* SECURITY UPDATE: double free in the Onigmo regexp parser - debian/patches/CVE-2026-89078.patch: build the alternation node in a local topnode instead of the caller's *top, so a branch that fails to parse is not freed by both parse_subexp() and onig_parse_tree(), and free the half-built failed branch as well; backport of upstream ruby/ruby 35000ac2ed plus its required follow-up bf937bfa16 (bug #13332 and bug #22384, Ruby 4.0.0) - CVE-2026-89078 * SECURITY UPDATE: integer overflow in the size of a compiled Onigmo pattern - debian/patches/CVE-2026-93577.patch: compare against the quantifier expansion limit by division instead of multiplying two ints whose product wraps, and cap the emitted program at MAX_COMPILED_PROGRAM_SIZE in add_opcode() with the new ONIGERR_TOO_BIG_COMPILED_PROGRAM, so a program past INT_MAX can no longer wrap the offsets emitted into it; backport of upstream ruby/ruby 7cfe8dc82f + cf35145fc4 + the follow-up 16d8a554b2 (bug #19020, Ruby 4.0.8) - CVE-2026-93577 * SECURITY UPDATE: integer overflow in the CI/CD regexp compiler path - debian/patches/CVE-2026-93577.patch: same Ruby defect and same fix as CVE-2026-93577 above, filed separately by GitLab for a second reporting path (bug #19020, Ruby 4.0.8) - CVE-2026-97229 * SECURITY UPDATE: overflow of the Onigmo repeat and null-check IDs - debian/patches/CVE-2026-110264.patch: raise the new ONIGERR_TOO_MANY_RANGE_REPEAT and ONIGERR_TOO_MANY_NULL_CHECK as soon as reg->num_repeat or reg->num_null_check cast to MemNumType goes non-positive, so an ID emitted into the compiled program can no longer wrap past 32767 and alias another construct's match state; backport of upstream ruby/ruby 493d26dcde (bug #16801, Ruby 4.0.9) - Behaviour change inherited from upstream: a regexp with more than 32767 bounded repeats or empty-check groups now raises RegexpError (SyntaxError for a literal) where it previously compiled and matched against aliased state - CVE-2026-110264