* SECURITY UPDATE: HTTPS identity check not bound to connection or TLS session reuse (incomplete fix for CVE-2026-48934) - debian/patches/CVE-2026-58040.patch: tag request options in https.request() with a per-request kPerRequestCheckServerIdentity symbol when the caller supplies its own checkServerIdentity and the Agent was not constructed with one, key Agent.prototype.getName() on that tag, skip both the TLS session resume and the session caching listener in createConnection() for tagged requests, and add an Agent.prototype.keepSocketAlive() override in lib/https.js that refuses to park such a socket in freeSockets - CVE-2026-58040