Issue #28563: Fixed possible DoS and arbitrary code execution when handle

plural form selections in the gettext module.  The expression parser now
supports exact syntax supported by GNU gettext.

diff --cc Misc/NEWS
index 91b97eb6e78f57a87ecf62e4cdf81778930db108,b4a02431a796d812bd1b586b1ce22ca4a09138bf..45e210d32cc62c243bac176994cc1bf320e9967b
--- 1/Misc/NEWS
--- 2/Misc/NEWS
+++ b/Misc/NEWS
@@@ -112,95 -241,6 +112,99 @@@ Core and Builtin
  Library
  -------
  
++- Issue #28563: Fixed possible DoS and arbitrary code execution when handle
++  plural form selections in the gettext module.  The expression parser now
++  supports exact syntax supported by GNU gettext.
++
 +- Issue #28387: Fixed possible crash in _io.TextIOWrapper deallocator when
 +  the garbage collector is invoked in other thread.  Based on patch by
 +  Sebastian Cufre.
 +
 +- Issue #27517: LZMA compressor and decompressor no longer raise exceptions if
 +  given empty data twice.  Patch by Benjamin Fogle.
 +
 +- Issue #28549: Fixed segfault in curses's addch() with ncurses6.
 +
 +- Issue #28449: tarfile.open() with mode "r" or "r:" now tries to open a tar
 +  file with compression before trying to open it without compression.  Otherwise
 +  it had 50% chance failed with ignore_zeros=True.
 +
 +- Issue #23262: The webbrowser module now supports Firefox 36+ and derived
 +  browsers.  Based on patch by Oleg Broytman.
 +
 +- Issue #27939: Fixed bugs in tkinter.ttk.LabeledScale and tkinter.Scale caused
 +  by representing the scale as float value internally in Tk.  tkinter.IntVar
 +  now works if float value is set to underlying Tk variable.
 +
 +- Issue #28255: calendar.TextCalendar.prweek() no longer prints a space after
 +  a weeks's calendar.  calendar.TextCalendar.pryear() no longer prints redundant
 +  newline after a year's calendar.  Based on patch by Xiang Zhang.
 +
 +- Issue #28255: calendar.TextCalendar.prmonth() no longer prints a space
 +  at the start of new line after printing a month's calendar.  Patch by
 +  Xiang Zhang.
 +
 +- Issue #20491: The textwrap.TextWrapper class now honors non-breaking spaces.
 +  Based on patch by Kaarle Ritvanen.
 +
 +- Issue #28353: os.fwalk() no longer fails on broken links.
 +
 +- Issue #28430: Fix iterator of C implemented asyncio.Future doesn't accept
 +  non-None value is passed to it.send(val).
 +
 +- Issue #27025: Generated names for Tkinter widgets now start by the "!" prefix
 +  for readability (was "`").
 +
 +- Issue #25464: Fixed HList.header_exists() in tkinter.tix module by addin
 +  a workaround to Tix library bug.
 +
 +- Issue #28488: shutil.make_archive() no longer adds entry "./" to ZIP archive.
 +
 +- Issue #25953: re.sub() now raises an error for invalid numerical group
 +  reference in replacement template even if the pattern is not found in
 +  the string.  Error message for invalid group reference now includes the
 +  group index and the position of the reference.
 +  Based on patch by SilentGhost.
 +
 +- Issue #28469: timeit now uses the sequence 1, 2, 5, 10, 20, 50,... instead
 +  of 1, 10, 100,... for autoranging.
 +
 +- Issue #28115: Command-line interface of the zipfile module now uses argparse.
 +  Added support of long options.
 +
 +- Issue #18219: Optimize csv.DictWriter for large number of columns.
 +  Patch by Mariatta Wijaya.
 +
 +- Issue #28448: Fix C implemented asyncio.Future didn't work on Windows.
 +
 +- Issue #23214: In the "io" module, the argument to BufferedReader and
 +  BytesIO's read1() methods is now optional and can be -1, matching the
 +  BufferedIOBase specification.
 +
 +- Issue #28480: Fix error building socket module when multithreading is
 +  disabled.
 +
 +- Issue #28240: timeit: remove ``-c/--clock`` and ``-t/--time`` command line
 +  options which were deprecated since Python 3.3.
 +
 +- Issue #28240: timeit now repeats the benchmarks 5 times instead of only 3
 +  to make benchmarks more reliable.
 +
 +- Issue #28240: timeit autorange now uses a single loop iteration if the
 +  benchmark takes less than 10 seconds, instead of 10 iterations.
 +  "python3 -m timeit -s 'import time' 'time.sleep(1)'" now takes 4 seconds
 +  instead of 40 seconds.
 +
 +- Distutils.sdist now looks for README and setup.py files with case
 +  sensitivity. This behavior matches that found in Setuptools 6.0 and
 +  later. See `setuptools 100
 +  <https://github.com/pypa/setuptools/issues/100>`_ for rationale.
 +
 +- Issue #24452: Make webbrowser support Chrome on Mac OS X.
 +
 +- Issue #20766: Fix references leaked by pdb in the handling of SIGINT
 +  handlers.
 +
  - Issue #27998: Fixed bytes path support in os.scandir() on Windows.
    Patch by Eryk Sun.