* SECURITY UPDATE: Double free in moduleTimerHandler() when a module timer callback stops the currently firing timer - debian/patches/CVE-2026-82677.patch: save the timer ID before running the callback and only remove and free the timer afterwards if that ID still maps to the same live timer in the Timers radix tree, so a callback calling RedisModule_StopTimer() on itself no longer causes the dispatcher to free the timer a second time - CVE-2026-82677 * SECURITY UPDATE: Use-after-free in ready-key blocked client iteration - debian/patches/CVE-2026-82631.patch: snapshot the IDs of the clients blocked on a ready key and re-resolve each one from the live waiter list before serving it, so serving one client that frees or unblocks another waiter can no longer leave the list iterator on a freed node - CVE-2026-82631