* SECURITY UPDATE: tarfile.data_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory, so tarfile.extractall() could write files outside the destination directory. - debian/patches/CVE-2026-7774.patch: backport of cpython c063191c ([3.10] branch variant of 57841198, gh-149486). data_filter now validates the normalised link target that is actually written to disk, resolves a symlink's target relative to its member name with trailing separators stripped, and rejects link members that would replace the destination directory itself. - CVE-2026-7774 * SECURITY UPDATE: ftplib.ftpcp() still called parse227() directly and passed the source server's self-reported PASV IPv4 address to the target server's PORT command, so a malicious source FTP server could redirect the target's data connection to an arbitrary host:port (SSRF); the CVE-2021-4189 fix only covered FTP.makepasv(). - debian/patches/CVE-2026-8328.patch: backport of cpython eac4fe3b (gh-87451). ftpcp() now uses the source server's actual peer address unless trust_server_pasv_ipv4_address is set, the same rule FTP.makepasv() already applies. - CVE-2026-8328