* SECURITY UPDATE: Heap buffer overflow via crafted HTML attribute encoding - debian/patches/CVE-2026-58472.patch: use size_t with INT_ADD_OK overflow checks when accumulating the encoded output size in html_quote_string() in src/convert.c, aborting on overflow instead of under-allocating - CVE-2026-58472 * SECURITY UPDATE: Heap buffer overflow in filename charset conversion - debian/patches/CVE-2026-58471.patch: correctly recompute the remaining output space on the iconv E2BIG reallocation path in convert_fname() in src/url.c - CVE-2026-58471 * SECURITY UPDATE: Heap buffer underread via all-whitespace Metalink URL - debian/patches/CVE-2026-58469.patch: add an end > beg bounds check in clean_metalink_string() in src/metalink.c to avoid decrementing the pointer before the start of the buffer - CVE-2026-58469