- SECURITY UPDATE: tarfile: honor a None result from the link-fallback filter call (CVE-2026-87910). When a hard link cannot be created, tarfile extracts the target member under the link's name and runs the filter on that renamed member first; a None result (skip this member) from that call was discarded, so a filter that refused the name was overridden and the member extracted anyway. That result is now honored before the second filter call. - SECURITY UPDATE: tarfile: normalize member names that leave the destination and come back (CVE-2026-19672, upstream commit 97688346). The tar and data filters checked containment on the resolved path, but directories are created from the name as given, so a name like '../evil/../dest/sub/file' passed the check while creating '../evil' outside the destination. Such names are now normalized before the check, so the directories created are the ones that were validated. Normalization drops internal '..' components and may change the meaning of a name that traverses symbolic links.