This is a future unblock request for a no-DSA security fix to
the kakoune source package.

[ Reason ]
As discussed in #1143968, there is a security issue that is not
triggered by a default setup, but it may still affect Debian
users of kakoune who have activated the autorestore functionality.

[ Impact ]
A security fix will not be present in the trixie version of kakoune.

[ Tests ]
The upstream commit that has been added as the CVE-2026-48120 patch
indeed involves an addition to the build- and autopkgtest-time
test suite that makes sure the fix works.

[ Risks ]
The change in the shell part of the kakoune autorestore tool is
relatively simple. It is limited in scope to only validating and
sanitizing filenames. As such, I believe the risk to be minimal.

[ Checklist ]
  [x] *all* changes are documented in the d/changelog
  [x] I reviewed all changes and I approve them
  [x] attach debdiff against the package in (old)stable
  [x] the issue is verified as fixed in unstable

[ Changes ]
Add the CVE-2026-48120 patch that makes the autorestore tool
validate the filenames it finds in the recorded files.

[ Other info ]
The issue is fixed in unstable by the just-uploaded 2026.05.21 new
upstream release.