[ Reason ]
Fix CVE-2026-79079.

[ Impact ]
A local attacker can execute arbitrary code via this vulnerability.

[ Tests ]
Compilation is okay. The software runs as usual.

[ Risks ]
The included patch is from upstream and applies cleanly.
popen() is replaced with a safeer alternative.

[ Checklist ]
  [x] *all* changes are documented in the d/changelog
  [x] I reviewed all changes and I approve them
  [x] attach debdiff against the package in (old)stable
  [x] the issue is verified as fixed in unstable

[ Changes ]
Replace two popen() calls with GLib's g_spawn_async() and g_spawn_sync()                                                                                                                                                                                                      to avoid passing arguments through a shell. This prevents filenames or                                                                                                                                                                                                        other data containing shell metacharacters from being interpreted as                                                                                                                                                                                                          shell commands.