python3.9 (3.9.2-1+deb11u4) bullseye-security; urgency=medium

python3.9 (3.9.2-1+deb11u4) bullseye-security; urgency=medium

  * Non-maintainer upload by the LTS Team.
  * Add salsa-ci.yml.
  * Drop Build-Conflicts: git.
  * Unexport PYTHONIOENCODING to unbreak tests on Salsa.
  * Disable test_mmap as it fails on Salsa.
  * Apply upstream patches for the following CVEs:
    - CVE-2022-37454: integer overflow and buffer overflow in the Keccak XKCP
      SHA-3 implementation.
    - CVE-2025-4516: issue in bytes.decode("unicode_escape",
      error="ignore|replace")
    - CVE-2025-6069: quadratic complexity in html.parser.HTMLParser
    - CVE-2025-6075: performance degradation in os.path.expandvars()
    - CVE-2025-8194: infinite loop and deadlock in tarfile
    - CVE-2025-8291: incorrect ZIP64 End of Central Directory handling
    - CVE-2025-12084: quadratic complexity in xml.dom.minidom appendChild etc
    - CVE-2025-13836: OOM or other DoS due to incorrect Content-Length
      handling in http.client
    - CVE-2025-13837: OOM or other DoS due to incorrect data size handling
      in plistlib
  * Update libpython symbols.

[dgit import unpatched python3.9 3.9.2-1+deb11u4]