[ Reason ]
This update fixes CVE-2026-96512 and closes #1148890 for trixie by
pulling three upstream commits.

[ Impact ]
The CVE remains unsolved

[ Checklist ]
  [X] *all* changes are documented in the d/changelog
  [X] I reviewed all changes and I approve them
  [X] attach debdiff against the package in (old)stable
  [X] the issue is verified as fixed in unstable

This may be suitable for the next trixie point release or an
intermediate update via trixie-updates.

Greetings
Marc