* SECURITY UPDATE: extraction filter bypassed for hardlink targets in tarfile.TarFile.extract() - debian/patches/CVE-2026-4360.patch: forward the resolved filter_function from extract() to _extract_one(), so that the recursive call which materialises a hardlink's target as a fallback is filtered too instead of falling back to unfiltered extraction, which let a crafted archive write the target with attributes the selected filter would have rejected (CWE-281). - CVE-2026-4360 * SECURITY UPDATE: CPU denial-of-service in xml.etree XPath index predicates - debian/patches/CVE-2026-6879.patch: memoise the indexed match per (parent, tag) pair in the ElementPath index-predicate selector instead of calling parent.findall(elem.tag) once per sibling, so patterns such as ".//a[1]" or ".//a[last()]" no longer rescan the whole sibling list for every sibling and are linear rather than quadratic in the number of same-tag siblings (CWE-407/CWE-1333). - CVE-2026-6879