* SECURITY UPDATE: integer overflow in the pixel cache staging buffer size - debian/patches/CVE-2026-106571.patch: use overflow-checked multiplications for the staging buffer size in SetPixelCacheNexusPixels() in magick/cache.c - CVE-2026-106571 * SECURITY UPDATE: coder security policy bypass - debian/patches/CVE-2026-106579.patch: check the coder name against the coder policy at all four decoder and encoder calls, including the WriteImage() fallback, in magick/constitute.c, and make the piddle Magick++ demo tolerate the MVG write that the policy now denies in Magick++/demo/piddle.cpp - CVE-2026-106579 * SECURITY UPDATE: PostScript code injection through image labels - debian/patches/CVE-2026-106577.patch: add coders/ghostscript-private.h with a shared EscapeParenthesis() that also escapes backslashes and trims the label, and use it for the PS, PS2, PS3 and PDF labels, the PDF title and producer, and the RenderPostscript() text in magick/annotate.c - CVE-2026-106577