- CVE-2026-7774: tarfile: make data_filter validate the normalised link target that is actually written to disk, strip trailing separators from a symlink member's name before resolving its directory, and reject link members that resolve to the destination directory itself, closing path-traversal bypasses of the 'data' extraction filter via crafted link entries (symlinks with empty or directory-like names) - Register TestFtpcpSecurity (CVE-2026-8328) in test_ftplib's test_main so regrtest actually runs the test (fixes an omission in the original backport; no functional change to the CVE fix itself)