* SECURITY UPDATE: xml.parsers.expat / xml.etree.ElementTree used insufficient entropy for libexpat hash-flooding protection, allowing a crafted XML document to trigger hash collisions. Mitigation requires both libexpat 2.8.0+ (or a distro-backported equivalent that exports XML_SetHashSalt16Bytes) and a Python-side patch to seed the parser with the new 16-byte salt API. - debian/patches/CVE-2026-7210.patch: backport of cpython 24b8f12544 (gh-149018, Stan Ulbrych). pyexpat and _elementtree call XML_SetHashSalt16Bytes with _Py_HashSecret.expat.hashsalt16 (16 bytes of entropy); legacy XML_SetHashSalt remains as the fallback when the loaded libexpat does not export the new symbol. The symbol is declared __attribute__((weak)) in Modules/pyexpat.c so the same source path works whether the build links against bundled libexpat 2.8.0+ or a distro libexpat 2.5/2.7 that backports the entropy fix without bumping XML_COMBINED_VERSION (Debian, Ubuntu, RHEL/CL, Alpine). Extends the PyExpat CAPI with a nullable SetHashSalt16Bytes slot populated from the weak reference. - CVE-2026-7210