* SECURITY UPDATE: experimental policy bypass via mainModule.__proto__ - debian/patches/CVE-2023-30581.patch: set the policy-wrapped require on Module.prototype and assign process.mainModule via setOwnProperty so process.mainModule.__proto__.require() can no longer load modules not declared in the policy manifest (backport of nodejs/node d0a8264ec9); includes the upstream regression test in test/parallel/test-policy-manifest.js adapted for node 12 (new policy-manifest fixtures) - CVE-2023-30581 * SECURITY UPDATE: HTTP/2 Rapid Reset denial of service - debian/patches/CVE-2023-44487.patch: backport the nghttp2 RST_STREAM rate-limit mitigation into bundled deps/nghttp2 (token-bucket limiter, default burst 1000 / rate 33, GOAWAY with INTERNAL_ERROR on exhaustion) so rapidly reset HTTP/2 streams no longer exhaust server resources (backport of nghttp2 72b4af6, shipped in nghttp2 1.57.0) - CVE-2023-44487