* SECURITY UPDATE: Heap buffer over-read in png_write_image_* due to truncation of ptrdiff_t row stride to png_uint_16 - debian/patches/CVE-2026-22801.patch: remove incorrect truncation casts from png_write_image_16bit, png_write_image_8bit, and png_image_write_main so large (>65535) and negative row strides are handled correctly - CVE-2026-22801 * SECURITY UPDATE: Heap buffer overflow in png_set_quantize due to stale palette indices stored in the color distance hash table - debian/patches/CVE-2026-25646.patch: store original palette indices via palette_to_index in png_set_quantize so the color-pruning loop does not read past the 769-element hash array - CVE-2026-25646