* SECURITY UPDATE: symlink extraction escape in the tarfile fallback - debian/patches/CVE-2025-8869.patch: validate that a symlink member's target resolves inside the tar archive, in the extraction fallback used on Pythons without PEP 706 tarfile filtering - CVE-2025-8869 * SECURITY UPDATE: path traversal into prefix-sharing sibling directories - debian/patches/CVE-2026-1703.patch: replace the os.path.commonprefix containment test in is_within_directory with an explicit path-component check - CVE-2026-1703 * SECURITY UPDATE: archive type confusion for concatenated tar+zip files - debian/patches/CVE-2026-3219.patch: choose the archive format in order of decreasing reliability and reject files that identify as both zip and tar - CVE-2026-3219 * SECURITY UPDATE: self version-check imported just-installed modules - debian/patches/CVE-2026-6357.patch: split the self version-update check so the network fetch and version computation run before the command body, and skip it entirely for "pip install pip" - CVE-2026-6357 * SECURITY UPDATE: entry point names installed outside the scripts directory - debian/patches/CVE-2026-8643.patch: reject console/gui script entry point names that resolve to a path outside the scripts directory - CVE-2026-8643 * SECURITY UPDATE: doubly-encoded package URL could escape the download directory - debian/patches/CVE-2026-13346.patch: stop decoding the URL path a second time in Link.filename and route the download-path joins through join_within_directory so the name is always a single path component - CVE-2026-13346