Move gh-157190 to the 3.10-3.13 block, mention 3.14+ not vulnerable

[hugovk]

Re: https://discuss.python.org/t/python-3-10-22-3-11-17-3-12-15-3-13-16-and-3-14-8-are-now-available/109296/10

Another question is why these security issues are not mentioned in proper changelogs on https://docs.python.org/3.*/whatsnew/changelog.html (for example, except for 3.13.8, none of them mentions gh-157190).

Specifically about gh-157190, the issue says:

This was incidentally fixed by 5a57248 for 3.14+ which changed os.link to use AT_SYMLINK_FOLLOW.

And CVE-2026-82049 says 3.14.8 isn't affected:

In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable...

affected

• affected from 0 before 3.10.22
• affected from 3.11.0 before 3.11.17
• affected from 3.12.0 before 3.12.15
• affected from 3.13.0 before 3.13.16
• affected from 3.14.0a1 before 3.14.0b1

So let's move it out of the 3.10-3.14 block into the 3.10-3.13 block, and add that:

Python 3.14 and later were already protected because os.link() follows symbolic links since Python 3.14.0b1 (gh-81793).

I've updated https://www.python.org/downloads/release/python-3148/ in the same way.

[psf-cabotage-us-east-2]

Branch Deploy for pr-155 in Python Insider

Environment has been destroyed.