Address PR review nits: doc ordering, partial-group wording, NEWS, whatsnew

- Reorder versionchanged param lists alphabetically in base64.rst and
  binascii.rst (canonical, ignorechars, padded).
- Restore "two to five" in a2b_ascii85/a2b_base85 partial-group text;
  partial finals are 2-4 chars but a complete final group is 5.
- Drop redundant versionchanged blocks from a2b_ascii85/a2b_base85
  since both functions are new in 3.15.
- Add Misc/NEWS.d entry and Doc/whatsnew/3.15.rst bullets covering the
  new canonical kwarg and the unconditional 1-char rejection.

Author: gpshead

Doc/library/base64.rst

@@ -118,7 +118,7 @@ POST request.
    For more information about the strict base64 check, see :func:`binascii.a2b_base64`
 
    .. versionchanged:: 3.15
-      Added the *ignorechars*, *padded*, and *canonical* parameters.
+      Added the *canonical*, *ignorechars*, and *padded* parameters.
 
    .. deprecated:: 3.15
       Accepting the ``+`` and ``/`` characters with an alternative alphabet
@@ -216,7 +216,7 @@ POST request.
    input.
 
    .. versionchanged:: 3.15
-      Added the *ignorechars*, *padded*, and *canonical* parameters.
+      Added the *canonical*, *ignorechars*, and *padded* parameters.
 
 
 .. function:: b32hexencode(s, *, padded=True, wrapcol=0)
@@ -243,7 +243,7 @@ POST request.
    .. versionadded:: 3.10
 
    .. versionchanged:: 3.15
-      Added the *ignorechars*, *padded*, and *canonical* parameters.
+      Added the *canonical*, *ignorechars*, and *padded* parameters.
 
 
 .. function:: b16encode(s, *, wrapcol=0)
@@ -384,7 +384,7 @@ Refer to the documentation of the individual functions for more information.
    .. versionadded:: 3.4
 
    .. versionchanged:: 3.15
-      Added the *ignorechars* and *canonical* parameters.
+      Added the *canonical* and *ignorechars* parameters.
       Single-character final groups are now always rejected as encoding
       violations.
 
@@ -426,7 +426,7 @@ Refer to the documentation of the individual functions for more information.
    .. versionadded:: 3.13
 
    .. versionchanged:: 3.15
-      Added the *ignorechars* and *canonical* parameters.
+      Added the *canonical* and *ignorechars* parameters.
       Single-character final groups are now always rejected as encoding
       violations.
 

Doc/library/binascii.rst

@@ -91,7 +91,7 @@ The :mod:`!binascii` module defines the following functions:
       Added the *strict_mode* parameter.
 
    .. versionchanged:: 3.15
-      Added the *alphabet*, *ignorechars*, *padded*, and *canonical* parameters.
+      Added the *alphabet*, *canonical*, *ignorechars*, and *padded* parameters.
 
 
 .. function:: b2a_base64(data, *, padded=True, alphabet=BASE64_ALPHABET, wrapcol=0, newline=True)
@@ -122,7 +122,7 @@ The :mod:`!binascii` module defines the following functions:
    Convert Ascii85 data back to binary and return the binary data.
 
    Valid Ascii85 data contains characters from the Ascii85 alphabet in groups
-   of five (except for the final group, which may have from two to four
+   of five (except for the final group, which may have from two to five
    characters). Each group encodes 32 bits of binary data in the range from
    ``0`` to ``2 ** 32 - 1``, inclusive. The special character ``z`` is
    accepted as a short form of the group ``!!!!!``, which encodes four
@@ -149,11 +149,6 @@ The :mod:`!binascii` module defines the following functions:
 
    .. versionadded:: 3.15
 
-   .. versionchanged:: next
-      Single-character final groups are now always rejected as encoding
-      violations. Previously they were silently ignored, producing no output
-      bytes.
-
 
 .. function:: b2a_ascii85(data, /, *, foldspaces=False, wrapcol=0, pad=False, adobe=False)
 
@@ -184,7 +179,7 @@ The :mod:`!binascii` module defines the following functions:
    More than one line may be passed at a time.
 
    Valid Base85 data contains characters from the Base85 alphabet in groups
-   of five (except for the final group, which may have from two to four
+   of five (except for the final group, which may have from two to five
    characters). Each group encodes 32 bits of binary data in the range from
    ``0`` to ``2 ** 32 - 1``, inclusive. A single-character final group is
    always rejected as an encoding violation.
@@ -203,11 +198,6 @@ The :mod:`!binascii` module defines the following functions:
 
    .. versionadded:: 3.15
 
-   .. versionchanged:: next
-      Single-character final groups are now always rejected as encoding
-      violations. Previously they were silently ignored, producing no output
-      bytes.
-
 
 .. function:: b2a_base85(data, /, *, alphabet=BASE85_ALPHABET, wrapcol=0, pad=False)
 

Doc/whatsnew/3.15.rst

@@ -729,6 +729,15 @@ base64
   :func:`~base64.z85decode`.
   (Contributed by Serhiy Storchaka in :gh:`144001` and :gh:`146431`.)
 
+* Added the *canonical* parameter in
+  :func:`~base64.b32decode`, :func:`~base64.b32hexdecode`,
+  :func:`~base64.b64decode`, :func:`~base64.urlsafe_b64decode`,
+  :func:`~base64.a85decode`, :func:`~base64.b85decode`, and
+  :func:`~base64.z85decode`,
+  to reject encodings with non-zero padding bits or other non-canonical
+  forms.
+  (Contributed by Gregory P. Smith in :gh:`146311`.)
+
 
 binascii
 --------
@@ -762,6 +771,10 @@ binascii
   :func:`~binascii.unhexlify`, and :func:`~binascii.a2b_base64`.
   (Contributed by Serhiy Storchaka in :gh:`144001` and :gh:`146431`.)
 
+* Added the *canonical* parameter in :func:`~binascii.a2b_base64`,
+  to reject encodings with non-zero padding bits.
+  (Contributed by Gregory P. Smith in :gh:`146311`.)
+
 
 calendar
 --------

Misc/NEWS.d/next/Library/2026-04-25-11-56-05.gh-issue-146311.iHWO0v.rst

@@ -0,0 +1,7 @@
+Add a *canonical* keyword-only parameter to the base16, base32, base64,
+base85, ascii85, and Z85 decoders in :mod:`base64` and :mod:`binascii`.
+When true, encodings with non-zero padding bits (base16/32/64) or
+non-canonical encodings (base85/ascii85) are rejected.  Single-character
+final groups in :func:`binascii.a2b_ascii85` and :func:`binascii.a2b_base85`
+are now always rejected as encoding violations, regardless of *canonical*;
+previously they were silently ignored and produced no output bytes.