Fully implement PEP 706: Change default filter for TarFile.extract() and extractall() to 'data'

[WilliamRoyNelson]

Feature or enhancement

Proposal:

The documentation for tarfile discusses changes to the default behavior in 3.14 as a future change, but now that 3.14 is in development this change should be implemented and references to the change should reflect that the default behavior is now implemented.

• Change default behavior in tarfile.py
• Remove deprecation warning when using None
• Update tests to reflect new default behavior
• Update tarfile documentation to reflect that the change has been implemented
• Update shutil
• Update shutil tests
• Add test to ensure default filter is set to 'data'

Has this already been discussed elsewhere?

No response given

Links to previous discussion of this feature:

https://peps.python.org/pep-0706/#defaults-and-their-configuration

If both the argument and attribute are None:

• In Python 3.12-3.13, a DeprecationWarning will be emitted and extraction will use the 'fully_trusted' filter.
• In Python 3.14+, it will use the 'data' filter.

https://docs.python.org/3.14/library/tarfile.html#extraction-filters

None (default): Use TarFile.extraction_filter.

If that is also None (the default), raise a DeprecationWarning, and fall back to the 'fully_trusted' filter, whose dangerous behavior matches previous versions of Python.

In Python 3.14, the 'data' filter will become the default instead. It’s possible to switch earlier; see TarFile.extraction_filter.

Linked PRs

• gh-121999: Change default tarfile filter to 'data' #122002