* SECURITY UPDATE: xml.etree.ElementTree's find(), findall() and iterfind() had quadratic complexity when an XPath index predicate ([1], [last()], [last()-N]) was evaluated against a document with many same-tag siblings. The [index] selector called parent.findall(tag) once per candidate element, and each such call is itself linear in the number of siblings, allowing a CPU denial-of-service on untrusted XML or untrusted XPath (CWE-407, algorithmic complexity). - debian/patches/CVE-2026-6879.patch: backport of cpython 2ffab083 (gh-152674, Petr Viktorin) taken via the upstream 3.12 backport 96510a37. The [index] selector now caches the resolved element per (parent, tag), so parent.findall() runs once per parent instead of once per candidate. The code change is verbatim: the pre-fix select() body in 3.6.15 is identical to the one upstream changed, so only line offsets differ. The regression test is added to test_xml_etree.py unchanged (it uses f-strings, available since 3.6); the Misc/NEWS.d/next/Security fragment is omitted as 3.6.15 ships a single Misc/NEWS. - CVE-2026-6879