* SECURITY UPDATE: email BytesGenerator header injection - debian/patches/CVE-2026-1299.patch: combined backport of gh-121650 (CVE-2024-6923) and gh-144125 (CVE-2026-1299) that adds email.errors.HeaderWriteError, the policy.verify_generated_headers attribute, and the verify-on-write check for both Generator and BytesGenerator, preventing CRLF/LF header injection through custom fold(). - CVE-2026-1299 * SECURITY UPDATE: ssl.SSLContext memory race in cert_store_stats / get_ca_certs - debian/patches/CVE-2024-0397.patch: backport the X509_STORE_get1_objects shim and the x509_object_dup helper from cpython 3.8.20 (29c97287d2). The two affected impl functions in Modules/_ssl.c (cert_store_stats / get_ca_certs) now take a deep-copy snapshot of the X509_STORE under X509_STORE_lock(), preventing the use-after-free that occurred when certificates were loaded concurrently from another thread. - CVE-2024-0397 * SECURITY UPDATE: ipaddress is_private/is_global misclassification - debian/patches/CVE-2024-4032.patch: backport cpython 3.8.20 fix 895f7e2ac2 (gh-113171). Adds the _IPv4Constants._private_networks_exceptions list (192.0.0.9/32, 192.0.0.10/32) and the IPv6 equivalents (2001:1::1/128, 2001:1::2/128, 2001:3::/32, 2001:4:112::/48, 2001:20::/28, 2001:30::/28). Expands 192.0.0.0/29 to /24, adds 64:ff9b:1::/48 and 2002::/16 to the IPv6 _private_networks list, and updates is_private to filter against the exceptions list and use ipv4_mapped semantics on IPv6. - CVE-2024-4032