* SECURITY UPDATE: postgresql May-2026 CVE batch - debian/patches/CVE-2026-6473.patch: integer overflow fixes across multiple vulnerable sites: formatting.c size calculations (mul_size), intarray/ltxtquery findoprnd() left-offset overflow with int16 check, ltree lquery numvar/totallen overflow with PG_UINT16_MAX check, ts_headline option length overflow with per-option ERRCODE_INVALID_PARAMETER_VALUE checks, array_agg accumArrayResultArr() nitems overflow with MaxArraySize check, and hstore_plperl/hstore_plpython palloc overflow via mul_size(). - debian/patches/CVE-2026-6474.patch: guard pg_strftime() callers and ensure null-terminated output on overflow; split timeofday() pg_strftime so the %Z timezone string is never embedded as a format string in subsequent snprintf(). - debian/patches/CVE-2026-6475.patch: prevent path traversal in pg_rewind via path_is_safe_for_extraction() helper. - debian/patches/CVE-2026-6477.patch: harden PQfn()/pqFunctionCall3 against server-controlled buffer overruns in libpq large-object interface (lo_read, lo_lseek64 and lo_tell64 callers). - debian/patches/CVE-2026-6478.patch: add timingsafe_bcmp() helper and apply it in MD5/RADIUS/plain auth paths to prevent timing-channel leaks (SCRAM not in 9.5). - debian/patches/CVE-2026-6479.patch: fix unbounded recursive handling of SSL negotiation in ProcessStartupPacket() (convert recursive call to goto-retry loop). - debian/patches/CVE-2026-6637.patch: switch refint contrib check_foreign_key to StringInfo and quote_literal_cstr() to prevent SQL injection and stack buffer overruns. - CVE-2026-6473 - CVE-2026-6474 - CVE-2026-6475 - CVE-2026-6477 - CVE-2026-6478 - CVE-2026-6479 - CVE-2026-6637 * debian/patches/fix-regress-tzdata-LMT.patch: refresh src/test/regress expected output for date, timestamptz and horology tests so they match the LMT abbreviation emitted by current tzdata for pre-1883 dates.