* OpenJDK 8u502 release, build 7 (Oracle July 2026 CPU). Release notes: https://openjdk.org/groups/vulnerability/advisories/2026-07-21 - Security fixes (8u502): + CVE-2026-41254: 2D integer overflow in Little CMS CubeSize + CVE-2026-46968: JSSE TLS certificate handling + CVE-2026-47010: ImageIO JPEG handling + CVE-2026-47021: 2D XBM image support + CVE-2026-47027: Security Jar file processing + CVE-2026-47057: Scripting Nashorn index handling + CVE-2026-47058: Scripting DataView implementation + CVE-2026-47059: 2D AWT ImagingLib + CVE-2026-47063: Security Jar handling + CVE-2026-60147: Security certification checking (CVE-2026-46917 from the same advisory does not affect the 8u train per the OpenJDK 2026-07-21 risk matrix.) * debian/rules: bump gh_tag to jdk8u502-ga, version_dash_buildnr to 502-b07, gh_tag_aarch32 to jdk8u502-b06-aarch32-20260710. * Refresh orig tarball from Ubuntu archive (openjdk-8_8u502-ga~us1.orig.tar.gz, sha1 553d02f135b9c68cf95a2daf0e5db367e4e0569b, size 67975803 bytes; source: archive.ubuntu.com openjdk-8 8u502-ga~us1). * Refresh Ubuntu quilt patches for u502 context: - zero-sh.diff (upstream added a RISCV branch to os::dll_load; the ZERO_SH branch and #error list are re-anchored after it) - gcc14.diff (upstream adopted the UINT8** freeArray signature in imageioJPEG.c, so that hunk is dropped; parse_manifest.c retained) All 48 quilt patches apply cleanly (0 rejects). * Ref: ELSCVE-167684, ELSCVE-167634, ELSCVE-167656