* SECURITY UPDATE: CPU denial of service via unbounded block skipping past end of stream in tarfile - debian/patches/CVE-2026-11972.patch: break out of the block skipping loop in _Stream.seek() as soon as read() returns no data in Lib/tarfile.py, so an attacker declared member size can no longer make parsing a stream mode ("r|") archive take exponentially longer; add regression test to Lib/test/test_tarfile.py - CVE-2026-11972 * SECURITY UPDATE: Out-of-bounds write when a bz2 decompressor or a BZ2File handle is reused after a decompression error - debian/patches/CVE-2026-9669.patch: record the failing libbz2 error code on BZ2DecompObject and refuse any further decompress() call with ValueError in Modules/bz2module.c, so crafted input can no longer make BZ2_bzDecompress() resume from an invalid internal state and write out of bounds to a stack buffer; also make the error sticky for the C BZ2File read paths, which re-entered the errored stream in the same way; add regression tests for both to Lib/test/test_bz2.py - CVE-2026-9669