* SECURITY UPDATE: urllib2 HTTPPasswordMgr credentials were not scoped by URL scheme. reduce_uri() drops the scheme, so credentials registered for "https://host/" were also returned for "http://host/", and an attacker able to force an HTTPS-to-HTTP downgrade or redirect received the Basic-auth credentials in cleartext. A URI registered without a scheme still matches any scheme, which keeps proxy authentication working. - debian/patches/CVE-2026-15806.patch: backport of cpython a2773a34183b7d94a243bb98fd658926cc5348ce (gh-155694, GH-155696), re-cut for Lib/urllib2.py. HTTPPasswordMgrWithPriorAuth does not exist in 2.7, so its hunk and test are dropped; the new tests are doctests, in the style of the existing password-manager tests. - CVE-2026-15806 * SECURITY UPDATE: stringprep applied post-Unicode-3.2.0 case mappings. map_table_b3() falls back to unicode.lower(), which uses the interpreter's bundled Unicode 5.2.0 data, so characters that gained a lowercase mapping after Unicode 3.2.0 (Georgian, Palochka, ...) were case-folded by the idna codec against RFC 3454. - debian/patches/CVE-2026-17084.patch: backport of cpython 1e54caa096678a38afcabecabb1ff72400dd6bae (gh-155292, GH-155293). The b3_exceptions table is generated from the running interpreter's UCD, so upstream's Unicode 16.0.0 table does not apply; it was regenerated with this version's own interpreter (UCD 5.2.0, 280 identity entries). - CVE-2026-17084