- CVE-2026-82049: resolve a hard link's target with os.path.realpath() before creating the link, so extracting a hard link to a symlink stored deeper in the archive cannot relocate that symlink to a shallower path where its relative target escapes the destination directory - CVE-2026-11940: re-filter the fallback member when hard link extraction falls back to extracting from the archive, and filter it under the link's own name, so a hard link to a deeper symlink cannot recreate that symlink at a shallower path outside the destination. Carries the CVE-2025-4330 fallback-filtering prerequisite (LinkFallbackError and makelink_with_filter), which this package did not have. Skip the member when the filter returns None for the link's own name, so a filter that skips rejected members cannot be bypassed the same way (CVE-2026-87910) - CVE-2025-4435: skip a member the extraction filter rejects instead of extracting it unfiltered when TarFile.errorlevel is 0