00485: CVE-2026-4224

Stack overflow parsing XML with deeply nested DTD content models

Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>

00486: pythongh-148646: Add --enable-prebuilt-jit-stencils configure …

…flag

00485: CVE-2026-4224

Stack overflow parsing XML with deeply nested DTD content models

Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>

00466: Downstream only: Skip tests not working with older expat version

We want to run these tests in Fedora and EPEL 10, but not in EPEL 9,
which has too old version of expat. We set the upper bound version
in the conditionalized skip to a release available in CentOS Stream 10,
which is tested as working.

00477: Raise an error when importing stdlib modules compiled for a di…

…fferent Python version

This is a downstream workaround "implementing"
python#137212 -
the mechanism for the check exists in Python 3.15+, where it needs to be
added to the standard library modules.
In Fedora, we need it also in previous Python versions, as we experience
segmentation fault when importing stdlib modules after update while
Python is running.

_tkinter, _tracemalloc and readline are not calling PyModuleDef_Init,
which is modified with this patch, hence they need a
direct call to the check function.

Co-Authored-By: Karolina Surma <ksurma@redhat.com>

00477: Raise an error when importing stdlib modules compiled for a di…

…fferent Python version

This is a downstream workaround "implementing" python#137212 -
the mechanism for the check exists in Python 3.15+, where it needs to be
added to the standard library modules.
In Fedora, we need it also in previous Python versions, as we experience
segmentation fault when importing stdlib modules after update while
Python is running.

_curses, _tkinter, _tracemalloc and readline are not calling PyModuleDef_Init,
which is modified with this patch, hence they need a
direct call to the check function.

Co-Authored-By: Karolina Surma <ksurma@redhat.com>

00478: CVE-2026-4519

Reject leading dashes in webbrowser URLs (pythonGH-146360)

(cherry picked from commit 82a24a4)

Co-authored-by: Seth Michael Larson <seth@python.org>

00478: CVE-2026-4519

Reject leading dashes in webbrowser URLs (pythonGH-143931) (pythonGH-146364)

(cherry picked from commit 82a24a4)

Co-authored-by: Seth Michael Larson <seth@python.org>

00478: CVE-2026-4519

Reject leading dashes in webbrowser URLs (pythonGH-143931) (pythonGH-146359)

Cherry-picked from Python 3.10: ad4d5ba

(cherry picked from commit 82a24a4)

Co-authored-by: Seth Michael Larson <seth@python.org>

00478: CVE-2026-4519

Reject leading dashes in webbrowser URLs (pythonGH-143931) (pythonGH-146359)

(cherry picked from commit 82a24a4)

Backported from Python 3.10: ad4d5ba

Co-authored-by: Seth Michael Larson <seth@python.org>