* SECURITY UPDATE: buffer overrun in the script engine when a regex capture or non-cacheable variable changes size between the length and copy passes, as reachable via the map directive with a regex-derived capture - debian/patches/CVE-2026-42533.patch: add an e->end buffer-end pointer and an ngx_http_script_check_length() bounds guard to the script copy operations in src/http/ngx_http_script.{c,h} and src/stream/ngx_stream_script.{c,h}; add the missing i+1 < v->len bounds check before testing the byte after '$' in ngx_http_compile_complex_value and ngx_stream_compile_complex_value - CVE-2026-42533