* SECURITY UPDATE: arbitrary code execution in the python and python3 omni-completion plugins: Completer.evalsource() executed import and from statements harvested from the current buffer through Python's import machinery, and because the buffer's directory is on sys.path, opening a hostile .py file alongside a sibling package ran attacker controlled code on omni-completion. - debian/patches/CVE-2026-52858.patch: skip execution of buffer level import/from statements unless the user opts in by setting g:pythoncomplete_allow_import, and re-import the vim module inside evalsource() so the opt-in is honoured, in runtime/autoload/python3complete.vim and runtime/autoload/pythoncomplete.vim; matches upstream patches 9.2.0561 and 9.2.0568. - CVE-2026-52858 * SECURITY UPDATE: arbitrary code execution in the python and python3 omni-completion plugins: the completion code reconstructed function and class definitions from the current buffer and ran them through exec(), and because Python evaluates parameter default values, parameter annotations and class base expressions at definition time, a hostile buffer could execute attacker controlled expressions via crafted def/class headers; the g:pythoncomplete_allow_import mitigation did not cover this path. - debian/patches/CVE-2026-52860.patch: strip default values and annotations from reconstructed function parameter lists and whitelist class base lists to dotted names before the generated source reaches exec(), in runtime/autoload/python3complete.vim and runtime/autoload/pythoncomplete.vim; matches upstream patch 9.2.0597. - CVE-2026-52860