* SECURITY UPDATE: change of permissions and modification time of a file outside the destination via a tar hard link to a symlink - debian/patches/CVE-2026-82049.patch: resolve the target of a hard link member with os.path.realpath() in TarFile.makelink() in Lib/tarfile.py, so the extracted hard link points to the file itself instead of duplicating a symlink whose relative target escapes the destination directory; make both link calls inside the upstream AttributeError/NotImplementedError/OSError envelope, so a link refused by the system (e.g. link(2) on a directory) falls back to extracting the linked member instead of aborting the extraction - CVE-2026-82049 * SECURITY UPDATE: tar extraction filter bypass via a hard link to a symlink stored at a deeper name - debian/patches/CVE-2026-11940.patch: pass the member that a hard link falls back to extracting through the extraction filter, under its own name and under the link's name, in TarFile.makelink_with_filter() in Lib/tarfile.py, and raise LinkFallbackError when the filter rejects it, so a symlink validated at its deeper archived name can no longer be recreated at the link's shallower path outside the destination; skip that member when the filter returns None for it under the link's name instead of extracting it anyway - CVE-2026-11940 * debian/rules: run test_tarfile verbosely in the check target, so the result of each tarfile test appears in the build log