* SECURITY UPDATE: under --experimental-permission, enabling trace events starts the tracing agent, which creates and truncates the file named by --trace-event-file-pattern without any FileSystemWrite check, so a process with no fs.write grant for that path can still write there (CVE-2026-56847) - debian/patches/CVE-2026-56847.patch: lift the ${pid}/${rotation} substitution out of NodeTraceWriter::OpenNewFileForStreaming() into a new static NodeTraceWriter::GetFilePath(), and use it in NodeCategorySet::Enable() to resolve the configured pattern and run the resulting path through THROW_IF_INSUFFICIENT_PERMISSIONS before the tracing agent is started. Also adds the upstream regression test test/parallel/test-permission-fs-write-trace-events.js - CVE-2026-56847 * SECURITY UPDATE: process.report.writeReport() checks the permission of the bare filename and of the cwd, but writes to report.directory joined with that filename, so under --experimental-permission a report can be created or truncated in a directory the process was never granted (CVE-2026-58039) - debian/patches/CVE-2026-58039.patch: hoist the report_directory and filename join in TriggerNodeReport() into a `pathname` local and move the FileSystemWrite check to after it, immediately before the file is opened, so the path that is checked is the path that is written; and prepend nr.getDirectory() to the resource the JavaScript gate in lib/internal/process/report.js tests. Also adds the upstream regression hunks to test/parallel/test-permission-fs-write-report.js - CVE-2026-58039 * SECURITY UPDATE: server.maxHeadersCount was applied only after parsing, by truncating the header list handed to JavaScript, while llhttp kept parsing and honouring every header it saw, so a request with more header pairs than the limit could be framed by Content-Length or Transfer-Encoding headers the application never sees -- a request smuggling and header-check bypass primitive (CVE-2026-58044) - debian/patches/CVE-2026-58044.patch: add a header_pairs_ counter and a TrackHeaderPair() check to the C++ Parser, called from on_header_field and reset with the rest of the per-message state, so exceeding the parser's maxHeaderPairs sets the llhttp error reason to HPE_HEADER_OVERFLOW and returns HPE_USER, rejecting the request instead of silently truncating it. Also adds the upstream regression test test/parallel/test-http-max-headers-count-overflow.js and the updated test-http-max-headers-count.js / test-https-max-headers-count.js - CVE-2026-58044