SECURITY UPDATE: CPU denial-of-service in the html.parser module via
repeated unterminated markup declarations (quadratic complexity in the
incremental HTMLParser)
debian/patches/CVE-2026-15308.patch: accumulate pending data in feed()
and parse on a doubling threshold instead of rescanning the whole
unparsed buffer each call, in Lib/html/parser.py