrf_token(input_token)
         _, expected_token, _ = self._get_raw_xsrf_token()
         if not token:
             raise HTTPError(403, "'_xsrf' argument has invalid format")
@@ -1751,10 +1833,18 @@ async def _execute(
         try:
             if self.request.method not in self.SUPPORTED_METHODS:
                 raise HTTPError(405)
+
+            # If we're not in stream_request_body mode, this is the place where we parse the body.
+            if not _has_stream_request_body(self.__class__):
+                try:
+                    self.request._parse_body()
+                except httputil.HTTPInputError as e:
+                    raise HTTPError(400, "Invalid body: %s" % e) from e
+
             self.path_args = [self.decode_argument(arg) for arg in args]
-            self.path_kwargs = dict(
-                (k, self.decode_argument(v, name=k)) for (k, v) in kwargs.items()
-            )
+            self.path_kwargs = {
+                k: self.decode_argument(v, name=k) for (k, v) in kwargs.items()
+            }
             # If XSRF cookies are turned on, reject form submissions without
             # the proper cookie
             if self.request.method not in (
@@ -1823,7 +1913,7 @@ def _log(self) -> None:
         self.application.log_request(self)
 
     def _request_summary(self) -> str:
-        return "%s %s (%s)" % (
+        return "{} {} ({})".format(
             self.request.method,
             self.request.uri,
             self.request.remote_ip,
@@ -1867,9 +1957,10 @@ def log_exception(
         .. versionadded:: 3.1
         """
         if isinstance(value, HTTPError):
-            if value.log_message:
-                format = "%d %s: " + value.log_message
-                args = [value.status_code, self._request_summary()] + list(value.args)
+            log_message = value.get_message()
+            if log_message:
+                format = "%d %s: %s"
+                args = [value.status_code, self._request_summary(), log_message]
                 gen_log.warning(format, *args)
         else:
             app_log.error(
@@ -1886,7 +1977,7 @@ def render(*args, **kwargs) -> str:  # type: ignore
             if name not in self._active_modules:
                 self._active_modules[name] = module(self)
             rendered = self._active_modules[name].render(*args, **kwargs)
-            return rendered
+            return _unicode(rendered)
 
         return render
 
@@ -1941,7 +2032,7 @@ def _has_stream_request_body(cls: Type[RequestHandler]) -> bool:
 
 
 def removeslash(
-    method: Callable[..., Optional[Awaitable[None]]]
+    method: Callable[..., Optional[Awaitable[None]]],
 ) -> Callable[..., Optional[Awaitable[None]]]:
     """Use this decorator to remove trailing slashes from the request path.
 
@@ -1970,7 +2061,7 @@ def wrapper(  # type: ignore
 
 
 def addslash(
-    method: Callable[..., Optional[Awaitable[None]]]
+    method: Callable[..., Optional[Awaitable[None]]],
 ) -> Callable[..., Optional[Awaitable[None]]]:
     """Use this decorator to add a missing trailing slash to the request path.
 
@@ -2239,7 +2330,7 @@ def add_transform(self, transform_class: Type["OutputTransform"]) -> None:
 
     def _load_ui_methods(self, methods: Any) -> None:
         if isinstance(methods, types.ModuleType):
-            self._load_ui_methods(dict((n, getattr(methods, n)) for n in dir(methods)))
+            self._load_ui_methods({n: getattr(methods, n) for n in dir(methods)})
         elif isinstance(methods, list):
             for m in methods:
                 self._load_ui_methods(m)
@@ -2254,7 +2345,7 @@ def _load_ui_methods(self, methods: Any) -> None:
 
     def _load_ui_modules(self, modules: Any) -> None:
         if isinstance(modules, types.ModuleType):
-            self._load_ui_modules(dict((n, getattr(modules, n)) for n in dir(modules)))
+            self._load_ui_modules({n: getattr(modules, n) for n in dir(modules)})
         elif isinstance(modules, list):
             for m in modules:
                 self._load_ui_modules(m)
@@ -2394,8 +2485,9 @@ def finish(self) -> None:
         if self.stream_request_body:
             future_set_result_unless_cancelled(self.request._body_future, None)
         else:
+            # Note that the body gets parsed in RequestHandler._execute so it can be in
+            # the right exception handler scope.
             self.request.body = b"".join(self.chunks)
-            self.request._parse_body()
             self.execute()
 
     def on_connection_close(self) -> None:
@@ -2460,9 +2552,11 @@ class HTTPError(Exception):
         mode).  May contain ``%s``-style placeholders, which will be filled
         in with remaining positional parameters.
     :arg str reason: Keyword-only argument.  The HTTP "reason" phrase
-        to pass in the status line along with ``status_code``.  Normally
+        to pass in the status line along with ``status_code`` (for example,
+        the "Not Found" in ``HTTP/1.1 404 Not Found``).  Normally
         determined automatically from ``status_code``, but can be used
-        to use a non-standard numeric code.
+        to use a non-standard numeric code. This is not a general-purpose
+        error message.
     """
 
     def __init__(
@@ -2473,19 +2567,32 @@ def __init__(
         **kwargs: Any,
     ) -> None:
         self.status_code = status_code
-        self.log_message = log_message
+        self._log_message = log_message
         self.args = args
         self.reason = kwargs.get("reason", None)
-        if log_message and not args:
-            self.log_message = log_message.replace("%", "%%")
+
+    @property
+    def log_message(self) -> Optional[str]:
+        """
+        A backwards compatible way of accessing log_message.
+        """
+        if self._log_message and not self.args:
+            return self._log_message.replace("%", "%%")
+        return self._log_message
+
+    def get_message(self) -> Optional[str]:
+        if self._log_message and self.args:
+            return self._log_message % self.args
+        return self._log_message
 
     def __str__(self) -> str:
         message = "HTTP %d: %s" % (
             self.status_code,
             self.reason or httputil.responses.get(self.status_code, "Unknown"),
         )
-        if self.log_message:
-            return message + " (" + (self.log_message % self.args) + ")"
+        log_message = self.get_message()
+        if log_message:
+            return message + " (" + log_message + ")"
         else:
             return message
 
@@ -2722,7 +2829,7 @@ async def get(self, path: str, include_body: bool = True) -> None:
                 # and less than the first-byte-pos.
                 self.set_status(416)  # Range Not Satisfiable
                 self.set_header("Content-Type", "text/plain")
-                self.set_header("Content-Range", "bytes */%s" % (size,))
+                self.set_header("Content-Range", f"bytes */{size}")
                 return
             if end is not None and end > size:
                 # Clients sometimes blindly use a large range to limit their
@@ -2776,7 +2883,7 @@ def compute_etag(self) -> Optional[str]:
         version_hash = self._get_cached_version(self.absolute_path)
         if not version_hash:
             return None
-        return '"%s"' % (version_hash,)
+        return f'"{version_hash}"'
 
     def set_headers(self) -> None:
         """Sets the content and caching headers on the response.
@@ -2817,7 +2924,10 @@ def should_return_304(self) -> bool:
         # content has not been modified
         ims_value = self.request.headers.get("If-Modified-Since")
         if ims_value is not None:
-            if_since = email.utils.parsedate_to_datetime(ims_value)
+            try:
+                if_since = email.utils.parsedate_to_datetime(ims_value)
+            except Exception:
+                return False
             if if_since.tzinfo is None:
                 if_since = if_since.replace(tzinfo=datetime.timezone.utc)
             assert self.modified is not None
@@ -3075,7 +3185,7 @@ def make_static_url(
         if not version_hash:
             return url
 
-        return "%s?v=%s" % (url, version_hash)
+        return f"{url}?v={version_hash}"
 
     def parse_url_path(self, url_path: str) -> str:
         """Converts a static URL path into a filesystem path.
@@ -3151,7 +3261,7 @@ def prepare(self) -> None:
         self.on_finish()
 
 
-class OutputTransform(object):
+class OutputTransform:
     """A transform modifies the result of an HTTP request (e.g., GZip encoding)
 
     Applications are not expected to create their own OutputTransforms
@@ -3188,17 +3298,15 @@ class GZipContentEncoding(OutputTransform):
 
     # Whitelist of compressible mime types (in addition to any types
     # beginning with "text/").
-    CONTENT_TYPES = set(
-        [
-            "application/javascript",
-            "application/x-javascript",
-            "application/xml",
-            "application/atom+xml",
-            "application/json",
-            "application/xhtml+xml",
-            "image/svg+xml",
-        ]
-    )
+    CONTENT_TYPES = {
+        "application/javascript",
+        "application/x-javascript",
+        "application/xml",
+        "application/atom+xml",
+        "application/json",
+        "application/xhtml+xml",
+        "image/svg+xml",
+    }
     # Python's GzipFile defaults to level 9, while most other gzip
     # tools (including gzip itself) default to 6, which is probably a
     # better CPU/size tradeoff.
@@ -3267,7 +3375,7 @@ def transform_chunk(self, chunk: bytes, finishing: bool) -> bytes:
 
 
 def authenticated(
-    method: Callable[..., Optional[Awaitable[None]]]
+    method: Callable[..., Optional[Awaitable[None]]],
 ) -> Callable[..., Optional[Awaitable[None]]]:
     """Decorate methods with this to require that the user be logged in.
 
@@ -3303,7 +3411,7 @@ def wrapper(  # type: ignore
     return wrapper
 
 
-class UIModule(object):
+class UIModule:
     """A re-usable, modular UI unit on a page.
 
     UI modules often execute additional queries, and they can include
@@ -3323,7 +3431,7 @@ def __init__(self, handler: RequestHandler) -> None:
     def current_user(self) -> Any:
         return self.handler.current_user
 
-    def render(self, *args: Any, **kwargs: Any) -> str:
+    def render(self, *args: Any, **kwargs: Any) -> Union[str, bytes]:
         """Override in subclasses to return this module's output."""
         raise NotImplementedError()
 
@@ -3371,12 +3479,12 @@ def render_string(self, path: str, **kwargs: Any) -> bytes:
 
 
 class _linkify(UIModule):
-    def render(self, text: str, **kwargs: Any) -> str:  # type: ignore
+    def render(self, text: str, **kwargs: Any) -> str:
         return escape.linkify(text, **kwargs)
 
 
 class _xsrf_form_html(UIModule):
-    def render(self) -> str:  # type: ignore
+    def render(self) -> str:
         return self.handler.xsrf_form_html()
 
 
@@ -3402,7 +3510,7 @@ def __init__(self, handler: RequestHandler) -> None:
         self._resource_list = []  # type: List[Dict[str, Any]]
         self._resource_dict = {}  # type: Dict[str, Dict[str, Any]]
 
-    def render(self, path: str, **kwargs: Any) -> bytes:  # type: ignore
+    def render(self, path: str, **kwargs: Any) -> bytes:
         def set_resources(**kwargs) -> str:  # type: ignore
             if path not in self._resource_dict:
                 self._resource_list.append(kwargs)
@@ -3451,7 +3559,7 @@ def html_body(self) -> str:
         return "".join(self._get_resources("html_body"))
 
 
-class _UIModuleNamespace(object):
+class _UIModuleNamespace:
     """Lazy namespace which creates UIModule proxies bound to a handler."""
 
     def __init__(
diff --git a/tornado/websocket.py b/tornado/websocket.py
index 8f0e0ae..c2e18d2 100644
--- a/tornado/websocket.py
+++ b/tornado/websocket.py
@@ -14,7 +14,9 @@
 import abc
 import asyncio
 import base64
+import functools
 import hashlib
+import logging
 import os
 import sys
 import struct
@@ -26,7 +28,7 @@
 from tornado.concurrent import Future, future_set_result_unless_cancelled
 from tornado.escape import utf8, native_str, to_unicode
 from tornado import gen, httpclient, httputil
-from tornado.ioloop import IOLoop, PeriodicCallback
+from tornado.ioloop import IOLoop
 from tornado.iostream import StreamClosedError, IOStream
 from tornado.log import gen_log, app_log
 from tornado.netutil import Resolver
@@ -97,6 +99,9 @@ def log_exception(
 
 _default_max_message_size = 10 * 1024 * 1024
 
+# log to "gen_log" but suppress duplicate log messages
+de_dupe_gen_log = functools.lru_cache(gen_log.log)
+
 
 class WebSocketError(Exception):
     pass
@@ -115,7 +120,7 @@ class _DecompressTooLargeError(Exception):
     pass
 
 
-class _WebSocketParams(object):
+class _WebSocketParams:
     def __init__(
         self,
         ping_interval: Optional[float] = None,
@@ -160,9 +165,6 @@ def on_message(self, message):
           def on_close(self):
               print("WebSocket closed")
 
-    .. testoutput::
-       :hide:
-
     WebSockets are not standard HTTP connections. The "handshake" is
     HTTP, but after the handshake, the protocol is
     message-based. Consequently, most of the Tornado HTTP facilities
@@ -202,6 +204,8 @@ def on_close(self):
     If the application setting ``websocket_ping_interval`` has a non-zero
     value, a ping will be sent periodically, and the connection will be
     closed if a response is not received before the ``websocket_ping_timeout``.
+    Both settings are in seconds; floating point values are allowed.
+    The default timeout is equal to the interval.
 
     Messages larger than the ``websocket_max_message_size`` application setting
     (default 10MiB) will not be accepted.
@@ -215,7 +219,7 @@ def __init__(
         self,
         application: tornado.web.Application,
         request: httputil.HTTPServerRequest,
-        **kwargs: Any
+        **kwargs: Any,
     ) -> None:
         super().__init__(application, request, **kwargs)
         self.ws_connection = None  # type: Optional[WebSocketProtocol]
@@ -277,17 +281,41 @@ async def get(self, *args: Any, **kwargs: Any) -> None:
 
     @property
     def ping_interval(self) -> Optional[float]:
-        """The interval for websocket keep-alive pings.
+        """The interval for sending websocket pings.
+
+        If this is non-zero, the websocket will send a ping every
+        ping_interval seconds.
+        The client will respond with a "pong". The connection can be configured
+        to timeout on late pong delivery using ``websocket_ping_timeout``.
 
-        Set websocket_ping_interval = 0 to disable pings.
+        Set ``websocket_ping_interval = 0`` to disable pings.
+
+        Default: ``0``
         """
         return self.settings.get("websocket_ping_interval", None)
 
     @property
     def ping_timeout(self) -> Optional[float]:
-        """If no ping is received in this many seconds,
-        close the websocket connection (VPNs, etc. can fail to cleanly close ws connections).
-        Default is max of 3 pings or 30 seconds.
+        """Timeout if no pong is received in this many seconds.
+
+        To be used in combination with ``websocket_ping_interval > 0``.
+        If a ping response (a "pong") is not received within
+        ``websocket_ping_timeout`` seconds, then the websocket connection
+        will be closed.
+
+        This can help to clean up clients which have disconnected without
+        cleanly closing the websocket connection.
+
+        Note, the ping timeout cannot be longer than the ping interval.
+
+        Set ``websocket_ping_timeout = 0`` to disable the ping timeout.
+
+        Default: equal to the ``ping_interval``.
+
+        .. versionchanged:: 6.5.0
+           Default changed from the max of 3 pings or 30 seconds.
+           The ping timeout can no longer be configured longer than the
+           ping interval.
         """
         return self.settings.get("websocket_ping_timeout", None)
 
@@ -380,8 +408,8 @@ def get_compression_options(self) -> Optional[Dict[str, Any]]:
 
         ``mem_level`` specifies the amount of memory used for the internal compression state.
 
-         These parameters are documented in details here:
-         https://docs.python.org/3.6/library/zlib.html#zlib.compressobj
+         These parameters are documented in detail here:
+         https://docs.python.org/3.13/library/zlib.html#zlib.compressobj
 
         .. versionadded:: 4.1
 
@@ -701,7 +729,7 @@ def set_nodelay(self, x: bool) -> None:
         raise NotImplementedError()
 
 
-class _PerMessageDeflateCompressor(object):
+class _PerMessageDeflateCompressor:
     def __init__(
         self,
         persistent: bool,
@@ -749,7 +777,7 @@ def compress(self, data: bytes) -> bytes:
         return data[:-4]
 
 
-class _PerMessageDeflateDecompressor(object):
+class _PerMessageDeflateDecompressor:
     def __init__(
         self,
         persistent: bool,
@@ -834,11 +862,10 @@ def __init__(
         # the effect of compression, frame overhead, and control frames.
         self._wire_bytes_in = 0
         self._wire_bytes_out = 0
-        self.ping_callback = None  # type: Optional[PeriodicCallback]
-        self.last_ping = 0.0
-        self.last_pong = 0.0
+        self._received_pong = False  # type: bool
         self.close_code = None  # type: Optional[int]
         self.close_reason = None  # type: Optional[str]
+        self._ping_coroutine = None  # type: Optional[asyncio.Task]
 
     # Use a property for this to satisfy the abc.
     @property
@@ -1001,14 +1028,12 @@ def _create_compressors(
         compression_options: Optional[Dict[str, Any]] = None,
     ) -> None:
         # TODO: handle invalid parameters gracefully
-        allowed_keys = set(
-            [
-                "server_no_context_takeover",
-                "client_no_context_takeover",
-                "server_max_window_bits",
-                "client_max_window_bits",
-            ]
-        )
+        allowed_keys = {
+            "server_no_context_takeover",
+            "client_no_context_takeover",
+            "server_max_window_bits",
+            "client_max_window_bits",
+        }
         for key in agreed_parameters:
             if key not in allowed_keys:
                 raise ValueError("unsupported compression parameter %r" % key)
@@ -1020,7 +1045,7 @@ def _create_compressors(
             max_message_size=self.params.max_message_size,
             **self._get_compressor_options(
                 other_side, agreed_parameters, compression_options
-            )
+            ),
         )
 
     def _write_frame(
@@ -1237,7 +1262,7 @@ def _handle_message(self, opcode: int, data: bytes) -> "Optional[Future[None]]":
             self._run_callback(self.handler.on_ping, data)
         elif opcode == 0xA:
             # Pong
-            self.last_pong = IOLoop.current().time()
+            self._received_pong = True
             return self._run_callback(self.handler.on_pong, data)
         else:
             self._abort()
@@ -1271,9 +1296,9 @@ def close(self, code: Optional[int] = None, reason: Optional[str] = None) -> Non
             self._waiting = self.stream.io_loop.add_timeout(
                 self.stream.io_loop.time() + 5, self._abort
             )
-        if self.ping_callback:
-            self.ping_callback.stop()
-            self.ping_callback = None
+        if self._ping_coroutine:
+            self._ping_coroutine.cancel()
+            self._ping_coroutine = None
 
     def is_closing(self) -> bool:
         """Return ``True`` if this connection is closing.
@@ -1284,60 +1309,80 @@ def is_closing(self) -> bool:
         """
         return self.stream.closed() or self.client_terminated or self.server_terminated
 
+    def set_nodelay(self, x: bool) -> None:
+        self.stream.set_nodelay(x)
+
     @property
-    def ping_interval(self) -> Optional[float]:
+    def ping_interval(self) -> float:
         interval = self.params.ping_interval
         if interval is not None:
             return interval
         return 0
 
     @property
-    def ping_timeout(self) -> Optional[float]:
+    def ping_timeout(self) -> float:
         timeout = self.params.ping_timeout
         if timeout is not None:
+            if self.ping_interval and timeout > self.ping_interval:
+                de_dupe_gen_log(
+                    # Note: using de_dupe_gen_log to prevent this message from
+                    # being duplicated for each connection
+                    logging.WARNING,
+                    f"The websocket_ping_timeout ({timeout}) cannot be longer"
+                    f" than the websocket_ping_interval ({self.ping_interval})."
+                    f"\nSetting websocket_ping_timeout={self.ping_interval}",
+                )
+                return self.ping_interval
             return timeout
-        assert self.ping_interval is not None
-        return max(3 * self.ping_interval, 30)
+        return self.ping_interval
 
     def start_pinging(self) -> None:
         """Start sending periodic pings to keep the connection alive"""
-        assert self.ping_interval is not None
-        if self.ping_interval > 0:
-            self.last_ping = self.last_pong = IOLoop.current().time()
-            self.ping_callback = PeriodicCallback(
-                self.periodic_ping, self.ping_interval * 1000
-            )
-            self.ping_callback.start()
+        if (
+            # prevent multiple ping coroutines being run in parallel
+            not self._ping_coroutine
+            # only run the ping coroutine if a ping interval is configured
+            and self.ping_interval > 0
+        ):
+            self._ping_coroutine = asyncio.create_task(self.periodic_ping())
+
+    @staticmethod
+    def ping_sleep_time(*, last_ping_time: float, interval: float, now: float) -> float:
+        """Calculate the sleep time until the next ping should be sent."""
+        return max(0, last_ping_time + interval - now)
 
-    def periodic_ping(self) -> None:
-        """Send a ping to keep the websocket alive
+    async def periodic_ping(self) -> None:
+        """Send a ping and wait for a pong if ping_timeout is configured.
 
         Called periodically if the websocket_ping_interval is set and non-zero.
         """
-        if self.is_closing() and self.ping_callback is not None:
-            self.ping_callback.stop()
-            return
+        interval = self.ping_interval
+        timeout = self.ping_timeout
 
-        # Check for timeout on pong. Make sure that we really have
-        # sent a recent ping in case the machine with both server and
-        # client has been suspended since the last ping.
-        now = IOLoop.current().time()
-        since_last_pong = now - self.last_pong
-        since_last_ping = now - self.last_ping
-        assert self.ping_interval is not None
-        assert self.ping_timeout is not None
-        if (
-            since_last_ping < 2 * self.ping_interval
-            and since_last_pong > self.ping_timeout
-        ):
-            self.close()
-            return
+        await asyncio.sleep(interval)
 
-        self.write_ping(b"")
-        self.last_ping = now
+        while True:
+            # send a ping
+            self._received_pong = False
+            ping_time = IOLoop.current().time()
+            self.write_ping(b"")
 
-    def set_nodelay(self, x: bool) -> None:
-        self.stream.set_nodelay(x)
+            # wait until the ping timeout
+            await asyncio.sleep(timeout)
+
+            # make sure we received a pong within the timeout
+            if timeout > 0 and not self._received_pong:
+                self.close(reason="ping timed out")
+                return
+
+            # wait until the next scheduled ping
+            await asyncio.sleep(
+                self.ping_sleep_time(
+                    last_ping_time=ping_time,
+                    interval=interval,
+                    now=IOLoop.current().time(),
+                )
+            )
 
 
 class WebSocketClientConnection(simple_httpclient._HTTPConnection):
@@ -1380,7 +1425,7 @@ def __init__(
             {
                 "Upgrade": "websocket",
                 "Connection": "Upgrade",
-                "Sec-WebSocket-Key": self.key,
+                "Sec-WebSocket-Key": to_unicode(self.key),
                 "Sec-WebSocket-Version": "13",
             }
         )
@@ -1641,6 +1686,11 @@ def websocket_connect(
 
     .. versionchanged:: 6.3
        Added the ``resolver`` argument.
+
+    .. deprecated:: 6.5
+       The ``callback`` argument is deprecated and will be removed in Tornado 7.0.
+       Use the returned Future instead. Note that ``on_message_callback`` is not
+       deprecated and may still be used.
     """
     if isinstance(url, httpclient.HTTPRequest):
         assert connect_timeout is None
@@ -1665,5 +1715,11 @@ def websocket_connect(
         resolver=resolver,
     )
     if callback is not None:
+        warnings.warn(
+            "The callback argument to websocket_connect is deprecated. "
+            "Use the returned Future instead.",
+            DeprecationWarning,
+            stacklevel=2,
+        )
         IOLoop.current().add_future(conn.connect_future, callback)
     return conn.connect_future
diff --git a/tornado/wsgi.py b/tornado/wsgi.py
index 32641be..c189562 100644
--- a/tornado/wsgi.py
+++ b/tornado/wsgi.py
@@ -38,7 +38,7 @@
 from tornado.ioloop import IOLoop
 from tornado.log import access_log
 
-from typing import List, Tuple, Optional, Callable, Any, Dict, Text
+from typing import List, Tuple, Optional, Callable, Any, Dict
 from types import TracebackType
 import typing
 
@@ -56,7 +56,7 @@ def to_wsgi_str(s: bytes) -> str:
     return s.decode("latin1")
 
 
-class WSGIContainer(object):
+class WSGIContainer:
     r"""Makes a WSGI-compatible application runnable on Tornado's HTTP server.
 
     .. warning::
@@ -185,7 +185,7 @@ def next_chunk() -> Optional[bytes]:
         status_code_str, reason = data["status"].split(" ", 1)
         status_code = int(status_code_str)
         headers = data["headers"]  # type: List[Tuple[str, str]]
-        header_set = set(k.lower() for (k, v) in headers)
+        header_set = {k.lower() for (k, v) in headers}
         body = escape.utf8(body)
         if status_code != 304:
             if "content-length" not in header_set:
@@ -204,7 +204,7 @@ def next_chunk() -> Optional[bytes]:
         request.connection.finish()
         self._log(status_code, request)
 
-    def environ(self, request: httputil.HTTPServerRequest) -> Dict[Text, Any]:
+    def environ(self, request: httputil.HTTPServerRequest) -> Dict[str, Any]:
         """Converts a `tornado.httputil.HTTPServerRequest` to a WSGI environment.
 
         .. versionchanged:: 6.3
diff --git a/tox.ini b/tox.ini
index 7eaa5bd..729f9b8 100644
--- a/tox.ini
+++ b/tox.ini
@@ -13,7 +13,7 @@
 [tox]
 envlist =
         # Basic configurations: Run the tests for each python version.
-        py38-full,py39-full,py310-full,py311-full,pypy3-full
+        py39-full,py310-full,py311-full,py312-full,py313-full,pypy3-full
 
         # Build and test the docs with sphinx.
         docs
@@ -23,13 +23,6 @@ envlist =
 
 [testenv]
 basepython =
-           py3: python3
-           py38: python3.8
-           py39: python3.9
-           py310: python3.10
-           py311: python3.11
-           py312: python3.12
-           pypy3: pypy3
            # In theory, it doesn't matter which python version is used here.
            # In practice, things like changes to the ast module can alter
            # the outputs of the tools (especially where exactly the
@@ -42,13 +35,16 @@ basepython =
 deps =
      full: pycurl
      full: twisted
-     full: pycares
+     # Pycares 5 has some backwards-incompatible changes that we don't support.
+     # And since CaresResolver is deprecated, I do not expect to fix it, so just
+     # pin the previous version. (This should really be in requirements.{in,txt} instead)
+     full: pycares<5
      docs: -r{toxinidir}/requirements.txt
      lint: -r{toxinidir}/requirements.txt
 
 setenv =
        # Treat the extension as mandatory in testing (but not on pypy)
-       {py3,py38,py39,py310,py311,py312}: TORNADO_EXTENSION=1
+       {py3,py39,py310,py311,py312,py313,py314}: TORNADO_EXTENSION=1
        # CI workers are often overloaded and can cause our tests to exceed
        # the default timeout of 5s.
        ASYNC_TEST_TIMEOUT=25
@@ -60,17 +56,16 @@ setenv =
        # during sdist installation (and it doesn't seem to be
        # possible to set environment variables during that phase of
        # tox).
-       {py3,py38,py39,py310,py311,pypy3}: PYTHONWARNINGS=error:::tornado
+       PYTHONWARNINGS=error:::tornado
        # Warn if we try to open a file with an unspecified encoding.
        # (New in python 3.10, becomes obsolete when utf8 becomes the
        # default in 3.15)
        PYTHONWARNDEFAULTENCODING=1
 
 # Allow shell commands in tests
-allowlist_externals = sh
+allowlist_externals = sh, env
 
 
-# All non-comment lines but the last must end in a backslash.
 # Tox filters line-by-line based on the environment name.
 commands =
          # py3*: -b turns on an extra warning when calling
@@ -100,9 +95,10 @@ setenv = TORNADO_EXTENSION=0
 commands =
     # Build the docs
     sphinx-build -q -E -n -W -b html . {envtmpdir}/html
-    # Run the doctests. No -W for doctests because that disallows tests
-    # with empty output.
-    sphinx-build -q -E -n -b doctest . {envtmpdir}/doctest
+    # Ensure that everything is either documented or ignored in conf.py
+    sphinx-build -q -E -n -W -b coverage . {envtmpdir}/coverage
+    # Run the doctests
+    sphinx-build -q -E -n -W -b doctest . {envtmpdir}/doctest
 
 [testenv:lint]
 commands =
@@ -110,12 +106,15 @@ commands =
          black --check --diff {posargs:tornado demos}
          # Many syscalls are defined differently on linux and windows,
          # so we have to typecheck both.
-         mypy --platform linux {posargs:tornado}
-         mypy --platform windows {posargs:tornado}
+         # Mypy currently uses the default encoding so we must unset the warning variable
+         # here (must be completely unset, not just set to zero/empty). Remove this
+         # (and the allowlist_externals for env) when mypy sets the encoding explicitly.
+         env -u PYTHONWARNDEFAULTENCODING mypy --platform linux {posargs:tornado}
+         env -u PYTHONWARNDEFAULTENCODING mypy --platform windows {posargs:tornado}
          # We mainly lint on the oldest version of Python we support, since
          # we're more likely to catch problems of accidentally depending on
          # something new than of depending on something old and deprecated.
          # But sometimes something we depend on gets removed so we should also
          # test the newest version.
-         mypy --platform linux --python-version 3.12 {posargs:tornado}
+         env -u PYTHONWARNDEFAULTENCODING mypy --platform linux --python-version 3.13 {posargs:tornado}
 changedir = {toxinidir}