* SECURITY UPDATE: tarfile.data_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory, so tarfile.extractall() could write files outside the destination directory. - debian/patches/CVE-2026-7774.patch: backport of cpython c063191c (gh-149486, 3.10 branch). The 'data' filter now validates the normalized linkname that is actually written to disk, strips trailing separators from the member name when resolving the directory a symlink target is relative to, and rejects link members whose name resolves to the destination directory itself. - CVE-2026-7774 * debian/patches/CVE-2026-8328.patch: register the TestFtpcpSecurity test class in test_ftplib's test_main so regrtest actually runs it (fixes an omission in the original backport; no functional change to the CVE fix itself).