* SECURITY UPDATE: code injection through WebAssembly export names - debian/patches/CVE-2023-39333.patch: createDynamicModule() built the ESM facade for a wasm module by interpolating each export name raw into three code positions, so a .wasm module exporting a non-identifier name could break out of the intended syntax and evaluate arbitrary JavaScript outside the WebAssembly sandbox. The facade now uses index-derived local bindings ($export_N) and a JSONStringify-quoted import.meta.exports[...] key. Adapted from nodejs/node@eaf9083c: V8 8.4.371.23 predates ES2022 arbitrary module namespace names, so upstream's `export { $export_N as "string" }` would be a SyntaxError for every wasm module here; the export clause is instead emitted only for names matching the IdentifierName grammar, with non-identifier names reachable through import.meta.exports only (they were unimportable on this V8 either way) - CVE-2023-39333 * SECURITY UPDATE: http.Agent keep-alive response-queue poisoning - debian/patches/CVE-2026-48931.patch: once responseKeepAlive() detaches the parser and removes the 'data' listener, a socket idling in the Agent freeSockets pool has no data consumer, so unsolicited bytes from a malicious peer are consumed as the response to the *next* request that reuses the socket. Install a handle-level read guard on idle pooled sockets that destroys the socket on any such data, and remove it again in reuseSocket() (backport of nodejs/node@0a22d401 squashed with its regression follow-up nodejs/node@eaa29254, which replaces the original public 'data' listener plus resume() -- that combination put pooled sockets into flowing mode and made the shipped test-http-agent-keepalive.js fail on listenerCount('data')) - CVE-2026-48931