Thanks to Coverity, these were all reported by their Prevent tool.

All of these (except _lsprof.c) should be backported.  Particularly
the hotshot change which validates sys.path.  Can someone backport?

Modules/_sre.c

@@ -2983,7 +2983,7 @@ match_groupdict(MatchObject* self, PyObject* args, PyObject* kw)
     return result;
 
 failed:
-    Py_DECREF(keys);
+    Py_XDECREF(keys);
     Py_DECREF(result);
     return NULL;
 }