There are probably a number of places that are open to attacks
such as the following one, in bltinmodule.c:min_max().

to get dependencies right.

  to include some information about the build environment.

source encoding. Will backport to 2.5.

get_completion_type to readline.

context. Fixes #1626801.

by the Makefile is also used at configure-time.

empty pattern match. (issue 852532).

Will backport to 2.5.

classes when they are actually created.

The exact behaviour of omitted and negative indices for the Pointer type may
need a closer look (especially as it's subtly different from simple slices)
but there's time yet before 2.6, and not enough before 3.0a1 :-)