* SECURITY UPDATE: tarfile data/tar extraction filter bypassed by a hard link whose target is a symlink - debian/patches/CVE-2026-82049.patch: pass os.path.realpath() of the hard-link source to os.link() in makelink_with_filter(), so the extracted name is a hard link to the file the symlink resolves to instead of a second name for the symlink inode itself. link(2) does not follow symlinks, so without this a crafted archive could place a copy of an already-extracted symlink one directory shallower, where its relative payload re-bases outside the destination directory and the chmod/utime that follow change the mode and mtime of the outside file while exposing its contents inside the extracted tree (CWE-59). Also carries upstream's test_sneaky_hardlink_relocation regression test. This fix is effective only in combination with CVE-2026-11940, which is already part of upstream 3.11.16 and blocks the variant that never reaches os.link() - CVE-2026-82049