Merge: 27988: Make sure iter_attachments does not mutate the payload list.

diff --cc Lib/email/message.py
Simple merge

diff --cc Misc/NEWS
index b367306703829108bb2167d2bb484e237f214fde,bfc693aaf05f08803997f4eb8291601d5b550d7a..ef85d1c8efe0bddd78e6161603c9a44ba6bfc416
--- 1/Misc/NEWS
--- 2/Misc/NEWS
+++ b/Misc/NEWS
@@@ -88,37 -38,34 +88,39 @@@ Core and Builtin
    In a brand new thread, raise a RuntimeError since there is no active
    exception to reraise. Patch written by Xiang Zhang.
  
 -- Issue #27419: Standard __import__() no longer look up "__import__" in globals
 -  or builtins for importing submodules or "from import".  Fixed handling an
 -  error of non-string package name.
 +Library
 +-------
  
 -- Issue #27083: Respect the PYTHONCASEOK environment variable under Windows.
++- Issue 27988: Fix email iter_attachments incorrect mutation of payload list.
+ 
 -- Issue #27514: Make having too many statically nested blocks a SyntaxError
 -  instead of SystemError.
 +- Issue #16113: Add SHA-3 and SHAKE support to hashlib module.
  
 -- Issue #27473: Fixed possible integer overflow in bytes and bytearray
 -  concatenations.  Patch by Xiang Zhang.
 +- Issue #27776: The :func:`os.urandom` function does now block on Linux 3.17
 +  and newer until the system urandom entropy pool is initialized to increase
 +  the security. This change is part of the :pep:`524`.
  
 -- Issue #27507: Add integer overflow check in bytearray.extend().  Patch by
 -  Xiang Zhang.
 +- Issue #27778: Expose the Linux ``getrandom()`` syscall as a new
 +  :func:`os.getrandom` function. This change is part of the :pep:`524`.
  
 -- Issue #27581: Don't rely on wrapping for overflow check in
 -  PySequence_Tuple().  Patch by Xiang Zhang.
 +- Issue #27691: Fix ssl module's parsing of GEN_RID subject alternative name
 +  fields in X.509 certs.
  
 -- Issue #27443: __length_hint__() of bytearray iterators no longer return a
 -  negative integer for a resized bytearray.
 +- Issue #18844: Add random.choices().
  
 -Library
 --------
 +- Issue #25761: Improved error reporting about truncated pickle data in
 +  C implementation of unpickler.  UnpicklingError is now raised instead of
 +  AttributeError and ValueError in some cases.
  
 -- Issue 27988: Fix email iter_attachments incorrect mutation of payload list.
 +- Issue #26798: Add BLAKE2 (blake2b and blake2s) to hashlib.
  
 -- Issue #27691: Fix ssl module's parsing of GEN_RID subject alternative name
 -  fields in X.509 certs.
 +- Issue #26032: Optimized globbing in pathlib by using os.scandir(); it is now
 +  about 1.5--4 times faster.
 +
 +- Issue #25596: Optimized glob() and iglob() functions in the
 +  glob module; they are now about 3--6 times faster.
 +
 +- Issue #27928: Add scrypt (password-based key derivation function) to
 +  hashlib module (requires OpenSSL 1.1.0).
  
  - Issue #27850: Remove 3DES from ssl module's default cipher list to counter
    measure sweet32 attack (CVE-2016-2183).