- CVE-2026-87910: honour a None result from the extraction filter on tarfile's hard-link fallback path. makelink_with_filter() discarded the result of the CVE-2026-11940 re-validation call and acted only on its exceptions, so a PEP 706 custom filter that skips a member by returning None was ignored and the member was extracted anyway, under the link's name. Carries upstream's test_extract_filters_target_none. The guard being repaired is native to upstream 3.11.16, not a patch of ours - CVE-2026-19672: normalise a tarfile member name containing ".." before the containment check in _get_filtered_attrs(). The "tar" and "data" filters validated the resolved path, which stays inside the destination for a name such as "../evil/../dest/sub/file", while the intermediate directories were created from the name as given and landed outside it. POSIX only. Carries upstream's test_parent_dir_out_and_back. Backported from upstream commit 97688346ada2 (gh-155999). Upstream has this on 3.12+ only; the 3.11 backport pull request is still open