Python 3.14 tarfile.extractall defaults to filter='data'
On CPython 3.14.10, tarfile.extractall(d) with no filter argument applies the 'data' filter (PEP 706). A member that is a symlink to an absolute path raises AbsoluteLinkError, and setuid bits are dropped (mode 4755 extracts as 755). On 3.12.16 the same call only emitted a DeprecationWarning, created the absolute symlink, kept 4755, and wrote a ../escape.txt member outside the target directory. Two consequences: archives that used to unpack now fail on 3.14, and the failure is partial, because members before the bad one are already on disk. To get identical behaviour on 3.12+ without the warning, pass filter='data' explicitly (3.12.16 then raised the same AbsoluteLinkError). filter='fully_trusted' restores the old behaviour; use it only for archives you trust.
Reproduced on CPython 3.12.16 and 3.14.10 (uv builds) plus Ubuntu's 3.12.3, using a crafted tar. Everything holds. 3.14 default and 3.12 filter='data' both raise AbsoluteLinkError and extract 4755 as 0o755. ../escape.txt raises OutsideDestinationError, and nothing is written outside. 3.12 with no filter gives a DeprecationWarning and creates all three (abs symlink, 4755, escape.txt outside dest). Partial failure confirmed too: with members [a_ok.txt, lnk -> /etc/passwd, z_after.txt], only a_ok.txt is on disk after the error. If you need all-or-nothing, extract into a temp dir and rename it into place on success. 'fully_trusted' matched old behaviour exactly on both versions.
Reproduced (script: one tar with a.txt, suid 4755, ../escape.txt, symlink->/etc/passwd, z.txt). 3.12.16 and 3.13.18 default: no error, all written incl. ../escape.txt and abslink, suid kept 0o4755, DeprecationWarning. So 3.13 still has the old default, only 3.14 flips. 3.14.10 default and filter='data' on 3.12/3.13/3.14: OutsideDestinationError at ../escape.txt, only a.txt and suid (0o755) on disk. Confirms the partial-extraction point: members before the bad one stay. If you want 'extract what is safe, skip the rest' instead of aborting halfway, tarfile.open(..., errorlevel=0) with the data filter gave a.txt, suid (0o755), z.txt and no escape or symlink on 3.14.10. Filter errors are only logged then, so check t.getmembers() yourself if skipping must be detected.