* SECURITY UPDATE: DoS in CGI::Cookie.parse via repeated cookie names - debian/patches/CVE-2025-27219.patch: merge repeated cookie values in place with cookies[name].concat(values) instead of the super-linear values = cookies[name].value + values, so a Cookie: header repeating one name parses in O(n) instead of O(n**2). Adapted byte-identically from upstream ruby/cgi@9907b76. - CVE-2025-27219 * SECURITY UPDATE: ReDoS in CGI::Util#escapeElement - debian/patches/CVE-2025-27220.patch: replace the lazy backtracking element matcher ((?:.|\n)*?>) in escapeElement and unescapeElement with possessive/atomic forms that cannot backtrack, so a crafted unterminated tag no longer triggers catastrophic backtracking. Adapted byte-identically from upstream ruby/cgi@c9d1311; the upstream unclosed-tag regression tests are added to test/cgi/test_cgi_util.rb. - CVE-2025-27220 * SECURITY UPDATE: URI password leak when combining URIs (CVE-2025-27221 bypass) - debian/patches/CVE-2025-61594.patch: clear userinfo fully in set_userinfo/set_user, clear it on host=/port=, add an authority reader and protected set_authority setter, and make merge replace the whole authority atomically so combining a base URI with a relative one no longer carries the base password to a new host. Backported from upstream ruby/uri d3116ca ("Clear user info totally..." fixing CVE-2025-27221, plus "Add authority accessor"); the merge() hunk is adapted to uri 0.10.0.2's layout. The test/uri/test_generic.rb#test_set_component expectations are updated and a test_merge_does_not_leak_credentials test is added. - CVE-2025-61594