I' leaving the whatsnew entry to release managers.

I' leaving the whatsnew entry to release managers.

Usually, release managers don't maintain the What's New document. Since this change is backward incompatible, IMO it would deserve a "Notable changes in Python 3.x.y" in their What's New document in 3.6-3.9 branches. Example for a recent security fix:
https://docs.python.org/dev/whatsnew/3.7.html#notable-changes-in-python-3-7-10

For Python 3.10, it can be written in the https://docs.python.org/dev/whatsnew/3.10.html#changes-in-the-python-api section.

This looks ready to me, and Christian has asked someone else to finish the merge as he's out.

Any other feedback? @vstinner, @serhiy-storchaka, are you guys happy with the changes (pending the versionchanged being updated in each backport)?

Withdrawing the readiness - @ambv and I would prefer to see this behind a flag (probably "strict" parsing), on by default for 3.10, and maybe on by default for 3.9/earlier.

The main reasoning being that this isn't our vulnerability, but an inconsistency with other vulnerable libraries. The current fix is the best it can be, but it doesn't prevent the vulnerability, it just causes Python to break first. So it ought to be relatively easy to retain the flexible (though admittedly non-sensical) behaviour for those who currently rely on it.

Thanks @tiran for the PR, and @ambv for merging it 🌮🎉.. I'm working now to backport this PR to: 3.8, 3.9.
🐍🍒⛏🤖

Sorry, @tiran and @ambv, I could not cleanly backport this to 3.8 due to a conflict.
Please backport using cherry_picker on command line.
cherry_picker 60ce8f0be6354ad565393ab449d8de5d713f35bc 3.8

GH-25815 is a backport of this pull request to the 3.9 branch.