* SECURITY UPDATE: Use-after-free because the application-supplied XML_Encoding.convert and XML_Encoding.release callbacks were left outside handler call depth tracking, so a same-parser call made from inside them freed state the running parse still owned (libexpat before 2.8.4) - debian/patches/CVE-2026-76957.patch: install the trampolines callUnknownEncodingConvert() and callUnknownEncodingRelease() in handleUnknownEncoding(), passing the parser itself to XmlInitUnknownEncoding() as the converter's user data, so the reentrancy counter is bumped around the application callbacks and the existing forbidden-call rejection rules apply to them too; routing release through the trampoline also clears m_unknownEncodingRelease/m_unknownEncodingData so it runs exactly once on every path; also carries upstream's regression test into tests/runtests.c (2.2.6 has neither tests/misc_tests.c nor tests/handlers.c, so the test brings a local equivalent of forbidden_calls_character_handler()) - CVE-2026-76957 * SECURITY UPDATE: Use-after-free because handler call depth tracking was absent entirely, leaving XML_GetBuffer, XML_Parse, XML_ParseBuffer, XML_ParserFree, XML_ParserReset and XML_ResumeParser callable from inside a handler, and the XML_TOK_DATA_CHARS handler calls in doCdataSection() untracked (libexpat before 2.8.2) - debian/patches/CVE-2026-56131.patch: introduce m_handlerCallDepth with beforeHandler()/afterHandler() around every handler invocation and isCalledFromInsideHandler() guards on the six affected entry points; this is the prerequisite the CVE-2026-76957 fix builds on, and it is the same 33-commit backport already shipped for expat 2.2.5 on ubuntu18.04els, regenerated against 2.2.6 - CVE-2026-56131 - CVE-2026-50219 - CVE-2026-56412