SECURITY UPDATE: out-of-bounds write on bz2 decompressor and BZ2File reuse
after a decompression error
debian/patches/CVE-2026-9669.patch: make a libbz2 decompression error
sticky on the decompressor object and on the BZ2File read paths in
Modules/bz2module.c, so a reused object can no longer re-enter
BZ2_bzDecompress() on an errored stream and write out of bounds