Roll up news for 2.7.17rc1.

Misc/NEWS.d/next/Build/2018-11-16-15-19-09.bpo-35264.h5GxH3.rst

-Fix SSL module build with OpenSSL 1.1.0

Misc/NEWS.d/next/Build/2019-04-11-18-50-58.bpo-36605.gk5czf.rst

-``make tags`` and ``make TAGS`` now also parse ``Modules/_io/*.c`` and
-``Modules/_io/*.h``.

Misc/NEWS.d/next/Build/2019-05-12-10-52-37.bpo-14353.LK1qWM.rst

-Fix detection of the bind_textdomain_codeset function for building gettext
-support into the locale module.

Misc/NEWS.d/next/Build/2019-09-28-02-37-11.bpo-38301.123456.rst

-In Solaris family, we must be sure to use ``-D_REENTRANT``.
-Patch by Jesús Cea Avión.

Misc/NEWS.d/next/C API/2019-06-06-08-47-04.bpo-37170.hO_fpM.rst

-Fix the cast on error in :c:func:`PyLong_AsUnsignedLongLongMask()`.

Misc/NEWS.d/next/Core and Builtins/2018-03-07-09-10-42.bpo-33006.Bzx3LA.rst

-Clarified Doc string for builtin filter function. 2nd Argument can be any
-iterable. Patch by Tony Flury

Misc/NEWS.d/next/Core and Builtins/2019-02-28-13-52-18.bpo-36149.GJdnh4.rst

-Fix use of uninitialized memory in cPickle when reading a truncated pickle
-from a file object.

Misc/NEWS.d/next/Core and Builtins/2019-03-11-15-37-33.bpo-36262.v3N6Fz.rst

-Fix an unlikely memory leak on conversion from string to float in the function
-``_Py_dg_strtod()`` used by ``float(str)``, ``complex(str)``,
-:func:`pickle.load`, :func:`marshal.load`, etc.

Misc/NEWS.d/next/Core and Builtins/2019-03-14-17-30-46.bpo-18368.WXaHAo.rst

-PyOS_StdioReadline() no longer leaks memory when realloc() fails.

Misc/NEWS.d/next/Core and Builtins/2019-03-25-23-37-26.bpo-36430.sd9xxQ.rst

-Fix a possible reference leak in :func:`itertools.count`.

Misc/NEWS.d/next/Core and Builtins/2019-03-27-22-35-16.bpo-36459.UAvkKp.rst

-Fix a possible double ``PyMem_FREE()`` due to tokenizer.c's ``tok_nextc()``.

Misc/NEWS.d/next/Core and Builtins/2019-04-02-04-10-32.bpo-36504.k_V8Bm.rst

-Fix signed integer overflow in _ctypes.c's ``PyCArrayType_new()``.

Misc/NEWS.d/next/Core and Builtins/2019-04-16-11-52-21.bpo-27987.n2_DcQ.rst

-pymalloc returns memory blocks aligned by 16 bytes, instead of 8 bytes, on
-64-bit platforms to conform x86-64 ABI. Recent compilers assume this alignment
-more often. Patch by Inada Naoki.

Misc/NEWS.d/next/Core and Builtins/2019-05-27-18-00-19.bpo-26423.RgUOE8.rst

-Fix possible overflow in ``wrap_lenfunc()`` when
-``sizeof(long) < sizeof(Py_ssize_t)`` (e.g., 64-bit Windows).

Misc/NEWS.d/next/Core and Builtins/2019-06-18-15-08-32.bpo-37329.7XVDRv.rst

-valgrind: suppress a false alarm in memory leak checks. _PyWarnings_Init()
-only allocates memory once at startup but it is not released at exit. Ignore
-this issue to be able to catch other bugs more easily.

Misc/NEWS.d/next/Core and Builtins/2019-09-12-16-36-16.bpo-38106.4pApn7.rst

-Fix race in PyThread_release_lock that was leading to memory corruption and
-deadlocks. The fix applies to POSIX systems where Python locks are implemented
-with mutex and condition variable because POSIX semaphores are either not
-provided, or are known to be broken. One particular example of such system is
-macOS.

Misc/NEWS.d/next/Documentation/2018-06-15-15-57-37.bpo-33832.xBFhKw.rst

-Add glossary entry for 'magic method'.

Misc/NEWS.d/next/Documentation/2018-12-22-22-52-05.bpo-35564.TuEU_D.rst

-Explicitly set master_doc variable in conf.py for compliance with Sphinx 2.0

Misc/NEWS.d/next/Documentation/2018-12-30-09-56-13.bpo-35605.gAWt32.rst

-Fix documentation build for sphinx<1.6.  Patch by Anthony Sottile.

Misc/NEWS.d/next/Documentation/2019-02-18-10-01-07.bpo-35126.LWwl8X.rst

-Improve the examples in the "How do I convert a number to string?" question
-of the "Programming" section of the FAQ.  Contributed by Stéphane Wirtel.

Misc/NEWS.d/next/Documentation/2019-07-06-02-19-02.bpo-37149.NumHn3.rst

-Replace the dead link to the Tkinter 8.5 reference by John Shipman, New
-Mexico Tech, with a link to the archive.org copy.

Misc/NEWS.d/next/Documentation/2019-07-06-17-19-26.bpo-37487.QagfZ5.rst

-Fix PyList_GetItem index description to include 0.

Misc/NEWS.d/next/IDLE/2019-05-05-16-27-53.bpo-13102.AGNWYJ.rst

-When saving a file, call os.fsync() so bits are flushed to e.g. USB drive.

Misc/NEWS.d/next/IDLE/2019-06-07-00-17-41.bpo-37177.voU6pQ.rst

-Properly 'attach' search dialogs to their main window so that they behave
-like other dialogs and do not get hidden behind their main window.

Misc/NEWS.d/next/Library/2017-08-30-20-27-00.bpo-31292.dKIaZb.rst

-Fix ``setup.py check --restructuredtext`` for
-files containing ``include`` directives.

Misc/NEWS.d/next/Library/2019-02-25-13-21-43.bpo-36106.VuhEiQ.rst

-Resolve potential name clash with libm's sinpi(). Patch by Dmitrii Pasechnik.

Misc/NEWS.d/next/Library/2019-03-04-10-42-46.bpo-36179.jEyuI-.rst

-Fix two unlikely reference leaks in _hashopenssl. The leaks only occur in
-out-of-memory cases.

Misc/NEWS.d/next/Library/2019-03-04-16-13-01.bpo-13096.SGPt_n.rst

-Fix memory leak in ctypes POINTER handling of large values.

Misc/NEWS.d/next/Library/2019-03-04-16-39-16.bpo-36186.Hqw1A_.rst

-Fix linuxaudiodev.linux_audio_device() error handling: close the internal file descriptor if it fails to open the device.

Misc/NEWS.d/next/Library/2019-03-06-13-21-33.bpo-35807.W7mmu3.rst

-Update ensurepip to install pip 19.0.3 and setuptools 40.8.0.

Misc/NEWS.d/next/Library/2019-03-08-13-32-21.bpo-36235._M72wU.rst

-Fix ``CFLAGS`` in ``customize_compiler()`` of ``distutils.sysconfig``: when
-the ``CFLAGS`` environment variable is defined, don't override ``CFLAGS``
-variable with the ``OPT`` variable anymore. Initial patch written by David
-Malcolm.

Misc/NEWS.d/next/Library/2019-03-14-14-40-22.bpo-36212.IEgRI8.rst

-Fix two possible reference leaks in the hotshot module.

Misc/NEWS.d/next/Library/2019-03-14-15-42-48.bpo-36289.wYKS47.rst

-Fix a possible reference leak in the io module.

Misc/NEWS.d/next/Library/2019-03-14-15-54-46.bpo-36291.UalHXP.rst

-Fix a possible reference leak in the json module.

Misc/NEWS.d/next/Library/2019-03-18-10-08-30.bpo-36337.QhJnXy.rst

-Fix buffer overflow in :meth:`~socket.socket.send` and
-:meth:`~socket.socket.sendall` methods of :func:`socket.socket` for data larger
-than 2 GiB.

Misc/NEWS.d/next/Library/2019-04-18-16-10-29.bpo-28552.MW1TLt.rst

-Fix :mod:`distutils.sysconfig` if :data:`sys.executable` is ``None`` or an
-empty string: use :func:`os.getcwd` to initialize ``project_base``.  Fix
-also the distutils build command: don't use :data:`sys.executable` if it is
-``None`` or an empty string.

Misc/NEWS.d/next/Library/2019-05-23-15-57-36.bpo-36713.sjPhnf.rst

-Rename the :meth:`test_ascii_replace` to :meth:`test_ascii_strict`.

Misc/NEWS.d/next/Library/2019-05-30-16-16-47.bpo-12639.TQFOR4.rst

-:meth:`msilib.Directory.start_component()` no longer fails if *keyfile* is
-not ``None``.

Misc/NEWS.d/next/Library/2019-06-10-12-02-45.bpo-36742.UEdHXJ.rst

-:func:`urlparse.urlsplit` error message for invalid ``netloc`` according to
-NFKC normalization is now a :class:`str` string, rather than a
-:class:`unicode` string, to prevent error when displaying the error.

Misc/NEWS.d/next/Library/2019-06-27-20-33-50.bpo-37437.du39_A.rst

-Update vendorized expat version to 2.2.7.

Misc/NEWS.d/next/Library/2019-07-24-18-27-44.bpo-37664.o-GYZC.rst

-Update wheels bundled with ensurepip (pip 19.2.3 and setuptools 41.2.0)

Misc/NEWS.d/next/Library/2019-08-23-14-47-09.bpo-34521.Y2BYu5.rst

-Fix file descriptors transfer in multiprocessing on FreeBSD: use
-``CMSG_SPACE()`` rather than ``CMSG_LEN()``; see :rfc:`3542`.

Misc/NEWS.d/next/Library/2019-08-28-14-04-18.bpo-37965.7xGE-C.rst

-Fix C compiler warning caused by distutils.ccompiler.CCompiler.has_function.

Misc/NEWS.d/next/Library/2019-08-31-01-52-59.bpo-34410.7KbWZQ.rst

-Fixed a crash in the :func:`tee` iterator when re-enter it. RuntimeError is
-now raised in this case.

Misc/NEWS.d/next/Library/2019-09-14-10-34-00.bpo-33936.8wCI_n.rst

-_hashlib no longer calls obsolete OpenSSL initialization function with
-OpenSSL 1.1.0+.

Misc/NEWS.d/next/Library/2019-09-15-10-30-33.bpo-38175.61XlUv.rst

-Fix a memory leak in comparison of :class:`sqlite3.Row` objects.

Misc/NEWS.d/next/Library/2019-09-27-15-24-45.bpo-38216.-7yvZR.rst

-Allow the rare code that wants to send invalid http requests from the
-`http.client` library a way to do so.  The fixes for bpo-30458 led to
-breakage for some projects that were relying on this ability to test their
-own behavior in the face of bad requests.

Misc/NEWS.d/next/Security/2019-02-13-17-21-10.bpo-35907.ckk2zg.rst

-CVE-2019-9948: Avoid file reading by disallowing ``local-file://`` and
-``local_file://`` URL schemes in :func:`urllib.urlopen`,
-:meth:`urllib.URLopener.open` and :meth:`urllib.URLopener.retrieve`.

Misc/NEWS.d/next/Security/2019-03-06-09-38-40.bpo-36216.6q1m4a.rst

-Changes urlsplit() to raise ValueError when the URL contains characters that
-decompose under IDNA encoding (NFKC-normalization) into characters that
-affect how the URL is parsed.
\ No newline at end of file

Misc/NEWS.d/next/Security/2019-04-10-08-53-30.bpo-30458.51E-DA.rst

-Address CVE-2019-9740 by disallowing URL paths with embedded whitespace or control characters through into the underlying http client request.  Such potentially malicious header injection URLs now cause an httplib.InvalidURL exception to be raised.

Misc/NEWS.d/next/Security/2019-04-29-15-34-59.bpo-36742.QCUY0i.rst

-Fixes mishandling of pre-normalization characters in urlsplit().

Misc/NEWS.d/next/Security/2019-05-04-13-33-37.bpo-34155.MJll68.rst

-Fix parsing of invalid email addresses with more than one ``@`` (e.g. a@b@c.com.) to not return the part before 2nd ``@`` as valid email address. Patch by maxking & jpic.

Misc/NEWS.d/next/Security/2019-05-20-00-35-12.bpo-35121.RRi-HU.rst

-Don't send cookies of domain A without Domain attribute to domain B when
-domain A is a suffix match of domain B while using a cookiejar with
-:class:`cookielib.DefaultCookiePolicy` policy. Patch by Karthikeyan
-Singaravelan.

Misc/NEWS.d/next/Security/2019-05-20-00-49-29.bpo-35647.oWmiGU.rst

-Don't set cookie for a request when the request path is a prefix match of
-the cookie's path attribute but doesn't end with "/". Patch by Karthikeyan
-Singaravelan.

Misc/NEWS.d/next/Security/2019-06-17-08-43-19.bpo-34631.pJ8CGR.rst

-Updated OpenSSL to 1.0.2s in Windows installer

Misc/NEWS.d/next/Security/2019-09-23-21-02-46.bpo-38174.MeWuJd.rst

-Update vendorized expat library version to 2.2.8, which resolves
-CVE-2019-15903.

Misc/NEWS.d/next/Security/2019-09-25-13-21-09.bpo-38243.1pfz24.rst

-Escape the server title of :class:`DocXMLRPCServer.DocXMLRPCServer`
-when rendering the document page as HTML.
-(Contributed by Dong-hee Na in :issue:`38243`.)

Misc/NEWS.d/next/Tests/2019-01-11-14-01-19.bpo-34836.7fat9-.rst

-Fix ``test_default_ecdh_curve`` when TLSv1.3 is enabled by default.

Misc/NEWS.d/next/Tests/2019-02-24-02-44-52.bpo-26386.YZylPP.rst

-Re-enable missing widget testcases in test_ttk_guionly.

Misc/NEWS.d/next/Tests/2019-02-24-03-19-43.bpo-27313.Sj9veH.rst

-Avoid test_ttk_guionly ComboboxTest failure with macOS Cocoa Tk.

Misc/NEWS.d/next/Tests/2019-03-05-13-27-36.bpo-36019.ebUjCm.rst

-Add test.support.TEST_HTTP_URL and replace references of
-http://www.example.com by this new constant. Contributed by Stéphane Wirtel.

Misc/NEWS.d/next/Tests/2019-03-08-12-53-37.bpo-36234.NRVK6W.rst

-test_posix.PosixUidGidTests: add tests for invalid uid/gid type (str).
-Patch written by David Malcolm.

Misc/NEWS.d/next/Tests/2019-04-09-14-08-02.bpo-36560._ejeOr.rst

-Fix reference leak hunting in regrtest: compute also deltas (of reference count
-and file descriptor count) during warmup, to ensure that everything is
-initialized before starting to hunt reference leaks.

Misc/NEWS.d/next/Tests/2019-05-06-18-29-54.bpo-35925.gwQPuC.rst

-Skip specific nntplib and ssl networking tests when they would otherwise fail due to a modern OS or distro with a default OpenSSL policy of rejecting connections to servers with weak certificates or disabling TLS below TLSv1.2.

Misc/NEWS.d/next/Tests/2019-05-08-15-55-46.bpo-36816.WBKRGZ.rst

-Update Lib/test/selfsigned_pythontestdotnet.pem to match self-signed.pythontest.net's new TLS certificate.
\ No newline at end of file

Misc/NEWS.d/next/Tests/2019-06-21-15-47-33.bpo-37362.D3xppx.rst

-test_gdb no longer fails if it gets an "unexpected" message on stderr: it now
-ignores stderr. The purpose of test_gdb is to test that python-gdb.py commands
-work as expected, not to test gdb.

Misc/NEWS.d/next/Tests/2019-06-24-10-47-07.bpo-37359.CkdtyO.rst

-Add --cleanup option to python3 -m test to remove ``test_python_*``
-directories of previous failed jobs. Add "make cleantest" to run
-``python3 -m test --cleanup``.
-

Misc/NEWS.d/next/Tests/2019-06-26-15-28-45.bpo-37411.5lGNhM.rst

-Fix test_wsgiref.testEnviron() to no longer depend on the environment
-variables (don't fail if "X" variable is set).

Misc/NEWS.d/next/Tools-Demos/2019-04-30-14-30-29.bpo-14546.r38Y-6.rst

-Fix the argument handling in Tools/scripts/lll.py.

Misc/NEWS.d/next/Tools-Demos/2019-07-24-16-20-54.bpo-37675.951Cvf.rst

-2to3 now works when run from a zipped standard library.

Misc/NEWS.d/next/Windows/2017-11-24-12-53-54.bpo-1104.1CWSZp.rst

-Correctly handle string length in ``msilib.SummaryInfo.GetProperty()`` to
-prevent it from truncating the last character.

Misc/NEWS.d/next/Windows/2019-06-18-09-53-15.bpo-35360.tdqSmo.rst

-Update Windows builds to use SQLite 3.28.0.

Misc/NEWS.d/next/Windows/2019-06-28-18-10-29.bpo-37445.LsdYO6.rst

-Include the ``FORMAT_MESSAGE_IGNORE_INSERTS`` flag in ``FormatMessageW()``
-calls.

Misc/NEWS.d/next/Windows/2019-09-16-12-47-12.bpo-38117.JaiB0X.rst

-Updates bundled OpenSSL to 1.0.2t

Misc/NEWS.d/next/macOS/2019-06-03-05-49-49.bpo-36231.RfmW_p.rst

-Support building Python on macOS without /usr/include installed. As of macOS
-10.14, system header files are only available within an SDK provided by
-either the Command Line Tools or the Xcode app.

Misc/NEWS.d/next/macOS/2019-06-18-05-39-01.bpo-34631.StdZhE.rst

-Updated OpenSSL to 1.0.2s in macOS installer.

Misc/NEWS.d/next/macOS/2019-06-18-10-02-11.bpo-35360.-CWbfy.rst

-Update macOS installer to use SQLite 3.28.0.

Misc/NEWS.d/next/macOS/2019-06-20-01-16-16.bpo-19960.LpLUPF.rst

-When building 2.7 on macOS without system header files installed in
-``/usr/include``, a few extension modules dependent on system-supplied
-third-party libraries were not being built, most notably zlib.
-

Misc/NEWS.d/next/macOS/2019-09-15-21-45-15.bpo-38117._U9F2r.rst

-Updated OpenSSL to 1.0.2t in macOS installer for 2.7.x.