Please accept upload of smarty4 4.5.5-1+deb13u1 to Debian trixie.

[ Reason ]
Security fixes:

  CVE-2026-62992: Fix resolving symbolic links in Security::_checkDir()
  before validating that a requested path lies within a configured secure
  directory.(Closes: #1145020).
  CVE-2026-62993: Fix validating the initial remote URL against trusted_uri
  under all circumstances when a security policy is active. (Closes:
  #1150507).
  CVE-2026-82531: Fix code injection vulnerability. (Closes: #1150192).

[ Impact ]
Security issues remain unfixed.

[ Tests ]
Tested using GOsa² in Debian Edu.

[ Risks ]
Impacted packages in Debian:

  - gosa (et al.)
  - postfixadmin
  - slbackup-php

[ Checklist ]
  [x] *all* changes are documented in the d/changelog
  [x] I reviewed all changes and I approve them
  [x] attach debdiff against the package in (old)stable
  [x] the issue is verified as fixed in unstable

[ Changes ]

+smarty4 (4.5.5-1+deb13u1) trixie; urgency=medium
+
+  * debian/patches:
+    + Add CVE-2026-62992+3.patch.
+      CVE-2026-62992: Fix resolving symbolic links in Security::_checkDir()
+      before validating that a requested path lies within a configured secure
+      directory.(Closes: #1145020).
+      CVE-2026-62993: Fix validating the initial remote URL against trusted_uri
+      under all circumstances when a security policy is active. (Closes:
+      #1150507).
+    + Add CVE-2026-82531.patch.
+      CVE-2026-82531: Fix code injection vulnerability. (Closes: #1150192).
+
+ -- Mike Gabriel <sunweaver@debian.org>  Tue, 03 Nov 2026 19:12:58 +0100

[ Other info ]
Security issues were marked as no-dsa by Debian's security team.