* SECURITY UPDATE: ACL mask crash prevention - debian/patches/CVE-2024-21127.patch: The patch defines an explicit all-access mask from NUM_ACLS and replaces complement-based all-privilege assignments. This prevents invalid high-order ACL bits from reaching an out-of-bounds access path. - CVE-2024-21127 * SECURITY UPDATE: mysqldump tablespace metadata not escaped or validated - debian/patches/CVE-2024-21247.patch: mysqldump emitted tablespace metadata into dump SQL without escaping or validating it, so crafted identifiers and numeric fields carried unescaped into the dump, an improper-access-control issue (CWE-284) in MySQL Client exploitable by replaying such a dump. The patch escapes and quotes metadata fields with their own identifier quote and validates numeric values. Together with the string-escaping fix already shipped in CVE-2025-30722.patch this covers the full mysqldump fix set for this CVE. - CVE-2024-21247 * SECURITY UPDATE: GROUP BY hash collision degradation - debian/patches/CVE-2024-20961.patch: unique_hash() combined per-field hashes with a bare XOR, so equal consecutive GROUP BY fields cancelled out and collapsed every row onto one hash bucket, letting an ordinary-privilege GROUP BY exhaust CPU. The patch combines hashes with my_hash_combine() instead. - CVE-2024-20961