chore(deps): refresh rpm lockfiles [SECURITY]

[red-hat-konflux]

This PR contains the following updates:

File rpms.in.yaml:

Package	Change
kernel-headers	5.14.0-687.38.1.el9_8 -> 5.14.0-687.39.1.el9_8
python-unversioned-command	3.9.25-7.el9_8.2 -> 3.9.25-7.el9_8.3
python3	3.9.25-7.el9_8.2 -> 3.9.25-7.el9_8.3
python3-libs	3.9.25-7.el9_8.2 -> 3.9.25-7.el9_8.3

---

python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory

CVE-2026-11940

More information

Details

A flaw was found in the tarfile.extractall() function within Python. A remote attacker could exploit this vulnerability by providing a specially crafted archive. This archive could bypass security filters by using a hardlink that references a symlink, allowing the symlink to be recreated outside the intended destination directory. This could lead to out-of-destination file reads or writes, potentially resulting in information disclosure or arbitrary file modification.

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2026-11940
• https://bugzilla.redhat.com/show_bug.cgi?id=2491848
• https://www.cve.org/CVERecord?id=CVE-2026-11940
• https://nvd.nist.gov/vuln/detail/CVE-2026-11940
• https://github.com/python/cpython/issues/151558
• https://github.com/python/cpython/pull/151559
• https://mail.python.org/archives/list/security-announce@python.org/thread/LD6QIISNQFQYOIEPJNEUIPV7S3V76FZH/

🔧 This Pull Request updates lock files to use the latest dependency versions.

---

Configuration

📅 Schedule: (in timezone Etc/UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

[rhacs-bot]

Auto-approved by automation.

[rhacs-bot]

Auto-approved by automation.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 27.34%. Comparing base (d6dd62a) to head (9ddb167).
⚠️ Report is 2 commits behind head on release-3.25.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@              Coverage Diff              @@
##           release-3.25    #3779   +/-   ##
=============================================
  Coverage         27.34%   27.34%           
=============================================
  Files                95       95           
  Lines              5420     5420           
  Branches           2545     2545           
=============================================
  Hits               1482     1482           
  Misses             3211     3211           
  Partials            727      727           

Flag	Coverage Δ
collector-unit-tests	27.34% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.