To fix CVE-2026-34743 I have prepared an update of xz-utils, pending review
at
https://salsa.debian.org/debian/xz-utils/-/merge_requests/5

I will post the final debdiff here once the review is complete and the
final version is known.

Changelog:

xz-utils (5.4.1-2+deb12u1) bookworm; urgency=medium

  * Backport upstream security fix for CVE-2026-34743, for which upstream states
    it's likely that this bug cannot be triggered in any real-world application,
    see https://tukaani.org/xz/index-append-overflow.html (Closes: #1132497)
  * Add myself as uploader and prepare gbp.conf and salsa-ci.yml for easier
    maintenance of this package in Bookworm (and later potentially in LTS)


Debdiff attached. Produced with:

apt source xz-utils/bookworm
debdiff xz-utils_5.4.1-1.dsc xz-utils_5.4.1-2+deb12u1.dsc >
xz-utils_5.4.1-1-5.4.1-2+deb12u1.debdiff