* SECURITY UPDATE: urllib HTTPPasswordMgr handed out credentials for a different URL scheme - debian/patches/CVE-2026-15806.patch: add _reduce_uri_with_scheme() and _is_suburi_with_scheme() and use them in HTTPPasswordMgr.add_password() and find_user_password() and in HTTPPasswordMgrWithPriorAuth's update_authenticated() and is_authenticated(). reduce_uri() dropped the scheme, so credentials registered for "https://host/" were also returned for "http://host/", and an attacker able to force an HTTPS to HTTP downgrade or redirect received them in cleartext. A URI registered without a scheme still matches any scheme, which keeps proxy authentication working. Also carries upstream's two new test_urllib2 tests. Upstream commit a2773a34183b - CVE-2026-15806 * SECURITY UPDATE: stringprep applied post-Unicode-3.2.0 case mappings - debian/patches/CVE-2026-17084.patch: regenerate Lib/stringprep.py so that b3_exceptions pins every codepoint that this interpreter's Unicode 14.0.0 case-folds but Unicode 3.2.0 does not to itself (684 entries). map_table_b3() fell back to str.lower(), which uses the bundled UCD, so the idna codec case-folded characters such as Cherokee, Cyrillic Palochka and Georgian Mtavruli that RFC 3454 requires to be left alone, and different Python versions derived different A-labels for the same name. The module now asserts the UCD version it was generated for. The table is specific to the bundled UCD, so it was regenerated with this version's own interpreter rather than copied from upstream; Tools/unicode/mkstringprep.py gains the generation loop and upstream's idna regression test is carried in test_codecs. Upstream commit 1e54caa09667 - CVE-2026-17084