* SECURITY UPDATE: symlink attacks on daemon operator-supplied paths - debian/patches/CVE-2026-53784.patch: add safe_open_no_attacker_symlinks() in util.c and confine the daemon module-root chdir under use-chroot=no - CVE-2026-53784 * SECURITY UPDATE: information disclosure via planted symlinks - debian/patches/CVE-2026-53802-CVE-2026-53803.patch: open the secrets file, --password-file, batch, log, config and exclude/include files through safe_open_no_attacker_symlinks() - CVE-2026-53802 - CVE-2026-53803 * SECURITY UPDATE: information disclosure via symlinked filter/merge files - debian/patches/CVE-2026-53786.patch: open filter and per-directory merge files through safe_open_no_attacker_symlinks() and treat a merge file hidden by the daemon filter as absent - CVE-2026-53786 * SECURITY UPDATE: arbitrary file write via absolute --temp-dir/--link-dest - debian/patches/CVE-2026-53795.patch: confine do_rename() and do_link() in syscall.c through an ownership walk on the pinned parent directory fd - CVE-2026-53795 * SECURITY UPDATE: daemon crash via a malformed file list entry - debian/patches/CVE-2026-70459.patch: reject a non-directory transfer-root entry and bound parent_ndx in flist.c, generator.c and receiver.c - CVE-2026-70459 * SECURITY UPDATE: "auth users" entries parsed on whitespace - debian/patches/CVE-2026-70463.patch: parse the daemon's "auth users" list with conf_strtok() in authenticate.c so it splits on commas alone - CVE-2026-70463 * The non-directory transfer-root guard shipped in +tuxcare.els5 under debian/patches/CVE-2026-53789.patch now lives in debian/patches/CVE-2026-70459.patch, no functional change * The upstream regression tests named in the patch headers are not carried: upstream ships them only as pytest testsuite/*_test.py files and 3.1.3 has no pytest harness