* SECURITY UPDATE: out-of-bounds read in FTP gateway directory-listing parser - debian/patches/CVE-2026-47729.patch: guard the whitespace-skipping strchr(w_space, *copyFrom) checks in ftpListParseParts() with a '*copyFrom &&' short-circuit so a listing date that is not followed by a filename cannot advance parsing past the input buffer - CVE-2026-47729 * SECURITY UPDATE: heap buffer overflow in cache digest reply handling - debian/patches/CVE-2026-50012.patch: bounds-check the received mask data size against the declared mask_size before the memcpy in peerDigestSwapInMask(), aborting the digest fetch when the on-the-wire size is larger than the mask - CVE-2026-50012