New upstream version 2.14.1

43 files changed, 235 insertions, 150 deletions

diff --git a/lib/ansible/cli/galaxy.py b/lib/ansible/cli/galaxy.py
index acc3f120..f4148d92 100755
--- a/lib/ansible/cli/galaxy.py
+++ b/lib/ansible/cli/galaxy.py
@@ -17,7 +17,9 @@ import shutil
 import sys
 import textwrap
 import time
+import typing as t
 
+from dataclasses import dataclass
 from yaml.error import YAMLError
 
 import ansible.constants as C
@@ -170,6 +172,30 @@ def validate_signature_count(value):
     return value
 
 
+@dataclass
+class RoleDistributionServer:
+    _api: t.Union[GalaxyAPI, None]
+    api_servers: list[GalaxyAPI]
+
+    @property
+    def api(self):
+        if self._api:
+            return self._api
+
+        for server in self.api_servers:
+            try:
+                if u'v1' in server.available_api_versions:
+                    self._api = server
+                    break
+            except Exception:
+                continue
+
+        if not self._api:
+            self._api = self.api_servers[0]
+
+        return self._api
+
+
 class GalaxyCLI(CLI):
     '''command to manage Ansible roles in shared repositories, the default of which is Ansible Galaxy *https://galaxy.ansible.com*.'''
 
@@ -198,7 +224,7 @@ class GalaxyCLI(CLI):
 
         self.api_servers = []
         self.galaxy = None
-        self._api = None
+        self.lazy_role_api = None
         super(GalaxyCLI, self).__init__(args)
 
     def init_parser(self):
@@ -678,25 +704,15 @@ class GalaxyCLI(CLI):
                 **galaxy_options
             ))
 
+        # checks api versions once a GalaxyRole makes an api call
+        # self.api can be used to evaluate the best server immediately
+        self.lazy_role_api = RoleDistributionServer(None, self.api_servers)
+
         return context.CLIARGS['func']()
 
     @property
     def api(self):
-        if self._api:
-            return self._api
-
-        for server in self.api_servers:
-            try:
-                if u'v1' in server.available_api_versions:
-                    self._api = server
-                    break
-            except Exception:
-                continue
-
-        if not self._api:
-            self._api = self.api_servers[0]
-
-        return self._api
+        return self.lazy_role_api.api
 
     def _get_default_collection_path(self):
         return C.COLLECTIONS_PATHS[0]
@@ -757,7 +773,7 @@ class GalaxyCLI(CLI):
                 display.vvv("found role %s in yaml file" % to_text(role))
                 if "name" not in role and "src" not in role:
                     raise AnsibleError("Must specify name or src for role")
-                return [GalaxyRole(self.galaxy, self.api, **role)]
+                return [GalaxyRole(self.galaxy, self.lazy_role_api, **role)]
             else:
                 b_include_path = to_bytes(requirement["include"], errors="surrogate_or_strict")
                 if not os.path.isfile(b_include_path):
@@ -766,7 +782,7 @@ class GalaxyCLI(CLI):
 
                 with open(b_include_path, 'rb') as f_include:
                     try:
-                        return [GalaxyRole(self.galaxy, self.api, **r) for r in
+                        return [GalaxyRole(self.galaxy, self.lazy_role_api, **r) for r in
                                 (RoleRequirement.role_yaml_parse(i) for i in yaml_load(f_include))]
                     except Exception as e:
                         raise AnsibleError("Unable to load data from include requirements file: %s %s"
@@ -1182,7 +1198,7 @@ class GalaxyCLI(CLI):
         for role in context.CLIARGS['args']:
 
             role_info = {'path': roles_path}
-            gr = GalaxyRole(self.galaxy, self.api, role)
+            gr = GalaxyRole(self.galaxy, self.lazy_role_api, role)
 
             install_info = gr.install_info
             if install_info:
@@ -1327,7 +1343,7 @@ class GalaxyCLI(CLI):
                 # (and their dependencies, unless the user doesn't want us to).
                 for rname in context.CLIARGS['args']:
                     role = RoleRequirement.role_yaml_parse(rname.strip())
-                    role_requirements.append(GalaxyRole(self.galaxy, self.api, **role))
+                    role_requirements.append(GalaxyRole(self.galaxy, self.lazy_role_api, **role))
 
         if not role_requirements and not collection_requirements:
             display.display("Skipping install, no requirements found")
@@ -1438,7 +1454,7 @@ class GalaxyCLI(CLI):
                         display.debug('Installing dep %s' % dep)
                         dep_req = RoleRequirement()
                         dep_info = dep_req.role_yaml_parse(dep)
-                        dep_role = GalaxyRole(self.galaxy, self.api, **dep_info)
+                        dep_role = GalaxyRole(self.galaxy, self.lazy_role_api, **dep_info)
                         if '.' not in dep_role.name and '.' not in dep_role.src and dep_role.scm is None:
                             # we know we can skip this, as it's not going to
                             # be found on galaxy.ansible.com
@@ -1522,7 +1538,7 @@ class GalaxyCLI(CLI):
 
             if role_name:
                 # show the requested role, if it exists
-                gr = GalaxyRole(self.galaxy, self.api, role_name, path=os.path.join(role_path, role_name))
+                gr = GalaxyRole(self.galaxy, self.lazy_role_api, role_name, path=os.path.join(role_path, role_name))
                 if os.path.isdir(gr.path):
                     role_found = True
                     display.display('# %s' % os.path.dirname(gr.path))
@@ -1541,7 +1557,7 @@ class GalaxyCLI(CLI):
                 display.display('# %s' % role_path)
                 path_files = os.listdir(role_path)
                 for path_file in path_files:
-                    gr = GalaxyRole(self.galaxy, self.api, path_file, path=path)
+                    gr = GalaxyRole(self.galaxy, self.lazy_role_api, path_file, path=path)
                     if gr.metadata:
                         _display_role(gr)
 
diff --git a/lib/ansible/cli/pull.py b/lib/ansible/cli/pull.py
index 99da8c4f..dc8f055b 100755
--- a/lib/ansible/cli/pull.py
+++ b/lib/ansible/cli/pull.py
@@ -38,6 +38,9 @@ class PullCLI(CLI):
         This inverts the default *push* architecture of ansible into a *pull* architecture,
         which has near-limitless scaling potential.
 
+        None of the CLI tools are designed to run concurrently with themselves,
+        you should use an external scheduler and/or locking to ensure there are no clashing operations.
+
         The setup playbook can be tuned to change the cron frequency, logging locations, and parameters to ansible-pull.
         This is useful both for extreme scale-out as well as periodic remediation.
         Usage of the 'fetch' module to retrieve logs from ansible-pull runs would be an
diff --git a/lib/ansible/executor/process/worker.py b/lib/ansible/executor/process/worker.py
index d925864b..5113b83d 100644
--- a/lib/ansible/executor/process/worker.py
+++ b/lib/ansible/executor/process/worker.py
@@ -87,10 +87,12 @@ class WorkerProcess(multiprocessing_context.Process):  # type: ignore[name-defin
         '''
 
         self._save_stdin()
-        try:
-            return super(WorkerProcess, self).start()
-        finally:
-            self._new_stdin.close()
+        # FUTURE: this lock can be removed once a more generalized pre-fork thread pause is in place
+        with display._lock:
+            try:
+                return super(WorkerProcess, self).start()
+            finally:
+                self._new_stdin.close()
 
     def _hard_exit(self, e):
         '''
diff --git a/lib/ansible/galaxy/role.py b/lib/ansible/galaxy/role.py
index 7a13c971..99bb525e 100644
--- a/lib/ansible/galaxy/role.py
+++ b/lib/ansible/galaxy/role.py
@@ -33,6 +33,7 @@ from shutil import rmtree
 
 from ansible import context
 from ansible.errors import AnsibleError, AnsibleParserError
+from ansible.galaxy.api import GalaxyAPI
 from ansible.galaxy.user_agent import user_agent
 from ansible.module_utils._text import to_native, to_text
 from ansible.module_utils.common.yaml import yaml_dump, yaml_load
@@ -63,7 +64,7 @@ class GalaxyRole(object):
         display.debug('Validate TLS certificates: %s' % self._validate_certs)
 
         self.galaxy = galaxy
-        self.api = api
+        self._api = api
 
         self.name = name
         self.version = version
@@ -104,6 +105,12 @@ class GalaxyRole(object):
         return self.name == other.name
 
     @property
+    def api(self):
+        if not isinstance(self._api, GalaxyAPI):
+            return self._api.api
+        return self._api
+
+    @property
     def metadata(self):
         """
         Returns role metadata
diff --git a/lib/ansible/module_utils/ansible_release.py b/lib/ansible/module_utils/ansible_release.py
index 1562b704..a38538f5 100644
--- a/lib/ansible/module_utils/ansible_release.py
+++ b/lib/ansible/module_utils/ansible_release.py
@@ -19,6 +19,6 @@
 from __future__ import (absolute_import, division, print_function)
 __metaclass__ = type
 
-__version__ = '2.14.0'
+__version__ = '2.14.1'
 __author__ = 'Ansible, Inc.'
 __codename__ = "C'mon Everybody"
diff --git a/lib/ansible/modules/apt.py b/lib/ansible/modules/apt.py
index 1070c300..1b7c5d29 100644
--- a/lib/ansible/modules/apt.py
+++ b/lib/ansible/modules/apt.py
@@ -68,7 +68,7 @@ options:
     type: str
   install_recommends:
     description:
-      - Corresponds to the C(--no-install-recommends) option for I(apt). C(yes) installs recommended packages.  C(no) does not install
+      - Corresponds to the C(--no-install-recommends) option for I(apt). C(true) installs recommended packages.  C(false) does not install
         recommended packages. By default, Ansible will use the same defaults as the operating system. Suggested packages are never installed.
     aliases: [ install-recommends ]
     type: bool
@@ -141,14 +141,14 @@ options:
      version_added: "1.6"
   autoremove:
     description:
-      - If C(yes), remove unused dependency packages for all module states except I(build-dep). It can also be used as the only option.
+      - If C(true), remove unused dependency packages for all module states except I(build-dep). It can also be used as the only option.
       - Previous to version 2.4, autoclean was also an alias for autoremove, now it is its own separate command. See documentation for further information.
     type: bool
     default: 'no'
     version_added: "2.1"
   autoclean:
     description:
-      - If C(yes), cleans the local repository of retrieved package files that can no longer be downloaded.
+      - If C(true), cleans the local repository of retrieved package files that can no longer be downloaded.
     type: bool
     default: 'no'
     version_added: "2.4"
@@ -170,7 +170,7 @@ options:
   fail_on_autoremove:
     description:
       - 'Corresponds to the C(--no-remove) option for C(apt).'
-      - 'If C(yes), it is ensured that no packages will be removed or the task will fail.'
+      - 'If C(true), it is ensured that no packages will be removed or the task will fail.'
       - 'C(fail_on_autoremove) is only supported with state except C(absent)'
     type: bool
     default: 'no'
@@ -202,7 +202,7 @@ attributes:
     platform:
         platforms: debian
 notes:
-   - Three of the upgrade modes (C(full), C(safe) and its alias C(yes)) required C(aptitude) up to 2.3, since 2.4 C(apt-get) is used as a fall-back.
+   - Three of the upgrade modes (C(full), C(safe) and its alias C(true)) required C(aptitude) up to 2.3, since 2.4 C(apt-get) is used as a fall-back.
    - In most cases, packages installed with apt will start newly installed services by default. Most distributions have mechanisms to avoid this.
      For example when installing Postgresql-9.5 in Debian 9, creating an excutable shell script (/usr/sbin/policy-rc.d) that throws
      a return code of 101 will stop Postgresql 9.5 starting up after install. Remove the file or remove its execute permission afterwards.
diff --git a/lib/ansible/modules/apt_key.py b/lib/ansible/modules/apt_key.py
index 18b88344..67caf6da 100644
--- a/lib/ansible/modules/apt_key.py
+++ b/lib/ansible/modules/apt_key.py
@@ -74,7 +74,7 @@ options:
         default: present
     validate_certs:
         description:
-            - If C(no), SSL certificates for the target url will not be validated. This should only be used
+            - If C(false), SSL certificates for the target url will not be validated. This should only be used
               on personally controlled sites using self-signed certificates.
         type: bool
         default: 'yes'
diff --git a/lib/ansible/modules/apt_repository.py b/lib/ansible/modules/apt_repository.py
index 09d45e2c..f9a0cd91 100644
--- a/lib/ansible/modules/apt_repository.py
+++ b/lib/ansible/modules/apt_repository.py
@@ -64,7 +64,7 @@ options:
         version_added: '2.10'
     validate_certs:
         description:
-            - If C(no), SSL certificates for the target repo will not be validated. This should only be used
+            - If C(false), SSL certificates for the target repo will not be validated. This should only be used
               on personally controlled sites using self-signed certificates.
         type: bool
         default: 'yes'
diff --git a/lib/ansible/modules/assemble.py b/lib/ansible/modules/assemble.py
index ba74a555..2b443ce8 100644
--- a/lib/ansible/modules/assemble.py
+++ b/lib/ansible/modules/assemble.py
@@ -36,7 +36,7 @@ options:
     required: true
   backup:
     description:
-    - Create a backup file (if C(yes)), including the timestamp information so
+    - Create a backup file (if C(true)), including the timestamp information so
       you can get the original file back if you somehow clobbered it
       incorrectly.
     type: bool
@@ -48,8 +48,8 @@ options:
     version_added: '1.4'
   remote_src:
     description:
-    - If C(no), it will search for src at originating/master machine.
-    - If C(yes), it will go to the remote/target machine for the src.
+    - If C(false), it will search for src at originating/master machine.
+    - If C(true), it will go to the remote/target machine for the src.
     type: bool
     default: yes
     version_added: '1.4'
diff --git a/lib/ansible/modules/assert.py b/lib/ansible/modules/assert.py
index 71b2424e..0ef5eb04 100644
--- a/lib/ansible/modules/assert.py
+++ b/lib/ansible/modules/assert.py
@@ -36,7 +36,7 @@ options:
     version_added: "2.7"
   quiet:
     description:
-      - Set this to C(yes) to avoid verbose output.
+      - Set this to C(true) to avoid verbose output.
     type: bool
     default: no
     version_added: "2.8"
diff --git a/lib/ansible/modules/blockinfile.py b/lib/ansible/modules/blockinfile.py
index 2f914418..63fc0214 100644
--- a/lib/ansible/modules/blockinfile.py
+++ b/lib/ansible/modules/blockinfile.py
@@ -36,6 +36,8 @@ options:
     - The marker line template.
     - C({mark}) will be replaced with the values in C(marker_begin) (default="BEGIN") and C(marker_end) (default="END").
     - Using a custom marker without the C({mark}) variable may result in the block being repeatedly inserted on subsequent playbook runs.
+    - Multi-line markers are not supported and will result in the block being repeatedly inserted on subsequent playbook runs.
+    - A newline is automatically appended by the module to C(marker_begin) and C(marker_end).
     type: str
     default: '# {mark} ANSIBLE MANAGED BLOCK'
   block:
diff --git a/lib/ansible/modules/command.py b/lib/ansible/modules/command.py
index ecf4d0f6..778d8a26 100644
--- a/lib/ansible/modules/command.py
+++ b/lib/ansible/modules/command.py
@@ -81,7 +81,7 @@ options:
     type: bool
     default: yes
     description:
-      - If set to C(yes), append a newline to stdin data.
+      - If set to C(true), append a newline to stdin data.
     version_added: "2.8"
   strip_empty_ends:
     description:
diff --git a/lib/ansible/modules/copy.py b/lib/ansible/modules/copy.py
index 7fed4a5c..37115faf 100644
--- a/lib/ansible/modules/copy.py
+++ b/lib/ansible/modules/copy.py
@@ -55,8 +55,8 @@ options:
   force:
     description:
     - Influence whether the remote file must always be replaced.
-    - If C(yes), the remote file will be replaced when contents are different than the source.
-    - If C(no), the file will only be transferred if the destination does not exist.
+    - If C(true), the remote file will be replaced when contents are different than the source.
+    - If C(false), the file will only be transferred if the destination does not exist.
     type: bool
     default: yes
     version_added: '1.1'
@@ -87,8 +87,8 @@ options:
   remote_src:
     description:
     - Influence whether C(src) needs to be transferred or already is present remotely.
-    - If C(no), it will search for C(src) on the controller node.
-    - If C(yes) it will search for C(src) on the managed (remote) node.
+    - If C(false), it will search for C(src) on the controller node.
+    - If C(true) it will search for C(src) on the managed (remote) node.
     - C(remote_src) supports recursive copying as of version 2.8.
     - C(remote_src) only works with C(mode=preserve) as of version 2.6.
     - Autodecryption of files does not work when C(remote_src=yes).
@@ -576,23 +576,24 @@ def main():
         module.params['mode'] = '0%03o' % stat.S_IMODE(os.stat(b_src).st_mode)
     mode = module.params['mode']
 
+    changed = False
+
     checksum_dest = None
+    checksum_src = None
+    md5sum_src = None
 
     if os.path.isfile(src):
-        checksum_src = module.sha1(src)
-    else:
-        checksum_src = None
-
-    # Backwards compat only.  This will be None in FIPS mode
-    try:
-        if os.path.isfile(src):
+        try:
+            checksum_src = module.sha1(src)
+        except (OSError, IOError) as e:
+            module.warn("Unable to calculate src checksum, assuming change: %s" % to_native(e))
+        try:
+            # Backwards compat only.  This will be None in FIPS mode
             md5sum_src = module.md5(src)
-        else:
-            md5sum_src = None
-    except ValueError:
-        md5sum_src = None
-
-    changed = False
+        except ValueError:
+            pass
+    elif remote_src and not os.path.isdir(src):
+        module.fail_json("Cannot copy invalid source '%s': not a file" % to_native(src))
 
     if checksum and checksum_src != checksum:
         module.fail_json(
@@ -657,6 +658,7 @@ def main():
 
     backup_file = None
     if checksum_src != checksum_dest or os.path.islink(b_dest):
+
         if not module.check_mode:
             try:
                 if backup:
@@ -680,8 +682,10 @@ def main():
                     (rc, out, err) = module.run_command(validate % src)
                     if rc != 0:
                         module.fail_json(msg="failed to validate", exit_status=rc, stdout=out, stderr=err)
+
                 b_mysrc = b_src
                 if remote_src and os.path.isfile(b_src):
+
                     _, b_mysrc = tempfile.mkstemp(dir=os.path.dirname(b_dest))
 
                     shutil.copyfile(b_src, b_mysrc)
@@ -701,6 +705,7 @@ def main():
                         # assume unwanted ACLs by default
                         src_has_acls = True
 
+                # at this point we should always have tmp file
                 module.atomic_move(b_mysrc, dest, unsafe_writes=module.params['unsafe_writes'])
 
                 if PY3 and hasattr(os, 'listxattr') and platform.system() == 'Linux' and not remote_src:
diff --git a/lib/ansible/modules/dnf.py b/lib/ansible/modules/dnf.py
index ce8c5ea1..a3b09908 100644
--- a/lib/ansible/modules/dnf.py
+++ b/lib/ansible/modules/dnf.py
@@ -95,7 +95,7 @@ options:
 
   autoremove:
     description:
-      - If C(yes), removes all "leaf" packages from the system that were originally
+      - If C(true), removes all "leaf" packages from the system that were originally
         installed as dependencies of user-installed packages but which are no longer
         required by any such package. Should be used alone or when state is I(absent)
     type: bool
@@ -132,14 +132,14 @@ options:
     version_added: "2.7"
   security:
     description:
-      - If set to C(yes), and C(state=latest) then only installs updates that have been marked security related.
+      - If set to C(true), and C(state=latest) then only installs updates that have been marked security related.
       - Note that, similar to C(dnf upgrade-minimal), this filter applies to dependencies as well.
     type: bool
     default: "no"
     version_added: "2.7"
   bugfix:
     description:
-      - If set to C(yes), and C(state=latest) then only installs updates that have been marked bugfix related.
+      - If set to C(true), and C(state=latest) then only installs updates that have been marked bugfix related.
       - Note that, similar to C(dnf upgrade-minimal), this filter applies to dependencies as well.
     default: "no"
     type: bool
@@ -168,15 +168,15 @@ options:
     type: str
   validate_certs:
     description:
-      - This only applies if using a https url as the source of the rpm. e.g. for localinstall. If set to C(no), the SSL certificates will not be validated.
-      - This should only set to C(no) used on personally controlled sites using self-signed certificates as it avoids verifying the source site.
+      - This only applies if using a https url as the source of the rpm. e.g. for localinstall. If set to C(false), the SSL certificates will not be validated.
+      - This should only set to C(false) used on personally controlled sites using self-signed certificates as it avoids verifying the source site.
     type: bool
     default: "yes"
     version_added: "2.7"
   sslverify:
     description:
       - Disables SSL validation of the repository server for this transaction.
-      - This should be set to C(no) if one of the configured repositories is using an untrusted or self-signed certificate.
+      - This should be set to C(false) if one of the configured repositories is using an untrusted or self-signed certificate.
     type: bool
     default: "yes"
     version_added: "2.13"
@@ -227,7 +227,7 @@ options:
     version_added: "2.8"
   allowerasing:
     description:
-      - If C(yes) it allows  erasing  of  installed  packages to resolve dependencies.
+      - If C(true) it allows  erasing  of  installed  packages to resolve dependencies.
     required: false
     type: bool
     default: "no"
diff --git a/lib/ansible/modules/fetch.py b/lib/ansible/modules/fetch.py
index 5ea1038a..646f78d9 100644
--- a/lib/ansible/modules/fetch.py
+++ b/lib/ansible/modules/fetch.py
@@ -36,9 +36,9 @@ options:
   fail_on_missing:
     version_added: '1.1'
     description:
-    - When set to C(yes), the task will fail if the remote file cannot be read for any reason.
+    - When set to C(true), the task will fail if the remote file cannot be read for any reason.
     - Prior to Ansible 2.5, setting this would only fail if the source file was missing.
-    - The default was changed to C(yes) in Ansible 2.5.
+    - The default was changed to C(true) in Ansible 2.5.
     type: bool
     default: yes
   validate_checksum:
@@ -88,7 +88,7 @@ notes:
   file was impossible unless C(fail_on_missing) was set.
 - In Ansible 2.5 or later, playbook authors are encouraged to use
   C(fail_when) or C(ignore_errors) to get this ability. They may
-  also explicitly set C(fail_on_missing) to C(no) to get the
+  also explicitly set C(fail_on_missing) to C(false) to get the
   non-failing behaviour.
 seealso:
 - module: ansible.builtin.copy
diff --git a/lib/ansible/modules/file.py b/lib/ansible/modules/file.py
index 150ff641..b691d3d9 100644
--- a/lib/ansible/modules/file.py
+++ b/lib/ansible/modules/file.py
@@ -73,7 +73,7 @@ options:
     description:
     - This flag indicates that filesystem links, if they exist, should be followed.
     - I(follow=yes) and I(state=link) can modify I(src) when combined with parameters such as I(mode).
-    - Previous to Ansible 2.5, this was C(no) by default.
+    - Previous to Ansible 2.5, this was C(false) by default.
     type: bool
     default: yes
     version_added: '1.8'
diff --git a/lib/ansible/modules/find.py b/lib/ansible/modules/find.py
index 218f3893..b13c841c 100644
--- a/lib/ansible/modules/find.py
+++ b/lib/ansible/modules/find.py
@@ -102,29 +102,29 @@ options:
         default: mtime
     hidden:
         description:
-            - Set this to C(yes) to include hidden files, otherwise they will be ignored.
+            - Set this to C(true) to include hidden files, otherwise they will be ignored.
         type: bool
         default: no
     follow:
         description:
-            - Set this to C(yes) to follow symlinks in path for systems with python 2.6+.
+            - Set this to C(true) to follow symlinks in path for systems with python 2.6+.
         type: bool
         default: no
     get_checksum:
         description:
-            - Set this to C(yes) to retrieve a file's SHA1 checksum.
+            - Set this to C(true) to retrieve a file's SHA1 checksum.
         type: bool
         default: no
     use_regex:
         description:
-            - If C(no), the patterns are file globs (shell).
-            - If C(yes), they are python regexes.
+            - If C(false), the patterns are file globs (shell).
+            - If C(true), they are python regexes.
         type: bool
         default: no
     depth:
         description:
             - Set the maximum number of levels to descend into.
-            - Setting recurse to C(no) will override this value, which is effectively depth 1.
+            - Setting recurse to C(false) will override this value, which is effectively depth 1.
             - Default is unlimited depth.
         type: int
         version_added: "2.6"
diff --git a/lib/ansible/modules/get_url.py b/lib/ansible/modules/get_url.py
index 5de71912..4cf27159 100644
--- a/lib/ansible/modules/get_url.py
+++ b/lib/ansible/modules/get_url.py
@@ -68,11 +68,11 @@ options:
     version_added: '2.1'
   force:
     description:
-      - If C(yes) and C(dest) is not a directory, will download the file every
-        time and replace the file if the contents change. If C(no), the file
+      - If C(true) and C(dest) is not a directory, will download the file every
+        time and replace the file if the contents change. If C(false), the file
         will only be downloaded if the destination does not exist. Generally
-        should be C(yes) only for small local files.
-      - Prior to 0.6, this module behaved as if C(yes) was the default.
+        should be C(true) only for small local files.
+      - Prior to 0.6, this module behaved as if C(true) was the default.
     type: bool
     default: no
     version_added: '0.7'
@@ -103,13 +103,13 @@ options:
     version_added: "2.0"
   use_proxy:
     description:
-      - if C(no), it will not use a proxy, even if one is defined in
+      - if C(false), it will not use a proxy, even if one is defined in
         an environment variable on the target hosts.
     type: bool
     default: yes
   validate_certs:
     description:
-      - If C(no), SSL certificates will not be validated.
+      - If C(false), SSL certificates will not be validated.
       - This should only be used on personally controlled sites using self-signed certificates.
     type: bool
     default: yes
diff --git a/lib/ansible/modules/getent.py b/lib/ansible/modules/getent.py
index fdfcf43b..1f763800 100644
--- a/lib/ansible/modules/getent.py
+++ b/lib/ansible/modules/getent.py
@@ -41,7 +41,7 @@ options:
         type: str
     fail_key:
         description:
-            - If a supplied key is missing this will make the task fail if C(yes).
+            - If a supplied key is missing this will make the task fail if C(true).
         type: bool
         default: 'yes'
 extends_documentation_fragment:
diff --git a/lib/ansible/modules/git.py b/lib/ansible/modules/git.py
index cca1e7a2..37477b3c 100644
--- a/lib/ansible/modules/git.py
+++ b/lib/ansible/modules/git.py
@@ -30,7 +30,7 @@ options:
             - The path of where the repository should be checked out. This
               is equivalent to C(git clone [repo_url] [directory]). The repository
               named in I(repo) is not appended to this path and the destination directory must be empty. This
-              parameter is required, unless I(clone) is set to C(no).
+              parameter is required, unless I(clone) is set to C(false).
         type: path
         required: true
     version:
@@ -54,7 +54,7 @@ options:
         description:
             - As of OpenSSH 7.5, "-o StrictHostKeyChecking=accept-new" can be
               used which is safer and will only accepts host keys which are
-              not present or are the same. if C(yes), ensure that
+              not present or are the same. if C(true), ensure that
               "-o StrictHostKeyChecking=accept-new" is present as an ssh option.
         type: bool
         default: 'no'
@@ -99,10 +99,10 @@ options:
         version_added: "1.9"
     force:
         description:
-            - If C(yes), any modified files in the working
+            - If C(true), any modified files in the working
               repository will be discarded.  Prior to 0.7, this was always
-              C(yes) and could not be disabled.  Prior to 1.9, the default was
-              C(yes).
+              C(true) and could not be disabled.  Prior to 1.9, the default was
+              C(true).
         type: bool
         default: 'no'
         version_added: "0.7"
@@ -115,13 +115,13 @@ options:
         version_added: "1.2"
     clone:
         description:
-            - If C(no), do not clone the repository even if it does not exist locally.
+            - If C(false), do not clone the repository even if it does not exist locally.
         type: bool
         default: 'yes'
         version_added: "1.9"
     update:
         description:
-            - If C(no), do not retrieve new revisions from the origin repository.
+            - If C(false), do not retrieve new revisions from the origin repository.
             - Operations like archive will work on the existing (old) repository and might
               not respond to changes to the options version or remote.
         type: bool
@@ -135,7 +135,7 @@ options:
         version_added: "1.4"
     bare:
         description:
-            - If C(yes), repository will be created as a bare repo, otherwise
+            - If C(true), repository will be created as a bare repo, otherwise
               it will be a standard repo with a workspace.
         type: bool
         default: 'no'
@@ -149,7 +149,7 @@ options:
 
     recursive:
         description:
-            - If C(no), repository will be cloned without the --recursive
+            - If C(false), repository will be cloned without the --recursive
               option, skipping sub-modules.
         type: bool
         default: 'yes'
@@ -164,9 +164,9 @@ options:
 
     track_submodules:
         description:
-            - If C(yes), submodules will track the latest commit on their
+            - If C(true), submodules will track the latest commit on their
               master branch (or other branch specified in .gitmodules).  If
-              C(no), submodules will be kept at the revision specified by the
+              C(false), submodules will be kept at the revision specified by the
               main project. This is equivalent to specifying the --remote flag
               to git submodule update.
         type: bool
@@ -175,7 +175,7 @@ options:
 
     verify_commit:
         description:
-            - If C(yes), when cloning or checking out a I(version) verify the
+            - If C(true), when cloning or checking out a I(version) verify the
               signature of a GPG signed commit. This requires git version>=2.1.0
               to be installed. The commit MUST be signed and the public key MUST
               be present in the GPG keyring.
diff --git a/lib/ansible/modules/include_role.py b/lib/ansible/modules/include_role.py
index 0124df6a..ea7c61e3 100644
--- a/lib/ansible/modules/include_role.py
+++ b/lib/ansible/modules/include_role.py
@@ -53,7 +53,7 @@ options:
     default: yes
   public:
     description:
-      - This option dictates whether the role's C(vars) and C(defaults) are exposed to the play. If set to C(yes)
+      - This option dictates whether the role's C(vars) and C(defaults) are exposed to the play. If set to C(true)
         the variables will be available to tasks following the C(include_role) task. This functionality differs from
         standard variable exposure for roles listed under the C(roles) header or C(import_role) as they are exposed
         to the play at playbook parsing time, and available to earlier roles and tasks as well.
diff --git a/lib/ansible/modules/rpm_key.py b/lib/ansible/modules/rpm_key.py
index cf40b118..f420eec5 100644
--- a/lib/ansible/modules/rpm_key.py
+++ b/lib/ansible/modules/rpm_key.py
@@ -33,7 +33,7 @@ options:
       choices: [ absent, present ]
     validate_certs:
       description:
-        - If C(no) and the C(key) is a url starting with https, SSL certificates will not be validated.
+        - If C(false) and the C(key) is a url starting with https, SSL certificates will not be validated.
         - This should only be used on personally controlled sites using self-signed certificates.
       type: bool
       default: 'yes'
diff --git a/lib/ansible/modules/set_fact.py b/lib/ansible/modules/set_fact.py
index 5609e5bc..5cb1f7d7 100644
--- a/lib/ansible/modules/set_fact.py
+++ b/lib/ansible/modules/set_fact.py
@@ -15,7 +15,7 @@ version_added: "1.2"
 description:
     - This action allows setting variables associated to the current host.
     - These variables will be available to subsequent plays during an ansible-playbook run via the host they were set on.
-    - Set C(cacheable) to C(yes) to save variables across executions using a fact cache.
+    - Set C(cacheable) to C(true) to save variables across executions using a fact cache.
       Variables will keep the set_fact precedence for the current run, but will used 'cached fact' precedence for subsequent ones.
     - Per the standard Ansible variable precedence rules, other types of variables have a higher priority, so this value may be overridden.
 options:
diff --git a/lib/ansible/modules/set_stats.py b/lib/ansible/modules/set_stats.py
index 2fd21da1..16d7bfef 100644
--- a/lib/ansible/modules/set_stats.py
+++ b/lib/ansible/modules/set_stats.py
@@ -28,7 +28,7 @@ options:
     default: no
   aggregate:
     description:
-        - Whether the provided value is aggregated to the existing stat C(yes) or will replace it C(no).
+        - Whether the provided value is aggregated to the existing stat C(true) or will replace it C(false).
     type: bool
     default: yes
 extends_documentation_fragment:
@@ -55,7 +55,7 @@ attributes:
         support: none
 notes:
     - In order for custom stats to be displayed, you must set C(show_custom_stats) in section C([defaults]) in C(ansible.cfg)
-      or by defining environment variable C(ANSIBLE_SHOW_CUSTOM_STATS) to C(yes). See the C(default) callback plugin for details.
+      or by defining environment variable C(ANSIBLE_SHOW_CUSTOM_STATS) to C(true). See the C(default) callback plugin for details.
 version_added: "2.3"
 '''
 
diff --git a/lib/ansible/modules/stat.py b/lib/ansible/modules/stat.py
index 918b588f..45ca78b2 100644
--- a/lib/ansible/modules/stat.py
+++ b/lib/ansible/modules/stat.py
@@ -48,7 +48,7 @@ options:
       - Use file magic and return data about the nature of the file. this uses
         the 'file' utility found on most Linux/Unix systems.
       - This will add both C(mime_type) and C(charset) fields to the return, if possible.
-      - In Ansible 2.3 this option changed from I(mime) to I(get_mime) and the default changed to C(yes).
+      - In Ansible 2.3 this option changed from I(mime) to I(get_mime) and the default changed to C(true).
     type: bool
     default: yes
     aliases: [ mime, mime_type, mime-type ]
diff --git a/lib/ansible/modules/subversion.py b/lib/ansible/modules/subversion.py
index a63de3c5..68aacfd2 100644
--- a/lib/ansible/modules/subversion.py
+++ b/lib/ansible/modules/subversion.py
@@ -36,8 +36,8 @@ options:
     aliases: [ rev, version ]
   force:
     description:
-      - If C(yes), modified files will be discarded. If C(no), module will fail if it encounters modified files.
-        Prior to 1.9 the default was C(yes).
+      - If C(true), modified files will be discarded. If C(false), module will fail if it encounters modified files.
+        Prior to 1.9 the default was C(true).
     type: bool
     default: "no"
   in_place:
@@ -65,32 +65,32 @@ options:
     version_added: "1.4"
   checkout:
     description:
-     - If C(no), do not check out the repository if it does not exist locally.
+     - If C(false), do not check out the repository if it does not exist locally.
     type: bool
     default: "yes"
     version_added: "2.3"
   update:
     description:
-     - If C(no), do not retrieve new revisions from the origin repository.
+     - If C(false), do not retrieve new revisions from the origin repository.
     type: bool
     default: "yes"
     version_added: "2.3"
   export:
     description:
-      - If C(yes), do export instead of checkout/update.
+      - If C(true), do export instead of checkout/update.
     type: bool
     default: "no"
     version_added: "1.6"
   switch:
     description:
-      - If C(no), do not call svn switch before update.
+      - If C(false), do not call svn switch before update.
     default: "yes"
     version_added: "2.0"
     type: bool
   validate_certs:
     description:
-      - If C(no), passes the C(--trust-server-cert) flag to svn.
-      - If C(yes), does not pass the flag.
+      - If C(false), passes the C(--trust-server-cert) flag to svn.
+      - If C(true), does not pass the flag.
     default: "no"
     version_added: "2.11"
     type: bool
diff --git a/lib/ansible/modules/template.py b/lib/ansible/modules/template.py
index faff7aa9..7ee581ad 100644
--- a/lib/ansible/modules/template.py
+++ b/lib/ansible/modules/template.py
@@ -18,9 +18,9 @@ options:
   follow:
     description:
     - Determine whether symbolic links should be followed.
-    - When set to C(yes) symbolic links will be followed, if they exist.
-    - When set to C(no) symbolic links will not be followed.
-    - Previous to Ansible 2.4, this was hardcoded as C(yes).
+    - When set to C(true) symbolic links will be followed, if they exist.
+    - When set to C(false) symbolic links will not be followed.
+    - Previous to Ansible 2.4, this was hardcoded as C(true).
     type: bool
     default: no
     version_added: '2.4'
diff --git a/lib/ansible/modules/unarchive.py b/lib/ansible/modules/unarchive.py
index 69e769d0..26890b50 100644
--- a/lib/ansible/modules/unarchive.py
+++ b/lib/ansible/modules/unarchive.py
@@ -96,7 +96,7 @@ options:
     version_added: "2.1"
   remote_src:
     description:
-      - Set to C(yes) to indicate the archived file is already on the remote system and not local to the Ansible controller.
+      - Set to C(true) to indicate the archived file is already on the remote system and not local to the Ansible controller.
       - This option is mutually exclusive with C(copy).
     type: bool
     default: no
@@ -104,8 +104,8 @@ options:
   validate_certs:
     description:
       - This only applies if using a https URL as the source of the file.
-      - This should only set to C(no) used on personally controlled sites using self-signed certificate.
-      - Prior to 2.2 the code worked as if this was set to C(yes).
+      - This should only set to C(false) used on personally controlled sites using self-signed certificate.
+      - Prior to 2.2 the code worked as if this was set to C(true).
     type: bool
     default: yes
     version_added: "2.2"
diff --git a/lib/ansible/modules/uri.py b/lib/ansible/modules/uri.py
index e67f90a4..958aefc9 100644
--- a/lib/ansible/modules/uri.py
+++ b/lib/ansible/modules/uri.py
@@ -104,8 +104,8 @@ options:
       - Whether or not the URI module should follow redirects. C(all) will follow all redirects.
         C(safe) will follow only "safe" redirects, where "safe" means that the client is only
         doing a GET or HEAD on the URI to which it is being redirected. C(none) will not follow
-        any redirects. Note that C(yes) and C(no) choices are accepted for backwards compatibility,
-        where C(yes) is the equivalent of C(all) and C(no) is the equivalent of C(safe). C(yes) and C(no)
+        any redirects. Note that C(true) and C(false) choices are accepted for backwards compatibility,
+        where C(true) is the equivalent of C(all) and C(false) is the equivalent of C(safe). C(true) and C(false)
         are deprecated and will be removed in some future version of Ansible.
     type: str
     choices: ['all', 'no', 'none', 'safe', 'urllib2', 'yes']
@@ -138,9 +138,9 @@ options:
     version_added: '2.1'
   validate_certs:
     description:
-      - If C(no), SSL certificates will not be validated.
-      - This should only set to C(no) used on personally controlled sites using self-signed certificates.
-      - Prior to 1.9.2 the code defaulted to C(no).
+      - If C(false), SSL certificates will not be validated.
+      - This should only set to C(false) used on personally controlled sites using self-signed certificates.
+      - Prior to 1.9.2 the code defaulted to C(false).
     type: bool
     default: yes
     version_added: '1.9.2'
@@ -170,19 +170,19 @@ options:
     version_added: '2.7'
   remote_src:
     description:
-      - If C(no), the module will search for the C(src) on the controller node.
-      - If C(yes), the module will search for the C(src) on the managed (remote) node.
+      - If C(false), the module will search for the C(src) on the controller node.
+      - If C(true), the module will search for the C(src) on the managed (remote) node.
     type: bool
     default: no
     version_added: '2.7'
   force:
     description:
-      - If C(yes) do not get a cached copy.
+      - If C(true) do not get a cached copy.
     type: bool
     default: no
   use_proxy:
     description:
-      - If C(no), it will not use a proxy, even if one is defined in an environment variable on the target hosts.
+      - If C(false), it will not use a proxy, even if one is defined in an environment variable on the target hosts.
     type: bool
     default: yes
   unix_socket:
diff --git a/lib/ansible/modules/user.py b/lib/ansible/modules/user.py
index 9ad76a90..cb35e950 100644
--- a/lib/ansible/modules/user.py
+++ b/lib/ansible/modules/user.py
@@ -32,7 +32,7 @@ options:
     hidden:
         description:
             - macOS only, optionally hide the user from the login window and system preferences.
-            - The default will be C(yes) if the I(system) option is used.
+            - The default will be C(true) if the I(system) option is used.
         type: bool
         version_added: "2.6"
     non_unique:
@@ -61,8 +61,8 @@ options:
         elements: str
     append:
         description:
-            - If C(yes), add the user to the groups specified in C(groups).
-            - If C(no), user will only be added to the groups specified in C(groups),
+            - If C(true), add the user to the groups specified in C(groups).
+            - If C(false), user will only be added to the groups specified in C(groups),
               removing them from all other groups.
         type: bool
         default: no
@@ -101,7 +101,7 @@ options:
         default: present
     create_home:
         description:
-            - Unless set to C(no), a home directory will be made for the user
+            - Unless set to C(false), a home directory will be made for the user
               when the account is created or if the home directory does not exist.
             - Changed from C(createhome) to C(create_home) in Ansible 2.5.
         type: bool
@@ -109,13 +109,13 @@ options:
         aliases: [ createhome ]
     move_home:
         description:
-            - "If set to C(yes) when used with C(home: ), attempt to move the user's old home
+            - "If set to C(true) when used with C(home: ), attempt to move the user's old home
               directory to the specified directory if it isn't there already and the old home exists."
         type: bool
         default: no
     system:
         description:
-            - When creating an account C(state=present), setting this to C(yes) makes the user a system account.
+            - When creating an account C(state=present), setting this to C(true) makes the user a system account.
             - This setting cannot be changed on existing users.
         type: bool
         default: no
diff --git a/lib/ansible/modules/yum.py b/lib/ansible/modules/yum.py
index cce8f4cb..040ee272 100644
--- a/lib/ansible/modules/yum.py
+++ b/lib/ansible/modules/yum.py
@@ -112,16 +112,16 @@ options:
     version_added: "1.9"
   validate_certs:
     description:
-      - This only applies if using a https url as the source of the rpm. e.g. for localinstall. If set to C(no), the SSL certificates will not be validated.
-      - This should only set to C(no) used on personally controlled sites using self-signed certificates as it avoids verifying the source site.
-      - Prior to 2.1 the code worked as if this was set to C(yes).
+      - This only applies if using a https url as the source of the rpm. e.g. for localinstall. If set to C(false), the SSL certificates will not be validated.
+      - This should only set to C(false) used on personally controlled sites using self-signed certificates as it avoids verifying the source site.
+      - Prior to 2.1 the code worked as if this was set to C(true).
     type: bool
     default: "yes"
     version_added: "2.1"
   sslverify:
     description:
       - Disables SSL validation of the repository server for this transaction.
-      - This should be set to C(no) if one of the configured repositories is using an untrusted or self-signed certificate.
+      - This should be set to C(false) if one of the configured repositories is using an untrusted or self-signed certificate.
     type: bool
     default: "yes"
     version_added: "2.13"
@@ -142,13 +142,13 @@ options:
     version_added: "2.3"
   security:
     description:
-      - If set to C(yes), and C(state=latest) then only installs updates that have been marked security related.
+      - If set to C(true), and C(state=latest) then only installs updates that have been marked security related.
     type: bool
     default: "no"
     version_added: "2.4"
   bugfix:
     description:
-      - If set to C(yes), and C(state=latest) then only installs updates that have been marked bugfix related.
+      - If set to C(true), and C(state=latest) then only installs updates that have been marked bugfix related.
     default: "no"
     type: bool
     version_added: "2.6"
@@ -187,7 +187,7 @@ options:
     version_added: "2.7"
   autoremove:
     description:
-      - If C(yes), removes all "leaf" packages from the system that were originally
+      - If C(true), removes all "leaf" packages from the system that were originally
         installed as dependencies of user-installed packages but which are no longer
         required by any such package. Should be used alone or when state is I(absent)
       - "NOTE: This feature requires yum >= 3.4.3 (RHEL/CentOS 7+)"
diff --git a/lib/ansible/modules/yum_repository.py b/lib/ansible/modules/yum_repository.py
index 52e176d9..84a10b92 100644
--- a/lib/ansible/modules/yum_repository.py
+++ b/lib/ansible/modules/yum_repository.py
@@ -21,7 +21,7 @@ description:
 options:
   async:
     description:
-      - If set to C(yes) Yum will download packages and metadata from this
+      - If set to C(true) Yum will download packages and metadata from this
         repo in parallel, if possible.
       - In ansible-core 2.11, 2.12, and 2.13 the default value is C(true).
       - This option has been deprecated in RHEL 8. If you're using one of the
@@ -117,7 +117,7 @@ options:
       - Tells yum whether or not it should perform a GPG signature check on
         packages.
       - No default setting. If the value is not set, the system setting from
-        C(/etc/yum.conf) or system default of C(no) will be used.
+        C(/etc/yum.conf) or system default of C(false) will be used.
     type: bool
   gpgkey:
     description:
@@ -289,7 +289,7 @@ options:
     default: 'no'
   skip_if_unavailable:
     description:
-      - If set to C(yes) yum will continue running if this repository cannot be
+      - If set to C(true) yum will continue running if this repository cannot be
         contacted for any reason. This should be set carefully as all repos are
         consulted for any given command.
     type: bool
@@ -299,7 +299,7 @@ options:
       - Whether yum should check the permissions on the paths for the
         certificates on the repository (both remote and local).
       - If we can't read any of the files then yum will force
-        I(skip_if_unavailable) to be C(yes). This is most useful for non-root
+        I(skip_if_unavailable) to be C(true). This is most useful for non-root
         processes which use yum on repos that have client cert files which are
         readable only by root.
     type: bool
diff --git a/lib/ansible/playbook/task.py b/lib/ansible/playbook/task.py
index 50ac5df7..6a9136d2 100644
--- a/lib/ansible/playbook/task.py
+++ b/lib/ansible/playbook/task.py
@@ -244,7 +244,7 @@ class Task(Base, Conditional, Taggable, CollectionSearch):
             elif k.startswith('with_') and k.removeprefix("with_") in lookup_loader:
                 # transform into loop property
                 self._preprocess_with_loop(ds, new_ds, k, v)
-            elif C.INVALID_TASK_ATTRIBUTE_FAILED or k in self._valid_attrs:
+            elif C.INVALID_TASK_ATTRIBUTE_FAILED or k in self.fattributes:
                 new_ds[k] = v
             else:
                 display.warning("Ignoring invalid attribute: %s" % k)
diff --git a/lib/ansible/plugins/action/__init__.py b/lib/ansible/plugins/action/__init__.py
index 7db61378..d199207c 100644
--- a/lib/ansible/plugins/action/__init__.py
+++ b/lib/ansible/plugins/action/__init__.py
@@ -674,7 +674,7 @@ class ActionBase(ABC):
             res = self._remote_chmod(remote_paths, 'u+x')
             if res['rc'] != 0:
                 raise AnsibleError(
-                    'Failed to set file mode on remote temporary files '
+                    'Failed to set file mode or acl on remote temporary files '
                     '(rc: {0}, err: {1})'.format(
                         res['rc'],
                         to_native(res['stderr'])))
@@ -689,9 +689,9 @@ class ActionBase(ABC):
         if remote_user in self._get_admin_users():
             raise AnsibleError(
                 'Failed to change ownership of the temporary files Ansible '
-                'needs to create despite connecting as a privileged user. '
-                'Unprivileged become user would be unable to read the '
-                'file.')
+                '(via chmod nor setfacl) needs to create despite connecting as a '
+                'privileged user. Unprivileged become user would be unable to read'
+                ' the file.')
 
         # Step 3d: Try macOS's special chmod + ACL
         # macOS chmod's +a flag takes its own argument. As a slight hack, we
diff --git a/lib/ansible/plugins/doc_fragments/action_common_attributes.py b/lib/ansible/plugins/doc_fragments/action_common_attributes.py
index e9579974..c135df5e 100644
--- a/lib/ansible/plugins/doc_fragments/action_common_attributes.py
+++ b/lib/ansible/plugins/doc_fragments/action_common_attributes.py
@@ -46,7 +46,7 @@ attributes:
     FILES = r'''
 attributes:
     safe_file_operations:
-      description: Uses Ansbile's strict file operation functions to ensure proper permissions and avoid data corruption
+      description: Uses Ansible's strict file operation functions to ensure proper permissions and avoid data corruption
     vault:
       description: Can automatically decrypt Ansible vaulted files
 '''
diff --git a/lib/ansible/plugins/doc_fragments/action_core.py b/lib/ansible/plugins/doc_fragments/action_core.py
index 9968fef6..931ca14e 100644
--- a/lib/ansible/plugins/doc_fragments/action_core.py
+++ b/lib/ansible/plugins/doc_fragments/action_core.py
@@ -5,7 +5,7 @@ from __future__ import (absolute_import, division, print_function)
 __metaclass__ = type
 
 
-# WARNING: this is mostly here as a convinence for documenting core behaviours, no plugin outside of ansbile-core should use this file
+# WARNING: this is mostly here as a convinence for documenting core behaviours, no plugin outside of ansible-core should use this file
 class ModuleDocFragment(object):
 
     # requires action_common
diff --git a/lib/ansible/plugins/filter/b64decode.yml b/lib/ansible/plugins/filter/b64decode.yml
index 6edf4abf..30565fa9 100644
--- a/lib/ansible/plugins/filter/b64decode.yml
+++ b/lib/ansible/plugins/filter/b64decode.yml
@@ -5,6 +5,10 @@ DOCUMENTATION:
   short_description: Decode a base64 string
   description:
     - Base64 decoding function.
+    - The return value is a string.
+    - Trying to store a binary blob in a string most likely corrupts the binary. To base64 decode a binary blob,
+      use the ``base64`` command  and pipe the encoded data through standard input. 
+      For example, in the ansible.builtin.shell`` module, ``cmd="base64 --decode > myfile.bin" stdin="{{ encoded }}"``.
   positional: _input
   options:
     _input:
diff --git a/lib/ansible/plugins/lookup/fileglob.py b/lib/ansible/plugins/lookup/fileglob.py
index b1ee05a2..abf8202e 100644
--- a/lib/ansible/plugins/lookup/fileglob.py
+++ b/lib/ansible/plugins/lookup/fileglob.py
@@ -18,6 +18,7 @@ DOCUMENTATION = """
         required: True
     notes:
       - Patterns are only supported on files, not directory/paths.
+      - See R(Ansible task paths,playbook_task_paths) to understand how file lookup occurs with paths.
       - Matching is against local system files on the Ansible controller.
         To iterate a list of files on a remote node, use the M(ansible.builtin.find) module.
       - Returns a string list of paths joined by commas, or an empty list if no files match. For a 'true list' pass C(wantlist=True) to the lookup.
diff --git a/lib/ansible/release.py b/lib/ansible/release.py
index 1562b704..a38538f5 100644
--- a/lib/ansible/release.py
+++ b/lib/ansible/release.py
@@ -19,6 +19,6 @@
 from __future__ import (absolute_import, division, print_function)
 __metaclass__ = type
 
-__version__ = '2.14.0'
+__version__ = '2.14.1'
 __author__ = 'Ansible, Inc.'
 __codename__ = "C'mon Everybody"
diff --git a/lib/ansible/template/native_helpers.py b/lib/ansible/template/native_helpers.py
index b6fc37b5..343e10c7 100644
--- a/lib/ansible/template/native_helpers.py
+++ b/lib/ansible/template/native_helpers.py
@@ -128,7 +128,7 @@ def ansible_native_concat(nodes):
         out = ''.join([to_text(v) for v in nodes])
 
     try:
-        return ast.literal_eval(
+        evaled = ast.literal_eval(
             # In Python 3.10+ ast.literal_eval removes leading spaces/tabs
             # from the given string. For backwards compatibility we need to
             # parse the string ourselves without removing leading spaces/tabs.
@@ -136,3 +136,9 @@ def ansible_native_concat(nodes):
         )
     except (ValueError, SyntaxError, MemoryError):
         return out
+
+    if isinstance(evaled, string_types):
+        quote = out[0]
+        return f'{quote}{evaled}{quote}'
+
+    return evaled
diff --git a/lib/ansible/utils/display.py b/lib/ansible/utils/display.py
index c3a5de98..e521f2a4 100644
--- a/lib/ansible/utils/display.py
+++ b/lib/ansible/utils/display.py
@@ -41,6 +41,7 @@ from ansible.utils.color import stringc
 from ansible.utils.multiprocessing import context as multiprocessing_context
 from ansible.utils.singleton import Singleton
 from ansible.utils.unsafe_proxy import wrap_var
+from functools import wraps
 
 
 _LIBC = ctypes.cdll.LoadLibrary(ctypes.util.find_library('c'))
@@ -163,12 +164,33 @@ b_COW_PATHS = (
 )
 
 
+def _synchronize_textiowrapper(tio, lock):
+    # Ensure that a background thread can't hold the internal buffer lock on a file object
+    # during a fork, which causes forked children to hang. We're using display's existing lock for
+    # convenience (and entering the lock before a fork).
+    def _wrap_with_lock(f, lock):
+        @wraps(f)
+        def locking_wrapper(*args, **kwargs):
+            with lock:
+                return f(*args, **kwargs)
+
+        return locking_wrapper
+
+    buffer = tio.buffer
+
+    # monkeypatching the underlying file-like object isn't great, but likely safer than subclassing
+    buffer.write = _wrap_with_lock(buffer.write, lock)
+    buffer.flush = _wrap_with_lock(buffer.flush, lock)
+
+
 class Display(metaclass=Singleton):
 
     def __init__(self, verbosity=0):
 
         self._final_q = None
 
+        # NB: this lock is used to both prevent intermingled output between threads and to block writes during forks.
+        # Do not change the type of this lock or upgrade to a shared lock (eg multiprocessing.RLock).
         self._lock = threading.RLock()
 
         self.columns = None
@@ -199,6 +221,13 @@ class Display(metaclass=Singleton):
 
         self._set_column_width()
 
+        try:
+            # NB: we're relying on the display singleton behavior to ensure this only runs once
+            _synchronize_textiowrapper(sys.stdout, self._lock)
+            _synchronize_textiowrapper(sys.stderr, self._lock)
+        except Exception as ex:
+            self.warning(f"failed to patch stdout/stderr for fork-safety: {ex}")
+
     def set_queue(self, queue):
         """Set the _final_q on Display, so that we know to proxy display over the queue
         instead of directly writing to stdout/stderr from forks
diff --git a/lib/ansible_core.egg-info/PKG-INFO b/lib/ansible_core.egg-info/PKG-INFO
index 7ecd0088..373b0ae4 100644
--- a/lib/ansible_core.egg-info/PKG-INFO
+++ b/lib/ansible_core.egg-info/PKG-INFO
@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: ansible-core
-Version: 2.14.0
+Version: 2.14.1
 Summary: Radically simple IT automation
 Home-page: https://ansible.com/
 Author: Ansible, Inc.
diff --git a/lib/ansible_core.egg-info/SOURCES.txt b/lib/ansible_core.egg-info/SOURCES.txt
index 0a4290ed..e97472c7 100644
--- a/lib/ansible_core.egg-info/SOURCES.txt
+++ b/lib/ansible_core.egg-info/SOURCES.txt
@@ -39,6 +39,7 @@ docs/docsite/ansible_5.inv
 docs/docsite/ansible_6.inv
 docs/docsite/collection-plugins.yml
 docs/docsite/jinja2.inv
+docs/docsite/known_good_reqs.txt
 docs/docsite/modules.js
 docs/docsite/python2.inv
 docs/docsite/python3.inv
@@ -2283,6 +2284,7 @@ test/integration/targets/copy/tasks/no_log.yml
 test/integration/targets/copy/tasks/selinux.yml
 test/integration/targets/copy/tasks/src_file_dest_file_in_non_existent_dir.yml
 test/integration/targets/copy/tasks/src_file_dest_file_in_non_existent_dir_remote_src.yml
+test/integration/targets/copy/tasks/src_remote_file_is_not_file.yml
 test/integration/targets/copy/tasks/tests.yml
 test/integration/targets/cron/aliases
 test/integration/targets/cron/defaults/main.yml
@@ -2468,6 +2470,13 @@ test/integration/targets/find/files/a.txt
 test/integration/targets/find/files/log.txt
 test/integration/targets/find/meta/main.yml
 test/integration/targets/find/tasks/main.yml
+test/integration/targets/fork_safe_stdio/aliases
+test/integration/targets/fork_safe_stdio/hosts
+test/integration/targets/fork_safe_stdio/run-with-pty.py
+test/integration/targets/fork_safe_stdio/runme.sh
+test/integration/targets/fork_safe_stdio/test.yml
+test/integration/targets/fork_safe_stdio/vendored_pty.py
+test/integration/targets/fork_safe_stdio/callback_plugins/spewstdio.py
 test/integration/targets/gathering/aliases
 test/integration/targets/gathering/explicit.yml
 test/integration/targets/gathering/implicit.yml
@@ -3027,6 +3036,7 @@ test/integration/targets/jinja2_native_types/test_concatentation.yml
 test/integration/targets/jinja2_native_types/test_dunder.yml
 test/integration/targets/jinja2_native_types/test_hostvars.yml
 test/integration/targets/jinja2_native_types/test_none.yml
+test/integration/targets/jinja2_native_types/test_preserving_quotes.yml
 test/integration/targets/jinja2_native_types/test_template.yml
 test/integration/targets/jinja2_native_types/test_template_newlines.j2
 test/integration/targets/jinja2_native_types/test_types.yml