The extraction methods in tarfile, and shutil.unpack_archive, have a new a filter argument that allows limiting tar features than may be surprising or dangerous, such as creating files outside the destination directory. See tarfile-extraction-filter for details.