SECURITY UPDATE: packet over-reads in the mysqlnd wire protocol parser
debian/patches/CVE-2025-1218.patch: bound every packet reader and the
text and binary row decoders in ext/mysqlnd/mysqlnd_wireprotocol.c and
ext/mysqlnd/mysqlnd_ps_codec.c, including the CVE-2024-8929 checks they
build on. Not carried: upstream's caching_sha2 and MariaDB hunks (code
absent in 7.0) and its regression tests (PHP 8 test harness).