Dear Release Team, Salvatore and Python Team, A short follow-up to the trixie batch sent on 3 November: upstream has merged PR #3195 (PYTHON-6252), fixing signed integer overflow when the C BSON buffer doubles its capacity: https://github.com/mongodb/mongo-python-driver/pull/3195
This complements the addition-size guard for CVE-2026-96749 already in our batch. A source-level check shows that the old doubling code is still present in Debian 4.19.0-2, trixie 4.10.1-6 and our candidate. The small buffer.c hunk applies directly to the candidate; the PR also contains upstream sanitizer CI additions. The submitted candidate is unchanged. Would you prefer to include this complementary fix in the batch, once it is also fixed in unstable, or handle it separately? Best regards, Federico Molara
