* SECURITY UPDATE: regular-expression denial of service in the bundled npm dependency pacote. addGitSha() stripped an existing committish from a git dependency spec with `spec.rawSpec.replace(/#.*$/, '')`, which backtracks quadratically on a rawSpec carrying many '#' characters followed by a newline, so resolving such a spec burned CPU for seconds instead of microseconds (CVE-2026-9496) - debian/patches/CVE-2026-9496.patch: replace the regular expression in deps/npm/node_modules/pacote/lib/util/add-git-sha.js with an indexOf/slice committish strip, which is linear in the length of the spec. Upstream's companion test change is omitted because npm publishes pacote without its test directory, so no test file ships here - CVE-2026-9496