* SECURITY UPDATE: Heap buffer overflow in remote filename charset conversion - debian/patches/CVE-2026-58471.patch: fix the E2BIG buffer-growth path of convert_fname() in src/url.c. On each iconv() overflow it recomputed the buffer size from the ORIGINAL length (done = len; len = done + inlen * 2) while resetting the write pointer to converted_fname + done, so outlen described a window that started before the bytes iconv() had already written; a multi-pass conversion therefore wrote past the allocation. The fix derives both the write offset and the remaining space from the actual bytes consumed (used = s - converted_fname) and guarantees the realloc grows the buffer - CVE-2026-58471 * SECURITY UPDATE: Integer overflow leading to heap buffer overflow in HTML attribute entity encoding - debian/patches/CVE-2026-58472.patch: change the size accumulator of html_quote_string() in src/convert.c from int to size_t and guard every addition with INT_ADD_OK(). The per-character increments were correct, but a sufficiently long input overflowed the signed int counter, so xmalloc() received an undersized (or negative) size and the second loop wrote the escaped string past the end of it - CVE-2026-58472