Hi Python Team, I am adopting pymongo under ITA #1150621 and would appreciate a review and help with an upload of a focused 4.18.3-1 unstable candidate fixing CVE-2026-106435 / #1150462. Aryan is CCed for continuity.
Merge request against the official master branch: https://salsa.debian.org/python-team/packages/pymongo/-/merge_requests/2 The Salsa CI pipeline has completed successfully on the proposed commit: https://salsa.debian.org/f.molara/pymongo/-/pipelines/1193133 The full upstream delta from 4.18.2 was reviewed. It includes the BSON regex bounds fix and its upstream regression tests. Adoption metadata is in a separate commit: the Debian Python Team remains Maintainer, I am added to Uploaders, and Aryan is retained. Local validation on amd64/Python 3.14.8: - sbuild and separate offline autopkgtest: each reports 1398 passed, 6632 skipped and 1173 deselected. - Targeted BSON/GridFS/URI tests with MongoDB 8.0.34: 180 passed, 8 skipped. Both new BSON tests and all 14 GridFS security regressions pass without skips; loaded C extensions were checked against the built debs. - Lintian 2.142.0 is clean on the DSC and all eight debs. The tested commit is 79d2dfafd7edf5a728e4194311edf1328261f3ae. Its source and companion histories are public in the fork: https://salsa.debian.org/f.molara/pymongo/-/tree/work/adoption-4.18.3 https://salsa.debian.org/f.molara/pymongo/-/tree/upstream https://salsa.debian.org/f.molara/pymongo/-/tree/pristine-tar Please keep upstream/pristine-tar synchronized when integrating. The candidate changelog is still UNRELEASED; finalization and signing remain for the agreed upload. Source/binary debdiffs and local test logs are available on request. A trixie baseline and a plan for one focused backport of #1150462 are ready. No stable fix is included here, and dedicated memory diagnostics and the full TLS/KMS/replica matrix have not been validated. https://bugs.debian.org/1150462 https://bugs.debian.org/1150621 Thank you, Federico Molara
