* SECURITY UPDATE: FTP data-connection redirection (SSRF) via the ftplib.ftpcp() helper. ftpcp() was not updated when CVE-2021-4189 was fixed: it still called parse227() directly and passed the raw attacker-controllable IPv4 address and port from the source server's PASV reply to target.sendport(), so a malicious source FTP server could redirect the target server's data connection to an arbitrary host:port. - debian/patches/CVE-2026-8328.patch: backport of cpython eac4fe3b (gh-87451, GH-149648). ftpcp() now ignores the advertised PASV host and uses the source server's real peer address (source.sock.getpeername()[0]), honoring the existing trust_server_pasv_ipv4_address opt-out, the same as FTP.makepasv(). Includes a TestFtpcpSecurity unit test adapted to Python 2.7 (hand-written stubs instead of unittest.mock). - CVE-2026-8328