[ Reason ]

snac2 before version 2.93 is affected by CVE-2026-112021, a heap-based
buffer overflow that allow unauthenticated attackers to corrupt heap
memory by sending JSON strings containing a \u0000 escape.  The CVE is
currently marked as no-DSA and, after coordinating with the DSA team,
they've asked me to go the p-u route.

[ Impact ]

snac2 users on trixie are currently vulnerable to the security
vulnerability above, which has been fixed a while ago in the upstream
code.

[ Tests ]

Upstream unfortunately doesn't have tests, but the fix has been in
production for several months now without any regressions.  As explained
below, this is a one-line, very targeted fix.

[ Risks ]

The fix is a one-line change to a JSON-parsing function.  While this
part of the code is important to the software functionality, the change
is easy to grasp and its correctness is trivially verifiable.  I would
classify the risk as low.

[ Checklist ]

  [x] *all* changes are documented in the d/changelog
  [x] I reviewed all changes and I approve them
  [x] attach debdiff against the package in (old)stable
  [x] the issue is verified as fixed in unstable

[ Changes ]

* Backport fix for CVE-2026-112021.
* gbp.conf adjustment for first trixie upload.