…ythonGH-104096)* Fix directory traversal security flaw in uu.decode()* also check absolute paths and os.altsep* Add a regression test.---------(cherry picked from commit0aeda29)Co-authored-by: Sam Carroll <70000253+samcarroll42@users.noreply.github.com>Co-authored-by: Gregory P. Smith <greg@krypto.org> [Google]

…ythonGH-104096)* Fix directory traversal security flaw in uu.decode()* also check absolute paths and os.altsep* Add a regression test.---------(cherry picked from commit0aeda29)Co-authored-by: Sam Carroll <70000253+samcarroll42@users.noreply.github.com>Co-authored-by: Gregory P. Smith <greg@krypto.org> [Google]

…ythonGH-104096)* Fix directory traversal security flaw in uu.decode()* also check absolute paths and os.altsep* Add a regression test.---------(cherry picked from commit0aeda29)Co-authored-by: Sam Carroll <70000253+samcarroll42@users.noreply.github.com>Co-authored-by: Gregory P. Smith <greg@krypto.org> [Google]

…ythonGH-104096)* Fix directory traversal security flaw in uu.decode()* also check absolute paths and os.altsep* Add a regression test.---------(cherry picked from commit0aeda29)Co-authored-by: Sam Carroll <70000253+samcarroll42@users.noreply.github.com>Co-authored-by: Gregory P. Smith <greg@krypto.org> [Google]

…ythonGH-104096)* Fix directory traversal security flaw in uu.decode()* also check absolute paths and os.altsep* Add a regression test.---------(cherry picked from commit0aeda29)Co-authored-by: Sam Carroll <70000253+samcarroll42@users.noreply.github.com>Co-authored-by: Gregory P. Smith <greg@krypto.org> [Google]

…GH-104096) (#104329)gh-99889: Fix directory traversal security flaw in uu.decode() (GH-104096)* Fix directory traversal security flaw in uu.decode()* also check absolute paths and os.altsep* Add a regression test.---------(cherry picked from commit0aeda29) [Google]Co-authored-by: Sam Carroll <70000253+samcarroll42@users.noreply.github.com>

…GH-104096) (#104330)gh-99889: Fix directory traversal security flaw in uu.decode() (GH-104096)* Fix directory traversal security flaw in uu.decode()* also check absolute paths and os.altsep* Add a regression test.---------(cherry picked from commit0aeda29) [Google]Co-authored-by: Sam Carroll <70000253+samcarroll42@users.noreply.github.com>

* main:pythongh-97696 Add documentation for get_coro() behavior with eager tasks (python#104304)pythongh-97933: (PEP 709) inline list/dict/set comprehensions (python#101441)pythongh-99889: Fix directory traversal security flaw in uu.decode() (python#104096)pythongh-104184: fix building --with-pydebug --enable-pystats (python#104217)pythongh-104139: Add itms-services to uses_netloc urllib.parse. (python#104312)pythongh-104240: return code unit metadata from codegen (python#104300)

* main: (156 commits)pythongh-97696 Add documentation for get_coro() behavior with eager tasks (python#104304)pythongh-97933: (PEP 709) inline list/dict/set comprehensions (python#101441)pythongh-99889: Fix directory traversal security flaw in uu.decode() (python#104096)pythongh-104184: fix building --with-pydebug --enable-pystats (python#104217)pythongh-104139: Add itms-services to uses_netloc urllib.parse. (python#104312)pythongh-104240: return code unit metadata from codegen (python#104300)pythongh-104276: Make `_struct.unpack_iterator` type use type flag instead of custom constructor (python#104277)pythongh-97696: Move around and update the whatsnew entry for asyncio eager task factory (python#104298)pythongh-103193: Fix refleaks in `test_inspect` and `test_typing` (python#104320)  require-pr-label.yml: Add missing "permissions:" (python#104309)pythongh-90656: Add platform triplets for 64-bit LoongArch (LA64) (python#30939)pythongh-104180: Read SOCKS proxies from macOS System Configuration (python#104181)pythongh-97696 Remove unnecessary check for eager_start kwarg (python#104188)pythonGH-104308: socket.getnameinfo should release the GIL (python#104307)pythongh-104310: Add importlib.util.allowing_all_extensions() (pythongh-104311)pythongh-99113: A Per-Interpreter GIL! (pythongh-104210)pythonGH-104284: Fix documentation gettext build (python#104296)pythongh-89550: Buffer GzipFile.write to reduce execution time by ~15% (python#101251)pythongh-104223: Fix issues with inheriting from buffer classes (python#104227)pythongh-99108: fix typo in Modules/Setup (python#104293)  ...

* main: (35 commits)pythongh-97696 Add documentation for get_coro() behavior with eager tasks (python#104304)pythongh-97933: (PEP 709) inline list/dict/set comprehensions (python#101441)pythongh-99889: Fix directory traversal security flaw in uu.decode() (python#104096)pythongh-104184: fix building --with-pydebug --enable-pystats (python#104217)pythongh-104139: Add itms-services to uses_netloc urllib.parse. (python#104312)pythongh-104240: return code unit metadata from codegen (python#104300)pythongh-104276: Make `_struct.unpack_iterator` type use type flag instead of custom constructor (python#104277)pythongh-97696: Move around and update the whatsnew entry for asyncio eager task factory (python#104298)pythongh-103193: Fix refleaks in `test_inspect` and `test_typing` (python#104320)  require-pr-label.yml: Add missing "permissions:" (python#104309)pythongh-90656: Add platform triplets for 64-bit LoongArch (LA64) (python#30939)pythongh-104180: Read SOCKS proxies from macOS System Configuration (python#104181)pythongh-97696 Remove unnecessary check for eager_start kwarg (python#104188)pythonGH-104308: socket.getnameinfo should release the GIL (python#104307)pythongh-104310: Add importlib.util.allowing_all_extensions() (pythongh-104311)pythongh-99113: A Per-Interpreter GIL! (pythongh-104210)pythonGH-104284: Fix documentation gettext build (python#104296)pythongh-89550: Buffer GzipFile.write to reduce execution time by ~15% (python#101251)pythongh-104223: Fix issues with inheriting from buffer classes (python#104227)pythongh-99108: fix typo in Modules/Setup (python#104293)  ...

…ode() (pythonGH-104096) (python#104332)(cherry picked from commit0aeda29)Co-authored-by: Sam Carroll <70000253+samcarroll42@users.noreply.github.com>

…H-104096) (#104331)(cherry picked from commit0aeda29)Co-authored-by: Sam Carroll <70000253+samcarroll42@users.noreply.github.com>

* Post 3.8.16* [3.8] Update copyright years to 2023. (pythongh-100852)* [3.8] Update copyright years to 2023. (pythongh-100848).(cherry picked from commit11f9932)Co-authored-by: Benjamin Peterson <benjamin@python.org>* Update additional copyright years to 2023.Co-authored-by: Ned Deily <nad@python.org>* [3.8] Update copyright year in README (pythonGH-100863) (pythonGH-100867)(cherry picked from commit30a6cc4)Co-authored-by: Ned Deily <nad@python.org>Co-authored-by: HARSHA VARDHAN <75431678+Thunder-007@users.noreply.github.com>* [3.8] CorrectCVE-2020-10735 documentation (pythonGH-100306) (python#100698)(cherry picked from commit1cf3d78)(cherry picked from commit88fe8d7)Co-authored-by: Jeremy Paige <ucodery@gmail.com>Co-authored-by: Gregory P. Smith <greg@krypto.org>* [3.8] Bump Azure Pipelines to ubuntu-22.04 (pythonGH-101089) (python#101215)(cherry picked from commitc22a55c)Co-authored-by: Hugo van Kemenade <hugovk@users.noreply.github.com>* [3.8]pythongh-100180: Update Windows installer to OpenSSL 1.1.1s (pythonGH-100903) (python#101258)*pythongh-101422: (docs) TarFile default errorlevel argument is 1, not 0 (pythonGH-101424)(cherry picked from commitea23271)Co-authored-by: Owain Davies <116417456+OTheDev@users.noreply.github.com>* [3.8]pythongh-95778: add doc missing in some places (pythonGH-100627) (python#101630)(cherry picked from commit4652182)* [3.8]pythongh-101283: Improved fallback logic for subprocess with shell=True on Windows (pythonGH-101286) (python#101710)Co-authored-by: Oleg Iarygin <oleg@arhadthedev.net>Co-authored-by: Steve Dower <steve.dower@microsoft.com>* [3.8]pythongh-101981: Fix Ubuntu SSL tests with OpenSSL (3.1.0-beta1) CI i… (python#102095)[3.8]pythongh-101981: Fix Ubuntu SSL tests with OpenSSL (3.1.0-beta1) CI issue (pythongh-102079)* [3.8]pythonGH-102306 Avoid GHA CI macOS test_posix failure by using the appropriate macOS SDK (pythonGH-102307)[3.8] Avoid GHA CI macOS test_posix failure by using the appropriate macOS SDK.* [3.8]pythongh-101726: Update the OpenSSL version to 1.1.1t (pythonGH-101727) (pythonGH-101752)FixesCVE-2023-0286 (High) and a couple of Medium security issues.https://www.openssl.org/news/secadv/20230207.txtCo-authored-by: Gregory P. Smith <greg@krypto.org>Co-authored-by: Ned Deily <nad@python.org>* [3.8]pythongh-102627: Replace address pointing toward malicious web page (pythonGH-102630) (pythonGH-102667)(cherry picked from commit61479d4)Co-authored-by: Blind4Basics <32236948+Blind4Basics@users.noreply.github.com>Co-authored-by: C.A.M. Gerlach <CAM.Gerlach@Gerlach.CAM>Co-authored-by: Hugo van Kemenade <hugovk@users.noreply.github.com>* [3.8]pythongh-101997: Update bundled pip version to 23.0.1 (pythonGH-101998). (python#102244)(cherry picked from commit89d9ff0)* [3.8]pythongh-102950: Implement PEP 706 – Filter for tarfile.extractall (pythonGH-102953) (python#104548)Backport ofc8c3956* [3.8]pythongh-99889: Fix directory traversal security flaw in uu.decode() (pythonGH-104096) (python#104332)(cherry picked from commit0aeda29)Co-authored-by: Sam Carroll <70000253+samcarroll42@users.noreply.github.com>* [3.8]pythongh-104049: do not expose on-disk location from SimpleHTTPRequestHandler (pythonGH-104067) (python#104121)Do not expose the local server's on-disk location from `SimpleHTTPRequestHandler` when generating a directory index. (unnecessary information disclosure)(cherry picked from commitc7c3a60)Co-authored-by: Ethan Furman <ethan@stoneleaf.us>Co-authored-by: Gregory P. Smith <greg@krypto.org>Co-authored-by: Jelle Zijlstra <jelle.zijlstra@gmail.com>* [3.8]pythongh-103935: Use `io.open_code()` when executing code in trace and profile modules (pythonGH-103947) (python#103954)Co-authored-by: Tian Gao <gaogaotiantian@hotmail.com>* [3.8]pythongh-68966: fix versionchanged in docs (pythonGH-105299)* [3.8] Update GitHub CI workflow for macOS. (pythonGH-105302)* [3.8]pythongh-105184: document that marshal functions can fail and need to be checked with PyErr_Occurred (pythonGH-105185) (python#105222)(cherry picked from commitee26ca1)Co-authored-by: Irit Katriel <1055913+iritkatriel@users.noreply.github.com>* [3.8]pythongh-102153: Start stripping C0 control and space chars in `urlsplit` (pythonGH-102508) (pythonGH-104575) (pythonGH-104592) (python#104593) (python#104895)`urllib.parse.urlsplit` has already been respecting the WHATWG spec a bitpythonGH-25595.This adds more sanitizing to respect the "Remove any leading C0 control or space from input" [rule](https://url.spec.whatwg.org/GH-url-parsing:~:text=Remove%20any%20leading%20and%20trailing%20C0%20control%20or%20space%20from%20input.) in response to [CVE-2023-24329](https://nvd.nist.gov/vuln/detail/CVE-2023-24329).I simplified the docs by eliding the state of the world explanatoryparagraph in this security release only backport.  (people will seethat in the mainline /3/ docs)(cherry picked from commitd7f8a5f)(cherry picked from commit2f630e1)(cherry picked from commit610cc0a)(cherry picked from commitf48a96a)Co-authored-by: Miss Islington (bot) <31488909+miss-islington@users.noreply.github.com>Co-authored-by: Illia Volochii <illia.volochii@gmail.com>Co-authored-by: Gregory P. Smith [Google] <greg@krypto.org>* [3.8]pythongh-103142: Upgrade binary builds and CI to OpenSSL 1.1.1u (pythonGH-105174) (pythonGH-105200) (pythonGH-105205) (python#105370)Upgrade builds to OpenSSL 1.1.1u.Also updates _ssl_data_111.h from OpenSSL 1.1.1u, _ssl_data_300.h from 3.0.9.Manual edits to the _ssl_data_300.h file prevent it from removing anyexisting definitions in case those exist in some peoples builds and wereimportant (avoiding regressions during backporting).(cherry picked from commitede89af)(cherry picked from commite15de14)Co-authored-by: Gregory P. Smith <greg@krypto.org>Co-authored-by: Ned Deily <nad@python.org>* Python 3.8.17* Post 3.8.17* Updated CI to build 3.8.17---------Co-authored-by: Łukasz Langa <lukasz@langa.pl>Co-authored-by: Benjamin Peterson <benjamin@python.org>Co-authored-by: Ned Deily <nad@python.org>Co-authored-by: Miss Islington (bot) <31488909+miss-islington@users.noreply.github.com>Co-authored-by: HARSHA VARDHAN <75431678+Thunder-007@users.noreply.github.com>Co-authored-by: Gregory P. Smith <greg@krypto.org>Co-authored-by: Jeremy Paige <ucodery@gmail.com>Co-authored-by: Hugo van Kemenade <hugovk@users.noreply.github.com>Co-authored-by: Steve Dower <steve.dower@python.org>Co-authored-by: Owain Davies <116417456+OTheDev@users.noreply.github.com>Co-authored-by: Éric <earaujo@caravan.coop>Co-authored-by: Oleg Iarygin <oleg@arhadthedev.net>Co-authored-by: Steve Dower <steve.dower@microsoft.com>Co-authored-by: Dong-hee Na <donghee.na@python.org>Co-authored-by: Blind4Basics <32236948+Blind4Basics@users.noreply.github.com>Co-authored-by: C.A.M. Gerlach <CAM.Gerlach@Gerlach.CAM>Co-authored-by: Pradyun Gedam <pradyunsg@gmail.com>Co-authored-by: Petr Viktorin <encukou@gmail.com>Co-authored-by: Sam Carroll <70000253+samcarroll42@users.noreply.github.com>Co-authored-by: Ethan Furman <ethan@stoneleaf.us>Co-authored-by: Jelle Zijlstra <jelle.zijlstra@gmail.com>Co-authored-by: Tian Gao <gaogaotiantian@hotmail.com>Co-authored-by: Irit Katriel <1055913+iritkatriel@users.noreply.github.com>Co-authored-by: stratakis <cstratak@redhat.com>Co-authored-by: Illia Volochii <illia.volochii@gmail.com>