* SECURITY UPDATE: html.parser.HTMLParser had quadratic complexity in incremental parsing. An unterminated construct (e.g. a tag or comment) fed across many feed() calls made the parser rescan the growing buffer and reconcatenate new data onto it on every call, both quadratic in the input size, allowing a CPU denial-of-service on uncontrolled data (CWE-407, algorithmic complexity). - debian/patches/CVE-2026-15308.patch: backport of cpython bcf98ddb (gh-153030, Serhiy Storchaka). feed() now accumulates new data in a list and only joins and parses it once enough has piled up, and close() flushes any pending buffer. Adapted to 3.6: feed()/close()/ reset() logic identical to upstream (3.6 already has list.clear()); the regression test is added with "from test import support"; the NEWS.d fragment is omitted as 3.6.15 ships a single Misc/NEWS. - CVE-2026-15308