* SECURITY UPDATE: heap buffer under-read in clean_metalink_string() - debian/patches/CVE-2026-58469.patch: bound the backward whitespace scan with end > beg in src/metalink.c so an all-whitespace Metalink URL cannot read before the start of the buffer - CVE-2026-58469 * SECURITY UPDATE: heap buffer overflow in convert_fname() - debian/patches/CVE-2026-58471.patch: correctly track used and remaining space across the iconv E2BIG reallocation in src/url.c so the output buffer is not overflowed - CVE-2026-58471 * SECURITY UPDATE: integer and heap buffer overflow in html_quote_string() - debian/patches/CVE-2026-58472.patch: size the quoted string using overflow-checked accumulation (size_t with INT_ADD_WRAPV) in src/convert.c and abort on overflow instead of under-allocating - CVE-2026-58472