[ Reason ]
Fix Potential ReDoS vulnerabilities in pygments:
CVE-2026-4539[1], CVE-2022-40896[2].

[ Impact ]
A specially crafted input can trigger excessive CPU consumption
due to inefficient regular expression processing in affected
lexers, leading to a denial of service condition.

[ Tests ]
The vulnerable code path was tested with the proposed
patch applied.

[ Risks ]
The changes are minimal and limited to the affected lexers.
They are direct backports of the upstream fixes and do not
modify unrelated functionality.

[ Checklist ]
  [x] *all* changes are documented in the d/changelog
  [x] I reviewed all changes and I approve them
  [x] attach debdiff against the package in (old)stable
  [x] the issue is verified as fixed in unstable

[ Changes ]
Backport the upstream fixes for CVE-2026-4539.

[ Other info ]
The merge request for unstable is open and awaiting review.

@piotr has reviewed this backport and will sponsor it.

Hi,

Please go ahead.

Thanks,

Hi Matheus,
[...]
progress of the unstable one? I did not saw one on
https://salsa.debian.org/python-team/packages/pygments/-/merge_requests
and it looks the issue would still be unfixed in unstable.

Did something felt trough the cracks?

Regards,
Salvatore

Hi Salvatore,

You're right, I forgot to send the unstable update.

The MR is available here:
https://salsa.debian.org/python-team/packages/pygments/-/merge_requests/4

Sorry for the confusion, and thanks for noticing it.

Hi Matheus,

With the fixes in unstable, can you as well upload pygments as
proposed for trixie (and acked by Jonathan)?

Unfortunately we will miss 13.6, but it can then be included in the
next point release after that.

Regards,
Salvatore