* Non-maintainer upload by the TuxCare ELS team. * CVE-2026-59948: Validate every package coming out of dependency resolution before it is installed or written to the lock file. Packages served by a repository or read from composer.lock were loaded without validation, so a malicious package with an invalid name could make Composer write attacker-controlled files outside the vendor directory. Also reject "-" prefixed source/dist urls and references. - debian/patches/0020-CVE-2026-59948.patch * CVE-2026-59946: Reject ".." bin paths escaping the package directory. - debian/patches/0020-CVE-2026-59948.patch * CVE-2026-84361: Reject Perforce source urls which are not network endpoints. A malicious package could set source.url to an rsh: or jsh: P4PORT value, making the p4 client run a local command when the package was installed from source. - debian/patches/0021-CVE-2026-84361.patch