* SECURITY UPDATE: multiple security fixes - debian/patches/CVE-2026-41284.patch: add a configurable maxRequestBodySize init-param to the WebDAV servlet to bound LOCK/PROPFIND XML request bodies; reject oversized bodies with 413 Request Entity Too Long. Includes the upstream BoundedByteArrayOutputStream helper and associated tests - CVE-2026-41284 - debian/patches/CVE-2026-41293.patch: filter invalid HTTP/2 header names in HpackDecoder / HPackHuffman / Stream / Http2Parser using a new HttpParser.isToken-based check; folds upstream follow-up (HttpParser i>32 hex/decimal fix, additional LocalStrings keys, HpackHuffman field-name branch simplification) and ships the new TestHPackHuffman / TestHttp2Section_8_2 tests. - debian/patches/CVE-2026-41293-tests.patch: adapt TestHttp2Section_8_2 to the 9.0.31 readFrame(boolean) signature - CVE-2026-41293 - debian/patches/CVE-2026-42498.patch: strip Authorization and Proxy-Authorization headers from WebSocket client userProperties after the proxy CONNECT, HTTP redirect, and successful upgrade paths so credentials are not leaked to redirect or proxy targets - CVE-2026-42498 - debian/patches/CVE-2026-43512.patch: fix DIGEST authentication handling of unknown users and users with a null password so they cannot authenticate; adds regression tests to TestDigestAuthenticator - CVE-2026-43512 - debian/patches/CVE-2026-43513.patch: add caseSensitive attribute to LockOutRealm and route usernames through a null-safe normalizeUsername helper so case-insensitive realms cannot be brute-forced by varying the case of the username. Folds the upstream Coverity NPE follow-up and adds the new TestLockoutRealm JUnit tests - CVE-2026-43513 - debian/patches/CVE-2026-43514.patch: switch the AJP secret comparison in AjpProcessor to a constant-time comparison using the new ConstantTime utility; includes the upstream ByteChunk start-offset follow-up - CVE-2026-43514 - debian/patches/CVE-2026-43515.patch: ensure RealmBase finds all matching extension-based security constraints by moving the match bookkeeping inside the inner extension-pattern loop; adds the upstream TestRealmBase.testUncoveredMethods regression test and a TesterRequest.getRequestPathMB() helper - CVE-2026-43515