- CVE-2026-9669: record the libbz2 error code on BZ2Decompressor and refuse further decompress() calls, so a decompressor reused after an error cannot resume from an invalid state and write out of bounds - CVE-2026-82049: resolve a hardlink's target with os.path.realpath() so extracting a hard link to a symlink cannot relocate that symlink and expose or modify files outside the destination - CVE-2026-11940: re-filter the fallback member when hard link extraction falls back to extracting from the archive, and filter it under the link's own name, so a hard link to a deeper symlink cannot recreate that symlink at a shallower path outside the destination. Carries the CVE-2025-4330 fallback-filtering prerequisite (LinkFallbackError and makelink_with_filter), which this package did not have - CVE-2026-87910: skip the fallback member when the filter returns None for it under the link's name, instead of ignoring that result - CVE-2025-4435: skip a member the extraction filter rejects instead of extracting it unfiltered when TarFile.errorlevel is 0