* CVE-2026-15308: fix quadratic-complexity CPU denial-of-service in html.parser.HTMLParser incremental parsing. When an unterminated construct (tag or comment) spanned many feed() calls, the growing buffer was rescanned and concatenated on every call. New data is now accumulated in a list and only joined and parsed once enough has piled up; close() flushes any buffered data before the final parse. - debian/patches/CVE-2026-15308.patch: backport upstream bcf98ddbc40ec9b3ee87da0124a5660b19b7e606 (gh-153030 / gh-153031).