tarfile and zipfile now sort directory listing to generate tar and zip archives
in a more reproducible way.

See also https://reproducible-builds.org/docs/stable-inputs/ on that topic.

When using customized decode error handlers, it is possible for builtin decoders
to write out-of-bounds and then crash.

Mention only ImportError caused by importing sitecustomize.py/usercustomize.py
themselves will be silently ignored.

…#5460)

…H-5464)

The f-string example for using datetime format specifier does not match the given output.
Changed the format from %b to %B so it matches the output of "January".

In the tutorial about the Generator expression, there is an example with
a dict comprehension and not with a generator expression, just removed
the code.

…5199)

…selection. (GH-3651)

It was deprecated in 3.6.

* bpo-32711: Fix warnings for Python/ast_unparse.c

Clarify that the level argument is used to determine whether to
perform absolute or relative imports: 0 is absolute, while a positive number
is the number of parent directories to search relative to the current module.

This reverts commit 72a0d21.

The reverted commit had a few issues so it was unanimously decided
to undo it. See the bpo issue for details.

* Make sure ``__spec__.loader`` matches ``__loader__`` for namespace packages.
* Make sure ``__spec__.origin` matches ``__file__`` for namespace packages.

https://bugs.python.org/issue32303
https://bugs.python.org/issue32305

…H-5265)

Modify RE examples in documentation to use raw strings to prevent DeprecationWarning.
Add text to REGEX HOWTO to highlight the deprecation.  Approved by Serhiy Storchaka.

)

Previously the module name was used, which broke relative imports when pdb was run against a plain module or submodule.

Fix typos found by codespell in docs, docstrings, and comments.

…i-language doc (GH-5482)

Changed the definition of width and precision from "integer" to "digit+" in format mini-language doc.

…ns. (GH-4564)

…ts. (#5930)

* Prevent low-grade poplib REDOS (CVE-2018-1060)

The regex to test a mail server's timestamp is susceptible to
catastrophic backtracking on long evil responses from the server.

Happily, the maximum length of malicious inputs is 2K thanks
to a limit introduced in the fix for CVE-2013-1752.

A 2KB evil response from the mail server would result in small slowdowns
(milliseconds vs. microseconds) accumulated over many apop calls.
This is a potential DOS vector via accumulated slowdowns.

Replace it with a similar non-vulnerable regex.

The new regex is RFC compliant.
The old regex was non-compliant in edge cases.

* Prevent difflib REDOS (CVE-2018-1061)

The default regex for IS_LINE_JUNK is susceptible to
catastrophic backtracking.
This is a potential DOS vector.

Replace it with an equivalent non-vulnerable regex.

Also introduce unit and REDOS tests for difflib.

Co-authored-by: Tim Peters <tim.peters@gmail.com>
Co-authored-by: Christian Heimes <christian@python.org>

…e. (GH-5701)

…ck_open

…ck_open

…ck_open