* SECURITY UPDATE: mysql client built-in command processing (WL#16949) - debian/patches/CVE-2025-50081.patch: adds the --commands option to the mysql command-line client and disables all built-in command processing by default, so dump/batch input can no longer invoke client commands. Keeping the commands-off default is deliberate and follows upstream 9.4.0: with commands left enabled the CVE would only be mitigable, not mitigated. - Behavior changes when commands are disabled (the default): + Built-in commands (help, source, system/\!, \g, ...) are rejected; only delimiter and charset (\C) survive. Batch runs abort on the first rejected command line ("batch" means stdin OR stdout is not a tty, so "mysql db > out.txt" is batch too). + --one-database stops tracking USE statements, so it no longer filters once the input switches databases: statements for every database in the dump are executed. Combine --one-database with --commands to keep the old filtering. + Opt-out: pass --commands, or set commands=1 in the [mysql] section of a config file. Do not put it in [client]: other client tools (mysqldump, mysqladmin, mysqlbinlog) reject it as an unknown variable. + Enabling --commands on 9.0.x restores the full pre-CVE system/\! shell escape: the per-command --system-command guard (WL#16482) is 9.1.0+ only and is not backported. - CVE-2025-50081