* SECURITY UPDATE: REXML DoS via an attribute value containing many '>' - debian/patches/CVE-2024-35176.patch: in parse_attributes (lib/rexml/parsers/baseparser.rb), resolve the missing-closing-quote case in a single pass -- read the value rest up to the closing quote and then up to the tag end with two source.match calls -- instead of consuming one '>'-chunk per iteration, which reset the scanner and re-ran ATTRIBUTE_PATTERN over the accumulating buffer, giving O(N^2) behaviour. Also make IOSource#match (lib/rexml/source.rb) retry the pattern after every read attempt so the partial buffer is matched once more before the source is declared exhausted, as required by the new value-rest read. Adapted from upstream ruby/rexml ba70cfef ("Read quoted attributes in chunks"); the read_until API added upstream has no callers here once parse_attributes is fixed in place. Adds a Timeout-based regression test (test/rexml/parse/test_attribute_gt_redos.rb) adapted from upstream. - CVE-2024-35176 * SECURITY UPDATE: REXML ReDoS via repeated spaces inside linear). Adapted from upstream ruby/rexml 1f1e6e9; a byte-identical md[0].strip is a no-op on 3.1.9.1 because here md[0] starts with the "=12 also skip the net/http and net/smtp tests, which spawn TCP servers via tcp_server_sockets_port0 and flake with Errno::EADDRINUSE under concurrent builds (mirrors alt-ruby31). - debian/patches/fix-tests-mjit-fork.patch: backport upstream 7a859b6a (Ruby 2.7.0+) to fix the flaky TestJIT#test_fork_with_mjit_worker_thread stderr output race; never backported to the 2.6 series.