@gpshead said:

The failure scenario for an application where we simply start claiming no match (return None?) on potentially suspicious filenames seems acceptable. I doubt it would be a big deal to users if any even notice at all. So if you want to go forward with a PR like #91993 my gut feeling is that nobody is going to balk at the change, even in security only release branches.

@pablogsal, do you agree?

@gpshead said:

The failure scenario for an application where we simply start claiming no match (return None?) on potentially suspicious filenames seems acceptable. I doubt it would be a big deal to users if any even notice at all. So if you want to go forward with a PR like #91993 my gut feeling is that nobody is going to balk at the change, even in security only release branches.

@pablogsal, do you agree?

I agree, but I am still not confident on backporting it, so unless there is some clear consensus from everyone I would recommend to be cautious here.

Status check is done, and it's a success ✅ .

Who's "everyone"?
Not too many people are interested in mailcap :)

Everyone is any core Dev interested on mailcap that want to voice their opinion. If nobody objects or everyone is just you and @gpshead then go ahead and merge it :)

So let's ping core devs from the original issue – but I doubt even they are particularly interested in mailcap.

@zooba @brettcannon @vstinner, do you agree with Greg?

The failure scenario for an application where we simply start claiming no match (return None?) on potentially suspicious filenames seems acceptable. I doubt it would be a big deal to users if any even notice at all. So if you want to go forward with a PR like [this] my gut feeling is that nobody is going to balk at the change, even in security only release branches.

So let's ping core devs from the original issue – but I doubt even they are particularly interested in mailcap.

Correct, I am not interested and thus have no opinion. 😁

My only strong preference is that there should be a clear what's new entry that specifies at least the name of the warning, to give users encountering this the best possible chance to figure out what has changed (and that it was us, and not something that they did).