* SECURITY UPDATE: out-of-bounds read in DNS reverse-lookup escape decoding when running against musl libc - debian/patches/CVE-2026-40684.patch: harden string_copy_dnsdomain() to consume 1, 2, or 3 digits incrementally instead of indexing past the input string when fewer than 3 digits follow a backslash escape - CVE-2026-40684 * SECURITY UPDATE: out-of-bounds heap write in JSON dewrap on malformed header value ending in a trailing backslash - debian/patches/CVE-2026-40685.patch: only skip a backslash in dewrap() when followed by a non-NUL character - CVE-2026-40685 * SECURITY UPDATE: SPA authenticator out-of-bounds write and uninitialised-heap information disclosure - debian/patches/CVE-2026-40687.patch: zero the spa_base64_to_bits() output buffer to plug the infoleak; replace assert()-based length guards in unicodeToString(), strToUnicode(), and toString() with explicit length clamping to prevent OOB writes - CVE-2026-40687