* SECURITY UPDATE: tarfile normalized AREGTYPE blocks to DIRTYPE while processing GNU long name/link follow-up headers, allowing a crafted tar archive to be misinterpreted. - debian/patches/CVE-2025-13462.patch: backport of cpython 42d754e34c (gh-141707). Skip DIRTYPE normalization on follow-up headers via a dircheck flag. - CVE-2025-13462 * SECURITY UPDATE: wsgiref.headers.Headers accepted C0 control characters in header names, values and parameters, enabling response splitting. - debian/patches/CVE-2026-0865.patch: backport of cpython f7fceed79c (gh-143916) plus the HTAB follow-up. Reject control characters; HTAB remains allowed in values but not names. - CVE-2026-0865 * SECURITY UPDATE: http.client did not reject CR/LF in HTTP tunnel (CONNECT) request headers set via HTTPConnection.set_tunnel(). - debian/patches/CVE-2026-1502.patch: backport of cpython 05ed7ce7ae (gh-146211). Validate the tunnel host and per-header name/value. - CVE-2026-1502 * SECURITY UPDATE: http.cookies Morsel.js_output() emitted cookie values into a document.cookie assignment using only quote-escaping, allowing a breakout / JavaScript injection. - debian/patches/CVE-2026-6019.patch: backport of cpython 76b3923d68 (gh-90309). Base64-encode the value and wrap it in atob(). - CVE-2026-6019