* SECURITY UPDATE: EXPLAIN crash in optimizer const table extraction - debian/patches/CVE-2026-21968.patch: EXPLAIN SELECT crashes when querying LEFT JOIN with derived tables containing stored functions and GROUP BY. The optimizer incorrectly marks such derived tables as const during EXPLAIN mode; backport adds is_const_optimizable() guard to three const-extraction code paths to prevent materializing derived tables with stored programs in EXPLAIN mode. - CVE-2026-21968 * SECURITY UPDATE: null dereference in Value_generator print_expr - debian/patches/CVE-2026-21937.patch: expr_item is nullptr when a functional index exceeds MI_MAX_KEY_LENGTH (767 bytes); MySQL stores expr_str but leaves expr_item null, causing a crash when print_expr() is called (e.g., SHOW CREATE TABLE). Backport adds an expr_item null guard in Value_generator::print_expr() and falls back to printing expr_str when the Item tree has not been unpacked. - CVE-2026-21937 * SECURITY UPDATE: PASSWORD EXPIRE not enforced for externally authenticated users - debian/patches/CVE-2026-21965.patch: The condition in set_and_validate_user_attributes() checking whether a plugin supports password expiration covered only the interval-based form (PASSWORD EXPIRE INTERVAL N DAY), missing the direct PASSWORD EXPIRE clause. Backport expands the condition to also check update_password_expired_column, so all non-default PASSWORD EXPIRE forms are rejected for plugins that do not support expiration. Additionally removes a redundant expiration check from mysql_alter_user() that was already subsumed by set_and_validate_user_attributes(). - CVE-2026-21965 * SECURITY UPDATE: assertion crash on bulk GIS insert into temp table - debian/patches/CVE-2026-21936.patch: Bulk inserts into a temporary table with a GIS secondary index crash via InnoDB assertion: when B-tree optimistic descent fails and a new mtr is started, the mtr log mode defaults to MTR_LOG_ALL instead of MTR_LOG_NO_REDO required for temporary tables. The backport adds an is_temporary() check immediately after mtr_start() to re-set the log mode to MTR_LOG_NO_REDO. - CVE-2026-21936