* SECURITY UPDATE: server crash in rollup subquery row comparator - debian/patches/CVE-2025-21500.patch: Fix a crash when a subquery containing GROUP BY WITH ROLLUP is used inside a row value comparator and returns no rows. cmp_item_row::store_value() now checks null_value after bring_value() before iterating sub-comparators; cmp_item::set_null_value() is promoted to a pure virtual method so nested row types propagate null correctly. - CVE-2025-21500 * SECURITY UPDATE: table value constructor ORDER BY hidden column crash - debian/patches/CVE-2025-21504.patch: Preparation of table value constructors did not track the number of hidden columns added for ORDER BY expressions. This could cause problems later in the resolving process, possibly leading to an unplanned server exit. Fixed by counting hidden items in table value constructors the same way as in regular query blocks. - CVE-2025-21504 * SECURITY UPDATE: Outer reference in window ORDER BY rejected - debian/patches/CVE-2025-21566.patch: MySQL allowed outer column references in a window's PARTITION BY and ORDER BY expressions, contrary to SQL 2016 standard section 7.15. The fix adds a check in the field resolution path to reject any outer reference encountered while resolving a window's ORDER BY or PARTITION BY clause. - CVE-2025-21566