* SECURITY UPDATE: urllib.request handed out credentials registered for an https:// URI to the matching http:// URI. HTTPPasswordMgr.reduce_uri() drops the scheme, and add_password()/find_user_password() compared only the reduced (authority, path) pair, so an attacker able to force an HTTPS-to-HTTP downgrade or redirect received the Basic-auth credentials in cleartext. HTTPPasswordMgrWithPriorAuth had the same flaw in update_authenticated()/is_authenticated(). Credentials are now scoped by scheme; a URI registered without a scheme still matches any scheme, which keeps proxy authentication working. - debian/patches/CVE-2026-15806.patch: backport of cpython a2773a34183b7d94a243bb98fd658926cc5348ce (gh-155694, GH-155696), the 3.13-branch form of the fix. The code change and the three new tests in Lib/test/test_urllib2.py are upstream's verbatim; only hunk offsets were re-cut. - CVE-2026-15806 * SECURITY UPDATE: the stringprep module, used by the "idna" codec (IDNA 2003), applied post-Unicode-3.2.0 case mappings that RFC 3454 forbids. map_table_b3() falls back to str.lower(), which uses the interpreter's own Unicode 11.0.0 data, for every codepoint missing from the generated b3_exceptions table, so characters that gained a lowercase mapping after 3.2.0 (Cherokee, Cyrillic Palochka, Georgian Mtavruli, Adlam, ...) were case-folded, and different Python versions derived different A-labels for the same domain name. - debian/patches/CVE-2026-17084.patch: backport of cpython 1e54caa096678a38afcabecabb1ff72400dd6bae (gh-155292, GH-155293), the 3.14-branch form of the fix, covering Lib/stringprep.py, Tools/unicode/mkstringprep.py and the new idna test in Lib/test/test_codecs.py. - The b3_exceptions table is generated from the running interpreter's Unicode database, so upstream's Unicode 16.0.0 table does not apply. Lib/stringprep.py was regenerated with the patched mkstringprep.py under this version's own interpreter (Unicode 11.0.0), adding 634 identity entries. The new unidata_version assertion makes a future Unicode database bump fail loudly instead of leaving the table stale. - CVE-2026-17084 * The Misc/NEWS.d fragments and documentation changes of both upstream commits are omitted, as is the Tools/unicode/makeunicodedata.py hook, which only matters when the bundled Unicode database is rebuilt.