* SECURITY UPDATE: "auth users" authorization bypass on entries containing a space - debian/patches/CVE-2026-70463.patch: parse the "auth users" value with conf_strtok() in auth_server(), so the documented leading-comma form splits on commas alone and an "@Group Name:deny" entry is no longer torn in two -- discarding the deny rule and creating an implicit allow rule from its first word; import conf_strtok() into util.c, which this version does not yet carry; document the leading-comma form in rsyncd.conf.yo and in the pre-generated rsyncd.conf.5 (this tree ships no yodl2man, so only the .5 is installed), without which an admin is never told the form that activates the fix; and add testsuite/cve-2026-70463.test - CVE-2026-70463 * SECURITY UPDATE: daemon filter-merge bypass of the module filter list - debian/patches/CVE-2026-53786.patch: in parse_filter_file(), strip the module_dir prefix that parse_merge_name() prepended before checking a client-supplied --filter merge file against daemon_filter_list, so the anchored module-relative daemon rule can match; the strip is conditional on the prefix really being present so the daemon's own "include from" / "exclude from" and get_cvs_excludes() paths are not truncated; upstream's early return on a daemon-filter hit is deliberately not taken, since without v3.5.0's daemon_config_filter_file exemption it would silently drop the operator's own "include from" / "exclude from" rules and, without v3.5.0's name+errno suppression, would leave hidden merge files silent while missing ones stay fatal; add testsuite/cve-2026-53786.test - CVE-2026-53786 * SECURITY UPDATE: daemon NULL dereference on a non-directory first file-list entry - debian/patches/CVE-2026-70459.patch: reject a "." or "/." transfer-root entry whose mode is not a directory in recv_file_entry(), and require dir_flist to actually hold an entry in recv_file_list() before trusting parent_ndx 0, closing the wild-pointer read that crashes the per-connection daemon child - CVE-2026-70459 * SECURITY UPDATE: --delete scope widening via implied-parent reclassification - debian/patches/CVE-2026-53789.patch: add is_implied_parent_dir() to exclude.c and use it in recv_file_entry() to force an implied parent back to the honest XMIT_TOP_DIR | XMIT_NO_CONTENT_DIR encoding, on both the protocol >= 30 and the legacy protocol < 30 paths, so it lands in FLAG_IMPLIED_DIR and delete_in_dir() cannot sweep pre-existing siblings outside the intended destination subtree - debian/patches/CVE-2022-29154-2.patch: drop the trailing slash in add_implied_include(), completing the upstream CVE-2022-29154 series this branch carries, so a "src/dir/" argument seeds the requested leaf as a plain include rule instead of a FILTRULE_DIRECTORY one; without it is_implied_parent_dir() would classify the explicitly requested directory as an implied parent and --delete would stop pruning it - CVE-2026-53789