Patch by Meador Inge.

copy of libz exists in $HOME/lib or /usr/local/lib.

Also removes a mention of using "Express Edition with the Windows SDK
64-bit compilers" to build 64-bit Python.  If that can be made to work,
it will need some extra instructions somewhere.

non-framework builds and for all variants of Tk.

to parse more than one XML document per pyexpat xmlparser instance.
(Original patches by Hirokazu Yamamoto and Amaury Forgeot d'Arc, with
suggested wording by David Gutteridge)

Patch by Jeremiah Lowin. Closes #20817.

... for missing keyword-only arguments. Patch by Jeremiah Lowin.
Closes #20816.

test_urllibnet.test_fileno intermittent failures with www.example.com.

failures when ssl is not present.

    68335b8afb1f 3.4
    ad0c75b7bd7d default

Previously a non-string, non-regex second argument and missing callable
argument could cause the test to appear to always pass.

Initial patch by Kamilla Holanda.

Remove useless test and unused variables. Initial patch by Andreas Schwab.

Closes #18456: Doc fix: PyDict_Update only works with dict-like objects, not key-value sequences. Patch by priyapappachan.

close the file descriptor if io.open() fails

loop in debug mode. Raise a RuntimeError if the event loop of the current
thread is different.  The check should help to debug thread-safetly issue.
Patch written by David Foster.

Closes #21043 by updating the documentation to remove specific CA
organizations and update the text to no longer need to tell you to
download root certificates, but instead use the OS certificates
avaialble through SSLContext.load_default_certs.

_PY_HASHTABLE_ENTRY_DATA => _Py_HASHTABLE_ENTRY_DATA

Closes #21013 by modfying ssl.create_default_context() to:

* Move the restricted ciphers to only apply when using
  ssl.Purpose.CLIENT_AUTH. The major difference between restricted and not
  is the lack of RC4 in the restricted. However there are servers that exist
  that only expose RC4 still.
* Switches the default protocol to ssl.PROTOCOL_SSLv23 so that the context
  will select TLS1.1 or TLS1.2 if it is available.
* Add ssl.OP_NO_SSLv3 by default to continue to block SSL3.0 sockets
* Add ssl.OP_SINGLE_DH_USE and ssl.OP_SINGLE_ECDG_USE to improve the security
  of the perfect forward secrecy
* Add ssl.OP_CIPHER_SERVER_PREFERENCE so that when used for a server side
  socket the context will prioritize our ciphers which have been carefully
  selected to maximize security and performance.
* Documents the failure conditions when a SSL3.0 connection is required so
  that end users can more easily determine if they need to unset
  ssl.OP_NO_SSLv3.