This blog is updated daily.
A general description is here.
‘unzip(., unzip = "internal")’ no longer leaks the zip handle on error, thanks to Kevin Ushey, see PR#19233
The internal method of ‘untar()’ now checks the whole path of every member, so that a final component of ‘".."’ or ‘"~"’ can no longer place a link or file outside the extraction directory; rejects hard- and symbolic-link targets restored as file copies, which resolve outside the extraction directory or pass through a symbolic link; applies the ‘umask’ to extracted files; also no longer restores ‘setuid’ or ‘setgid’ permission bits. Similarly, the internal method of ‘unzip()’ no longer extracts through symbolic links below ‘exdir’, both thanks to Kevin Ushey's report and patch in PR#19229.