This blog is updated daily.
A general description is here.
The internal method of ‘untar()’ now checks the whole path of every member, so that a final component of ‘".."’ or ‘"~"’ can no longer place a link or file outside the extraction directory; rejects hard- and symbolic-link targets restored as file copies, which resolve outside the extraction directory or pass through a symbolic link; applies the umask to extracted files; also no longer restores setuid or setgid permission bits. Similarly, the internal method of ‘unzip()’ no longer extracts through symbolic links below ‘exdir’, both thanks to Kevin Ushey's report and patch in PR#19229.
‘delete.response’ inadvertently converted indices (attributes ‘response’, ‘offset’, ‘specials’) from integer to double. It also replaced ‘NULL’ components of ‘specials’ with ‘logical(0L)’.