Merge branch '2.20' into 2.21

Author: cowtowncoder

release-notes/VERSION-2.x

@@ -167,8 +167,9 @@ No changes since 2.19.1
 
 2.18.10 (not yet released)
 
-#725: (cbor) Ensure `maxNameLength` limit enforced for CBOR parser
-#726: (smile) Ensure `maxNameLength` limit enforced for Smile parser
+#725: (cbor) Ensure `maxNameLength` limit enforced for CBOR parser [CVE-2026-68495]
+ (reported by @tinyb0y)
+#726: (smile) Ensure `maxNameLength` limit enforced for Smile parser [CVE-2026-68496]
  (reported by @tinyb0y)
 #727: (cbor) `CBORParser.nextFieldName(SerializableString)` confuses 5-bit length
   marker 23 with 24 ("1-byte length suffix follows")