* SECURITY UPDATE: Permission Model bypass via process.report.writeReport() path misvalidation - debian/patches/CVE-2026-48617.patch: gate writeReport() in lib/internal/process/report.js on permission.has('fs.write', ...) for the supplied file or the current working directory, throwing ERR_ACCESS_DENIED instead of writing a diagnostic report outside the --allow-fs-write allow-list - CVE-2026-48617 * SECURITY UPDATE: Permission Model bypass via FileHandle.utimes() in the promises API - debian/patches/CVE-2026-48935.patch: throw ERR_ACCESS_DENIED from futimes() in lib/internal/fs/promises.js when the Permission Model is enabled, so file timestamps can no longer be modified through a read-only FileHandle - CVE-2026-48935