* SECURITY UPDATE: xml.parsers.expat and xml.etree.ElementTree used insufficient entropy for the Expat hash-flooding salt (only the 8-byte Py_hash_t field _Py_HashSecret.expat.hashsalt was passed to XML_SetHashSalt), allowing a crafted XML document to trigger hash flooding in Expat's internal hash tables. Full mitigation requires libexpat 2.8.0+ at runtime (or a distro-backported equivalent that exports XML_SetHashSalt16Bytes). - debian/patches/CVE-2026-7210.patch: backport of cpython 24b8f12544 (gh-149018, Stan Ulbrych). Adds a 16-byte hashsalt16 field to _Py_HashSecret.expat and prefers the new XML_SetHashSalt16Bytes API in both Modules/pyexpat.c (newxmlparseobject + capi export) and Modules/_elementtree.c (XMLParser.__init__); the legacy XML_SetHashSalt path is kept as fallback when the loaded libexpat does not export the new symbol. The symbol is declared __attribute__((weak)) in Modules/pyexpat.c so the same source path works whether the build links against bundled libexpat 2.8.0+ or a distro libexpat 2.5/2.7 that backports the entropy fix without bumping XML_COMBINED_VERSION (Debian, Ubuntu, RHEL/CL, Alpine). - CVE-2026-7210