https://bugs.python.org/issue34548

The SAX parser no longer processes general external entities by default
to increase security. Before, the parser created network connections
to fetch remote files or loaded local files from the file system for DTD
and entities.
Signed-off-by: Christian Heimes <christian@python.org>



https://bugs.python.org/issue17239

Add SSLContext.post_handshake_auth and
SSLSocket.verify_client_post_handshake for TLS 1.3 post-handshake
authentication.

Signed-off-by: Christian Heimes <christian@python.org>q


https://bugs.python.org/issue34670

Use "backslashreplace" instead of "unicode-escape".  It is not
implementation depended and escapes only non-encodable characters.

Also simplify the code.

News entry clean up, added to what's new

Requested by @gvanrossum in https://github.com/python/cpython/pull/4509 


https://bugs.python.org/issue32117

Also make docs for NEWFALSE and NEWTRUE more consistent
with docs for other opcodes.

OpenSSL follows the convention that whenever you call a function, it
returns an error indicator value; and if this value is negative, then
you need to go look at the actual error code to see what happened.

Commit c6fd1c1c introduced a small mistake in
_ssl__SSLSocket_shutdown_impl: instead of checking whether the error
indicator was negative, it started checking whether the actual error
code was negative, and it turns out that the error codes are never
negative. So the effect was that 'unwrap()' lost the ability to raise
SSL errors.


https://bugs.python.org/issue34759

https://bugs.python.org/issue34623

* bpo-29577: allow multiple mixin classes

Iterable unpacking is now allowed without parentheses in yield and return
statements, e.g. ``yield 1, 2, 3, *rest``. Thanks to David Cuthbert for the
change and jChapman for added tests.

We cannot simply call locale.getpreferredencoding() here,
as GDB might have been linked against a different version
of Python with a different encoding and coercion policy
with respect to PEP 538 and PEP 540.

Thanks to Victor Stinner for a hint on how to fix this.

PowerShell Core 6.1 is the cross-platform port of Windows PowerShell. This change updates Activate.ps1 to not make Windows assumptions as well as installing it into the bin/Scripts directory on all operating systems.

Requires PowerShell Core 6.1 for proper readline support once the shell has been activated for the virtual environment.

Make it more accurate and not limited to UNIX.

There was a missing PyMem_Free(format) in time_strftime().

Reduce the knotty preprocessor conditional logic, dedent unnecessarily nested
code, and handle errors properly.

The first edition of this change (afde1c1a)
failed (bpo-34715) because FreeBSD doesn't define the timezone globals. That's
why we're now checking for HAVE_DECL_TZNAME.

Apparently, FreeBSD doesn't raise OSError when offset is
not a multiple of mmap.PAGESIZE.

* Revert "bpo-34589: Add -X coerce_c_locale command line option (GH-9378)"

This reverts commit dbdee007.

* Revert "bpo-34589: C locale coercion off by default (GH-9073)"

This reverts commit 7a0791b6.

* Revert "bpo-34589: Make _PyCoreConfig.coerce_c_locale private (GH-9371)"

This reverts commit 188ebfa4.

They were specific to the C implementation.

A couple of fixes here to make this more PEP-8:

* Avoid multiple statements on one line with `;` statement separator -- this is very rare in Python and is "generally discouraged" in PEP 8 (and if used, per PEP 8 there shouldn't be a space before the `;`)
* Add output for the first "Formatted String Literals" example. (Side note: are the doctests for this being run? If so, why didn't it fail?)
* Avoid space before `!r`. I have generally not seen spaces before the `!`, and this also matches the style used in the docs here: https://docs.python.org/3/library/string.html#format-string-syntax



https://bugs.python.org/issue34712

`list.append([], None)` was profiled but `list.append([], None, **{})` was not profiled.
Enable profiling for later case.

https://bugs.python.org/issue34125

Follow up to 2a9c3805 (bpo-34585).

Currently configure.ac uses AC_RUN_IFELSE to determine the byte order of doubles, but this silently fails under cross compilation and Python doesn't do floats properly.

Instead, steal a macro from autoconf-archive which compiles code using magic doubles (which encode to ASCII) and grep for the representation in the binary.

RFC because this doesn't yet handle the weird ancient ARMv4 OABI 'mixed-endian' encoding properly. This encoding is ancient and I don't believe the union of "Python 3.8 users" and "OABI users" has anything in. Should the support for this just be dropped too? Alternatively, someone will need to find an OABI toolchain to verify the encoding of the magic double.

Co-authored-by: Elvis Pranskevichus <elvis@magic.io>

The docs were ambiguous about whether you pass in a coroutine function
or a coroutine object, e.g. is it:

  aestack.push_async_exit(some_async_func)

or

  aestack.push_async_exit(some_async_func())

(It's the first one.)