SECURITY UPDATE: CPU denial-of-service in html.parser.HTMLParser via
repeated unterminated markup declarations in incremental parsing
debian/patches/CVE-2026-15308.patch: accumulate incrementally fed
data in a list and only join and parse it once enough has piled up,
avoiding the quadratic rescanning and concatenation of an
unterminated construct across feed() calls in Lib/HTMLParser.py