* SECURITY UPDATE: excess base64 data ignored after the first padded quad - debian/patches/CVE-2026-3446.patch: treat the pad character as non-alphabet data in binascii.a2b_base64() as permitted by RFC 4648 section 3.3, so decoding continues to the end of the input instead of silently dropping everything that follows the first padded quad - CVE-2026-3446 * SECURITY UPDATE: symlink escape via the tarfile hardlink-extraction fallback - debian/patches/CVE-2026-11940.patch: revalidate the link with the hardlink's own shallower name in makelink_with_filter() so a crafted archive whose hardlink references a symlink stored at a deeper path cannot recreate a relative target that escapes the destination directory (incomplete fix of CVE-2025-4330), and pass the extraction filter from extract() down to _extract_one() so the revalidation runs for single-member extraction as well and not only for extractall() - CVE-2026-11940 * SECURITY UPDATE: script-element breakout in http.cookies Morsel.js_output() - debian/patches/CVE-2026-6019.patch: percent-encode the cookie value with urllib.parse.quote() and wrap it in decodeURIComponent() in the generated inline or other HTML parser-sensitive sequences cannot escape the script element, while non-latin-1 values still reach the browser as UTF-8 - CVE-2026-6019