* SECURITY UPDATE: denial of service through quadratic runtime in the default-attribute lookup performed by storeAtts() - debian/patches/CVE-2026-66046.patch: resolve the CDATA-ness of a specified attribute through the per-element defaultAttForName hash table instead of a linear scan of defaultAtts, and fold in the upstream follow-up that makes dtdCopy create entries of the same size so storeAtts does not read .attIndex out of bounds (libexpat PR #1321, PR #1331). - CVE-2026-66046 * SECURITY UPDATE: malformed UTF-16 accepted because a high surrogate was not required to be followed by a low surrogate - debian/patches/CVE-2026-93990.patch: reject a 4-byte UTF-16 sequence whose second code unit is not a low surrogate, in both the little2_ and big2_ tokenizers (libexpat PR #1282). - CVE-2026-93990