* SECURITY UPDATE: server crash from out-of-memory when expressions build very large intermediate arrays or objects - debian/patches/CVE-2026-13056.patch: add the internalQueryMaxExpressionOutputBytes limit and enforce it in $array, $concatArrays, $object, $setUnion and $zip - CVE-2026-13056 * SECURITY UPDATE: users with limited privileges may kill cursors of other users through killCursors - debian/patches/CVE-2025-13643.patch: recheck killCursors authorization under the cursor manager lock right before the cursor is killed, on both mongod and mongos - CVE-2025-13643 * SECURITY UPDATE: unauthorized data access through a client-supplied $mergeCursors aggregation stage - debian/patches/CVE-2025-6713.patch: mark $mergeCursors as internal so it requires the internal privilege on the cluster resource - CVE-2025-6713