* SECURITY UPDATE: the tarfile extraction filters ('data' and 'tar') could be bypassed by a crafted archive whose hardlink references a symlink stored at a deeper name than the hardlink itself. The hardlink-extraction fallback validated the symlink at its archived location but recreated it at the hardlink's shallower path, so a relative target could escape the destination directory. Incomplete fix of CVE-2025-4330. - debian/patches/CVE-2026-11940.patch: backport of cpython be13e86f (gh-151558, 3.11 branch). makelink_with_filter now re-runs the filter on the member re-rooted at the link's own path before using the fallback, so an escaping target is rejected with LinkFallbackError. - CVE-2026-11940 * SECURITY UPDATE: configparser wrote multi-line values containing carriage return characters without escaping them, so a value under attacker control could inject unexpected keys, values and sections into the written configuration file. - debian/patches/CVE-2026-0864.patch: backport of cpython 5858e42c (gh-143927). RawConfigParser.write() now normalizes all line endings (CR, CRLF and LF) to "\n\t". - CVE-2026-0864 * SECURITY UPDATE: tarfile did not handle EOF in _Stream.seek() for files opened in streaming mode ("r|"), so a small forged archive whose member header declares a huge size made archive parsing loop once per declared block against an already-exhausted stream, causing a CPU denial of service. - debian/patches/CVE-2026-11972.patch: backport of cpython f50bf135 (gh-151981). The block loop in _Stream.seek() now breaks when read() returns no data, so parsing fails fast with ReadError instead of spinning. - CVE-2026-11972 * SECURITY UPDATE: TarFile.extract() did not pass the extraction filter down to _extract_one(), so on the single-member extract() path the hardlink/symlink extraction fallback recreated the link target without applying the filter: attacker-controlled mode, uid and gid were applied verbatim even with filter='data', and the CVE-2025-4330/CVE-2026-11940 fallback checks never ran there. - debian/patches/CVE-2026-4360.patch: backport of cpython 7ccdbaba (gh-151987, Petr Viktorin). extract() now forwards filter_function to _extract_one(). Adapted to 3.8: fix hunk identical to upstream; the regression tests' parenthesized multi-item "with" blocks are rewritten as backslash-continued statements (3.8 syntax). - CVE-2026-4360