delta/cpython-git.git, branch v3.8.8

Python 3.8.8

2021-02-19T10:28:41+00:00

closes bpo-43254: Fix *snprintf() man page refs. (GH-24563)

2021-02-19T02:03:34+00:00

(cherry picked from commit e92d67dfbb4790df37aa6a0961fb6dc7e8d2fbbf)

Co-authored-by: Erlend Egeberg Aasland

Remove all links to mingw.org (GH-24552)

2021-02-18T20:07:24+00:00

This lease on this domain has lapsed. This not only makes these dead links, but a potential attack vector for readers of python.org as the domain can be obtained by an untrustworthy party.

I considered redirecting these links to http://mingw-w64.org/ which is a maintained fork of mingw, but beyond my unfamiliarity with the exact level of compatibility, at the time of this PR that site had an expired cert and so is not much of a vulnerability fix.

Automerge-Triggered-By: GH:Mariatta
(cherry picked from commit 743932d50815edbe4ffd530ae091c53ae47dd34b)

Co-authored-by: Jeremy Paige

Post 3.8.8rc1

2021-02-16T19:07:06+00:00

Python 3.8.8rc1

2021-02-16T18:12:03+00:00

bpo-42819, readline: Disable bracketed paste (GH-24108)

2021-02-15T23:47:52+00:00

(cherry picked from commit 755f3c1521b422bc2177013d289f5439975fdc4f)

Co-authored-by: Dustin Rodrigues

Add a warning block around the get_referrers() documentation (GH-24511)

2021-02-15T23:12:34+00:00

(cherry picked from commit 813db24f7c2c536d587d1832c3c52b44fa9e242e)

Co-authored-by: Pablo Galindo

bpo-43108: Fix a reference leak in the curses module (GH-24420) (GH-24429)

2021-02-15T18:43:52+00:00

(cherry picked from commit bb739ec922c6992a2be38f9fd3c544c2cc322dde)

Co-authored-by: Pablo Galindo 

Co-authored-by: Pablo Galindo

[3.8] bpo-42967: only use '&' as a query string separator (GH-24297) (#24529)

2021-02-15T18:15:02+00:00

* bpo-42967: only use '&' as a query string separator (#24297)

bpo-42967: [security] Address a web cache-poisoning issue reported in
urllib.parse.parse_qsl().

urllib.parse will only us "&" as query string separator by default
instead of both ";" and "&" as allowed in earlier versions. An optional
argument seperator with default value "&" is added to specify the
separator.

Co-authored-by: Éric Araujo 
Co-authored-by: blurb-it[bot] <43283697+blurb-it[bot]@users.noreply.github.com>
Co-authored-by: Ken Jin <28750310+Fidget-Spinner@users.noreply.github.com>
Co-authored-by: Éric Araujo 
(cherry picked from commit fcbe0cb04d35189401c0c880ebfb4311e952d776)

* [3.8] bpo-42967: only use '&' as a query string separator (GH-24297)

bpo-42967: [security] Address a web cache-poisoning issue reported in urllib.parse.parse_qsl().

urllib.parse will only us "&" as query string separator by default instead of both ";" and "&" as allowed in earlier versions. An optional argument seperator with default value "&" is added to specify the separator.

Co-authored-by: Éric Araujo 
Co-authored-by: blurb-it[bot] <43283697+blurb-it[bot]@users.noreply.github.com>
Co-authored-by: Ken Jin <28750310+Fidget-Spinner@users.noreply.github.com>
Co-authored-by: Éric Araujo .
(cherry picked from commit fcbe0cb04d35189401c0c880ebfb4311e952d776)

Co-authored-by: Adam Goldschmidt 

* Update correct version information.

* fix docs and make logic clearer

Co-authored-by: Adam Goldschmidt 
Co-authored-by: Fidget-Spinner <28750310+Fidget-Spinner@users.noreply.github.com>

bpo-43204: Fix LibTomCrypt URL in md5module.c and sha*module.c comments (GH-24507) (GH-24516)

2021-02-14T14:53:10+00:00

Automerge-Triggered-By: GH:tiran
(cherry picked from commit 5ec7d535581bc99918e032891167a96abd224ed6)

Co-authored-by: Erlend Egeberg Aasland 

Co-authored-by: Erlend Egeberg Aasland