* SECURITY UPDATE: authorization bypass in "auth users" @Group Name parsing - debian/patches/CVE-2026-70463.patch: tokenise the "auth users" value with conf_strtok() in authenticate.c, imported into util.c and declared in proto.h, so a leading comma splits on commas alone and an @Group Name entry containing a space is no longer torn in two and its deny rule silently discarded - CVE-2026-70463 * SECURITY UPDATE: daemon filter-merge bypass of the module filter list - debian/patches/CVE-2026-53786.patch: strip module_dirlen from an absolute --filter merge path in parse_filter_file() in exclude.c before checking it against daemon_filter_list, so an anchored module-relative daemon rule matches, and treat a merge file hidden by the daemon filter as non-existent instead of a fatal error - CVE-2026-53786 * SECURITY UPDATE: daemon NULL dereference on a non-directory transfer root - debian/patches/CVE-2026-70459.patch: reject a "." or "/." transfer-root entry that is not a directory in recv_file_entry() in flist.c, instead of dereferencing it as a directory structure pointer, and require dir_flist to actually hold an entry in recv_file_list() before trusting parent_ndx 0, closing the second route to the same uninitialised dir_flist->files[0] - CVE-2026-70459 * SECURITY UPDATE: --delete scope widening via implied-parent reclassification - debian/patches/CVE-2026-53789.patch: add is_implied_parent_dir() to exclude.c and use it in recv_file_entry() in flist.c to force an implied parent directory back to the honest XMIT_TOP_DIR|XMIT_NO_CONTENT_DIR encoding, so it lands in FLAG_IMPLIED_DIR and delete_in_dir() cannot sweep pre-existing siblings; also covers the synthetic transfer-root entry and the legacy protocol < 30 XMIT_TOP_DIR path - CVE-2026-53789