* SECURITY UPDATE: XML injection via malformed UTF-16 input: a high surrogate not followed by a low surrogate is accepted and consumes the following code unit, hiding markup characters from the parser (libexpat through 2.8.4) - debian/patches/CVE-2026-93990.patch: reject a UTF-16 high surrogate whose second code unit is not a low surrogate by defining IS_INVALID_CHAR (and isInvalid4 for XML_MIN_SIZE) for the little2_/big2_ encodings; also carries upstream's regression test into tests/runtests.c - CVE-2026-93990 * SECURITY UPDATE: Denial of service via quadratic complexity in storeAtts(), which scanned elementType->defaultAtts linearly to determine the CDATA status of every non-normalized attribute (libexpat through 2.8.3) - debian/patches/CVE-2026-66046.patch: store the index of the first default attribute declaration in the per-element hash table and use a hash lookup instead of the linear scan; includes upstream's follow-up for dtdCopy() so that external entity parsers do not read past the hash table entries - CVE-2026-66046