Hi,For the record I referenced the patch to track progress, but until it's validated by upstream we (LTS Team) usually don't recommend applying PRs in the packaging. (Unless this was intentional e.g. so it could be tested widely in Debian unstable.)
Upstream just answered with reservations about including the patch, it may be worth discussing with them :) https://github.com/hoytech/String-Compare-ConstantTime/pull/21#issuecomment-2798871668
Cheers! Sylvain Beucler Debian LTS Team
