Hello release team,

[ Reason ]

Fix CVE-2026-14330 (no-dsa):
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1141309
https://security-tracker.debian.org/tracker/CVE-2026-14330

[ Impact ]

Vulnerable systems if not installed.

[ Tests ]

Test plan:

0. Install pulseaudio-utils and candidate pipewire-pulse:

   $ sudo apt install pulseaudio-utils \
       ../pipewire-pulse_1.4.2-1+deb13u1_amd64.deb \
       ../pipewire_1.4.2-1+deb13u1_amd64.deb \
       ../libpipewire-0.3-modules_1.4.2-1+deb13u1_amd64.deb  \
       ../pipewire-bin_1.4.2-1+deb13u1_amd64.deb  \
       ../libpipewire-0.3-0t64_1.4.2-1+deb13u1_amd64.deb  \
       ../libspa-0.2-modules_1.4.2-1+deb13u1_amd64.deb  \
       ../gstreamer1.0-pipewire_1.4.2-1+deb13u1_amd64.deb \
       ../pipewire-alsa_1.4.2-1+deb13u1_amd64.deb \
       ../libspa-0.2-modules_1.4.2-1+deb13u1_amd64.deb  \
       ../libspa-0.2-bluetooth_1.4.2-1+deb13u1_amd64.deb

1. Reboot to make sure new version is used:
   $ reboot
   ...
   $ dpkg -s pipewire-pulse | grep Version
   Version: 1.4.2-1+deb13u1

2. Upload sample to pactl:
   pactl upload-sample /usr/share/sounds/alsa/Front_Left.wav my-sample

3. Play sample from pactl:
   pactl play-sample my-sample

4. Confirm sound can be heard from pipewire-pulse

Observations:

Test plan successful, sound can be heard before and after upgrading
pipewire-pulse to 1.4.2-1+deb13u1 which contains the CVE fix.

[ Risks ]

Possible regression in pipewire-pulse frontend if too many channels or
memory are allocated as they now have hard limits to fix the CVE.

[ Checklist ]
  [x] *all* changes are documented in the d/changelog
  [x] I reviewed all changes and I approve them
  [x] attach debdiff against the package in (old)stable
  [x] the issue is verified as fixed in unstable

[ Changes ]

See d/changelog.

Cherry-picked two extra upstream commits needed for the CVE fix to
apply, they were not needed for the unstable fix but are needed here
since they introduce some additional checks that are not part of the CVE
but are necessary for the CVE patch to apply correctly.

[ Other info ]

N/A