Hi,

I'd like to make a stable upload for puma, fixing CVE-2026-47736 and
CVE-2026-47737. The sec team marked both as no-DSA, hence doing SPU.

Fixes are backported from the upstream, changes fit easily without
much fuzz.

There are wide coverage tests including the tests for this particular
fixes. All are passing during the build.


  [x] *all* changes are documented in the d/changelog
  [x] I reviewed all changes and I approve them
  [x] attach debdiff against the package in (old)stable
  [x] the issue is verified as fixed in unstable

Hi,

Sorry forgot to attach the debdiff in initial mail. Attaching in this
one.