- CVE-2026-87910: honour a None result from the extraction filter on tarfile's hard-link fallback. The CVE-2026-11940 guard re-runs the filter on the link target re-rooted at the link's own name, but discarded the result and overwrote it on the next line, so a custom filter returning None ("skip this member") was ignored and the member was extracted at the shallower name the filter had declined. The bundled "data" and "tar" filters raise rather than return None, so only custom filters are affected. Carries upstream's test_extract_filters_target_none. Must stay ordered after CVE-2026-11940.patch, which supplies the re-rooted call - CVE-2026-19672: normalize a member name that leaves the destination and comes back ("../evil/../dest/sub/file") before tarfile's "tar"/"data" filters check containment. The check used the resolved path, which lands back inside, while the intermediate directories were created from the name as given, so a directory appeared outside the extraction root. Backport of cpython 97688346ada2df3e5b9c279348862c3d64ab0823 (gh-155999). Names containing ".." are now normalized with os.path.normpath(), which may change the meaning of a name that traverses symbolic links. Carries upstream's test_parent_dir_out_and_back. Applies to this package only because CVE-2007-4559.patch backports the PEP 706 filters, so it must stay ordered after that patch