* SECURITY UPDATE: silently incorrect regular expression matches from oversized tries - debian/patches/CVE-2026-13221.patch: skip building a trie when the delta between the first branch and the shared tail would overflow the 16-bit next_off field in S_study_chunk() in regcomp.c; add a regression test in t/re/pat_advanced.t; backported from upstream commit 03f74bbbd3a68350d926ee93d56ee4808c28c4c7. - CVE-2026-13221 * SECURITY UPDATE: out-of-bounds heap read in pack/unpack - debian/patches/CVE-2026-57432.patch: croak when the computed structure size would overflow SSize_t and harden the B/b and H/h length calculations in S_measure_struct() in pp_pack.c; document the new diagnostic in pod/perldiag.pod; backported from upstream commits 5f7eb6bbbe0510964e3fb1d6bb691e5445913e55 and 40754edc72dd3e513d758153c0e2f0215897740e. - CVE-2026-57432