Santiago, Sorry for the slow follow-up, and thanks for the detailed reply - especially the bullseye-security branch pointer for git-lfs, that's exactly the reference I needed, and the heads-up about the current apt-get dist-upgrade regression makes this more urgent than I'd realized.
My Salsa account is approved now: https://salsa.debian.org/eim I'll switch to full debdiffs for both packages rather than inline patches - working on getting a proper signing setup in place first, will follow up here once cjose and git-lfs are both ready in that form. Good to know cjose is already on the security team's radar via dsa-needed.txt for trixie; I'll coordinate around that rather than duplicate it. Thanks again, Ivo
