.. bpo: 37463
.. date: 2019-07-01-08-46-14
.. nonce: 1CHwjE
.. release date: 2019-07-02
.. section: Security

ssl.match_hostname() no longer accepts IPv4 addresses with additional text
after the address and only quad-dotted notation without trailing
whitespaces. Some inet_aton() implementations ignore whitespace and all data
after whitespace, e.g. '127.0.0.1 whatever'.

..

.. bpo: 24214
.. date: 2019-06-22-12-45-20
.. nonce: hIiHeD
.. section: Core and Builtins

Improved support of the surrogatepass error handler in the UTF-8 and UTF-16
incremental decoders.

..

.. bpo: 37440
.. date: 2019-06-28-16-40-17
.. nonce: t3wX-N
.. section: Library

http.client now enables TLS 1.3 post-handshake authentication for default
context or if a cert_file is passed to HTTPSConnection.

..

.. bpo: 37437
.. date: 2019-06-27-20-33-50
.. nonce: du39_A
.. section: Library

Update vendorized expat version to 2.2.7.

..

.. bpo: 37428
.. date: 2019-06-27-13-27-02
.. nonce: _wcwUd
.. section: Library

SSLContext.post_handshake_auth = True no longer sets
SSL_VERIFY_POST_HANDSHAKE verify flag for client connections. Although the
option is documented as ignored for clients, OpenSSL implicitly enables cert
chain validation when the flag is set.

..

.. bpo: 32627
.. date: 2019-02-03-19-13-08
.. nonce: b68f64
.. section: Library

Fix compile error when ``_uuid`` headers conflicting included.

..

.. bpo: 37369
.. date: 2019-06-28-08-09-08
.. nonce: 1iVpxq
.. section: Windows

Fixes path for :data:`sys.executable` when running from the Microsoft Store.

..

.. bpo: 35360
.. date: 2019-06-18-09-05-08
.. nonce: tdqSmo
.. section: Windows

Update Windows builds to use SQLite 3.28.0.

..

.. bpo: 34602
.. date: 2019-07-02-01-06-47
.. nonce: 10d4wl
.. section: macOS

Avoid test suite failures on macOS by no longer calling resource.setrlimit
to increase the process stack size limit at runtime.  The runtime change is
no longer needed since the interpreter is being built with a larger default
stack size.