- Rebase onto vendor 2.56.0-6.amzn2.0.8, which fixes CVE-2026-15711 (oversized WebSocket control frames are now rejected per RFC 6455 section 5.5) - CVE-2026-5119: do not send cookies to a HTTP proxy for a HTTPS request - CVE-2026-66338: reject chunk sizes carrying trailing garbage and chunk sizes that overflow goffset instead of parsing them permissively, narrowing an HTTP request smuggling differential - CVE-2026-66337: clamp the bytes returned by soup_filter_input_stream_read_until() to the caller buffer length when the boundary is found, preventing a heap buffer over-read