* SECURITY UPDATE: libcurl could reuse a connection for a STARTTLS transfer despite a mismatched TLS configuration. - debian/patches/CVE-2026-8286.patch: add an SSL-config match check before reusing a connection for a clear-text protocol that requests TLS, in lib/url.c. - CVE-2026-8286 * SECURITY UPDATE: a trailing-dot cookie domain could bypass the Public Suffix List check and set a super-cookie. - debian/patches/CVE-2026-8924.patch: trim trailing dots from the domains before the PSL check in lib/cookie.c. - CVE-2026-8924 * SECURITY UPDATE: libcurl could send proxy Digest credentials to the wrong proxy when the proxy is selected from environment variables on a reused handle. - debian/patches/CVE-2026-8927.patch: clear the proxy Digest state when the environment proxy changes, in lib/url.c and lib/urldata.h. - CVE-2026-8927