* SECURITY UPDATE: HTTP/2 server push use-after-free - debian/patches/CVE-2026-18924.patch: make a pushed transfer inherit the parent handle's share in lib/http2.c, so a connection held by a share cannot be freed while the pushed transfer still uses it. - CVE-2026-18924 * SECURITY UPDATE: public key pinning bypassed when no server certificate - debian/patches/CVE-2026-80230.patch: in lib/vtls/openssl.c, treat a missing server certificate as acceptable only when no pinned public key is configured, so pinning is still enforced with peer and host verification disabled. - CVE-2026-80230 * SECURITY UPDATE: cookie for an exact PSL domain kept wildcard scope - debian/patches/CVE-2026-82209.patch: in lib/cookie.c, clear the tailmatch flag when a cookie's Domain attribute is itself a public suffix, so it becomes host-only instead of being sent to sibling subdomains. - CVE-2026-82209