- CVE-2026-34978: reject ".." path traversal in the RSS notifier notify-recipient-uri, both in notifier/rss.c and when the subscription is created in the scheduler, and refuse to write when the target path exists and is not a regular file; previously a remote IPP client could make the lp-owned notifier clobber root-managed state such as CacheDir/job.cache - CVE-2026-34979: fix heap buffer overflow when building filter option strings; ipp_length() skipped NOVALUE, MIMETYPE, NAMELANG, TEXTLANG, URI and URISCHEME attributes that get_options() does emit, so the allocated options buffer was undersized