* SECURITY UPDATE: webbrowser.open() dash-prefix check bypass via the action token - debian/patches/CVE-2026-4786.patch: validate the action-expanded URL and reorder the action/URL substitution so a URL containing the action token cannot expand into a dash-prefixed browser flag (CVE-2026-4519 bypass). - CVE-2026-4786 * SECURITY UPDATE: dangling input pointer (UAF) in bz2/lzma decompressors - debian/patches/CVE-2026-6100.patch: clear next_in on the MemoryError error path in _bz2/_lzma decompress() so a reused decompressor cannot read or write through a stale pointer to the released input buffer. - CVE-2026-6100 * SECURITY UPDATE: insufficient Expat hash-flooding entropy - debian/patches/CVE-2026-7210.patch: seed Expat with 16 bytes of entropy via XML_SetHashSalt16Bytes when libexpat exposes it (weak symbol), falling back to the legacy 8-byte salt otherwise. - debian/patches/CVE-2026-41080.patch: backport XML_SetHashSalt16Bytes into the BUNDLED expat (applied on ubuntu16.04 only; el7 on the RPM side) so the 16-byte salt path above is not inert; other platforms link system expat. - CVE-2026-7210 * SECURITY UPDATE: bz2.BZ2Decompressor reuse after error (stack overflow) - debian/patches/CVE-2026-9669.patch: record the libbz2 error and raise ValueError on any subsequent decompress() call instead of re-entering libbz2 on an inconsistent stream (CWE-121). - CVE-2026-9669