* SECURITY UPDATE: urllib HTTPPasswordMgr credentials were not scoped by URL scheme - debian/patches/CVE-2026-15806.patch: add _reduce_uri_with_scheme() and _is_suburi_with_scheme() to Lib/urllib/request.py and use them in HTTPPasswordMgr and HTTPPasswordMgrWithPriorAuth, so credentials registered for an https:// URI are no longer handed out for http:// (cleartext leak after a downgrade or redirect). A URI registered without a scheme still matches any scheme, keeping proxy auth working. - CVE-2026-15806 * SECURITY UPDATE: stringprep applied post-Unicode-3.2.0 case mappings - debian/patches/CVE-2026-17084.patch: regenerate Lib/stringprep.py so b3_exceptions pins to itself every codepoint that the bundled UCD 15.0.0 case-folds but Unicode 3.2.0 does not, so the idna codec no longer folds them against RFC 3454. The table was regenerated with this version's own interpreter; mkstringprep.py and tests updated. - CVE-2026-17084