* SECURITY UPDATE: CPU denial-of-service in tarfile streaming mode via a crafted archive that declares more blocks than it contains - debian/patches/CVE-2026-11972.patch: in Lib/tarfile.py, break out of the block loop in _Stream.seek() once read() returns no data, so an archive opened in streaming mode (mode='r|') can no longer make parsing take exponentially longer by declaring a block count past end of file. Backport of upstream commit 3f031d431f80 (gh-151981 / GH-151982), taken unchanged from this package's amazonlinux2els branch where it was adapted for 3.7 by Qiantong Zhong . Bundles the upstream regression test test_getmembers_big_size (test_tarfile.py). - CVE-2026-11972 * SECURITY UPDATE: out-of-bounds stack write when a bz2 decompressor is reused after a decompression error - debian/patches/CVE-2026-9669.patch: in Modules/_bz2module.c, record the libbz2 error code on BZ2Decompressor and raise ValueError on any further decompress() call, so an application that catches the OSError and retries with the same decompressor can no longer make it resume from an invalid internal state and write out of bounds to a stack buffer. Backport of upstream commit 938ec030e90c (gh-150599 / GH-150600) via the 3.10 backport; `self->bzerror = 0;` is placed by hand in _bz2_BZ2Decompressor___init___impl(), whose lock-allocation prologue differs in this version. Bundles the upstream regression test test_decompress_after_data_error (test_bz2.py). - CVE-2026-9669