bugfixes:
- ec2_asg - no longer terminates an instance before creating a replacement (https://github.com/ansible/ansible/pull/36679)
- ec2_group - security groups in default VPCs now have a default egress rule (https://github.com/ansible/ansible/pull/38018)
- inventory correctly removes hosts from 'ungrouped' group (https://github.com/ansible/ansible/pull/37617)
- letsencrypt - fixed domain matching authorization (https://github.com/ansible/ansible/pull/37558)
- letsencrypt - improved elliptic curve account key parsing (https://github.com/ansible/ansible/pull/37275)
- facts are no longer processed more than once for each action (https://github.com/ansible/ansible/issues/37535)
- cs_vpc_offering - only return VPC offferings matching name arg (https://github.com/ansible/ansible/pull/37783)
- cs_configuration - filter names inside the module instead of relying on API (https://github.com/ansible/ansible/pull/37910)
- various fixes to networking module connection subsystem (https://github.com/ansible/ansible/pull/37529)
- ios_* - fixed netconf issues (https://github.com/ansible/ansible/pull/38155)
- ovirt_* - various bugfixes (https://github.com/ansible/ansible/pull/38341)
- ansible-vault no longer requires '--encrypt-vault-id' with edit (https://github.com/ansible/ansible/pull/35923)
- k8s lookup plugin now uses same auth method as other k8s modules (https://github.com/ansible/ansible/pull/37533)
- ansible-inventory now properly displays group_var graph (https://github.com/ansible/ansible/pull/38744)
- setup - FreeBSD fact gathering no longer fails on missing dmesg, sysctl, etc (https://github.com/ansible/ansible/pull/37194)
- inventory scripts now read passwords without byte interpolation (https://github.com/ansible/ansible/pull/35582)
- user - fixed password expiration support in FreeBSD
- meta - inventory_refresh now works properly on YAML inventory plugins (https://github.com/ansible/ansible/pull/38242)
- foreman callback plugin - fixed API options (https://github.com/ansible/ansible/pull/38138)