* SECURITY UPDATE: sdist could include files excluded by MANIFEST.in - debian/patches/CVE-2026-59890.patch: normalize the Unicode form when matching MANIFEST.in patterns, backport of pypa/setuptools dd9f436a36486b4cb8a4c70a2321548b0be09b8f (GHSA-h35f-9h28-mq5c). FileList compiled each exclude/global-exclude/recursive-exclude/prune glob to a regex and matched it byte-for-byte against the on-disk file name, so a rule authored in NFC did not match a name stored in NFD and the intended exclusion silently failed, packing the file into the sdist. - CVE-2026-59890