The Debian package is not well maintained anymore unfortunately. But
it's very easy to compile SpamAssassin yourself on Debian Stretch:
1. Remove old package but leave configuration:
apt remove spamassassin
2. Install dependencies:
apt install libpcre3-dev libdigest-sha-perl libhtml-parser-perl
libnet-dns-perl libnet-ident-perl libio-socket-ssl-perl libio-zlib-perl
libarchive-tar-perl libgdbm-dev libhtml-tree-perl libwww-perl
libnetaddr-ip-perl libio-socket-inet6-perl libmail-dkim-perl
libdigest-sha-perl libmail-spf-perl libdbi-perl libencode-detect-perl
re2c libgeo-ip-perl libio-socket-ip-perl libnet-patricia-perl make
libdbd-mysql-perl
3. Download 3.4.2 package and unpack in /usr/local/src or somewhere
else:
4. Compile and install:
perl Makefile.PL
make
make install
sa-update
Best,
Jan