* SECURITY UPDATE: CPython's SourcelessFileLoader read legacy .pyc files with a plain _io.FileIO instead of io.open_code(), because FileLoader.get_data() only routed SourceLoader and ExtensionFileLoader subclasses through open_code(). A PEP 578 open_code hook installed to vet code before it is executed was therefore not consulted when a sourceless .pyc was imported, letting code loaded that way escape such validation (CWE-668). - debian/patches/CVE-2026-2297.patch: backport of cpython a51b1b51 (gh-145506). SourcelessFileLoader is added to the open_code() branch of FileLoader.get_data(). As in the upstream 3.10 backport 876858c9, the frozen Python/importlib_external.h is regenerated as well - the interpreter executes the frozen blob, not the .py file, and the Debian recipe does not run "make regen-all". - CVE-2026-2297 * SECURITY UPDATE: xml.etree.ElementTree.Element.findall(), a fully consumed Element.iterfind(), and Element.find() when the first match sits near the end of the sibling list had O(n**2) time complexity for XPath index predicates ([1], [last()], [last()-N]), because the predicate re-ran parent.findall(tag) for every candidate sibling. Parsing an attacker-supplied XML document with many same-tag siblings could therefore consume excessive CPU time (CWE-407, inefficient algorithmic complexity). - debian/patches/CVE-2026-6879.patch: backport of cpython 2ffab083 (gh-152674). The (parent, tag) lookup is cached so each sibling group is scanned once. - CVE-2026-6879