* SECURITY UPDATE: Denial of service through oversized time-series bucket writes - debian/patches/CVE-2025-13507.patch: reject time-series bucket inserts and updates that would exceed the maximum BSON size and count the meta field in bucket size estimates - CVE-2025-13507 * SECURITY UPDATE: Denial of service through unbounded memory use in aggregation expressions - debian/patches/CVE-2026-13056.patch: limit the memory a single $array, $object, $concatArrays, $setUnion, $zip, $map or $reduce expression can use - CVE-2026-13056 * SECURITY UPDATE: Use-after-free through a cached JavaScript emit function - debian/patches/CVE-2026-8336.patch: clear the emit state after each evaluation and reject calls to a stale emit function - CVE-2026-8336