* SECURITY UPDATE: internal robustness fix in schematron report formatting - debian/patches/libxml2-2.10.2-CVE-2025-49795.patch: check the result of xmlXPathCompiledEval() in xmlSchematronFormatReport() before reading it, so a report whose select expression does not compile is handled on the existing early-exit path instead, and free the compiled expression and the select string inside the guard so a hostile schema cannot leak once per matching node per rule; backport of upstream 499bcb78 and its required follow-up 24d7e159 - CVE-2025-49795 * SECURITY UPDATE: security hardening for fields shared with libxslt - debian/patches/libxml2-2.10.2-CVE-2025-7425.patch: read xmlAttr.atype, xmlNode.extra and xmlDoc.properties through masking accessors, so the upper bits libxslt stores its own flags in cannot disturb libxml2's ID bookkeeping; backport of Red Hat's c9s libxml2-2.9.13-CVE-2025-7425.patch - CVE-2025-7425