* SECURITY UPDATE: tarfile PEP 706 "data"/"tar" extraction filter bypass via a hard link to a symlink. A crafted archive whose hard link names a symlink stored deeper in the archive made makelink_with_filter() call os.link() on the unresolved source; link(2) does not follow symlinks, so the extracted member became the same symlink inode under the hard link's own, shallower name, where its relative payload re-bases outside the destination. The chmod()/utime() that tarfile applies next then hit the outside file, changing its mode and mtime, and its contents became readable from inside the extracted tree (CWE-59). - debian/patches/CVE-2026-82049.patch: backport of cpython b8f23e307097552eaea2604383a12ab280520d0d (gh-157190, GH-157191, GH-157192), the 3.13-branch form of the fix; the changed line and its comment are upstream's verbatim, only re-anchored because this tree has no "unlink an existing targetpath" step before os.link(). The upstream regression test test_sneaky_hardlink_relocation is carried too, minus the @symlink_test / @os_helper.skip_unless_hardlink decorators and with os_helper.can_symlink() spelled support.can_symlink(), neither of which exists in 3.7. - The one-line fix closes only the variant where the archive carries a decoy file at the outer name, so os.path.exists(tarinfo._link_target) is true and extraction goes through os.link(). The decoy-less variant never reaches os.link() at all; under the "data" filter it is rejected by CVE-2026-11940.patch, already in this package, so the two must not be separated. - CVE-2026-82049 * The Misc/NEWS.d fragment of the upstream commit is omitted; this version ships a single Misc/NEWS file.