mercurial CVEs - plan for f25 and f26 updates