* SECURITY UPDATE: improper validation of bracketed hosts in urlparse - debian/patches/CVE-2024-11168.patch: backport of cpython b2171a2fd4 (gh-103848). urlparse.urlsplit() accepted bracketed hosts that are neither valid IPv6 nor IPvFuture literals. Adds _check_bracketed_host() to Lib/urlparse.py, called from both the "http" fast-path and the generic branch. Python 2.7 has no ipaddress module, so the bracket content is validated with socket.inet_pton() (IPv4 in brackets rejected; otherwise must parse as IPv6). - CVE-2024-11168 * SECURITY UPDATE: NULL deref in bundled libexpat XML_StopParser - debian/patches/CVE-2024-50602.patch: backport of libexpat PR #915 (51c7019069b8) into the bundled Modules/expat/ (2.2.8). XML_StopParser() on a parser in the XML_INITIALIZED state left it in a state where XML_ResumeParser() crashed via a NULL dereference. XML_StopParser() now refuses to stop/suspend an unstarted parser, returning the new XML_ERROR_NOT_STARTED. - CVE-2024-50602 * SECURITY UPDATE: square brackets allowed in parsed URL domain names - debian/patches/CVE-2025-0938.patch: backport of cpython b8b4b713c5 (gh-105704). Completes CVE-2024-11168 by rejecting square brackets in plain domain names. Adds _check_bracketed_netloc() to Lib/urlparse.py (mirroring NetlocResultMixins._hostinfo()) and uses it in both branches of urlsplit() in place of the inline bracket extraction. - CVE-2025-0938