I just discovered a lurking problem in the timebase.c module in all of the branches for releases >=3.20: In gpsd_gpstime_resolv():

Preface (日本語版も公開されています。) While PyPI has a security page, they don’t have a clear policy for vulnerability assessments.1 This article describes the vulnerabilities that were reported as potential vulnerabilities, using publicly available information. This was done without actually exploiting / demonstrating the vulnerabilities. This article is not intended to encourage you to perform an unauthorized vulnerability assessment. If you find any vulnerabilities in PyPI, please report them to security@python.org.2 TL;DR There was a vulnerability in GitHub Actions of PyPI’s repository, which allowed a malicious pull request