* SECURITY UPDATE: memory denial of service via attacker-controlled Content-Length in http.client - debian/patches/CVE-2025-13836.patch: rewrite Lib/http/client.py _safe_read to read large responses in geometrically-growing chunks bounded by _MIN_READ_BUF_SIZE (1 MiB), preventing OOM when a malicious server advertises a large Content-Length without sending matching data. Adapted from cpython 3.10 backport 5dc101675fd - CVE-2025-13836 * SECURITY UPDATE: command injection in webbrowser.open() via leading dash in URL - debian/patches/CVE-2026-4519.patch: add BaseBrowser._check_url static method that rejects URLs whose lstripped form starts with a dash, and call it at the start of every open() method in GenericBrowser, BackgroundBrowser, UnixBrowser, Konqueror, Grail, WindowsDefault, MacOSX, and MacOSXOSAScript. Adapted from cpython 3.10 backports ad4d5ba32af and 591ed890270; sys.audit() context lines absent in 3.7 (added in 3.8) so the check is inserted as the first statement of each open() - CVE-2026-4519