* SECURITY UPDATE: hostname verification silently skipped by SSLContext.wrap_bio() when no server_hostname is given - debian/patches/CVE-2026-19553.patch: in Lib/ssl.py, validate the wrap_bio() arguments like wrap_socket() does: reject server_hostname and session in server mode, and emit a DeprecationWarning when check_hostname is enabled but server_hostname is None, so a client that verified the certificate chain but never the peer's identity is no longer silent about it (asyncio's create_connection()/start_tls() reach this path too). Backport of upstream commit 5867d4e4ae6d (gh-156793 / GH-158503, 3.10 branch, which warns instead of raising ValueError for backward compatibility). Bundles the upstream regression tests (test_ssl.py, test_sslproto.py), adapted to the 3.7 test.support API. - CVE-2026-19553 * SECURITY UPDATE: use-after-free in the SSL servername (SNI) callback - debian/patches/CVE-2026-19445.patch: in Modules/_ssl.c, look the SSLContext up from the connection instead of the borrowed pointer registered with OpenSSL, hold strong references to it and to the callback while they are used, and unregister the callback when the context is deallocated, so a TLS client can no longer make a server call through a freed SSLContext after sni_callback switched the connection to another context. Backport of upstream commit ec44b5a3258c (gh-156293 / GH-158504, 3.10 branch); Py_NewRef() is replaced by Py_INCREF() for 3.7. Bundles the upstream regression tests (test_ssl.py), adapted to the 3.7 test.support API. - CVE-2026-19445