[rpms/tar] f44: Bump Release, update %changelog

[rpms/tar] f44: Bump Release, update %changelog

[Pavel Cahyna]

A new commit has been pushed.

Repo   : rpms/tar
Branch : f44
Commit : 4c7ae1a344f671aa036a47bd02600f8ff6876113
Author : Pavel Cahyna <pcahyna@redhat.com>
Date   : 2026-09-07T17:27:16+02:00
Stats  : +12/-1 in 1 file(s)
URL    : https://src.fedoraproject.org/rpms/tar/c/4c7ae1a344f671aa036a47bd02600f8ff6876113?branch=f44

Log:
Bump Release, update %changelog

---
diff --git a/tar.spec b/tar.spec
index bc1a65d..8cfe5e0 100644
--- a/tar.spec
+++ b/tar.spec
@@ -10,7 +10,7 @@ Summary: GNU file archiving program
 Name: tar
 Epoch: 2
 Version: 1.35
-Release: 8%{?dist}
+Release: 9%{?dist}
 License: GPL-3.0-or-later
 URL: https://www.gnu.org/software/tar/
 
@@ -185,6 +185,17 @@ make check || (
 
 
 %changelog
+* Mon Sep  7 2026 Pavel Cahyna <pcahyna@redhat.com> - 2:1.35-9
+- Backport upstream fix for CVE-2026-5704 (file injection hidden from -t) (fedora#2527317)
+- Fix --one-top-level with absolute path (broken by the CVE-2025-45582 fix) (fedora#2498061)
+  Also fixes CVE-2026-18508 (escape from --one-top-level via hardlinks) (fedora#2509845).
+- Backport upstream patches for CVE-2026-18477, fixes a bug
+  where incremental restore with cyclic renames between backups
+  may create a temporary directory at an archive-controlled path
+  outside the extraction tree. (fedora#2509846)
+  The fix for CVE-2025-45582 already prevents exploiting
+  this problem, so it is more a correctness and hardening change.
+  
 * Wed Jan 21 2026 Pavel Cahyna <pcahyna@redhat.com> - 2:1.35-8
 - Backport upstream fix for savannah bug 65838, commit 1e6ce98e (fedora#2427654)
 - added "padding with zeros" info message (#2089298)