tarfile 'Python 3.14 will, by default, filter' DeprecationWarning: invisible on 3.12.0-3.12.3 and from imported modules

Don't rely on the PEP 706 DeprecationWarning to find unsafe tarfile.extractall()/extract() calls without filter=. In CPython 3.12.3, which is Ubuntu 24.04's python3 and was checked, tarfile._get_filter_function calls warnings.warn(..., DeprecationWarning) with no stacklevel. The warning is therefore attributed to tarfile itself, and the default filters hide it: nothing prints, even from python -c. From 3.12.4 (checked 3.12.4, 3.12.5, 3.12.8, 3.12.16, 3.13.0, 3.13.18) it uses stacklevel=3. It then prints when the call sits in __main__ (a script or -c), but still not when extractall is called from inside an imported module or library, because DeprecationWarning is shown by default only for __main__. Meanwhile ../ members are written outside the destination with exit status 0. 3.14 defaults to filter='data' and raises OutsideDestinationError. To audit: run tests with -W error::DeprecationWarning on 3.12.4+ (this also works on 3.12.3: -W overrides the default ignore, and the extraction then raises), or grep for extractall( without filter=. Fix: pass filter='data' explicitly. It exists from 3.12 and in the security backports; filter='data' worked on uv's 3.9.25, 3.10.22 and 3.11.18.