* SECURITY UPDATE: GSSAPI client state and credentials persisted across authentication attempts - debian/patches/CVE-2026-106553-CVE-2026-106555.patch: add ssh_gssapi_cleanup_global_client() and call it before each userauth request in auth2.c and before each pre-auth GSSAPI context setup in monitor.c, and add a userok flag to ssh_gssapi_client so that ssh_gssapi_storecreds() only stores delegated credentials after successful authorization, in gss-serv.c and ssh-gss.h - CVE-2026-106553 - CVE-2026-106555 * SECURITY UPDATE: Command injection via command-line username - debian/patches/CVE-2026-106583.patch: reject '$' and '\' anywhere in a command-line supplied user name in valid_ruser(), in ssh.c - CVE-2026-106583 * SECURITY UPDATE: Decompression bomb exceeding maximum packet size - debian/patches/CVE-2026-106585.patch: fail uncompress_buffer() once the decompressed output reaches PACKET_MAX_SIZE, in packet.c - CVE-2026-106585