[ Reason ]
Fixing CVE-2026-27205 within flask changed the API and broke
flask-socketio. The outcome was that onionshare chat cannot be used
anymore on Trixie (#1136892).
The API change in flask is known with 3.1.3 and flask-socketio 5.6.1
already adopted the API change (#1132356), that got uploaded to unstable.

[ Impact ]
Every application used to write RequestContext.session is broken
and cannot be used anymore. One application is onionshare, the chat
mode.

[ Tests ]
flask-socketio own testsuite discovered this breakage [1] and debusine
[2] shows that the testsuite is fixed with the current packported patch.
Built myself and tested locally.

[1] https://lists.debian.org/debian-lts/2026/07/msg00080.html
[2] https://debusine.debian.net/debian/developers/work-request/1558905/

[ Risks ]
The source of this patch is from upstream, that is stripped down to a
minimal change that fixes that adopt the API change done by fixing
CVE-2026-27205.
As the patch itself does not change the API of flask-socketio, I expect
that the risk of this fix is very minimal. Especially it uses
duck-typing, so it should adopt the corret API of flask in either way.

[ Checklist ]
  [x] *all* changes are documented in the d/changelog
  [x] I reviewed all changes and I approve them
  [x] attach debdiff against the package in (old)stable
  [x] the issue is verified as fixed in unstable

[ Changes ]
* Added part of upstream patch to adopt new flask API.
* Update gbp.conf debian-branch to debian/trixie.

[ Other info ]
Myself is not the Mantainer of flask-socketio. I asked phls if I
should/can do the pu.

phls answered me on 2026-10-28 by email:

I hope this is enough evidence, that I work together with the mantainer
of flask-socketio.

I didn't upload as I don't know if I should remark it somehow, that I'm
not the mantainer.

Regards,

hefee