* SECURITY UPDATE: tarfile.data_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory, so tarfile.extractall() could write files outside the destination directory. - debian/patches/CVE-2026-7774.patch: backport of cpython c063191c (gh-149486, [3.10] branch). data_filter now validates the normalised linkname that is actually written to disk, strips trailing separators from a symlink member's name before resolving its directory, and rejects link members that resolve to the destination directory itself. - CVE-2026-7774 * debian/patches/CVE-2026-8328.patch: register the TestFtpcpSecurity test class in test_ftplib's test_main so regrtest actually runs it (fixes an omission in the original backport; no functional change to the CVE fix itself).