* Non-maintainer upload by the TuxCare ELS team. * CVE-2026-40261: Prevent a command injection vulnerability in Perforce::syncCodeBase(), which appended the source reference to the 'p4 sync -f' command without escaping. Package metadata served by a malicious or compromised Composer repository could inject shell metacharacters, leading to command execution even when Perforce is not installed. - debian/patches/0019-CVE-2026-40261.patch * CVE-2026-40176: Prevent a command injection vulnerability in Perforce::generateP4Command(), which interpolated the Perforce connection parameters (user, client, port) into the 'p4' command line without escaping. A malicious composer.json declaring a Perforce VCS repository could inject shell metacharacters, leading to command execution even when Perforce is not installed. Also backport the prerequisite upstream fix for Perforce::connectClient(), which passed the client spec path through the shell redirection of the same command line with only spaces escaped. - debian/patches/0020-CVE-2026-40176.patch * CVE-2023-43655: Refuse to run on a non-CLI SAPI when register_argc_argv is enabled and the entry point is a phar, which allowed a composer.phar published to a web-accessible directory to be driven through the query string. This package installs bin/composer as a plain PHP script and ships no phar, so the guard is inert here; it is applied for parity with the upstream and Debian bookworm fixes. - debian/patches/0021-CVE-2023-43655.patch