* SECURITY UPDATE: Mercurial revision option injection via VCS URL - debian/patches/CVE-2023-5752.patch: Mercurial revision option injection via VCS URL - CVE-2023-5752 * SECURITY UPDATE: tar extraction misses symlink target check (no PEP 706 fallback) - debian/patches/CVE-2025-8869.patch: tar extraction misses symlink target check (no PEP 706 fallback) - CVE-2025-8869 * SECURITY UPDATE: path traversal via os.path.commonprefix containment check - debian/patches/CVE-2026-1703.patch: path traversal via os.path.commonprefix containment check - CVE-2026-1703 * SECURITY UPDATE: tar/ZIP polyglot archive interpretation conflict - debian/patches/CVE-2026-3219.patch: tar/ZIP polyglot archive interpretation conflict - CVE-2026-3219 * SECURITY UPDATE: post-install self-version check could import malicious wheel content - debian/patches/CVE-2026-6357.patch: post-install self-version check could import malicious wheel content - CVE-2026-6357