* SECURITY UPDATE: tarfile ignored a None result from the extraction filter on the link fallback path - debian/patches/CVE-2026-87910.patch: keep the result of the first filter_function() call in TarFile.makelink_with_filter() and return early when it is None, so a filter that skips a member by returning None is honoured when link extraction falls back to copying the target under the link's own, shallower name instead of the member being extracted anyway (CWE-22). - CVE-2026-87910 * SECURITY UPDATE: tarfile tar/data filters created directories outside the destination - debian/patches/CVE-2026-19672.patch: collapse ".." components with os.path.normpath() in _get_filtered_attrs() before the containment check, so a member whose name leaves the destination and comes back, such as "../evil/../dest/sub/file", no longer creates the intermediate directories outside it. The containment check looked at the resolved path, which stayed inside, while the directories were created from the name as given (CWE-22). Backport of upstream commit 97688346ada2. - Behaviour change: the "tar" and "data" filters now rewrite such names with os.path.normpath(), which removes internal ".." components and so may change the meaning of a name that traverses symbolic links. - CVE-2026-19672