* SECURITY UPDATE: daemon module-root chdir escape under `use chroot = no` - debian/patches/CVE-2026-53784.patch: add safe_open_no_attacker_symlinks() to util.c and route change_dir()'s daemon module-root chdir through it, so a planted parent-component symlink no longer moves the daemon's CWD outside the module; a symlink is followed only when owned by uid 0 or our euid - CVE-2026-53784 * SECURITY UPDATE: arbitrary file read via symlinked operator input paths - debian/patches/CVE-2026-53802.patch: open --filter merge files (including per-directory merges and -C .cvsignore), --files-from/--include-from/ --exclude-from (exclude.c) and the --password-file / daemon secrets file (authenticate.c) through the same ownership-checked walk, so a planted symlink cannot feed an arbitrary file to the filter parser or the authentication response - CVE-2026-53802 * SECURITY UPDATE: arbitrary file write via symlinked operator output paths - debian/patches/CVE-2026-53803.patch: open --log-file (log.c), the --write-batch/--read-batch files (batch.c and main.c) and the daemon motd, lock and --config paths (clientserver.c, connection.c, params.c) through the same ownership-checked walk, so a planted symlink cannot redirect a privileged write, and require --read-batch to name a regular file or a FIFO - CVE-2026-53803 * NOTE: the ownership-checked path walk opens each intermediate directory for reading, where plain path resolution needed only search permission, so an operator path under a search-only (e.g. 0711) ancestor that the caller cannot read is now refused: --log-file falls back to syslog with a warning and --exclude-from fails. This matches upstream behaviour.