* SECURITY UPDATE: urllib.request HTTPPasswordMgr handed out credentials across URL schemes (CWE-523, unprotected transport of credentials). reduce_uri() reduces a URI to (authority, path) and drops the scheme, so add_password() and find_user_password() - and HTTPPasswordMgrWithPriorAuth update_authenticated()/is_authenticated() - treated "https://host/" and "http://host/" as the same URI. Credentials registered only for the TLS-protected origin were therefore sent in cleartext to an http:// URL reached through a downgrade or redirect. - debian/patches/CVE-2026-15806.patch: backport of cpython a2773a34183b7d94a243bb98fd658926cc5348ce (gh-155694, GH-155696), which adds _reduce_uri_with_scheme() and _is_suburi_with_scheme() and uses them in the password managers; a URI registered without a scheme still matches any scheme, keeping proxy authentication working. Includes the upstream regression tests in Lib/test/test_urllib2.py. - CVE-2026-15806 * SECURITY UPDATE: stringprep (the "idna" codec, IDNA 2003) case-folded characters using post-Unicode-3.2.0 data. RFC 3454 mandates Unicode 3.2.0, but map_table_b3() falls back to str.lower() for any codepoint missing from the generated b3_exceptions table, and str.lower() uses the interpreter's bundled Unicode (12.1.0 here). Characters that gained a lowercase mapping later - Cherokee, Cyrillic Palochka, Georgian Mtavruli, Adlam, ... - were folded, so different Python versions derived different A-labels for the same U-label. - debian/patches/CVE-2026-17084.patch: backport of cpython 1e54caa096678a38afcabecabb1ff72400dd6bae (gh-155292, GH-155293), which pins every such codepoint to itself in b3_exceptions, renames the 3.2.0 alias to unicodedata_320 and asserts the bundled unidata_version, plus the generator change in Tools/unicode/mkstringprep.py and the new idna test in Lib/test/test_codecs.py. The upstream table is specific to its UCD, so Lib/stringprep.py was regenerated with this version's own interpreter (UCD 12.1.0: 641 identity entries added). - CVE-2026-17084