Merge version 1.4+really1.3.48-2+rpi1 and 1.4+really1.3.49-1 to produce 1.4+really1...

diff --cc debian/changelog
index bdbca59b16906a50d5f9860e48c8cfbb7f616cf7,2492e2f5d0ec0cd42b21d789043d190c416ac84a..1d920890b6a33811d6716076e6654f8279c21b33
--- 1/debian/changelog
--- 2/debian/changelog
+++ b/debian/changelog
@@@ -1,12 -1,13 +1,23 @@@
- graphicsmagick (1.4+really1.3.48-2+rpi1) forky-staging; urgency=medium
++graphicsmagick (1.4+really1.3.49-1+rpi1) forky-staging; urgency=medium
 +
 +  [changes brought forward from 1.4+really1.3.36-1+rpi1 by Peter Michael Green <plugwash@raspbian.org> at Wed, 30 Dec 2020 03:11:26 +0000]
 +  * Ignore test failures, the tests fail on 64-bit kernels.
 +
 +  [changes brought forward from 1.4+really1.3.40-1+rpi2 by Peter Michael Green <plugwash@raspbian.org> at Thu, 19 Jan 2023 18:12:16 +0000]
 +  * Remove hardcoded dependency on libtiff5 (Closes: #1029212)
 +
-  -- Raspbian forward porter <root@raspbian.org>  Tue, 13 Oct 2026 06:15:58 +0000
++ -- Raspbian forward porter <root@raspbian.org>  Wed, 14 Oct 2026 16:13:10 +0000
++
+ graphicsmagick (1.4+really1.3.49-1) unstable; urgency=high
+ 
+   * New upstream release:
+     - fixes CVE-2025-55154: guard against integer overflow and underflow
+       in MNG MAGN chunk handling,
+     - fixes CVE-2026-56379: command injection vulnerability in the SVG
+       decoder,
+     - fixes CVE-2026-61464: heap-based buffer over-write vulnerability.
+ 
+  -- Laszlo Boszormenyi (GCS) <gcs@debian.org>  Sun, 11 Oct 2026 09:14:32 +0200
  
  graphicsmagick (1.4+really1.3.48-2) unstable; urgency=high