* SECURITY UPDATE: REXML DoS via many '<' or '>' characters in an attribute value - debian/patches/CVE-2024-35176.patch: in parse_attributes, when the outer @source.match stops at a '>' inside a quoted attribute value, read forward to the actual closing quote in a single chunk instead of looping one '>' at a time, so the per-attribute outer loop is O(1) iterations rather than O(n). Also extend IOSource#match to always re-try the regex after read() returns false at EOF so the final partially-filled buffer is still matched. - CVE-2024-35176 * SECURITY UPDATE: REXML ReDoS via repeated zeros in a character reference - debian/patches/CVE-2024-39908.patch: rewrite REXML::Text.check to iterate over '<' and '&' sentinels with String#index and validate each entity / character reference explicitly, instead of string.scan() with the NEEDS_A_SECOND_CHECK regex whose '�*' branch caused O(n^2) backtracking on inputs with many leading zeros. The remaining CVE-2024-39908 subvariants (repeated '>' inside