python3.9 (3.9.2-1+deb11u5) bullseye; urgency=medium

python3.9 (3.9.2-1+deb11u5) bullseye; urgency=medium

  * Apply upstream patch to fix regression after CVE-2025-12084 fix
    (see #1122875 for more details)
  * Apply upstream patched for the following CVEs:
    - CVE-2025-11468: Folding email comments of unfoldable characters
      didn't preserve parenthesis which could be abused.
    - CVE-2025-15282: User-controlled data URLs parsed by urllib allowed
      injecting headers through newlines in the data URL mediatype.
    - CVE-2025-15366: User-controlled command could have additional commands
      injected using newlines.
    - CVE-2025-15367: User-controlled command could have additional commands
      injected using newlines.
    - CVE-2026-0672: User-controlled cookie values and parameters could be
      used to inject HTTP headers into messages.
    - CVE-2026-0865: User-controlled header names and values containing
      newlines could be used to inject HTTP headers.
    - CVE-2026-1299: email module allowed header injection in the
      BytesGenerator class.

[dgit import unpatched python3.9 3.9.2-1+deb11u5]