* SECURITY UPDATE: urllib.request HTTPPasswordMgr did not scope credentials by URL scheme (CWE-523, unprotected transport of credentials). reduce_uri() reduces a URI to an (authority, path) pair and drops the scheme, so credentials registered for 'https://host/' were also returned for 'http://host/'. An attacker able to force an HTTPS to HTTP downgrade or redirect therefore received the Basic-auth credentials in cleartext. - debian/patches/CVE-2026-15806.patch: backport of cpython a2773a34183b7d94a243bb98fd658926cc5348ce (gh-155694, GH-155696), which adds _reduce_uri_with_scheme() and _is_suburi_with_scheme() and uses them in HTTPPasswordMgr.add_password()/find_user_password() and HTTPPasswordMgrWithPriorAuth.update_authenticated()/is_authenticated(). A URI registered without a scheme still matches any scheme, which keeps proxy authentication working. Includes upstream's regression tests in Lib/test/test_urllib2.py. - CVE-2026-15806 * SECURITY UPDATE: stringprep (and so the 'idna' codec) applied case mappings from outside Unicode 3.2.0, which RFC 3454 mandates. map_table_b3() falls back to str.lower() for every codepoint not listed in b3_exceptions, and str.lower() uses the interpreter's own Unicode 15.1.0 data, so characters that gained a lowercase mapping after 3.2.0 (Cherokee, Georgian Mtavruli, Adlam, Cyrillic Palochka and others) were case-folded. Different Python versions derived different A-labels for the same U-label, breaking domain-name comparison and enabling spoofing. - debian/patches/CVE-2026-17084.patch: backport of cpython 1e54caa096678a38afcabecabb1ff72400dd6bae (gh-155292), which pins every such codepoint to itself in b3_exceptions, renames the 3.2.0 database alias to unicodedata_320 and asserts the generating unidata_version, plus the matching Tools/unicode/mkstringprep.py and Lib/test/test_codecs.py changes. The upstream table is specific to its Unicode database, so Lib/stringprep.py was regenerated with this version's own 3.13.15 interpreter (UCD 15.1.0) rather than copied. - CVE-2026-17084