SECURITY UPDATE: heap overflow in the JPEG 2000 output adapter
debian/patches/CVE-2026-39919.patch: stop the sub-byte-depth loop in
process_one_trunk() writing one output byte per column of a sampled
component, and reject unsupported bit depths in decode_image(), in
base/sjpx_openjpeg.c.