* SECURITY UPDATE: stack buffer overrun in libpq frontend large object interface via dangerous PQfn() with result_is_int=0 - debian/patches/CVE-2026-6477.patch: add buf_size parameter to pqFunctionCall3() and introduce private PQnfn() wrapper to validate that returned data fits in result_buf; update lo_read(), lo_lseek64() and lo_tell64() to pass their buffer sizes in src/interfaces/libpq/fe-exec.c, src/interfaces/libpq/fe-lobj.c, src/interfaces/libpq/fe-protocol3.c, src/interfaces/libpq/libpq-int.h and doc/src/sgml/libpq.sgml - CVE-2026-6477 * SECURITY UPDATE: covert timing channel in MD5 password comparison allows recovery of user credentials via authentication timing observations - debian/patches/CVE-2026-6478.patch: add timingsafe_bcmp() constant-time comparison helper from upstream and replace timing-leaky memcmp()/strcmp() in authentication paths (MD5 password verify, SCRAM ServerKey/StoredKey/ nonce checks, RADIUS response signature) in src/backend/libpq/auth.c, src/backend/libpq/auth-scram.c, src/backend/libpq/crypt.c, src/interfaces/libpq/fe-auth-scram.c, src/interfaces/libpq/Makefile, src/include/port.h, src/port/Makefile and src/port/timingsafe_bcmp.c - CVE-2026-6478