* SECURITY UPDATE: html.parser.HTMLParser incremental parsing could be driven into quadratic-time CPU consumption. Each feed() concatenated new data onto the unparsed buffer and re-scanned it from the start, so feeding a long unterminated construct (tag, comment, declaration, PI, CDATA) in many small chunks was quadratic in the input size — a denial of service (CWE-407). - debian/patches/CVE-2026-15308.patch: backport of cpython bcf98ddbc4 (gh-153030, PR gh-153031; adapted from the 3.13 backport 7933f4bf71). feed() now accumulates incoming data in a list and only joins and parses it once the buffer has doubled, and close() flushes any pending data before the final scan. - CVE-2026-15308