Quick correction before I spend time on this: trixie is actually already fixed. The Security Team NMU'd it a month ago - caddy (2.6.2-12+deb13u1) trixie-security, Aron Xu, 2026-08-10 - and it covers all 8 CVEs. So nothing needed there after all, but thanks again for flagging it - good reminder to check both suites before assuming only bookworm needs the work.
Ivo
