[ Reason ]
Fixes CVE-2025-68146, a Time-of-Check-Time-of-Use (TOCTOU) race condition
which allows local attackers to corrupt or truncate arbitrary user files
through symlink attacks.

[ Impact ]
Potential exploitation of the vulnerability, leading to integrity
violations if not addressed. Also see ticket #1123510 [1]

[ Tests ]
Unit tests included with the package succeed.

[ Risks ]
Low risk IMHO; the fix is exclusively targeted towards the vulnerability
in question. Most of the patch code lines actually deal with the (more
complex) Windows case. O_NOFOLLOW should be available on Debian.

[ Checklist ]
  [x] *all* changes are documented in the d/changelog
  [x] I reviewed all changes and I approve them
  [x] attach debdiff against the package in (old)stable
  [ ] the issue is verified as fixed in unstable

[ Changes ]
Added a patch which adds O_NOFOLLOW flag to os.open() call in
UnixFileLock._acquire(), hence ensuring the system returns the ELOOP
error if lock path is a symlink, preventing the attack.

[ Other info ]
None as far as I would consider important.

[1] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1123510

This update was released with Debian 13.3.

Control: tag -1 = trixie pending

No it wasn't yet. Sorry. It has been accepted ready for 13.4.

Thanks,