* Non-maintainer upload by the TuxCare ELS team. * CVE-2026-45793: Stop echoing a rejected GitHub OAuth token in the "invalid characters" exception, accept the "-" used by GitHub Actions installation tokens, and mask modern GitHub tokens in debug output. - debian/patches/0022-CVE-2026-45793.patch * CVE-2026-59947: Mask credentials embedded in the user slot of a URL (https://TOKEN@host/) in Url::sanitize(), in -vvv command output and in the HTTP basic authentication debug message. - debian/patches/0023-CVE-2026-59947.patch * CVE-2026-59948: Validate every package resolved by the solver before it is locked or installed, rejecting invalid package names and source/dist URLs or references starting with "-", so a malicious repository cannot write files outside the vendor directory. - debian/patches/0024-CVE-2026-59948.patch * CVE-2026-59946: Reject package bin entries containing ".." path segments, which let a dependency chmod an arbitrary host file during install. - debian/patches/0025-CVE-2026-59946.patch * CVE-2026-84361: Reject Perforce source URLs that are not network endpoints, so an rsh:/jsh: P4PORT cannot make the p4 client run a local command. - debian/patches/0026-CVE-2026-84361.patch