main
gh-143927: Normalize all line endings (CR, CRLF, and LF) in configparser (GH-143929)
gh-149018: Use `XML_SetHashSalt16Bytes` in `pyexpat`/`_elementtree` when possible (#149023)
gh-149079: Fix O(n^2) canonical ordering in unicodedata.normalize() (GH-149080)
gh-149486: tarfile.data_filter: validate written link target (GH-149487)
gh-149474: use `Py_fopen` in `Binary{Reader,Writer}` for audit hook and path-like support (#149524)
gh-87451: Apply CVE-2021-4189 PASV fix to ftplib.ftpcp() (GH-149648)
gh-149698: Update bundled expat to 2.8.1 (GH-149699)
gh-149835: Use realpath() instead of abspath() in shutil.move() (GH-149986)
gh-150743: Limit trailer lines and interim responses read by http.client (GH-150741)
gh-150599: Prevent bz2 decompressor reuse after errors (#150600)
gh-151159: Bump OpenSSL versions for iOS and Android (GH-151164)
gh-151159: Update macOS installer to use OpenSSL 3.5.7. (#151171)
gh-151558: Fix symlink escape via `tarfile` hardlink-extraction fallback (GH-151559)
gh-151544: Fixes CVE-2026-12003 by removing the fallback to %VPATH%/Modules/Setup.local for discovering sources in getpath.py (GH-151545)
gh-151981: Make tarfile._Stream.seek break at EOF (GH-151982)
gh-151987: Pass filter_function to TarFile._extract_one() during .extract() (GH-151988)
gh-152216: Update bundled expat to 2.8.2 (GH-152234)
gh-152674: Avoid quadratic behavior in xml.etree.ElementPath index predicates (GH-152676)
gh-153030: Fix quadratic complexity in incremental parsing in HTMLParser (GH-153031)
Link to blurb on PyPI in the NEWS.d READMEs. (#3323)