Bundle 2026-W7

Editor assessment

This commit patches CVE-2026-27493. The header chore: Bundle 2026-W7 names a release week but not the dependency updates or fixes inside it, so the subject works as a tag for release engineers rather than as a description. The body is a long block of Signed-off-by and nine co-author trailers with no prose, meaning the message offers no summary of what the bundle contains or why it was cut. Those trailers are correctly formatted, but they crowd out any explanation a reader might use. For a routine aggregate commit, a short list of notable bumps would be enough to raise it. As written it is valid and conventional but tells an outsider almost nothing before they open an enormous diff.