* Drop the (<< 1:6.0) version constraint on the libdb-dev build dependency in debian/control.in and debian/control, matching debian10els. Bullseye ships only libdb-dev 5.3.1+nmu1, so the constraint excludes nothing, and the builder's pbuilder-satisfydepends misreads the '<<' relation as a build-profile restriction and skips installing the package entirely. * SECURITY UPDATE: directory traversal when extracting tar archives - debian/patches/CVE-2007-4559.patch: add the PEP 706 extraction filter API to Lib/tarfile.py, providing the fully_trusted, tar and data filters, the FilterError exception hierarchy, the TarFile. extraction_filter attribute and the filter= argument to extract() and extractall(), so that callers can reject members that would escape the destination directory. Includes the upstream follow-ups gh-149486 and gh-155999, which validate the written link target and normalise a member name that leaves the destination and comes back. The filters remain opt-in and do not contain a member extracted at errorlevel=0 or through makelink()'s hardlink fallback; see the patch header - CVE-2007-4559 * SECURITY UPDATE: quadratic complexity in IDNA decoding - debian/patches/CVE-2022-45061.patch: replace the per-character 'for c in RandAL: if c:' BIDI loop in nameprep() with a single 'if any(RandAL):' test in Lib/encodings/idna.py, so the RandALCat checks run once instead of once per character, restoring linear behaviour - CVE-2022-45061 * SECURITY UPDATE: control character injection via http cookies - debian/patches/CVE-2026-0672.patch: reject control characters in Morsel keys, values, coded values and reserved attributes in Lib/Cookie.py - CVE-2026-0672 * SECURITY UPDATE: incomplete fix for the http cookie control character injection - debian/patches/CVE-2026-3644.patch: apply the same control character rejection to Morsel.update() and js_output() in Lib/Cookie.py, which the previous fix left unguarded - CVE-2026-3644 * SECURITY UPDATE: configuration file injection via carriage returns in written option values - debian/patches/CVE-2026-0864.patch: normalise CR and CRLF, and not only LF, into '\n\t' continuation lines when writing option values in RawConfigParser.write() in Lib/ConfigParser.py, so that an attacker-controlled value can no longer inject additional sections, keys and values into the written file - CVE-2026-0864 * SECURITY UPDATE: C stack overflow parsing deeply nested content models - debian/patches/CVE-2026-4224.patch: guard conv_content_model() in Modules/pyexpat.c with Py_EnterRecursiveCall(), so that a deeply nested element declaration raises RuntimeError instead of crashing the interpreter - CVE-2026-4224 * SECURITY UPDATE: argument injection via leading dashes in browser URLs - debian/patches/CVE-2026-4519.patch: reject URLs beginning with a dash in BaseBrowser._check_url() in Lib/webbrowser.py, so that a URL can no longer be passed to the browser process as an option - CVE-2026-4519 * SECURITY UPDATE: CPU denial-of-service in html.parser.HTMLParser via repeated unterminated markup declarations in incremental parsing - debian/patches/CVE-2026-15308.patch: accumulate incrementally fed data in a list and only join and parse it once enough has piled up, in Lib/HTMLParser.py - CVE-2026-15308