* SECURITY UPDATE: C stack overflow (DoS) in pyexpat when parsing deeply nested DTD content models - debian/patches/CVE-2026-4224.patch: guard conv_content_model() in Modules/pyexpat.c with Py_EnterRecursiveCall/Py_LeaveRecursiveCall to bound recursion when a registered ElementDeclHandler converts a deeply nested content model. - CVE-2026-4224 * SECURITY UPDATE: HTTP header injection via control characters in cookies - debian/patches/CVE-2026-0672.patch: add _has_control_character() and reject control characters in Morsel.__setitem__()/setdefault()/set() and BaseCookie.output() in Lib/http/cookies.py. - CVE-2026-0672 * SECURITY UPDATE: incomplete fix for CVE-2026-0672 (control characters in cookies via additional Morsel paths) - debian/patches/CVE-2026-3644.patch: reject control characters in Morsel.update(), Morsel.__setstate__() and Morsel.js_output() in Lib/http/cookies.py. - CVE-2026-3644 * SECURITY UPDATE: tarfile member type confusion (regular file parsed as directory) via GNU long name/link headers - debian/patches/CVE-2025-13462.patch: skip the AREGTYPE->DIRTYPE normalization while reading GNU LONGNAME/LONGLINK and PAX follow-up headers (dircheck=False) in Lib/tarfile.py. - CVE-2025-13462