We updated the server, our testsuite must match.

https://bugs.python.org/issue36816

✈️ CLE -> DEN ✈️ GH-pycon2019
(cherry picked from commit 6bd81734)
Co-authored-by: Gregory P. Smith <greg@krypto.org>

Disallow control chars in http URLs in urllib.urlopen.  This addresses a potential security problem for applications that do not sanity check their URLs where http request headers could be injected.

Disable https related urllib tests on a build without ssl (GH-13032)
These tests require an SSL enabled build. Skip these tests when python is built without SSL to fix test failures.

Use http.client.InvalidURL instead of ValueError as the new error case's exception. (GH-13044)
Co-Authored-By: Miro Hrončok <miro@hroncok.cz>

(cherry picked from commit d537ab0f)
Co-authored-by: Steve Dower <steve.dower@python.org>

(cherry picked from commit 56ed8649)
Co-authored-by: Zackery Spytz <zspytz@gmail.com>

Under some conditions the earlier fix for bpo-18075, "Infinite recursion
tests triggering a segfault on Mac OS X", now causes failures on macOS
when attempting to change stack limit with resource.setrlimit
resource.RLIMIT_STACK, like regrtest does when running the test suite.
The reverted change had specified a non-default stack size when linking
the python executable on macOS.  As of macOS 10.14.4, the previous
code causes a hard failure when running tests, although similar
failures had been seen under some conditions under some earlier
systems.  For now, revert the original change and resume using
the default stack size when linking the interpreter.
(cherry picked from commit 883dfc66)
Co-authored-by: Ned Deily <nad@python.org>

(cherry picked from commit fc8284e2)
Co-authored-by: Jean-François B <jfbu@free.fr>

bpo-36195: Remove the ThreadPoolExecutor documentation mentioning the initializer feature added in Python 3.7 (GH-12182)

[3.6] bpo-36216: Add check for characters in netloc that normalize to separators (GH-12201) (GH-12215)

Co-authored-by: Xtreak <tir.karthi@gmail.com>

Don't send cookies of domain A without Domain attribute to domain B when domain A is a suffix match of domain B while using a cookiejar with `http.cookiejar.DefaultCookiePolicy` policy.  Patch by Karthikeyan Singaravelan.
(cherry picked from commit ca7fe506)
Co-authored-by: Xtreak <tir.karthi@gmail.com>

(cherry picked from commit 41737720)
Co-authored-by: Gregory P. Smith <greg@krypto.org>

(cherry picked from commit aeca373b)
Co-authored-by: Ned Deily <nad@python.org>

Add credit for the cert parser vulnerability. Mention also Cisco
TALOS-2018-0758 identifier.

(cherry picked from commit 9db56fb8)
Co-authored-by: Julien Palard <julien@palard.fr>

While the introduction of ModuleNotFoundError was fully backwards
compatible on the import API consumer side, folks providing alternative
implementations of `__import__` need to make an update to be
forward compatible with clients that start relying on the new subclass.

https://bugs.python.org/issue35486
(cherry picked from commit cee29b46)
Co-authored-by: Nick Coghlan <ncoghlan@gmail.com>

(cherry picked from commit e9a044ec)
Co-authored-by: Harmandeep Singh <harmandeep3091@gmail.com>

The problem affects _testWithTimeoutTriggeredSend in test_socket.py.
(cherry picked from commit 1f511e1a)
Co-authored-by: Pablo Galindo <Pablogsal@gmail.com>

There is a race condition regarding signal delivery in test_signal_handling_args for
test_asyncio.test_events.KqueueEventLoopTests. The signal can be received at any moment outside the time window provided in the test. The fix is to wait for the signal to be received instead with a bigger timeout.
(cherry picked from commit 5471420f)
Co-authored-by: Pablo Galindo <Pablogsal@gmail.com>

Fix a NULL pointer deref in ssl module. The cert parser did not handle CRL
distribution points with empty DP or URI correctly. A malicious or buggy
certificate can result into segfault.
Signed-off-by: Christian Heimes <christian@python.org>

https://bugs.python.org/issue35746
(cherry picked from commit a37f5243)
Co-authored-by: Christian Heimes <christian@python.org>

Revert "bpo-24746: Avoid stripping trailing whitespace in doctest fancy diff (GH-10639) (GH-11477)" (GH-11509)

This reverts commit 5d9ae8b9 which was merged to 3.6 in error.

(cherry picked from commit cbb16459)
Co-authored-by: Sanyam Khurana <8039608+CuriousLearner@users.noreply.github.com>

closes bpo-35643: Fix a SyntaxWarning: invalid escape sequence in Modules/_sha3/cleanup.py (GH-11413)

(cherry picked from commit d466c43e)
Co-authored-by: Mickaël Schoentgen <contact@tiger-222.fr>

(cherry picked from commit 9a69ae8a)

(cherry picked from commit 7e3fb40b)

Co-authored-by: Suriyaa ✌️️ <isc.suriyaa@gmail.com>

This reverts commit 37607f26.

Due to regressions found with using Tk 8.6.9.1, the python.org macOS
installers for 3.6.8 and 3.7.2 are shipping with Tcl/Tk 8.6.8 as used
in previous releases.

`BLDSHARED` needs to have both `LDFLAGS` and `LDFLAGS_NODIST`, not just `LDFLAGS_NODIST`; `PY_CORE_LDFLAGS` provides both.  For example, as it stands now with just `LDFLAGS_NODIST`, macOS universal builds are broken as the necessary `-arch` flags are no longer passed to the standard library extension module link step from `setup.py` resulting in extension modules being single architecture only.

https://bugs.python.org/issue35257
(cherry picked from commit 44a3ee07)
Co-authored-by: Ned Deily <nad@python.org>

(cherry picked from commit 3e8f962e)
Co-authored-by: Arthur Neufeld <aneufeld@seinesoftware.ca>

(cherry picked from commit 57dd79e6)
Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>

(cherry picked from commit 3fcc1e08)
Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>

(cherry picked from commit bdabb073)
Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>

When compiling 3rd party C extensions, the linker flags used by the
compiler for the interpreter and the stdlib modules, will get
leaked into distutils. In order to avoid that, the PY_CORE_LDFLAGS
and PY_LDFLAGS_NODIST are introduced to keep those flags separated.

(cherry picked from commit cf10a750)

(cherry picked from commit 0854b92c)

"make profile-opt" no longer replaces CFLAGS_NODIST with CFLAGS. It
now adds profile-guided optimization (PGO) flags to CFLAGS_NODIST,
existing CFLAGS_NODIST flags are kept.

(cherry picked from commit 640ed520)

bpo-35450: reflect in docs that venv module is not always creating a copy of the Python binary (GH-11144) (GH-11168)