Packages changed: MicroOS-release (20261020 -> 20261103) SVT-AV1 (4.2.0 -> 4.3.0) aaa_base accountsservice (23.13.9 -> 26.27.3) apparmor at-spi2-core (2.60.7 -> 2.62.1) aurorae6 (6.8.0 -> 6.8.2) bluedevil6 (6.8.0 -> 6.8.2) bluez breeze6 (6.8.0 -> 6.8.2) breeze6-gtk (6.8.0 -> 6.8.2) brotli (1.2.0 -> 1.2.1) bubblewrap (0.12.0 -> 0.13.1) busybox bzip2 ca-certificates-mozilla (2.90 -> 2.92) containerd (2.3.3 -> 2.4.2) cpio cracklib-dict-full (2.8.12 -> 2.10.3) cups (2.4.19 -> 2.4.20) curl dconf (0.49.0 -> 51.0) discover6 (6.8.0 -> 6.8.2) dracut (112+suse.57.g23bbfee -> 112+suse.62.g1b64cef) e2fsprogs (1.47.3 -> 1.47.4) efivar (38 -> 39) ethtool (7.1 -> 7.2) expat (2.9.0 -> 2.10.0) ffado fftw3 (3.3.10 -> 3.3.11) firewalld flatpak-kcm6 (6.8.0 -> 6.8.2) freetype2 fuse-overlayfs (1.17 -> 1.18) fwupd (2.1.8 -> 2.1.9) gdk-pixbuf (2.44.7 -> 2.44.8) gettext-runtime ghostscript glib-networking (2.80.1 -> 2.90.1) glib2 (2.88.4 -> 2.90.1) glycin-loaders (2.1.5 -> 2.2.5) gnutls google-noto-fonts (20261001 -> 20261101) grub2 gsettings-desktop-schemas (50.1 -> 51.0) gvfs (1.60.3 -> 1.62.0) harfbuzz (14.6.0 -> 15.0.0) iproute2 (7.2 -> 7.3) jbigkit (2.1 -> 2.2) kactivitymanagerd6 (6.8.0 -> 6.8.2) kde-cli-tools6 (6.8.0 -> 6.8.2) kde-gtk-config6 (6.8.0 -> 6.8.2) kdecoration6 (6.8.0 -> 6.8.2) kdeplasma6-addons (6.8.0 -> 6.8.2) kernel-source (7.2.11 -> 7.3.1) kf6-baloo kglobalacceld6 (6.8.0 -> 6.8.2) kinfocenter6 (6.8.0 -> 6.8.2) kirigami-addons6 (1.14.0 -> 1.16.0) kmenuedit6 (6.8.0 -> 6.8.2) knighttime6 (6.8.0 -> 6.8.2) kpipewire6 (6.8.0 -> 6.8.2) krb5 kscreen6 (6.8.0 -> 6.8.2) kscreenlocker6 (6.8.0 -> 6.8.2) ksshaskpass6 (6.8.0 -> 6.8.2) ksystemstats6 (6.8.0 -> 6.8.2) kwayland-integration6 (6.8.0 -> 6.8.2) kwayland6 (6.8.0 -> 6.8.2) kwin6 (6.8.0 -> 6.8.2) lame (3.100 -> 4.0) layer-shell-qt6 (6.8.0 -> 6.8.2) lcms2 (2.19.1 -> 2.20) libapparmor libarchive (3.8.9 -> 3.8.10) libconfig (1.8.2 -> 1.8.3) libdeflate (1.25 -> 1.26) libglycin (2.1.5 -> 2.2.5) libheif (1.23.6 -> 1.23.7) libimobiledevice (1.4.0+0git.20251010 -> 1.4.0+9git.20260610) libimobiledevice-glue (1.3.2+git0.20250604 -> 1.3.3+git0.20261005) libjpeg-turbo libkscreen6 (6.8.0 -> 6.8.2) libksysguard6 (6.8.0 -> 6.8.2) libmad (0.16.4 -> 0.16.5) libnfs libnotify (0.8.8 -> 0.8.9) libopenmpt (0.8.9 -> 0.8.10) libostree (2026.4 -> 2026.6) libplasma6 (6.8.0 -> 6.8.2) libqaccessibilityclient-qt6 librsvg (2.62.4 -> 2.63.4) libsndfile libsolv (0.7.40 -> 0.7.41) libsoup (3.6.6 -> 3.8.1) libtirpc (1.3.7 -> 1.3.8) libunistring (1.4.2 -> 1.5) libupnp (22.1.8 -> 22.1.10) libwacom (2.19.1 -> 2.20.0) libzypp (17.38.16 -> 17.38.17) live555 (2026.10.17 -> 2026.10.29) llvm23 (23.1.3 -> 23.1.4) lvm2 (2.03.38 -> 2.03.43) lvm2-device-mapper (2.03.38_1.02.212 -> 2.03.43_1.02.217) makedumpfile milou6 (6.8.0 -> 6.8.2) ncurses (6.6.20260926 -> 6.6.20261017) ngtcp2 (1.25.0 -> 1.26.0) openexr (3.5.2 -> 3.5.3) oxygen6-sounds (6.6.3 -> 6.8.2) parted patterns-base patterns-kde pciutils (3.14.0 -> 3.15.0) pcsc-lite (2.3.3 -> 2.5.3) pipewire (1.6.9 -> 1.6.11) plasma5support6 (6.8.0 -> 6.8.2) plasma6-activities (6.8.0 -> 6.8.2) plasma6-activities-stats (6.8.0 -> 6.8.2) plasma6-browser-integration (6.8.0 -> 6.8.2) plasma6-desktop (6.8.0 -> 6.8.2) plasma6-integration (6.8.0 -> 6.8.2) plasma6-nm (6.8.0 -> 6.8.2) plasma6-openSUSE plasma6-pa (6.8.0 -> 6.8.2) plasma6-print-manager (6.8.0 -> 6.8.2) plasma6-systemmonitor (6.8.0 -> 6.8.2) plasma6-workspace (6.8.0 -> 6.8.2) podman (6.1.2 -> 6.1.4) polkit-kde-agent-6 (6.8.0 -> 6.8.2) powerdevil6 (6.8.0 -> 6.8.2) python-SQLAlchemy (2.0.51 -> 2.1.6) python-alembic (1.18.5 -> 1.20.1) python-certifi (2026.7.22 -> 2026.10.23) python-gobject (3.56.3 -> 3.58.1) python-jsonpatch (1.33 -> 1.37) python-jsonpointer (3.1.1 -> 3.5) python-maturin (1.15.0 -> 1.16.0) python-pycparser (3.0 -> 3.12) python313 python313-core qqc2-breeze-style6 (6.8.0 -> 6.8.2) qt6-base qt6-declarative rebootmgr (4.0+git20261008.76d8ee7 -> 4.3) rootlesskit (3.2.0 -> 3.3.0) rsync rust-keylime (0.2.9+49 -> 0.2.10+12) samba (4.25.0+git.473.e78e78fbf4 -> 4.25.1+git.476.bfc358351cb) sdbootutil (1+git20261007.53bc127 -> 1+git20261026.4e266f0) sddm-kcm6 (6.8.0 -> 6.8.2) selinux-policy (20261019 -> 20261030) sensors snowball (3.0.1 -> 3.1.1) spectacle (6.8.0 -> 6.8.2) speex spice-vdagent (0.23.0 -> 0.23.0+git6.e940b00) sqlite3 (3.53.2 -> 3.54.1) systemsettings6 (6.8.0 -> 6.8.2) taglib (2.3 -> 2.3.2) tesseract-ocr (5.5.3 -> 5.5.4) tevent union6 (6.8.0 -> 6.8.2) userspace-rcu (0.15.6 -> 0.15.7) util-linux util-linux-systemd vlc wireplumber (0.5.18 -> 0.5.19) xdg-desktop-portal-kde6 (6.8.0 -> 6.8.2) xfsprogs (6.19.0 -> 7.2.0) xkeyboard-config xorg-x11-server (21.1.24 -> 21.1.25) xterm (411 -> 412) xwayland (24.1.13 -> 24.1.14) zvbi (0.2.45 -> 0.2.46) zypp-boot-plugin (0.0.13 -> 0.0.14) zypper (1.14.101 -> 1.14.102) === Details === ==== MicroOS-release ==== Version update (20261020 -> 20261103) Subpackages: MicroOS-release-appliance MicroOS-release-dvd - automatically generated by openSUSE-release-tools/pkglistgen ==== SVT-AV1 ==== Version update (4.2.0 -> 4.3.0) - Update to release 4.3.0 * Improvedd the quality vs. speed tradeoffs across all presets: * ~5-8% improvement in cycle efficiency at similar quality levels * ~10-11% run time reduction in multi-threaded mode * Speed optimizations in MD pruning, RDOQ and coefficient cost, MV cost and subpel search, loop filter parameter derivation, and block copies * Now runs anti-aliasing-aware screen content detection only on I-frames in multi-threaded mode * Added low-delay tile parallelism * Added opt-in CBR pre-encode frame skipping * Added screen content tools for RTC: IntraBC on I-frames and palette on intra blocks of inter frames ==== aaa_base ==== - Remove the /etc/init.d/boot.local and /etc/init.d/after.local ghost placeholders; nothing has executed these files since the sysvinit era and the spec already recorded the intent to drop them. This resolves the executable-marked-as-config-file errors on the pair - Build the text-only subpackages extras, malloccheck, wsl and yama-enable-ptrace as noarch - Drop the legacy aaa_base:/etc/DIR_COLORS provides from aaa_base-extras; nothing in Tumbleweed requires it - Fix a typo in the yama-enable-ptrace description and wrap the main description line - Drop the Group tags from all package sections - Rework aaa_base-rpmlintrc: drop the filters whose targets no longer exist in the package (the wtmp log file group, the restricted hostname symlink and the deprecated init script filters for the removed .local files) and add reasoned filters for the remaining deliberate warnings (the nsswitch.conf backup copy in %post, the skel dotfiles, /var/adm and the sysconfig fillup templates) ==== accountsservice ==== Version update (23.13.9 -> 26.27.3) - Update to version 26.27.3: + release notes are at https://gitlab.freedesktop.org/accountsservice/accountsservice - Rebase accountsservice-sysconfig.patch and harden_accounts-daemon.service.patch. - Drop accountsservice-mocklib-gcc14.patch and remove patched mocklib: fixed upstream. - Add json-c to BuildRequires: new dependency. - Rename libaccountsservice package to account for new sover. - Make vala package noarch. It doesn't contain any binaries. ==== apparmor ==== - Pass the distribution build flags to the plain make builds of the parser and the binutils programs, so apparmor_parser, aa-exec, aa-load and aa-status are built with fortify and stack-protector hardening like the rest of the package - Drop the obsolete BuildRoot tag from both specs and use the pkgconfig spelling of the pkg-config BuildRequires ==== at-spi2-core ==== Version update (2.60.7 -> 2.62.1) Subpackages: libatk-1_0-0 libatk-bridge-2_0-0 libatspi0 typelib-1_0-Atk-1_0 typelib-1_0-Atspi-2_0 - Update to version 2.62.1: * Fix baseline race in direct connection test. * Fix typecasting macros in atspi-application.h. * At-spi-bus-launcher: Clean up dbus-daemon when terminating from signals other than SIGTERM. - Update version dependencies according to meson.build. - Update to version 2.62.0.1: + This is functionally equivalent to 2.62.0, but the tag for 2.62.0 was not signed. ==== aurorae6 ==== Version update (6.8.0 -> 6.8.2) - Update to 6.8.2 * New bugfix release * For more details please see: * https://kde.org/announcements/plasma/6/6.8.2 - Changes since 6.8.1: * Update version for new release 6.8.2 - Update to 6.8.1: * New bugfix release * For more details see https://kde.org/announcements/plasma/6/6.8.1 - Changes since 6.8.0: * Update version for new release 6.8.1 ==== bluedevil6 ==== Version update (6.8.0 -> 6.8.2) - Update to 6.8.2 * New bugfix release * For more details please see: * https://kde.org/announcements/plasma/6/6.8.2 - Changes since 6.8.1: * Update version for new release 6.8.2 - Update to 6.8.1: * New bugfix release * For more details see https://kde.org/announcements/plasma/6/6.8.1 - Changes since 6.8.0: * Update version for new release 6.8.1 * kcm: Fix device section headers ==== bluez ==== Subpackages: bluez-cups libbluetooth3 - Own zsh-completion dirs. ==== breeze6 ==== Version update (6.8.0 -> 6.8.2) Subpackages: breeze6-cursors breeze6-decoration breeze6-style breeze6-style-qt5 breeze6-wallpapers - Update to 6.8.2 * New bugfix release * For more details please see: * https://kde.org/announcements/plasma/6/6.8.2 - Changes since 6.8.1: * Update version for new release 6.8.2 - Update to 6.8.1: * New bugfix release * For more details see https://kde.org/announcements/plasma/6/6.8.1 - Changes since 6.8.0: * Update version for new release 6.8.1 ==== breeze6-gtk ==== Version update (6.8.0 -> 6.8.2) Subpackages: gtk3-metatheme-breeze6 metatheme-breeze6-common - Update to 6.8.2 * New bugfix release * For more details please see: * https://kde.org/announcements/plasma/6/6.8.2 - Changes since 6.8.1: * Update version for new release 6.8.2 - Update to 6.8.1: * New bugfix release * For more details see https://kde.org/announcements/plasma/6/6.8.1 - Changes since 6.8.0: * Update version for new release 6.8.1 ==== brotli ==== Version update (1.2.0 -> 1.2.1) Subpackages: libbrotlicommon1 libbrotlidec1 libbrotlienc1 - Update to release 1.2.1 * Fixed an out-of-bounds write write permitting remote code execution [CVE-2026-111497] ==== bubblewrap ==== Version update (0.12.0 -> 0.13.1) - update to 0.13.1: * bwrap now accepts multiple --sync-fd arguments and will handle all of the fds. * O_PATH is used when opening parent directories in the new root, fixing an error when read permission is missing. - update to 0.13.0: * Linux kernel headers with __NR_pivot_root (Linux 2.3.41+) are required at build-time on all architectures * If compiled with -Dassume_kernel=5.12.0 or newer, then a kernel with the mount_setattr syscall is required at runtime, and kernel headers with __NR_mount_setattr are required at build-time on most architectures. On the x86_64, i386 and aarch64 architectures, a fallback is provided to be able to compile with pre-5.12 kernel headers. * On kernels that support it (5.12+), use mount_setattr() to remount filesystems with ro, nodev and/or nosuid. * Arguments that expect a path argument (--bind, --overlay-src, etc.) now reject empty strings. Previously they would sometimes be treated as the root directory due to implementation details, but this was unintended. * A new build option -Ddebug_logging=true can be used to enable verbose debug logging (not recommended for distro builds). These debug messages don't appear unless environment variable DEBUG_INVOCATION is set at runtime. * Fix build failures with older gcc or older -std argument * Fix build failure with musl * Fix test failure on systems that lack hostname(1) * Fix test failure on systems with a mount point containing a backslash * Fix test failure on systems with older xdg-desktop-portal * Don't leave a temporary file behind after running the test suite * CI improvements ==== busybox ==== - Note we are not affected by the following CVEs with no fixes upstream. The relevant applets are disabled in our config. Add comments to the config file warning that enabling them would expose the unfixed CVEs: * dpkg-deb extraction-root escape via per-ar-member deferred symlink flush, CONFIG_DPKG disabled (CVE-2026-90954, bsc#1285581) * dpkg stale field_start pointer causing out-of-bounds read and status file corruption, CONFIG_DPKG disabled (CVE-2026-88842, bsc#1285579) * HTTP request smuggling via pipelined requests in httpd reverse proxy, CONFIG_FEATURE_HTTPD_PROXY disabled (CVE-2026-88829, bsc#1285577) - Fix denial of service via terminal escape sequences in process names displayed by netstat (CVE-2024-58251, bsc#1241700) * 0001-Fix-CVE-2024-58251-sanitize-process-names-when-calli.patch - Fix tar extraction-root escape via deferred symlink/hardlink creation (CVE-2026-108119, bsc#1284987) * 0001-tar-protect-against-Symlink-Hardlink-attack.patch - Fix integer underflow in udhcpc d4_recv_raw_packet() leading to a crash when processing short untrusted DHCP packets (CVE-2026-88833, bsc#1285315) * 0001-udhcpc-ensure-packet.data.cookie-exists-before-we-ac.patch - Fix httpd authentication timing difference between existing and non-existing system users caused by a missing else clause after a failed getspnam_r() call (CVE-2026-88834, bsc#1285314) * 0001-httpd-do-not-try-to-use-obviously-bogus-password-fro.patch - Fix path traversal in libarchive allowing a crafted archive with a ".." member name to create files outside the extraction directory (CVE-2026-92205, bsc#1286932) * 0001-tar-.-is-also-an-unsafe-filename-treat-as-such.patch ==== bzip2 ==== - Remove the explicit Requires(pre) on libbz2-1: the bzip2 binaries already generate a libbz2.so.1()(64bit) dependency, which only libbz2-1 provides, so the effective requirement is unchanged, and bzip2 ships no %pre scriptlet for the (pre) qualifier to serve. Drop bzip2-rpmlintrc with it; its only filter hid the resulting explicit-lib-dependency error - Hardlink the duplicated alias man-page stubs (bzcat.1/bunzip2.1 and bzfgrep.1/bzegrep.1) with %fdupes - Drop the Group tags ==== ca-certificates-mozilla ==== Version update (2.90 -> 2.92) - Updated to 2.92 state (bsc#1286261 CVE-2026-114406 bsc#1287180) - Removed: - emSign ECC Root CA - C3 - emSign ECC Root CA - G3 - emSign Root CA - C1 ==== containerd ==== Version update (2.3.3 -> 2.4.2) - Update to v2.4.2 [CVE-2026-84304, bsc#1279217, CVE-2026-53495, bsc#1280007, CVE-2026-23493, bsc#1282669, CVE-2026-95838, bsc#1285124] * https://github.com/containerd/containerd/releases/tag/v2.4.2 * https://github.com/containerd/containerd/releases/tag/v2.4.0 * https://github.com/containerd/containerd/releases/tag/v2.3.7 * https://github.com/containerd/containerd/releases/tag/v2.3.6 * https://github.com/containerd/containerd/releases/tag/v2.3.5 * https://github.com/containerd/containerd/releases/tag/v2.3.4 - Rebase patches: * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch ==== cpio ==== - Remove the leftover update-alternatives %post fragment and its Requires(post) from the mt subpackage. cpio-mt migrated away from update-alternatives to a Conflicts strategy (bsc#1240092) and the SLE 16 band already ships without the fragment (jsc#PED-15643); as written it could never fire, since it deregisters the alternative only when gnumt is absent, while cpio-mt’s own %post always runs with gnumt installed - Annotate the two %ghost files of the mt subpackage with %attr (0755 for the /usr/bin/mt symlink path, 0644 for its man page) to silence the zero-permission ghost warnings; the ghosts stay so a stale /usr/bin/mt keeps an owning package - Drop the obsolete Group tags and the commented-out install-info prereq lines ==== cracklib-dict-full ==== Version update (2.8.12 -> 2.10.3) - Switch wordlist Source URLs from ftp:// to http:// (ftp is not reachable from the build environment); three wordlists re-downloaded with identical content (gzip header only) - Update to 2.10.3, following the cracklib 2.10.3 package (boo#1160062): rebuild the dictionaries with its current tools. No wordlist changes. - Spec cleanup (spec-cleaner pass) ==== cups ==== Version update (2.4.19 -> 2.4.20) Subpackages: cups-client cups-config libcups2 libcupsimage2 - fix_mailto_validation.patch is "Fix: mailto notifier rejects valid email addresses containing dots" https://github.com/OpenPrinting/cups/pull/1745 "Regression: mailto notifier rejects valid email addresses containing dots/periods" https://github.com/OpenPrinting/cups/issues/1744 - Version upgrade to 2.4.20: See https://github.com/openprinting/cups/releases CUPS 2.4.20 provides amount of bug fixes and security fixes: Assigned CVE ids: CVE-2026-55480 (bsc#1284277) CVE-2026-61702 (bsc#1284278) CVE-2026-87875 (bsc#1279945) CVE-2026-87876 (bsc#1279944) CVE-2026-55453 (bsc#1284275) CVE-2026-55467 (bsc#1284276) CVE-2026-105326 (bsc#1284274) Several fixes use GHSA id of security advisory due long waiting time for CVE ids from CNA. Due our changed policy the fixes referencing GHSA id are for: * vulnerabilities with CVSS < 7.0, which we take as lower priority vulnerabilities, * issues which require print admin rights for triggering them, * issues where its fix is security hardening patch/feature. Per our security policy, issues which require print admin rights, or are security hardening patches, are not taken as vulnerability and they reference a security advisory due convenience, see https://github.com/OpenPrinting/cups?tab=security-ov-file More details in CHANGES.md - excerpts: * SECURITY-5.7: The scheduler did not open temporary PPD files in exclusive mode (CVE-2026-55480) * SECURITY-5.5: The scheduler did not remove all job status attributes from a job creation request (GHSA-7j85-5r23-xhvh) * SECURITY-5.3: The scheduler did not validate the request language value (CVE-2026-61702) * SECURITY-4.6: Attribute names were not validated as proper keyword values (GHSA-w9hj-hq9p-m7f6) * SECURITY-4.3: The `cupsUTF32toUTF8` function incorrectly treated UTF-32 values as 64-bit (CVE-2026-87875) * SECURITY-4.1: Held jobs for temporary print queues could crash the scheduler (GHSA-qqm8-4q5h-jg55) * SECURITY-3.3: The backend did not sanitize IPP attribute strings (CVE-2026-55453) * SECURITY-3.3: The scheduler did not filter out group separators from job submissions (GHSA-wjc4-qhjr-5m5x) * SECURITY-3.0: Quota and policy operations did not treat usernames as case-sensitive (CVE-2026-87876) * SECURITY-3.0: The scheduler's startup permission checks were vulnerable to TOU attacks (GHSA-gj33-wxpv-6fgg) * SECURITY-2.5: The scheduler did not sanitize fax numbers (CVE-2026-55467) * SECURITY-2.5: The 'mailto' notifier did not sanitize the recipient address provided to the sendmail command (CVE-2026-105326) * SECURITY-2.3: The scheduler could crash when modifying a class (GHSA-pwg4-pv39-8c22) * Fixed handling of multiple PPD: keywords from filters (Issue #1562, related to CVE-2026-34980) Issues are those at https://github.com/OpenPrinting/cups/issues - Adapted downgrade-autoconf-requirement.patch for CUPS 2.4.20 - cups-2.4.19-CVE-2026-87875.patch is no longer needed because the issue is fixed upstream. - avoid_C99_loop_initial_declarations.patch avoids "ppd-cache.c:2173:5: error: 'for' loop initial declarations are only allowed in C99 mode" which happens when building CUPS 2.4.20 on older SLE12 https://github.com/OpenPrinting/cups/issues/1742 ==== curl ==== Subpackages: libcurl4 - Make the wcurl subpackage noarch: it ships a single shell script wrapper, so the architecture-specific build was flagged by no-binary; also capitalise its summary - Drop the obsolete Group tags from the fish and zsh completion subpackages ==== dconf ==== Version update (0.49.0 -> 51.0) Subpackages: libdconf1 - Update version dependencies according to meson.build. - Update to version 51.0: + No changes since 51.rc. - Update to version 51.rc: + Update overview regarding safe writer. - Update to version 51.beta: + Implement safe GVDB writer and use it by default for homes on NFS + docs: - Describe DBDIR argument in man page - Fix a typo ==== discover6 ==== Version update (6.8.0 -> 6.8.2) Subpackages: discover6-backend-flatpak discover6-backend-fwupd discover6-notifier - Update to 6.8.2 * New bugfix release * For more details please see: * https://kde.org/announcements/plasma/6/6.8.2 - Changes since 6.8.1: * Update version for new release 6.8.2 * Update version for new release 6.8.2 * fwupd: Do not pass the FwupdBackend object to the connect thread * AppsModel: Remove dup'd stream class * UpdateModel: React when resources disappear * Set X-KDE-AliasFor for Discover's hidden desktop entries (kde#511886) - Update to 6.8.1: * New bugfix release * For more details see https://kde.org/announcements/plasma/6/6.8.1 - Changes since 6.8.0: * Update version for new release 6.8.1 * Prepare ResourcesUpdatesModel before running headless updates (kde#519082) ==== dracut ==== Version update (112+suse.57.g23bbfee -> 112+suse.62.g1b64cef) Subpackages: dracut-ima - Update to version 112+suse.62.g1b64cef: * fix(bluetooth): always install HID drivers that can be needed * fix(bluetooth): mark installed hostonly files * fix(nvmf): prevent nvmf's installkernel failure when no nbft present * test(DRACUT-CPIO): fix unbound CPIO_TESTDIR variable * test(STORAGE): fix condition to add disk2 ==== e2fsprogs ==== Version update (1.47.3 -> 1.47.4) Subpackages: libcom_err2 libext2fs2 - Update e2fsprogs.keyring - Update to 1.47.4: * mke2fs: support multiple -E options and a new root_selinux option setting the SELinux label of the root directory; suppress large-block-size warnings when the kernel supports block sizes greater than page size * mke2fs -d: handle copying files larger than 2 GiB; no longer create oversized orphan-file inodes with 64k block size * e2fsck: stop flagging fast symlinks with large external EAs (EA-inode backed) as corrupt; check EA-inode values for invalid zero size * e4defrag: fix crash defragmenting inline-data files * e2scrub: fix lvremove retry loop on temporary busy failures * fuse2fs and libext2fs: many correctness fixes found running xfstests (superblock error flags, refuse inconsistent mounts, read-only/offset mounts, permissions, ACLs, inline data, fallocate, FITRIM, statfs, relatime) * Man page cleanups - Spec cleanup (spec-cleaner): drop obsolete Group tags and ppc64 Obsoletes, https Source URLs, pkgconfig-style dependencies ==== efivar ==== Version update (38 -> 39) - Add efivar-bsc1286645-revert-file-wrapper-removal.patch to revert the removal of "File()" (bsc#1286645) - CVE-2026-6862: efivar: stack overflow in device path node parsing can cause a denial of service (bsc#1262696) * efivar-bsc1262696-fix-stack-overflow-in-device-path-parsing.patch - Update to 39: * efivar CLI: -A accepts hex values, -a can create a non-existent variable * Revamped efi_well_known variable handling * File device paths no longer print "File(" or ")" * Fixed IPv4 and IPv6 device path printing * Handle non-ACPI systems in device_get * Headers gained extern "C" for easier use by C++ * Build fixes: musl libc, i686 format error, riscv64 -march, gcc-13, invalid free in main * Make-based build: LLD detection fixes, removed deprecated - -add-needed linker flag, docs can be disabled * Upstream moved from rhinstaller to the rhboot organization - Drop efivar-bsc1202209-fix-glibc-2.36-build.patch, efivar-adjust-dependency.patch and efivar-bsc1206388-revamp-efi_well_known-variable-handling.patch: all fixed upstream in this release - Rebase efivar-filter-gcc-march.patch for the upstream riscv64 rework (boo#1231368) - Rebase libefiboot-export-disk_get_partition_info.patch for the upstream extern "C" header rework - Switch Source to the rhboot tag archive: upstream published no release tarball for 39 ==== ethtool ==== Version update (7.1 -> 7.2) - Update to release 7.2 * Feature: support for KSZ87xx PHY tunables (--{get,set}-phy-tunable) * Fix: cmis: fix printing of Tx bias current (-m) * Fix: cmis: fix printing of channel-level flags (-m) * Fix: cmis: fix printing of CDB EPL pages (-m) * Fix: printing of transmitter technology for CMIS transceivers (-m) * Fix: avoid undefined behavior with CMIS transceivers (-m) * Fix: add missing CMIS transmitter technologies (-m) * Fix: printing of attenuation and wavelength (-m) * Fix: printing of link length (-m) * Fix: sfpid: print all implemented options (-m) * Fix: sfpid: print all compliance codes (-m) * Fix: qsfp: print all compliance codes (-m) * Fix: module-eeprom: clamp data length to attribute payload size (-m) * Fix: validate module EEPROM offset and length (-m) * Fix: rss: bound hash function masks in text and JSON output (-x) * Fix: fbnic: fix off-by-one shift in reg dump parser (-d) * Fix: fbnic: Fix various TX and RX CSR fields decoding (-d) * Fix: fbnic: Fix register dump names and bit labels (-d) ==== expat ==== Version update (2.9.0 -> 2.10.0) - update to 2.10.0: * Security fixes: * CVE-2026-113351, bsc#1286599: denial of service with use of XML_ParserReset * CVE-2026-115506, bsc#1287856: detect billion laughs attacks quicker and more of its variations * CVE-2026-117610, bsc#1288868: fix initial non-final empty subparser parse calls, was segfaulting * CVE-2026-118370, bsc#1288849: protect attIndex and nPrefixes in storeAtts from signed integer overflow * Bug fixes: * Initialize m_parsingStatus.finalBuffer in parserInit * Improve XML_Parse for XML_CONTEXT_BYTES == 0 * Use C99 length modifiers for ptrdiff_t and size_t * Check isCalledFromInsideHandler first in XML_Parse * Add missing check for a character handler reset * Library version bumped from 14:0:13 to 14:1:13 ==== ffado ==== - libffado-date_time.patch: avoid mismatched format string types and args ==== fftw3 ==== Version update (3.3.10 -> 3.3.11) - improve summaries - Use HTTP to download sources instead of FTP. - Update to version 3.3.11: * New API fftw_copy_plan(). * Support SVE SIMD instructions. * Support LoongArch LSX and LASX SIMD instructions. * Support Apple ARM, RISC-V and LoongArch cycle counters. * Fix SSE2 double-precision unaligned access segfaults. * threads/openmp/mpi-devel now require pkgconfig(fftw3/f/l) (provided by fftw3-devel); man pages ship as regular files. - Modernize spec file (spec-cleaner, drop Group/BuildRoot). ==== firewalld ==== Subpackages: python313-firewall - Add zsh BuildRequires: Needed due to zsh-completion dirs. ==== flatpak-kcm6 ==== Version update (6.8.0 -> 6.8.2) - Update to 6.8.2 * New bugfix release * For more details please see: * https://kde.org/announcements/plasma/6/6.8.2 - No code change since 6.8.1 - Update to 6.8.1: * New bugfix release * For more details see https://kde.org/announcements/plasma/6/6.8.1 - No code changes since 6.8.0 ==== freetype2 ==== - fix description ==== fuse-overlayfs ==== Version update (1.17 -> 1.18) - update to 1.18 (bsc#1286378, CVE-2026-77478): * main: fix operations on hardlinked lower-layer files resolving to the wrong layer (CVE-2026-77478). ==== fwupd ==== Version update (2.1.8 -> 2.1.9) Subpackages: libfwupd3 typelib-1_0-Fwupd-2_0 - Update to version 2.1.9: * This release adds the following features: + Add an instance ID for each Redfish HPE device class and target pair + Include if the machine is a container or hypervisor in the report data + Require libusb 1.0.27 when building the daemon * This release fixes the following bugs: + Add After=local-fs.target to fwupd.service to fix a CoreOS mount issue + Create a dbx device with version 0 when the variable is missing + Delete the efi helper when using fwupdtool reboot-cleanup + Do not show GPIO devices in the fwupdmgr emulation-tag device list + Do not truncate 64-bit values when exporting firmware as XML + Fix a small memory leak when installing dell-kestrel firmware + Fix the DFU footer size check + Ignore parent battery reports when updating the Jabra GNP child + Process all releases to set the version on a 2023-only dbx + Remove command aliases from bash-completion + Use absolute paths when sending the filename hint * This release adds support for the following hardware: Pixart PID 38CA - Update version dependencies according to meson.build. - rename Polkit rules to give it a 10- prefix, allowing them to gain priority over the SUSE-specific rules generated in /etc/polkit-1/rules.d/90-default-privs.rules (bsc#1279948). ==== gdk-pixbuf ==== Version update (2.44.7 -> 2.44.8) Subpackages: gdk-pixbuf-query-loaders libgdk_pixbuf-2_0-0 typelib-1_0-GdkPixbuf-2_0 - Update to version 2.44.8: + glycin: Support x-/y-dpi options for png, tiff and jpeg + Updated translations. ==== gettext-runtime ==== Subpackages: envsubst libtextstyle0 - Add ldconfig calls to the gettext-tools scriptlets: the package ships libgettextpo.so.0 but never ran ldconfig for it; the calls join the existing %post and a new %postun - Add gettext-spit-shebang.patch: /usr/bin/spit used an /usr/bin/env python3 shebang, name the interpreter directly - Extend the frozen gettext-linkdupes.sh hardlink list to cover the examples and data files added since it was generated (hello-go, hello-go-http, hello-c++20, hello-objc-gnome2, the GNOME m4 files, the shared po/LINGUAS files and the nls.m4 pair under /usr/share); the list stays frozen and is extended by hand rather than replaced by live %fdupes runs, because a BuildRequires on fdupes would create a build loop (its dependency chain reaches back into gettext) - Drop the stale removal of gettext.jar from %install: no jar is built since the Java support was dropped, and the line missed the buildroot prefix - Fix the libtextstyle0 summary wording (text styling) - Drop the deprecated Group: tags - rpmlintrc: drop the filters for the fixed gettext-tools ldconfig findings and the gettext-csharp filters (that package is built from a different source package) - The remaining rpmlint error, non-devel-file-in-devel-package for libgettextpo.so.0 in gettext-tools, is a checker problem, not a package defect: gettext-tools is the designated devel package for libgettextpo (it ships the headers, the unversioned symlink and Provides: gettext-devel). It is tracked on the rpmcrab side and is deliberately not restructured or filtered in this package ==== ghostscript ==== - Build --without-local-brotli to not use the brotli sources in Ghostscript but the system brotli library to avoid CVE-2026-111497: ghostscript: brotli: "Brotli decoder out-of-bounds write permits remote code execution" (bsc#1287815) ==== glib-networking ==== Version update (2.80.1 -> 2.90.1) - Update to version 2.90.1: * Bugs fixed: + CVE-2026-103963: Unbounded TLS 1.3 session ticket queue growth in glib-networking allows remote denial of service + CVE-2026-112963: glib-networking macOS OpenSSL backend incorrectly trusts non-SSL policy certificates as TLS anchors + CVE-2026-113624: glib-networking TLS client session cache key not rebuilt after certificate property change, allowing stale session resumption + CVE-2026-113622: glib-networking: Missing TLS purpose validation in glib-networking OpenSSL backend allows Extended Key Usage bypass + CVE-2026-113623: glib-networking: Unbounded memory growth in glib- networking GnuTLS backend application data buffer during TLS handshake allows remote denial of service + openssl: consult errno on syscall failure * Updated translations. - Update version dependencies according to meson.build. - Update to version 2.90.0: + Bugs fixed: - meson: Remove version checks that are always true + Updated translations. - Update to version 2.90.alpha: + Bugs fixed: - test fails with openssl 3.4.x - (CVE-2025-60018) (#YWH-PGM9867-106) Out of Bond Reads on glib-networking through tls/openssl/gtlscertificate-openssl.c via "g_tls_certificate_openssl_get_property()" due to Incorrect BIO_write Return Value Validation in Certificate PEM Export - (CVE-2026-2574) (#YWH-PGM9867-150) OOB Read on glib-networking through tls/openssl/gtlsclientconnection-openssl.c via g_tls_client_connection_openssl_get_property() - (CVE-2026-10028) (#YWH-PGM9867-278) Infinite loop in certification path building - meson: Introduce option for enable/disable tests - openssl: check return value of g_tls_bio_alloc() and BIO_new() - openssl: delete support for OCSP stapling - Fix file database and PKCS11 test failures and update CI! - Fix miscellaneous safety issues reported by bug hunters - Delete gtlshttp - Fix connection test reusing a GError - openssl: fix error code confusion - ci: add catch for reporting stack traces - Require OpenSSL 1.1.1 or newer - Some fixes found with kiro - Fix various memory leaks - openssl: refactor error handling code - openssl: use ERR_clear_error() all over the place - gnutls: always notify accepted-cas property after handshake + Updated translations. - Drop CVE-2026-10028.patch: Fixed upstream. ==== glib2 ==== Version update (2.88.4 -> 2.90.1) Subpackages: glib2-tools libgio-2_0-0 libgirepository-2_0-0 libglib-2_0-0 libgmodule-2_0-0 libgobject-2_0-0 typelib-1_0-GLib-2_0 typelib-1_0-GLibUnix-2_0 typelib-1_0-GModule-2_0 typelib-1_0-GObject-2_0 typelib-1_0-Gio-2_0 - Update to version 2.90.1: * Bugs fixed: + Add address and thread sanitizer scheduled CI job + inotify: cancelling monitor through symlink alias removes watch used by still-active monitors + g_file_trash() returns FALSE without setting the GError when trashing a non-empty directory for `DT_UNKNOWN` nodes + tools: Add another variant of an existing suppression to glib.supp + giochannel: Fix strncmp() off the end of the buffer + gvariant: Handle get_data_as_bytes() for corrupted variants + utils: Add missing ENUMERATOR_AVAILABLE_IN + rcbox: Turn assertion into error + gdbusauthmechanismsha1: Don't split into too many tokens + logging: Don't stack overflow with too many fields + regex: Handle empty matches at end + unicode: - Fix error handling in normalization - Don't read past limits - Prevent overflow in normalization + gmarkup: Be careful in error paths + gresource: Avoid underflow + gcharsetconverter: Avoid closing invalid iconv descriptors + gregex: Fix some trivial typos in the docs + gfileenumerator: Reformat docs to fully use gi-docgen and match style guide + fileutils: Check the mode before creating the file + Clarify various inconsistencies with g_socket_address_new_from_native() + tests: Avoid a ubsan warning about passing NULL to strncmp() + glib.supp: Mark a TLS variable as not really a leak * Updated translations. - Drop gsettings.zsh (_gsettings completion) as source, no longer needed as zsh ships its own gsettings completions (boo#1284142). - Update to version 2.90.0: + Bugs fixed: - G_DEFINE_TYPE parent_class variable trips clang 23's `-Wunused-but-set-global` - `-Wtypedef-redefinition` warnings from `GDBusActionGroup` when building 2.89.4 with clang - fix: handle long filenames in trash by truncating from front - tests: allocate an adequate alternate signal stack - gtestutils: Mark a TLS variable as not really a leak - goutputstream: Fix an unused-variable warning with G_DISABLE_ASSERT + Updated translations. - Update to version 2.89.4 (Unstable): + Improve support for nanosecond source timeouts + Fix installed service file containing build path + Support clicking notification icons on Windows + Improve stream splice performance by increasing buffer size + Updated translations. - Update to version 2.89.3 (Unstable): + Support systemd-style UAPI file masking and drop-ins for `GKeyFile` + Add some string and date convenience API, `g_string_free_deep()` and `g_set_date_time()` + Add some convenience API to `GUnixFDList` + Bugs fixed: - Support UAPI file masking and drop-ins in GKeyFile - gio/tests: iptosmessage does not compile on Solaris - fd leak in `g_file_set_contents_full()` on error? - gio-tool: crash (assertion failed) when running 'gio help help' - Add g_string_free_deep - datetime: Add g_set_date_time - giostream: Clarify is_closed() method docs for streams - gunixfdlist: Add g_unix_fd_list_append_take, g_unix_fd_list_peek, g_unix_fd_list_lookup, g_unix_fd_list_lookup_peek - gtestutils: Fix a minor typo in a documentation comment - tests: Minor compiler warning fixes for GCC16 - build: Fix a deprecation warning from Meson 1.12 - docs: Use dedicated docblocks for new enum members - docs: Annotate callbacks rather than user_data - Add finer accuracy g_timeout APIs - gdbusnameowning: Don't print any logs when connection is closed - Avoid reserved identifiers in public macros - Update to version 2.89.2 (Unstable): + Fix potential miscompilation with GCC 17 with `G_GNUC_CONST` on `get_type()` functions + Update toolchain requirement to C11; previously this was just strongly recommended + Various bugs fixed. + Updated translations. - Update to version 2.89.1 (Unstable): + g_thread_yield() may not yield control to another thread as expected on Linux. + gio: gmemorymonitordbus: Fix fallback backends can't be properly loaded + gregex: Remove "array length" annotations + win32-build.md: Update Visual Studio build info + Don't use slow content type for icons when only fast content is queried + Performance improvements to GVariant/GDBusMessage + docs: fix wrong reference to gint16 for gint32 types in glib/types.md + Add missing finish-func annotations + gregex: g_match_info_fetch_pos() and g_match_info_fetch_all() will now work after partial matches as well ... changelog too long, skipping 27 lines ... https://gitlab.gnome.org/GNOME/glib ==== glycin-loaders ==== Version update (2.1.5 -> 2.2.5) - Update to version 2.2.5: * This release contains the following new component versions: + Glycin-core 4.0.5 + Glycin 4.0.5 + Glycin-builtin 4.0.5 + Glycin-external 4.0.5 + Libglycin 2.2.5 + Libglycin-gtk4 2.2.5 * Fixed: + Require gufo-exif 0.5.5 to avoid reading exif values from incorrect positions in some images. + Libglycin: Don't panic when trying to lookup an infinite pixel density. Instead, don't return any pixel density. + Meson/thumbnailer: Ensure that libglycin is built before glycin-thumbnailer. - Pass libglycin=true to meson setup in glycin-loaders.spec.inc following upstream changes. - Update to version 2.2.4: * This release contains the following new component versions: + Glycin-core 4.0.4 + Glycin-image-rs 2.2.4 + Glycin 4.0.4 + Glycin-builtin 4.0.4 + Glycin-external 4.0.4 + Libglycin 2.2.4 + Libglycin-gtk4 2.2.4 * Fixed: + Require gufo-exif 0.5.4 to avoid a panic in exif lookup for certain images. + Glycin: Longer magic byte strings in config identifiers now have a higher priority. This fixes cursors being sometimes identified as TGAs. - Update to version 2.2.3: * This release contains the following new component versions: + Glycin-core 4.0.3 + Glycin-image-rs 2.2.3 + Glycin 4.0.3 + Glycin-builtin 4.0.3 + Glycin-external 4.0.3 + Libglycin 2.2.3 + Libglycin-gtk4 2.2.3 * Fixed: + Require gufo-exif 0.5.3 which fixes parsing issues with non-Canon MakerNote entries. This can cause images not to be rotated according to the Orientation tag. + Image-rs/animation: Drop thread after the Image.done D-Bus method is called. + Image-rs: Prevent channel with animation frames from filling up, causing a effective memory leak. + Libglycin: Don't block main thead in `get_mime_types`. * Changed: Glycin: Canonicalize paths of "Exec" keys when loading configs. - Update to version 2.2.2: * This release contains the following new component versions: + Glycin-core 4.0.2 + Glycin 4.0.2 + Glycin-builtin 4.0.2 + Glycin-external 4.0.2 + Libglycin 2.2.2 + Libglycin-gtk4 2.2.2 * Fixed: Set the unix socket sending the image data to the loader to non-blocking. Otherwise, small socket send buffer configurations might lead to infinite blocking. - Update to version 2.2.1: + This release contains the following new component versions: - glycin-utils 5.0.1 + Fixed: Don't mmap already write sealed memfds as shared. This is only supported since Linux 6.7 . - Update to version 2.2.0: + This release contains the following new component versions: - glycin-common 2.0.0 - glycin-core 4.0.0 - glycin-heif 2.2.0 - glycin-image-rs 2.2.0 - glycin-jxl 2.2.0 - glycin-raw 2.2.0 - glycin-svg 2.2.0 - glycin-test 2.2.0 - glycin-thumbnailer 2.2.0 - glycin-utils 5.0.0 - glycin 4.0.0 - glycin-builtin 4.0.0 - glycin-external 4.0.0 - libglycin-gtk4-rebind 0.2.0 - libglycin-gtk4-rebind-sys 0.2.0 - libglycin-rebind 0.2.0 - libglycin-rebind-sys 0.2.0 - libglycin 2.2.0 - libglycin-gtk4 2.2.0 + Fixed: - glycin/sandbox: Fix compilation on 32 bit architectures - Update to version 2.2.beta.1: + This release contains the following new component versions: - glycin-core 4.0.0-beta.1 - glycin-heif 2.2.0-beta.1 - glycin-image-rs 2.2.0-beta.1 - glycin-jxl 2.2.0-beta.1 - glycin-raw 2.2.0-beta.1 - glycin-svg 2.2.0-beta.1 - glycin-test 2.2.0-beta.1 ... changelog too long, skipping 157 lines ... + Changed: svg: Don't limit the size of elements in the SVG ==== gnutls ==== - FIPS: Perform RSA-PSS self-tests. (bsc#1286296) * fips: perform RSA self-tests using RSA-PSS instead of PKCS#1 v1.5 (ed0c45d) * pk: use deterministic RNG for RSA-PSS in self-tests (35c56812) - FIPS: Mark internal HMAC-SHA-1 when session tickets are enabled as non approved (bsc#1284342) * Add gnutls-FIPS-SLI-session-ticket.patch - FIPS: Mark TLS 1.2 cipher suites using HMAC-SHA-1 for record authentication as non approved (bsc#1284341) * Add an additional GNUTLS_MAC_AEAD check to independently evaluate the MAC algorithm * Add gnutls-FIPS-SLI-record-MAC.patch - FIPS: Mark SHA-1 in TLS v1.0 PRF as non approved (bsc#1284343) * Add gnutls-FIPS-SLI-tls10-PRF.patch - FIPS: TLS 1.3 initialized using empty input (bsc#1284344) * TLS 1.3 key schedule was initialized using an empty input instead of the zero-filled value specified by RFC 8446. * secrets: pass actual zeroes in _tls13_init_secret2 (7fad16dc) * Add gnutls-FIPS-zeros-in_tls13_init_secret2.patch ==== google-noto-fonts ==== Version update (20261001 -> 20261101) Subpackages: google-noto-sans-fonts google-noto-sans-symbols-fonts google-noto-sans-symbols2-fonts - Update to 20261101: * Sans Mongolian: * Various vertical typesetting fixes * Follow the chachlag onset mvs forms in the shaping locks * Include ligatures for p, f, k and kh with l and m * Sans Music: Improve the spacing of the augmentation dot ==== grub2 ==== Subpackages: grub2-arm64-efi grub2-common grub2-snapper-plugin - Fix out-of-bound memory write and uninitialized read in add_multiple_nvme_bootdevices() when adding boot device to PowerPC OpenFirmware's boot list (bsc#1284464) * 0001-osdep-unix-platform-Fix-NVMe-boot-device-buffer-boun.patch * 0002-osdep-unix-platform-Handle-missing-IEEE1275-NVMe-boo.patch * 0003-osdep-unix-platform-Fix-memory-leaks-in-add_multiple.patch - Fix memory leak in error path, add missing error return check in grub_initrd_component(), ensure NULL check before memset() in grub_cryptokey_discard() (bsc#1284464) * 0009-Add-crypttab_entry-to-obviate-the-need-to-input-pass.patch * 0002-discard-cached-key-before-entering-grub-shell-and-ed.patch * Fix-the-size-calculation-for-the-synthesized-initrd.patch - Fix out-of-bound memory write in add_multiple_dm_multipath_bootdevices() when adding boot device to PowerPC OpenFirmware's boot list * 0001-ieee1275-support-dm-multipath-bootlist.patch - Rebase patches * 0002-Restrict-cryptsetup-key-file-permission-for-better-s.patch * 0001-Improve-TPM-key-protection-on-boot-interruptions.patch - Reduce the size and number of TPM 8 PCR events (bsc#1278206) * 0001-script-execute-Do-not-measure-.-block-bodies-into-PC.patch * 0002-script-execute-Free-argv-on-error-paths-in-grub_scri.patch * 0001-grub-mkconfig-Track-and-deduplicate-emitted-modules.patch * 0002-00_header-Deduplicate-device-preparation-for-theme-f.patch * 0003-31_efi_bootnext-Consolidate-EFI-platform-check.patch - Fix overflow in grub-mkpasswd-argon2 (bsc#1284464) * 0001-grub-mkpasswd-argon2-validate-argument-ranges-to-avo.patch - Fix overflow in MFA key protector (bsc#1284464) * 0001-mfa-fix-key-size-calculation-when-keyfile_size-is-0.patch * 0002-mfa-reject-keyfile-offset-at-EOF-to-prevent-empty-ke.patch * 0003-mfa-wipe-key-buffer-on-file-read-error.patch * 0004-mfa-require-both-factors-to-provide-non-empty-keys.patch - Rebase patches * grub-install-force-journal-draining-to-ensure-data-i.patch * grub2-btrfs-05-grub2-mkconfig.patch * grub2-efi-xen-cmdline.patch * grub2-suse-remove-linux-root-param.patch ==== gsettings-desktop-schemas ==== Version update (50.1 -> 51.0) - Update to version 51.0: + Updated translations. - Update to version 51.rc: + Added setting for custom pointer acceleration profile + Remove gconf schema migration files + Updated translations. - Update to version 51.beta: + Add setting to configure the focus ring visibility timeout + Add 'orientation-lock' setting to take over the g-s-d setting + Updated translations. - Update to version 51.alpha: + Add scroll speed setting for touchpads + Add the ability to enable button scrolling on a mouse + Increase default maximum thumbnail cache from 512MB to 2GB + Updated translations. ==== gvfs ==== Version update (1.60.3 -> 1.62.0) Subpackages: gvfs-backends - Update version dependencies according to meson.build. ==== harfbuzz ==== Version update (14.6.0 -> 15.0.0) Subpackages: libharfbuzz-gobject0 libharfbuzz-subset0 libharfbuzz0 typelib-1_0-HarfBuzz-0_0 - Update to version 15.0.0: * Support for the new tables and formats in the ISO Open Font Format (OFF) 5th edition is now enabled by default: + New tables and formats for 24-bit glyph indices (a.k.a. beyond-64k): the `GLYF`, `LOCA`, `GVAR`, `MAXP`, `HHEA`, `HMTX`, `VHEA`, and `VMTX` tables, `cmap` format 15, `VORG` version 2, `COLR` `PaintGlyph2`, the 24-bit `GSUB`, `GPOS`, `GDEF`, `BASE`, and `JSTF` formats, and extended TrueType Collection directories. A test font, `NotoSans-beyond64k.ttf`, which merges the Noto Sans fonts into a single font, can be found at: https://drive.google.com/file/d/1vMQI9mZMzfKIMHD96Iie40Oyo9NnnweH/view + Cubic curves in `GLYF` outlines. + The `DMAP` table, supported since 14.6.0. * Support instancing axes not referenced by retained `VARC` data. The latest `VARC` test fonts can be found at: https://github.com/notofonts/noto-cjk-varco/releases/tag/v0.005 * The raster (`libharfbuzz-raster`), vector (`libharfbuzz-vector`), and GPU (`libharfbuzz-gpu`) libraries are no longer considered experimental. This means that the HarfBuzz API and ABI stability guarantees now apply to these libraries as well. * Fix possible use-after-free in `hb_font_set_face()`, which now resets the font functions to the defaults for the new face. The function is now deprecated. Use `hb_font_create()` instead. * Fix heap-buffer-overflow in `hb_font_set_variation()` after `hb_font_set_face()` switches to a face with more variation axes. * Subsetting `CFF` and `CFF2` fonts whose subroutine calls are not preceded by an immediate subroutine number now fails instead of silently dropping the table, unless desubroutinizing. * Overriding atomic operators at compile time is not supported anymore. * Rewrite the number parser without Ragel, fixing various edge cases. * Harden the experimental WebAssembly shaper against malicious fonts. * Update the experimental Rust shaper (HarfRust) to 0.15, and the `fontations` font functions to read-fonts 0.46. * Update the `kbts` shaping backend to `kb_text_shape` 2.28g, and support font variations in it. * Various subsetting and instancing fixes, especially for `CFF2`, `COLR`, and variable layout tables. * Various fixes to the raster and vector libraries. * Various variable font fixes. * Various fixes for malformed fonts. * Various documentation fixes. * Various build and CI fixes. * Deprecated API: -hb_font_set_face() ==== iproute2 ==== Version update (7.2 -> 7.3) - Update to release 7.3 * ip: add OVPN device mode support * ss: stop displaying dccp sockets * seg6: add support for lookup attribute in SRv6 encap routes * ip nexthop: support fdb destination port * ip/bond: add lacp_strict support ==== jbigkit ==== Version update (2.1 -> 2.2) - Update to 2.2: - Robustness release, upgrade is recommended when processing BIE or PBM/PGM data from untrusted sources. - The jbig.c decoder now caps the final image layer at 2 GB by default via the new sd->maxmem limit (adjustable), mitigating denial of service through excessive image dimensions. - pbmtojbg and pbmtojbg85 validate PBM/PGM header dimensions and check size calculations against integer overflow. - Fixed jbg85_dec_finalheight() macro typo, a jbg_enc_options() range check, jbgtopbm division by zero, and several converter file-handling fixes. - struct jbg_dec_state gained maxmem: libjbig consumers must be recompiled against the new headers (soname unchanged). - Dropped jbigkit-CVE-2022-1210.patch, superseded upstream; rebased jbigkit-2.1-shlib.patch to the 2.2 sources, fixing parallel-build races in the test programs and test suite. - Spec cleanup: BuildRequires for gcc and make, %ldconfig_scriptlets, https source URL. ==== kactivitymanagerd6 ==== Version update (6.8.0 -> 6.8.2) - Update to 6.8.2 * New bugfix release * For more details please see: * https://kde.org/announcements/plasma/6/6.8.2 - Changes since 6.8.1: * Update version for new release 6.8.2 - Update to 6.8.1: * New bugfix release * For more details see https://kde.org/announcements/plasma/6/6.8.1 - Changes since 6.8.0: * Update version for new release 6.8.1 ==== kde-cli-tools6 ==== Version update (6.8.0 -> 6.8.2) - Update to 6.8.2 * New bugfix release * For more details please see: * https://kde.org/announcements/plasma/6/6.8.2 - Changes since 6.8.1: * Update version for new release 6.8.2 - Update to 6.8.1: * New bugfix release * For more details see https://kde.org/announcements/plasma/6/6.8.1 - Changes since 6.8.0: * Update version for new release 6.8.1 ==== kde-gtk-config6 ==== Version update (6.8.0 -> 6.8.2) Subpackages: kde-gtk-config6-gtk3 - Update to 6.8.2 * New bugfix release * For more details please see: * https://kde.org/announcements/plasma/6/6.8.2 - Changes since 6.8.1: * Update version for new release 6.8.2 - Update to 6.8.1: * New bugfix release * For more details see https://kde.org/announcements/plasma/6/6.8.1 - Changes since 6.8.0: * Update version for new release 6.8.1 ==== kdecoration6 ==== Version update (6.8.0 -> 6.8.2) Subpackages: libkdecorations3-6 libkdecorations3private2 - Update to 6.8.2 * New bugfix release * For more details please see: * https://kde.org/announcements/plasma/6/6.8.2 - Changes since 6.8.1: * Update version for new release 6.8.2 - Update to 6.8.1: * New bugfix release * For more details see https://kde.org/announcements/plasma/6/6.8.1 - Changes since 6.8.0: * Update version for new release 6.8.1 ==== kdeplasma6-addons ==== Version update (6.8.0 -> 6.8.2) - Update to 6.8.2 * New bugfix release * For more details please see: * https://kde.org/announcements/plasma/6/6.8.2 - Changes since 6.8.1: * Update version for new release 6.8.2 * wallpapers/tiled: Animate animated images again (kde#516541) * applets/webbrowser: Apply the fixed zoom factor after each page load (kde#485583) * wallpapers/potd: Make the preview match Scaled, Centered and Tiled (kde#505690) * applets/webbrowser: Allow pages to read and write to the clipboard (kde#523381) * applets/mediaframe: fix adding files/folders - Update to 6.8.1: * New bugfix release * For more details see https://kde.org/announcements/plasma/6/6.8.1 - Changes since 6.8.0: * kwin/windowswitchers: use non-grabbing popup window type * Update version for new release 6.8.1 ==== kernel-source ==== Version update (7.2.11 -> 7.3.1) Subpackages: kernel-64kb kernel-default - Linux 7.3.1 (bsc#1012628). - io_uring/poll: don't loop on HUP with multiple references (bsc#1012628). - pid_namespace: prevent TIF_NOTIFY_SIGNAL from interrupting the reaper (bsc#1012628). - coredump: prevent TIF_NOTIFY_SIGNAL from interrupting coredumps (bsc#1012628). - signal: allow taks to temporarily block TIF_NOTIFY_SIGNAL (bsc#1012628). - exit: hang up the tty before closing the files (bsc#1012628). - fork: release the files of a failed fork after sched_cancel_fork() (bsc#1012628). - ptrace: refuse to change the signal mask of a user worker (bsc#1012628). - io-wq: order the exit bit against worker creation task work (bsc#1012628). - signal: only SIGKILL and the freezers interrupt a coredumping task (bsc#1012628). - signal: don't retarget shared signals in a dying thread group (bsc#1012628). - coredump: hold RCU while releasing parked threads (bsc#1012628). - ftrace: Initialize modname and offset in print_rec() (bsc#1012628). - asymmetric_keys: reject trust keys without IDs (bsc#1012628). - keys/trusted_keys: return immediately after TPM unseal failure (bsc#1012628). - KEYS: trusted: Fix blob allocation size in tpm2_key_decode() (bsc#1012628). - KEYS: Fix key_reject_and_link() race with keyring restriction (bsc#1012628). - keys: Protect the read method check against type removal (bsc#1012628). - keys: make keyring indexes independent of kernel addresses (bsc#1012628). - keys: Protect the type name while describing a key (bsc#1012628). - keys: Check the authorization payload in process keyring searches (bsc#1012628). - keys: Avoid the owner account dereference in named keyring lookup (bsc#1012628). - io_uring: end the drain when the drain request completes (bsc#1012628). - io_uring/waitid: prevent cancel reference wrap (bsc#1012628). - io_uring/net: keep recv buffer select length within MAX_RW_COUNT (bsc#1012628). - io_uring/wait: wake real-time waiters from hard interrupt context (bsc#1012628). - io_uring/poll: avoid retry wakeup loss when dropping ownership (bsc#1012628). - tracing/syscalls: Use copy_from_user for the faultable syscall buffer (bsc#1012628). - tracing/histograms: Verify event_call identity when updating synth_event refcount (bsc#1012628). - tracing: Fix 64-bit and signed histogram fields on 32-bit kernels (bsc#1012628). - tracing: Add the bucket size to expr_field_str() (bsc#1012628). - tracing: Unregister field variable histograms when the command fails (bsc#1012628). - tracing: Save the event file instead of the compatible histogram (bsc#1012628). - tracing: Reject incomplete event filter expressions (bsc#1012628). - tracing: Hold trace_types_lock when resetting last boot data from readers (bsc#1012628). - tracing: Hold trace_types_lock when updating modules in persistent instances (bsc#1012628). - tools/dma: fix building with O= (bsc#1012628). - Bluetooth: L2CAP: refuse __l2cap_chan_add if chan already has conn (bsc#1012628). - mm/damon/core: error damos_commit_quota_goal() for zero target_value (bsc#1012628). - genirq/proc: Fix missing CPU header in /proc/interrupts (bsc#1012628). - commit 8815021 - rpm/release-projects: Add SUSE:SLFO:Kernel:1.0 - commit 2b42edb - rpm/mkspec: Adjust for 32bit arch rename again There is a discrepancy between OBS architecture and rpm architecture for 32bit arm. Specify both variants. Fixes: 38dbb311314 ("rpm/mkspec: Adjust for 32bit Arm arch rename") - commit 09b332e - Revert "mkspec: Exclude rt flavor from kernel-syms dependencies (bsc#1244337)." This reverts commit 7c95ae0ac0bb4a4481565e3a3ead1e221ced817c. - commit ee3b323 - Revert "rpm/mkspec: Fix missing kernel-syms-rt creation (bsc#1244337)" This reverts commit 630f139a764a8ea61dfc0bb46f3675769d8ac1e0. - commit ebcac98 - Revert "rpm/mkspec: Exclude azure from kernel-syms dependencies" This reverts commit c174e9bd96115668914bc3ed97c2df3525bf7930. - commit 16115a3 - series.conf: move a patch to sorted section patches.suse/ALSA-usb-audio-Avoid-applying-boot-quirk-for-Behring.patch is upstream now. - commit 2c911cd - Refresh patches.suse/powerpc-ftrace-Don-t-restore-r13-during-ftrace_regs_caller.patch. Update upstream status. - commit 22d516d - x86/mm/pat: Use pr_warn() for early W^X warnings (bsc#1284523). ... changelog too long, skipping 38 lines ... - commit 38dbb31 ==== kf6-baloo ==== Subpackages: kf6-baloo-file kf6-baloo-imports kf6-baloo-kioslaves libKF6Baloo6 libKF6BalooEngine6 - Add patch to fix occasional crashes on login: * 0001-service-do-not-start-too-early.patch ==== kglobalacceld6 ==== Version update (6.8.0 -> 6.8.2) Subpackages: libKGlobalAccelD6-0 - Update to 6.8.2 * New bugfix release * For more details please see: * https://kde.org/announcements/plasma/6/6.8.2 - Changes since 6.8.1: * Update version for new release 6.8.2 - Update to 6.8.1: * New bugfix release * For more details see https://kde.org/announcements/plasma/6/6.8.1 - Changes since 6.8.0: * Update version for new release 6.8.1 ==== kinfocenter6 ==== Version update (6.8.0 -> 6.8.2) - Update to 6.8.2 * New bugfix release * For more details please see: * https://kde.org/announcements/plasma/6/6.8.2 - Changes since 6.8.1: * Update version for new release 6.8.2 * kcms/energy: Don't read properties of a null battery - Update to 6.8.1: * New bugfix release * For more details see https://kde.org/announcements/plasma/6/6.8.1 - Changes since 6.8.0: * Update version for new release 6.8.1 - Add explicit dependency for QtGraphs import ==== kirigami-addons6 ==== Version update (1.14.0 -> 1.16.0) Subpackages: libKirigamiAddonsComponents6 libKirigamiAddonsStatefulApp6 libKirigamiApp6 - Update to 1.16.0 https://carlschwan.eu/2026/10/29/kirigami-addons-1.16.0.-the-material-updates/ ==== kmenuedit6 ==== Version update (6.8.0 -> 6.8.2) - Update to 6.8.2 * New bugfix release * For more details please see: * https://kde.org/announcements/plasma/6/6.8.2 - Changes since 6.8.1: * Update version for new release 6.8.2 - Update to 6.8.1: * New bugfix release * For more details see https://kde.org/announcements/plasma/6/6.8.1 - Changes since 6.8.0: * Update version for new release 6.8.1 ==== knighttime6 ==== Version update (6.8.0 -> 6.8.2) Subpackages: libKNightTime0 - Update to 6.8.2 * New bugfix release * For more details please see: * https://kde.org/announcements/plasma/6/6.8.2 - Changes since 6.8.1: * Update version for new release 6.8.2 - Update to 6.8.1: * New bugfix release * For more details see https://kde.org/announcements/plasma/6/6.8.1 - Changes since 6.8.0: * Update version for new release 6.8.1 ==== kpipewire6 ==== Version update (6.8.0 -> 6.8.2) Subpackages: kpipewire6-imports libKPipeWire6 libKPipeWireDmaBuf6 libKPipeWireMonitor6 libKPipeWireRecord6 - Update to 6.8.2 * New bugfix release * For more details please see: * https://kde.org/announcements/plasma/6/6.8.2 - Changes since 6.8.1: * Update version for new release 6.8.2 * libx264encoder: Tell libx264 the stream's frame rate (kde#526931) * PipeWireBaseEncodedStream: Apply a requested size set before starting - Update to 6.8.1: * New bugfix release * For more details see https://kde.org/announcements/plasma/6/6.8.1 - Changes since 6.8.0: * Update version for new release 6.8.1 * PipeWireSourceStream: copy the cursor bitmap with its real size ==== krb5 ==== - Package /var/log/krb5 in krb5-server (mode 0700, as created by krb5-log.tmpfiles) so the directory the krb5-server logrotate config rotates is owned by a package, and move krb5-log.conf (the tmpfiles entry creating it) and its %tmpfiles_create call from the main package to krb5-server, where both belong; client-only installs no longer create the server log directory - Mark the LDAP schema templates (kerberos.schema, kerberos.ldif) %config(noreplace) like the package's other config files - Annotate the /var/lib/kerberos/krb5 and .../user %ghost state directories with their real mode (0755, per krb5.tmpfiles) - Drop the duplicated kinit/klist entries from %files client - Drop three dead rpmlintrc filters (files-duplicate for css and png files and shlib-policy-missing-suffix); nothing in the current file lists matches them - Prevent denial of Service via crafted forwarded credentials * CVE-2026-107778, bsc#1284816 - Prevent denial of Service via malformed PAC in S4U2Proxy * CVE-2026-107778, bsc#1284817 - Add 0014-cve-2026-107708.patch and 0015-cve-2026-107778.patch ==== kscreen6 ==== Version update (6.8.0 -> 6.8.2) - Update to 6.8.2 * New bugfix release * For more details please see: * https://kde.org/announcements/plasma/6/6.8.2 - Changes since 6.8.1: * Update version for new release 6.8.2 - Update to 6.8.1: * New bugfix release * For more details see https://kde.org/announcements/plasma/6/6.8.1 - Changes since 6.8.0: * Update version for new release 6.8.1 * kcm: Only compute a badge color for real display numbers * kcm: Don't read the panel height before an output is selected ==== kscreenlocker6 ==== Version update (6.8.0 -> 6.8.2) Subpackages: kscreenlocker6-imports libKScreenLocker6 - Update to 6.8.2 * New bugfix release * For more details please see: * https://kde.org/announcements/plasma/6/6.8.2 - Changes since 6.8.1: * Update version for new release 6.8.2 - Update to 6.8.1: * New bugfix release * For more details see https://kde.org/announcements/plasma/6/6.8.1 - Changes since 6.8.0: * Handle dropping command line arguments in live upgrades * Update version for new release 6.8.1 ==== ksshaskpass6 ==== Version update (6.8.0 -> 6.8.2) - Update to 6.8.2 * New bugfix release * For more details please see: * https://kde.org/announcements/plasma/6/6.8.2 - Changes since 6.8.1: * Update version for new release 6.8.2 - Update to 6.8.1: * New bugfix release * For more details see https://kde.org/announcements/plasma/6/6.8.1 - Changes since 6.8.0: * Update version for new release 6.8.1 ==== ksystemstats6 ==== Version update (6.8.0 -> 6.8.2) - Update to 6.8.2 * New bugfix release * For more details please see: * https://kde.org/announcements/plasma/6/6.8.2 - Changes since 6.8.1: * Update version for new release 6.8.2 - Update to 6.8.1: * New bugfix release * For more details see https://kde.org/announcements/plasma/6/6.8.1 - Changes since 6.8.0: * Update version for new release 6.8.1 ==== kwayland-integration6 ==== Version update (6.8.0 -> 6.8.2) - Update to 6.8.2 * New bugfix release * For more details please see: * https://kde.org/announcements/plasma/6/6.8.2 - Changes since 6.8.1: * Update version for new release 6.8.2 - Update to 6.8.1: * New bugfix release * For more details see https://kde.org/announcements/plasma/6/6.8.1 - Changes since 6.8.0: * Update version for new release 6.8.1 ==== kwayland6 ==== Version update (6.8.0 -> 6.8.2) Subpackages: libKWaylandClient6 - Update to 6.8.2 * New bugfix release * For more details please see: * https://kde.org/announcements/plasma/6/6.8.2 - Changes since 6.8.1: * Update version for new release 6.8.2 - Update to 6.8.1: * New bugfix release * For more details see https://kde.org/announcements/plasma/6/6.8.1 - Changes since 6.8.0: * Update version for new release 6.8.1 ==== kwin6 ==== Version update (6.8.0 -> 6.8.2) Subpackages: libkwin6 - Update to 6.8.2 * New bugfix release * For more details please see: * https://kde.org/announcements/plasma/6/6.8.2 - Too many changes since 6.8.1, only listing bugfixes: * keyboard_layout: Keep an application's layout after its last window closes (kde#476831, kde#452445) * backends/drm: move direct scanout device check to the compositor (kde#527544) * wayland/pointerconstraints_v1: fix state being overwritten (kde#527675) * backends/drm: disable post-blend offloading if color pipelines aren't supported (kde#527628) * multigpuswapchain: more correctly check the buffer type (kde#527591) * multigpuswapchain: fix synchronization with EGL copy (kde#527591) * Lower pip surfaces in the stack (kde#527648) * plugins/stickykeys: Latch and lock modifiers on key release (kde#509714) * plugins/slidingnotifications: Fix instant animation speed handling (kde#527478) * backends/drm: don't allow post-blend offloading with legacy (kde#527421) * plugins/startupfeedback: Fix icon sizing (kde#527308) * inputmethod: Fix visible in virtual keyboard dbus API (kde#527067) * outputconfigurationstore: allow generating a completely new config (kde#527401) * qpa: Guard against resizes in EGLPlatformContext::swapBuffers() (kde#527269) - Update to 6.8.1: * New bugfix release * For more details see https://kde.org/announcements/plasma/6/6.8.1 - Too many changes to list here - Drop patches, now upstream: * 0001-opengl-gltexture-use-swizzles-to-ignore-non-existent.patch ==== lame ==== Version update (3.100 -> 4.0) - Update to version 4.0 (libmp3lame soname unchanged, still .so.0): * Major version bump: the 9-byte encoder version field in MP3s overflowed with 3.100 minor versions; 4.0 resets the scheme. * Security fixes: AIFF header parser integer-underflow DoS (CVSS 5.5, frontend); Blade DLL beInitStream stack overflow (Windows-only, CVSS 8.4). * Fix build with recent GCC/Clang (UTF-8 ID3 tag functions); export id3tag_set_textinfo/comment_utf8 from shared lib. * Add ID3v2.4 support and upstream pkg-config support. * mp3rtp gains IPv6 support (incompatible CLI change). - Use upstream lame.pc; keep libmp3lame.pc alias. - Use pkgconfig(ncurses); drop obsolete Group tags. - Add pkgconfig(libmpg123) BuildRequires: 4.0's --enable-decoder mandates external mpg123 (configure errors out without it). - Add lame-4.0-frontend-utf8.patch (backport of upstream post-4.0 fix): split the mistyped ID3v2 tag handler into typed UTF-16/UTF-8 variants and add id3tag_set_fieldvalue_utf8(); export hip_set_pinfo and hip_finish_pinfo for the frontend; unbreaks the build with GCC 14+ defaults. ==== layer-shell-qt6 ==== Version update (6.8.0 -> 6.8.2) Subpackages: libLayerShellQtInterface6 - Update to 6.8.2 * New bugfix release * For more details please see: * https://kde.org/announcements/plasma/6/6.8.2 - Changes since 6.8.1: * Update version for new release 6.8.2 - Update to 6.8.1: * New bugfix release * For more details see https://kde.org/announcements/plasma/6/6.8.1 - Changes since 6.8.0: * Update version for new release 6.8.1 ==== lcms2 ==== Version update (2.19.1 -> 2.20) - Update to version 2.20 * Added a plug-in type for profile header parsing. * Fixed premultiplied alpha on planar 16 bit and optimized matrix-shaper transforms. * Fixed planar half float and Lab double formatters, and planar strides in fast_float. * Fixed gamut checking with two profiles and a possible crash with malformed profiles. * Recovered neutrality correction in black point detection. * Made cmsCreateLab2Profile white point handling consistent with cmsCreateLab4Profile. * Fixed UTF8 buffer size calculation. * CGATS parser is now more permissive on certain properties. * Fixed callback type mismatch in resampled CLUT evaluation. * Fixed a crash in PostScript CSA generation. * Fixed memory leaks in black preserving intents and .cube loading. * cmsChangeBuffersFormat now correctly rejects format changes on floating point transforms. ==== libapparmor ==== - Pass the distribution build flags to the plain make builds of the parser and the binutils programs, so apparmor_parser, aa-exec, aa-load and aa-status are built with fortify and stack-protector hardening like the rest of the package - Drop the obsolete BuildRoot tag from both specs and use the pkgconfig spelling of the pkg-config BuildRequires ==== libarchive ==== Version update (3.8.9 -> 3.8.10) - Update to 3.8.10 (security, bugfix and minor feature release): * 7z: add Delta, RISCV, ARMTHUMB and IA64 filters for non-lzma archives * Support message digests via nettle 4 and mbedtls 3 * tar: add --mode option for GNU tar compatibility * Hardening fixes: iso9660 boot-image block count overflow, two reader use-after-free paths, compress flush 1-byte heap overflow, bsdunzip use-after-free, rar5 integer overflow, integer conversion hardening in lha and iso9660 * No soname change: libarchive.so.13 unchanged - Drop obsolete Group: tags; encode upstream libxml2 >= 2.7.3 floor. ==== libconfig ==== Version update (1.8.2 -> 1.8.3) Subpackages: libconfig++15 libconfig15 - Update to release 1.8.3 * Preserve 32-bit width when writing negative binary integers * Preserve explicit 64-bit suffixes when parsing nondecimal integers * Preserve double precision when auto-converting integer assignments * Improve handling of file read errors in the lexer ==== libdeflate ==== Version update (1.25 -> 1.26) - update to 1.26: * Added support for compression level -1 as an alias for the default compression level (6). * libdeflate now requires a C11 compiler. * Fixed build failures with clang 18 specifically (clang 19+ unaffected). * Fixed build failure with glibc 2.43 and later. * Enabled unaligned access optimizations on all PowerPC variants. * Improved CRC-32 performance on Arm Neoverse V-Series processors by selecting a faster CRC-32 implementation for these processors. * The CMakeLists.txt now supports the user overriding `CMAKE_C_FLAGS_RELEASE`. * The CMakeLists.txt no longer runs installation commands when it is built as a subproject. ==== libglycin ==== Version update (2.1.5 -> 2.2.5) - Update to version 2.2.5: * This release contains the following new component versions: + Glycin-core 4.0.5 + Glycin 4.0.5 + Glycin-builtin 4.0.5 + Glycin-external 4.0.5 + Libglycin 2.2.5 + Libglycin-gtk4 2.2.5 * Fixed: + Require gufo-exif 0.5.5 to avoid reading exif values from incorrect positions in some images. + Libglycin: Don't panic when trying to lookup an infinite pixel density. Instead, don't return any pixel density. + Meson/thumbnailer: Ensure that libglycin is built before glycin-thumbnailer. - Pass libglycin=true to meson setup in glycin-loaders.spec.inc following upstream changes. - Update to version 2.2.4: * This release contains the following new component versions: + Glycin-core 4.0.4 + Glycin-image-rs 2.2.4 + Glycin 4.0.4 + Glycin-builtin 4.0.4 + Glycin-external 4.0.4 + Libglycin 2.2.4 + Libglycin-gtk4 2.2.4 * Fixed: + Require gufo-exif 0.5.4 to avoid a panic in exif lookup for certain images. + Glycin: Longer magic byte strings in config identifiers now have a higher priority. This fixes cursors being sometimes identified as TGAs. - Update to version 2.2.3: * This release contains the following new component versions: + Glycin-core 4.0.3 + Glycin-image-rs 2.2.3 + Glycin 4.0.3 + Glycin-builtin 4.0.3 + Glycin-external 4.0.3 + Libglycin 2.2.3 + Libglycin-gtk4 2.2.3 * Fixed: + Require gufo-exif 0.5.3 which fixes parsing issues with non-Canon MakerNote entries. This can cause images not to be rotated according to the Orientation tag. + Image-rs/animation: Drop thread after the Image.done D-Bus method is called. + Image-rs: Prevent channel with animation frames from filling up, causing a effective memory leak. + Libglycin: Don't block main thead in `get_mime_types`. * Changed: Glycin: Canonicalize paths of "Exec" keys when loading configs. - Update to version 2.2.2: * This release contains the following new component versions: + Glycin-core 4.0.2 + Glycin 4.0.2 + Glycin-builtin 4.0.2 + Glycin-external 4.0.2 + Libglycin 2.2.2 + Libglycin-gtk4 2.2.2 * Fixed: Set the unix socket sending the image data to the loader to non-blocking. Otherwise, small socket send buffer configurations might lead to infinite blocking. - Update to version 2.2.1: + This release contains the following new component versions: - glycin-utils 5.0.1 + Fixed: Don't mmap already write sealed memfds as shared. This is only supported since Linux 6.7 . - Update to version 2.2.0: + This release contains the following new component versions: - glycin-common 2.0.0 - glycin-core 4.0.0 - glycin-heif 2.2.0 - glycin-image-rs 2.2.0 - glycin-jxl 2.2.0 - glycin-raw 2.2.0 - glycin-svg 2.2.0 - glycin-test 2.2.0 - glycin-thumbnailer 2.2.0 - glycin-utils 5.0.0 - glycin 4.0.0 - glycin-builtin 4.0.0 - glycin-external 4.0.0 - libglycin-gtk4-rebind 0.2.0 - libglycin-gtk4-rebind-sys 0.2.0 - libglycin-rebind 0.2.0 - libglycin-rebind-sys 0.2.0 - libglycin 2.2.0 - libglycin-gtk4 2.2.0 + Fixed: - glycin/sandbox: Fix compilation on 32 bit architectures - Update to version 2.2.beta.1: + This release contains the following new component versions: - glycin-core 4.0.0-beta.1 - glycin-heif 2.2.0-beta.1 - glycin-image-rs 2.2.0-beta.1 - glycin-jxl 2.2.0-beta.1 - glycin-raw 2.2.0-beta.1 - glycin-svg 2.2.0-beta.1 - glycin-test 2.2.0-beta.1 ... changelog too long, skipping 157 lines ... + Changed: svg: Don't limit the size of elements in the SVG ==== libheif ==== Version update (1.23.6 -> 1.23.7) - update to 1.23.7: * CVE-2026-XXXXX (GHSA-xwcv-cp39-m2w4) Out-of-bounds read in the OpenH264 decoder plugin. An AVC SPS that libheif's coded- size check could not parse was skipped and still passed to OpenH264, which accepts cropping offsets whose sum wraps around and returns plane pointers far outside of its frame buffer. An SPS that cannot be parsed is now an error, also in subset SPS NAL units. The VVC SPS check had the same pattern and fails closed as well. Introduced with the coded-size check of v1.23.5. (high) * CVE-2026-XXXXX (GHSA-jx54-6rm6-2cgj) The AV1 coded-size check of v1.23.5 could be bypassed with libaom through an OBU without a size field. libheif stopped scanning at that OBU, while libaom continued and decoded a later, larger sequence header and frame. The last OBU of a sample is now given an explicit size before the data is scanned and decoded, so that both see the same framing. (high) * CVE-2026-XXXXX (GHSA-fpr5-xpfr-vcq3) The AV1 coded-size check of v1.23.5 could be bypassed with libaom. `num_ticks_per_picture_minus_1` was read with a UVLC reader that stops after 20 leading zero bits, although AV1 allows 31, and the error was ignored. The sequence header was then skipped, or scanned from the middle of the code where it could yield a small decoy size, and libaom allocated the real, much larger frame. The AV1 UVLC reader now follows the AV1 specification, and a sequence header that cannot be scanned completely is rejected. (high) * CVE-2026-XXXXX (GHSA-35mc-3887-rr37) Heap use-after-free when grid tiles are decoded in parallel. Several derived tiles (`iovl`, `iden` or `grid`) can share one coded input image. Their bit-depth queries read the decoder data of that input while another tile thread replaced it during decoding. A crafted file could crash the application or corrupt the heap with default options. The bit-depth queries now lock the decode mutex of the queried item. Only v1.23.6 is affected. (high) * CVE-2026-XXXXX (GHSA-hpg4-g2gc-pq42) Heap buffer overflow when padding an image to a size that is larger in one dimension and smaller in the other. `heif_image_extend_padding_to_size()` could be reached with such a size by re-encoding a sequence whose frames have different sizes with the x265 or x264 sequence encoder. Padding now refuses a size below the image or any of its planes, checks all planes before changing them, and the sequence encoders refuse a frame whose size differs from the first frame. (high) * CVE-2026-XXXXX (GHSA-9rpf-2x22-78m9) `heif_context_encode_thumbnail()` returned success without setting the output handle when the image already fits into the bounding box. Callers that released the handle, among them `heif-enc -t` and the C++ wrapper, freed an uninitialized or stale pointer (use-after-free, double free). The handle is now set to NULL in that case, as the API documentation says. (high) * CVE-2026-XXXXX (GHSA-48p4-gj45-w9v6) CPU exhaustion through derived images that decode a large image again and again and use only a few pixels of it, for example a grid of 1x1 tiles that are each a `clap` crop of an 8192x8192 overlay. A 2.6 kB file took 26 seconds to decode. Each decode now has a pixel budget of twice the size of the distinct images it uses (at least 2048x2048, at most `max_image_size_pixels`), single- tile decodes get their share of it, an exceeded security limit in a grid tile is an error also without strict decoding, and grid tiles outside of the image are not decoded. (high) * CVE-2026-XXXXX (GHSA-2g6j-vhr6-6wrj) CPU exhaustion through many coded pictures in one image item or sequence sample. The decoder decoded all of them, although only one image is returned: a 16 kB file with 1000 hidden HEVC pictures of 4096x4096 took 14 seconds. More than eight coded pictures per decode are now refused. HEVC, AVC and VVC count picture starts, AV1 counts frame OBUs, and AVC data with embedded start codes is refused. (high) * CVE-2026-XXXXX (GHSA-7qm8-hj35-269r) CPU exhaustion through repeated transformations. An item could carry many associations of the same `irot`, `imir` or `clap` property, and `iden` chains multiplied them: a 28 kB file took 73 seconds to decode. An item may now have at most one association of each of these properties, as HEIF requires, and at most 32 transformations are applied along a decode path. (high) * CVE-2026-XXXXX (GHSA-hhg3-fxg7-3gxw) CPU exhaustion while opening a file whose images have many `colr` associations. Reading the file regenerated and compared a colour profile property for every association. Reading and encoding now store colour profiles separately, so that opening a file does not create properties. (high) * CVE-2026-XXXXX (GHSA-73j7-gvm9-x8q6) CPU exhaustion in sequence decoding through samples that produce no output, for example when an edit list repeats a sample that the decoder does not display. One call of `heif_track_decode_next_image()` could run for minutes, also with `ignore_sequence_editlist`. The number of samples that are decoded without returning frames is now limited per codec, and `ignore_sequence_editlist` stops after the original samples. (high) * CVE-2026-XXXXX (GHSA-74mj-m37q-h3q9) Quadratic CPU time when opening a file with a `moov` box. The `stsc` entry of every chunk was looked up by a linear scan, so a file with many ... changelog too long, skipping 56 lines ... 16-bit grayscale images with alpha ==== libimobiledevice ==== Version update (1.4.0+0git.20251010 -> 1.4.0+9git.20260610) - Update to version 1.4.0+9git.20260610 (9 commits past the 1.4.0 release, no SONAME change): * ostrace: fix a memory leak (upstream issue #1677) * afc: improve error handling; afcclient cd fix, start in /Documents with --documents, progress and echo fixes * endianness.h: default to little endian if __BYTE_ORDER is undefined; libsrp6a-sha512: fix environ handling for Apple * docs: CSS fix ==== libimobiledevice-glue ==== Version update (1.3.2+git0.20250604 -> 1.3.3+git0.20261005) - Update to version 1.3.3+git0.20261005: * Update NEWS for release * Update soversion for release * utils: Correct ctype(3) usage * socket: Improve portability by replacing OS-specific macros with AC_CHECK_HEADERS * endianness.h: Default to little endian * Add atexit call to (empty) deinit function to prevent stripping off initializer code * Add FUNDING * [github-actions] Update build workflow to use windows-latest * socket: Use const void* instead of void* in signature of socket_send() ==== libjpeg-turbo ==== - update to 3.2.1: * Fixed a regression that broke Unix builds where position-independent code was disabled for static libraries. Workaround: set CMAKE_POSITION_INDEPENDENT_CODE or use a toolchain that enables PIC automatically. * Sped up RGB-to-baseline JPEG compression by 10-17% with the accurate integer DCT algorithm on RISC-V Vector (RVV) hardware, using strided segment load and multiply-accumulate intrinsics. * Hid symbols of the in-tree zlib and libspng implementations and renamed the zlib symbols, so static TurboJPEG API users do not expose or call them by accident. * Fixed an integer overflow and buffer overrun in tj3LoadImage12() and tj3LoadImage16() when a 32-bit build loads a packed-pixel image with more than 2^31 components. * Fixed a division by zero (CVE-2026-75466) when loading a non-grayscale indexed-color PNG image with TJPF_UNKNOWN pixel format. * Fixed wrong chrominance from tj3DecompressToYUV*() for 4:2:0, 4:1:0 and 2:4 images with the fast IDCT and 1/2 scaling. * Fixed a buffer overrun and segfault when partially decompressing a crafted 4:2:0 image with merged upsampling, SIMD disabled and a crop that leaves 1-2 samples per component plane. * Hardened the libjpeg API against 12-bit full-color decompression with one-pass quantization and RGB565 conversion enabled. * Fixed jpeg*_skip_scanlines() with non-fancy upsampling: wrong scanline count, or skipped scanlines returned later. * Hardened the TurboJPEG API against an ignored fatal error from tj3DecompressHeader() followed by a retry with a valid image. This could report wrong dimensions and cause a too-small output buffer. * Made tj3DecompressHeader() always drop a previously extracted ICC profile, so tj3GetICCProfile() and tj3TransformBufSize() no longer see stale data. * Made tj3TransformBufSize() account for all extra markers copied to the destination: comments, JFIF thumbnails and Exif data. ==== libkscreen6 ==== Version update (6.8.0 -> 6.8.2) Subpackages: libKF6Screen8 libKF6ScreenDpms8 libkscreen6-plugin - Update to 6.8.2 * New bugfix release * For more details please see: * https://kde.org/announcements/plasma/6/6.8.2 - Changes since 6.8.1: * Update version for new release 6.8.2 - Update to 6.8.1: * New bugfix release * For more details see https://kde.org/announcements/plasma/6/6.8.1 - Changes since 6.8.0: * Update version for new release 6.8.1 ==== libksysguard6 ==== Version update (6.8.0 -> 6.8.2) Subpackages: ksysguardsystemstats6-data libKSysGuardSystemStats2 libksysguard6-imports - Update to 6.8.2 * New bugfix release * For more details please see: * https://kde.org/announcements/plasma/6/6.8.2 - Changes since 6.8.1: * Update version for new release 6.8.2 * Only show 2000 data points in Line Chart applet (kde#527627) - Drop patch: * 0001-Drop-org.kde.ksysguard.processlisthelper.applyschedu.patch - Update to 6.8.1: * New bugfix release * For more details see https://kde.org/announcements/plasma/6/6.8.1 - Changes since 6.8.0: * Update version for new release 6.8.1 ==== libmad ==== Version update (0.16.4 -> 0.16.5) - Update to version 0.16.5: * New: + Add mad_version_get_string() as an ABI-stable alternative for getting the version string. + Add -DPAD_VERSION_STRING (disabled by default) to pad the global version string for improved ABI compatibility with 0.15.1b. + Miscellaneous stuff: - Add CONTRIBUTING.md and BUILDING.md for contribution guidelines and how to build the library, respectively. - Fix typos in README. * Changed: + Deprecated global version and build type strings. The latter is deprecated with no replacement, while mad_version_get_string() should be used in place of the former. + CMake 3.10+ is now required. This allows for supporting CMake 4.0+ without warnings. + Disabled architecture-specific optimizations for 32-bit ARM for now. These optimizations have unfortunately bitrotted and can cause a segfault. + Reorganize the source tree to be cleaner. + Remove nonexistent -DMADD{16}_ASM options from build documentation. These options have been long gone and haven't worked since we dropped GCC 4.4 support. + Static and shared library versions of libmad are now built at the same time by default. You can also build only a static version with - DBUILD_SHARED_LIBS=OFF. * Fixed: + Fixed anonymous struct for C++ compatibility. + Fix some clang-tidy warnings. + Fix a Clang warning. + minimad: Fix format under 32-bit. + Fixed missing MAD_DEPRECATED declarations for MSVC. + Fixed x86 CPU detection. + Fixed build on ARM v7. - Drop libmad-x86.patch: Applied upstream. - Add 9dd96b40c5caf76fd1c6ef9dcc80ba330eb57a79.patch: Really fix build on arm - Delete the now build static lib. ==== libnfs ==== - Add libnfs-CVE-2026-108985.patch: ZDR: enforce the maxsize bound (bsc#1284986, CVE-2026-108985). ==== libnotify ==== Version update (0.8.8 -> 0.8.9) Subpackages: libnotify4 typelib-1_0-Notify-0_7 - Update to version 0.8.9: * This is a maintenance release, mostly with bug fixes around notify-send behaviors and portal notifications, together with more tests coverage for hints edge cases, and some library cleanups: + Notify-send: - Start action ID from 1 as docs states - Fix the activation token FD validity check - Don't write the notification ID and action to stdin - Don't cache the hint conversion error + Notify: Free the application name and icon on uninit + Notification: - Do not send the default action as a button in portal notifications - Read the icon contents using g_file_load_contents() - Use g_clear_handle_id() for the portal timeout + Tests/notify-send: - Add tests for the default action button - Verify behavior on invalid hints + Launch-context: Don't omit parameter names in vfunc implementation + Bugs fixed: - portal: "default" action adds additional button - Omitted parameter names in a vfunc implementation ==== libopenmpt ==== Version update (0.8.9 -> 0.8.10) - Update to version 0.8.10 * [Sec] Possible heap out-of-bounds write when loading SymMOD files containing WAV IMA ADPCM samples (r25623, r25645). See also https://github.com/OpenMPT/openmpt/security/advisories/GHSA-fxf7-wc37-p2cx * [Sec] Possible heap out-of-bounds read when loading custom tunings from MPTM files (r25609, r25615). ==== libostree ==== Version update (2026.4 -> 2026.6) Subpackages: libostree-1-1 - Update to version 2026.6: * sign: Compare OpenSSL sign results against 1, test more spki cases * core: Reject duplicate names in dirtree objects * static-delta: Parse superblock files as untrusted * prepare-root: Allow /run/ostree to exist already * fetcher-uri: Keep https scheme when dropping default port * rofiles-fuse: Check hardlinks for O_TRUNC opens and removexattr * sign-spki: Pass GBytes when looking up revoked keys * static-delta: Avoid mapping BSPATCH output on FUSE - Update to version 2026.5: * static-delta: validate bspatch payload offset and length * min-free-space: Use min(3%, 1GB) as default * docs: drop parameters that are no longer in the signatures * ostree-repo: Change argument name in header to match implementation * generator: Skip boot.mount if /etc/fstab has a /boot entry by * static-delta: validate on-disk checksum names when listing deltas * static-delta: bound mode and xattr dict offsets * bin/prune: Keep recent unreferenced commits * prepare-root: Tolerate an existing /sysroot.tmp in the static path * prepare-root: Guard against short digest in load_variant * lib: Validate commit tree checksum length on read * fetcher-curl: Bound header value copies to buffer length * ostree-gpg-verify-result: Strictly match subkeys if suffixed with ! * otcore: Treat only 1 from EVP_DigestVerify as valid * lib: Parse content object header as untrusted * man: Document signed-delta and sign-verify behaviour * core: Throw an error for short ostree.sizes entries * static-delta: Avoid copying bspatch output * static-delta: Simplify mapped content allocation * Two security-related fixes reported ==== libplasma6 ==== Version update (6.8.0 -> 6.8.2) Subpackages: libPlasma8 libplasma6-components libplasma6-desktoptheme - Update to 6.8.2 * New bugfix release * For more details please see: * https://kde.org/announcements/plasma/6/6.8.2 - Changes since 6.8.1: * Update version for new release 6.8.2 * PlasmaCore.ToolTipArea: don't lower label opacity when there is no heading present - Update to 6.8.1: * New bugfix release * For more details see https://kde.org/announcements/plasma/6/6.8.1 - Changes since 6.8.0: * Update version for new release 6.8.1 ==== libqaccessibilityclient-qt6 ==== Subpackages: libqaccessibilityclient-qt6-0 - Drop the Qt 5 flavor ==== librsvg ==== Version update (2.62.4 -> 2.63.4) - Update to version 2.63.4: * Handle EXIF orientation in images, and handle the image-orientation property. Note that the only values supported for this property are 'from-image' (the default) and 'none'. Note that this will change the rendering of SVG documents which assume the images with EXIF orientation data are not auto-oriented correctly. In this case, please add the following attribute to the corresponding image elemnts: style="image-orientation: none;" - Update to version 2.63.3: * Librsvg-rebind crate version 0.3.0: * Let the image-rs crate enforce its default limit of 512 MB for allocated memory for each decoded image. The `--unlimited` flag in rsvg-convert (or the corresponding flags in the C and Rust APIs) now control whether the limits are enforced or not. * Fix panic when a feConvolveMatrix declaration has an invalid size. * When fuzzing, don't decode raster images from data: URIs to avoid sinking fuzz time in the image-rs crate. - Update version dependencies according to meson.build. - Update to version 2.63.2 (RUSTSEC-2026-0305 / CVE-2026-96889): + librsvg crate version 2.63.2 + librsvg-rebind crate version 0.3.0 + Fix use-after-free when there are duplicate XML entities in nested Xinclude documents. - Changes from version 2.63.1: + This version is to be considered non-working; the chacha20 0.10.1 crate was yanked from crates.io. - Update to version 2.63.0: + librsvg crate version 2.63.0 + librsvg-rebind crate version 0.3.0 + Limit the depth of files that reference other files, via XML XInclude, inter-document references, and CSS includes. The Rust API has a new ImplementationLimit::MaximumFileNestingDepthExceeded error variant to surface this to the loading functions. + Fix blurry embeded SVG images by rasterizing them at device resolution. + Remove loading limits from image-rs. This means that raster images, when embedded in SVG documents, have no limits for their size or memory consumption. The idea, for now, is that security-sensitive applications that use librsvg should do their own sandboxing if they want to impose memory limits. + Raise the maximum nesting depth of layers for glibc systems. The maximum on glibc is now 500 nested layers; the maximum for musl systems remains at 50 layers. This is due to the amount of stack space required, since musl has a reduced default stack compared to glibc. Please see the comments in that bug if you would like to help with the musl situation. - Disable bug1100_fuzz_layer_nesting_depth test and enable svg1_1_text_text_03_b_svg test again. - Update to version 2.62.91: + librsvg crate version 2.63.0-beta.1 + librsvg-rebind crate version 0.3.0 + Update test suite for change in how Pango renders underline/overline. + Update Rust dependencies. + Update C dependencies in the CI. - No longer disable librsvg --test reference. - Update to version 2.62.90: + librsvg crate version 2.63.0-beta.0 + Limit the depth of files that reference other files, via XML XInclude, inter-document references, and CSS includes. The Rust API has a new ImplementationLimit::MaximumFileNestingDepthExceeded error variant to surface this to the loading functions. + Fix blurry embeded SVG images by rasterizing them at device resolution. + Fix build when gobject-introspection is enabled but gdk-pixbuf is disabled. + Document the crate's feature flags. + Update the Rust dependencies. ==== libsndfile ==== - Fix integer overflow vulnerability in mat4_read_header() (bsc#1282671, CVE-2026-88372): libsndfile-CVE-2026-88372.patch ==== libsolv ==== Version update (0.7.40 -> 0.7.41) Subpackages: libsolv-tools-base libsolv1 - improved speed of repo_add_solv, should now be more that 20% faster in many cases - repo_add_solv hardening to catch corrupt solv files earlier - hardened apkv3 code [bsc#1284786] [bsc#1284995] [CVE-2026-104622] [CVE-2026-104624] - fixed repo_conda xml parsing [bsc#1284786] [CVE-2026-104621] - support pre-sizing of id hashes (pool_presize_idhashes, pool_get_idcounts solv_read_idcounts) - new POOL_FLAG_NOWHATPROVIDESSHRINK pool flag to disable shrinking if speed matters more then memory usage - bump version to 0.7.41 ==== libsoup ==== Version update (3.6.6 -> 3.8.1) - Update to version 3.8.1: * Limit the size of intermediate (redirect and auth) response bodies * Http2: Fix stalls when the reader is slower than the session timeout, and propagate connection errors to response body streams * Zstd: Support multiple concatenated frames, which previously truncated responses * Cookie-jar: Fix a `SoupConnection` leak when using an HTTP proxy * Logger: Fix undefined behavior found by UBSan * Build: Require brotli >= 1.1.0 for brotli support * Fix building the tests on Windows and update README.msvc * Updated translations. - Add explicit pkgconfig(libbrotlienc) BuildRequires: meson setup checks for it - Update to version 3.8.0: + Harden authentication: - Check `nonce` validity in Digest authentication (CVE-2026-3099) - Do not send cached proxy credentials after a redirect to a different origin + Harden multipart handling: - Fix an out-of-bounds read when less data than the boundary is buffered (CVE-2026-66337) - Limit the length of part headers - Fix a leak of the current part's headers + Prevent request smuggling in the server: - Close the connection after an early response to `Expect: 100-continue` - Reject `Host` headers containing URI delimiters - Require chunk-size to begin with a hex digit + Http2: - Fix skipping over multiple buffered chunks of a response body - Fix a `GCancellable` leak [Michael Catanzaro] + Fix the build on platforms without `dlfcn.h` + Updated translations. - Skip test-suite on non-64-bit architectures (glgo#GNOME/libsoup#556). - Update to version 3.7.3: + Add `soup_message_set_compression_dictionary_id()` and `soup_message_get_compression_dictionary_id()` to send the `Dictionary-ID` header alongside `Available-Dictionary` + Add `soup_websocket_extension_process_incoming_message_with_limit()` so extensions can bound how much they decompress + Harden WebSocket handling: - Bound decompressed message size during inflation (CVE-2026-15709) - Reject oversized control frames (CVE-2026-15711) - Cap incoming frame payloads, message reassembly, and outgoing frames at what the underlying buffer can hold - Bound outgoing permessage-deflate buffer growth - Cap the number of queued unsolicited pongs - Emit `SoupWebsocketConnection::pong` with a `GBytes`, as declared - Store accepted WebSocket extensions per message rather than per handler + Harden authentication and caching: - Do not send `Proxy-Authorization` through an established CONNECT tunnel (CVE-2026-66339) - Scope cached proxy credentials to the proxy they came from (CVE-2026-12547) - Reject caching authenticated responses in shared caches (CVE-2026-15713) + Tighten HTTP parsing and validation: - Reject CRLF injection in the HTTP method (CVE-2026-3633) - Fix `Range` parsing overflows and coalescing cost, and validate `Content-Range` when parsing it - Keep duplicate `Content-Length` headers when they are identical - Fix an out-of-bounds read in case of an excessively long multipart boundary - Do not treat base64 data URI content as a NUL-terminated string + http2: - Never send more body bytes than nghttp2 requested (CVE-2026-85534) - Keep the message alive across `io_run_until()` in `run_until_read()` - Do not assume that `GOAWAY` opaque data is NUL-terminated + server: Report the resource length in 416 responses + session: Do not send a message cancelled while being queued + cookie: Annotate constants' values - Drop libsoup-CVE-2026-85534.patch, - Drop libsoup-CVE-2026-15711.patch, libsoup-CVE-2026-12547.patch, libsoup-CVE-2026-15712.patch, libsoup-CVE-2026-15714.patch, libsoup-CVE-2026-66339.patch: fixed upstream. - Update to version 3.7.2: + Add support for compression dictionaries: - Support the dcb and dcz encodings - Add new `soup_message_set_compression_dictionary_hash()`, `SoupMessage::request-compression-dictionary`, and `SoupCompressionDictionaryRequest` + Remove color codes from http2 debug logs + Add missing autoptr defines for `SoupMessageBody` + http2: - Fix content-sniffer running while message is paused - Consume buffered response body before cancel - Fix requeuing failed messages when connection is not reusable + soup-body-input-stream: Limit buffer read to the received content - Update to version 3.7.1: Use canonical signal names. ... changelog too long, skipping 42 lines ... + libsoup-revert-dep-meson-0.62-shim02-6b34bc58.patch ==== libtirpc ==== Version update (1.3.7 -> 1.3.8) Subpackages: libtirpc-netconfig libtirpc3 - Update to version 1.3.8 (bsc#1285882, CVE-2026-85977, bsc#1285881, CVE-2026-85231): * Security hardening against malicious-data memory exhaustion: cap decoded pmap/rpcb XDR list lengths to 1024 nodes (CVE-2026-85977) and RPCSEC_GSS wrapped payload decoding at 16 MB (CVE-2026-85231, authenticated remote DoS). * Fix off-by-one allocation when building the GSS caller name. * Export authdes_getucred and rpc_gss_getcred under a versioned symbol node (backward compatible, soname stays libtirpc.so.3). - Spec cleanup: drop obsolete Group tags. ==== libunistring ==== Version update (1.4.2 -> 1.5) - update to 1.5: * The data tables and algorithms have been updated to Unicode version 18.0.0 ==== libupnp ==== Version update (22.1.8 -> 22.1.10) Subpackages: libixml22 libupnp22 - Update to release 22.1.10 * Reject CR and LF in the service type of a SOAP action. - Update to release 22.1.9 * Reject an HTTP response whose status code is not three digits. * Fix denial of service of the miniserver worker threads. * Fix a heap over-read when sending a GENA event. * Fix a path traversal in the web server. * Fix a corrupted attribute list when ixmlElement_setAttributeNode() or ixmlElement_setAttributeNodeNS() was called with an attribute the element already owned and the lookup did not return that same attribute. * Send "Content-Range: bytes */" in the 416 response of the web server to a Range request that cannot be satisfied. ==== libwacom ==== Version update (2.19.1 -> 2.20.0) Subpackages: libwacom-data libwacom9 - Update to 2.20.0: * New devices: Lenovo Yoga 9 2-in-1 14IPH11, IdeaPad 5 14AHP9 and ThinkBook 14s Yoga (ISDv4 526b), Huion HS610 (new USB PID), XP-Pen Deco SE, Gaomon S620, Ugee M808 * tools: stay quiet when /dev/input is not present - Bump meson floor to >= 0.58.0 and add glib >= 2.68 floor, matching the minimums declared upstream - Spec cleanup: drop obsolete Group tags, canonical spec-cleaner style ==== libzypp ==== Version update (17.38.16 -> 17.38.17) - Fix hanging eventloop in case setupHandle fails. This may happen e.g. due to a failing curlSetupOption call as result of a miss configured option value. - zypp.conf: Add download.min_download_speed_time (60 sec) (fixes [#751]) - version 17.38.17 (35) ==== live555 ==== Version update (2026.10.17 -> 2026.10.29) Subpackages: libBasicUsageEnvironment2 libUsageEnvironment3 libgroupsock33 - Update to version 2026.10.29: * Mostly cosmetic changes, and replaced more calls to "sprintf()" with calls to "snprintf()". - Update to version 2026.10.24: * In "RTPInterface::handleRead()", if we're reading from a TCP socket, call "getpeername()" to set our "fromAddress", because the "recvfrom()" call won't set it. * Added a check to "AC3AudioStreamParser" for a buffer overflow that probably won't happen, but to be safe... * Began replacing some calls to "sprintf()" (that were perfectly safe, but caused some compilers to emit warning messages) with calls to "snprintf()". - Update to version 2026.10.23: * The bug fix in version 2026.10.21 was not complete. This should fix it for real. - Bump lmdmaj define to 122 following upstream changes. - Fix typos in the description - Update to version 2026.10.22: * Fixed a bug that had accidentally been introduced in version 2026.07.23: We now correctly parse the "RTP/SAVP" and "RTP/SAVP/TCP" profile strings. * When a RTSP server is asked to stream RTP/RTSP-over-TCP, we don't record the TCP socket number to use when we're processing the "SETUP" command. Instead, we have to wait until we're processing the "PLAY" command, because the "PLAY" command might be using a different TCP connection (and thus a different socket number). - Bump lmdmaj define to 121 following upstream changes. - Update to version 2026.10.21: * Fixed a bug that could possibly allow a malicious client to cause a RTSP server to crash when streaming from an AC-3 audio file. ==== llvm23 ==== Version update (23.1.3 -> 23.1.4) - Update to version 23.1.4. * This release contains bug-fixes for the LLVM 23.1.0 release. This release is API and ABI compatible with 23.1.0. - Build all targets on ppc64le. - Build SPIRV target also on ARMv6/7 and s390x. - Cleanup parts specific to ppc and ppc64, because we don't build them anymore. - Increase memory for compile jobs to avoid OOM. - Build compiler-rt builtins for wasm32-wasip1 as part of the runtimes build (LLVM_BUILTIN_TARGETS) and ship them in clang23, so that clang can link wasm32-wasip1 binaries with a WASI sysroot. ==== lvm2 ==== Version update (2.03.38 -> 2.03.43) Subpackages: liblvm2cmd2_03 - lvm2 on LUKS: failed to activate VG after unencrypted device appears during boot (bsc#1288220) * Add upstream patch + bug-1288220_pvscan-preserve-preferred-device-name-when-importing.patch - Update to version 2.03.43: * Wipe stale signatures before formatting a VDO data LV on thin storage; allow 4K stripe size smaller than page size. * dmeventd fixes: raid repair after partial replacement, snapshot extension backoff, snapshot threshold and unmount handling. * pvmove in shared VGs with lvmlockd, cluster lock lifecycle for the pvmove LV, lock probes for holder availability. * lvmpersist hardening: reject non-block devices, validate options, require PR tools, clean up keys on interruption. * Add lvmconfig --edit to set or remove an lvm.conf setting and backup/file-limit handling for config edits. * Remove cmirrord and clustered mirror log daemon support; drop the legacy vgimportclone.sh script. * Increase the default value of global/lvmlockd_lock_retries from 3 to 6. * Respect /run/mdadm/creating- in 69-dm-lvm.rules. * Many dmeventd, lvmlockd, vgmerge/vgcreate/vgimportclone lock-leak and raid/pvmove polling fixes. - Sync lvm.conf with upstream 2.03.43 defaults (adds allocation/vdo_use_kernel_format and backup/config_file_backup_limit options). - Package the new dmvdostats symlink and man page in device-mapper. - Drop patches adopted upstream or obsolete: * cmirrord_remove_date_time_from_compilation.patch (cmirrord removed upstream) * bug-1214071-blkdeactivate_calls_wrong_mountpoint.patch (upstream uses /usr/bin/mountpoint now) - Rebase bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-rules.patch onto the reworked MD section, keeping the new creating-guard. - Rework bug-1184124-link-tests-as-PIE.patch to pass -pie in the two generic test link recipes, and bug-1037309_Makefile-skip-compliling-daemons-lvmlockd-directory.patch to its configure hunk (the Makefile.in part is upstream now). - Sonames unchanged (libdevmapper.so.1.03, liblvm2cmd.so.2.03); device-mapper package version moves to 2.03.43_1.02.217. - Spec cleanup: drop Group tags, https sources, pkgconfig deps. ==== lvm2-device-mapper ==== Version update (2.03.38_1.02.212 -> 2.03.43_1.02.217) Subpackages: device-mapper libdevmapper-event1_03 libdevmapper1_03 - lvm2 on LUKS: failed to activate VG after unencrypted device appears during boot (bsc#1288220) * Add upstream patch + bug-1288220_pvscan-preserve-preferred-device-name-when-importing.patch - Update to version 2.03.43: * Wipe stale signatures before formatting a VDO data LV on thin storage; allow 4K stripe size smaller than page size. * dmeventd fixes: raid repair after partial replacement, snapshot extension backoff, snapshot threshold and unmount handling. * pvmove in shared VGs with lvmlockd, cluster lock lifecycle for the pvmove LV, lock probes for holder availability. * lvmpersist hardening: reject non-block devices, validate options, require PR tools, clean up keys on interruption. * Add lvmconfig --edit to set or remove an lvm.conf setting and backup/file-limit handling for config edits. * Remove cmirrord and clustered mirror log daemon support; drop the legacy vgimportclone.sh script. * Increase the default value of global/lvmlockd_lock_retries from 3 to 6. * Respect /run/mdadm/creating- in 69-dm-lvm.rules. * Many dmeventd, lvmlockd, vgmerge/vgcreate/vgimportclone lock-leak and raid/pvmove polling fixes. - Sync lvm.conf with upstream 2.03.43 defaults (adds allocation/vdo_use_kernel_format and backup/config_file_backup_limit options). - Package the new dmvdostats symlink and man page in device-mapper. - Drop patches adopted upstream or obsolete: * cmirrord_remove_date_time_from_compilation.patch (cmirrord removed upstream) * bug-1214071-blkdeactivate_calls_wrong_mountpoint.patch (upstream uses /usr/bin/mountpoint now) - Rebase bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-rules.patch onto the reworked MD section, keeping the new creating-guard. - Rework bug-1184124-link-tests-as-PIE.patch to pass -pie in the two generic test link recipes, and bug-1037309_Makefile-skip-compliling-daemons-lvmlockd-directory.patch to its configure hunk (the Makefile.in part is upstream now). - Sonames unchanged (libdevmapper.so.1.03, liblvm2cmd.so.2.03); device-mapper package version moves to 2.03.43_1.02.217. - Spec cleanup: drop Group tags, https sources, pkgconfig deps. ==== makedumpfile ==== - support kernel 7.1 -- add: * makedumpfile-Fix-wrong-exclusion-of-compound-tail-pages-on-.patch ==== milou6 ==== Version update (6.8.0 -> 6.8.2) - Update to 6.8.2 * New bugfix release * For more details please see: * https://kde.org/announcements/plasma/6/6.8.2 - Changes since 6.8.1: * Update version for new release 6.8.2 - Update to 6.8.1: * New bugfix release * For more details see https://kde.org/announcements/plasma/6/6.8.1 - Changes since 6.8.0: * Update version for new release 6.8.1 ==== ncurses ==== Version update (6.6.20260926 -> 6.6.20261017) Subpackages: libncurses6 ncurses-utils terminfo-base - Make patch FORTIFY_SOURCE_3-fix.patch optional means only for glibc < 2.36 and also simply disable FORTIFYing for specific variable "string" (boo#1285901) - Add ncurses patch 20261010 + modify test/test_mouse.c to demonstrate mouse_get(), mouse_test() and mouse_mask(). ==== ngtcp2 ==== Version update (1.25.0 -> 1.26.0) Subpackages: libngtcp2-16 libngtcp2_crypto_gnutls8 libngtcp2_crypto_ossl0 - Update to 1.26.0: * New API: ngtcp2_conn_tx_strmq_push_if_not and an extend_max_data callback * Receiving STOP_SENDING no longer closes the stream; a STREAM_LIMIT error is returned on STREAMS_BLOCKED violations * STREAM_DATA_BLOCKED and DATA_BLOCKED are now sent only when data is actually blocked * CUBIC congestion control fixes: CWND increment, undo state reset on confirmed loss, slow-start pacing gain * Hardened connection ID handling, path validation and client migration, plus 0RTT and token handling fixes * 32-bit platform fixes and a fixed heap overrun on targets with 4-byte aligned malloc - Rebase curl-impersonate.patch and ngtcp2-boringssl-shared.patch for the new sources - Spec cleanup: use pkgconfig() interdependencies between the - devel subpackages and tag the carried patches ==== openexr ==== Version update (3.5.2 -> 3.5.3) Subpackages: libIex-3_5-34 libIlmThread-3_5-34 libOpenEXR-3_5-34 libOpenEXRCore-3_5-34 - Update to version 3.5.3: * Add support for Python 3.15 * Several diagnostic/correctness fixes across the utility tools (exrmetrics, exrmultipart, exrcheck) and core decompression paths (courtesy of @ssoj13/Alex Khal) * Address several long-standing build errors and test failures on i686 (32-bit linux) and s390x (big-endian) hosts. * Fix build issues on macOS < 10.15 * Fix build issues on powerpc * Fix for absolute paths for libm in OpenEXRTargets.cmake * Fix for running on Windows 7 involving CreateFile2 ==== oxygen6-sounds ==== Version update (6.6.3 -> 6.8.2) - Update to 6.8.2 * New bugfix release * For more details please see: * https://kde.org/announcements/plasma/6/6.8.2 - Changes since 6.8.1: * Update version for new release 6.8.2 ==== parted ==== Subpackages: libparted-fs-resize0 libparted2 - Drop Obsoletes: libparted0 from libparted2. The libparted.so.0 and libparted.so.2 file sets are disjoint, so the generations are co-installable as the shared library packaging policy intends; the obsoletes only forced removal of the older generation, and also drew the obsolete-not-provided warning. - baselibs.conf: run /sbin/ldconfig in %post and %postun of the generated libparted2 and libparted-fs-resize0 -32bit packages; they previously carried no ldconfig scriptlets at all. - Drop the Group tags and the BuildRoot tag (ignored by rpm). - Convert BuildRequires: pkg-config to pkgconfig, and drop the %doc marker from the info files (spec-cleaner conversions). ==== patterns-base ==== Subpackages: patterns-base-base patterns-base-bootloader patterns-base-hardware patterns-base-minimal_base patterns-base-x11 - Regenerate pattern-definition-32bit.txt from the current spec (pre_checkin.sh), as a follow-up to SR 1392459: the file had not been regenerated for several spec generations, so the 32-bit pattern definitions no longer matched the patterns: drop entries whose packages left the patterns (yast2-apparmor, systemd-sysvinit, nscd, dmraid, ifplugd, setserial, providers, the system-user-*/system-group-* helpers, terminfo-iterm/ - screen, dbus-1-glib, dbus-1-x11, tigervnc and the YaST control-centre packages), follow the renames (terminfo-base, coreutils-systemd, opensuse-welcome-launcher) and the moves between patterns (mailx, zypper, udev-configure-printer), and add the entries added to the patterns since (lvm2, wtmpdb, procps, fwupd, blog-plymouth, supportutils, systemd-coredump, cockpit-packages, myrlyn) - Extend the pre_checkin.sh skip list with kdump, kernel_livepatching, immutable_base and hardware: the spec creates no 32-bit marker files for them ("These packages don't generate a 32bit pattern"), so the generator must not emit sections for them either; this also keeps future regenerations free of the truncated rich-dependency lines the generator produces for those patterns - x11_enhanced pattern: on openSUSE, drop the hard Requires on pattern() = x11. x11_enhanced is session plumbing, not a server, and the default openSUSE session is Wayland (X applications run via Xwayland); the x11 pattern stays the opt-in X session bundle and itself Recommends x11_enhanced, so selecting X still pulls the enhanced plumbing in. The non-openSUSE (SLE / SL Micro) branch keeps the hard requirement unchanged - Modernise the core patterns: * base: drop the Suggests on openssl-1_1: the package was dropped from Factory, and the comment above it still claimed 1.1 was the default openssl, two major versions out of date * console: drop the Suggests on cnetworkmanager: the Python-2-era NetworkManager CLI no longer exists in Factory * console: suggest plocate instead of mlocate: mlocate was dropped from Factory and plocate is its designated successor (it Provides and Obsoletes mlocate); no pattern named plocate before * enhanced_base: drop the Suggests on kerneloops: the package is gone from Factory and the crash submission service it reported to is defunct * x11_enhanced: drop the Suggests on xorg-x11-driver-video-radeonhd and xorg-x11-driver-video-unichrome: both drivers were removed from Factory years ago * enhanced_base: recommend iw and wireless-regdb instead of wireless-tools: wireless-tools is the stalled 30.pre9 pre-release driving the deprecated Wireless Extensions API and iw is its nl80211 successor; wireless-regdb was not pulled in by any installing pattern before, so default installs ran on the kernel's built-in world regulatory domain * enhanced_base: use the current package names update-bootloader and kmod instead of the compat aliases perl-Bootloader and kmod-compat: the alias packages no longer exist and only resolve via the Provides of their successors, so the lines would silently rot if those compat Provides were ever dropped * enhanced_base: drop the Recommends on klogd on openSUSE: journald captures the kernel messages, and the pattern already goes for the journal on Tumbleweed (boo#1143144) * enhanced_base: drop the Recommends on deltarpm: Tumbleweed repositories publish no deltainfo, so the repository infrastructure deltarpm serves no longer exists there * enhanced_base: drop the Recommends on net-snmp: a full SNMP stack does not belong in every default install * enhanced_base: drop the Recommends on mpt-status: it is the status tool for the LSI 1030, a 2002-era SCSI RAID chip * enhanced_base: drop the Recommends on gpart: the 1999-era lost-partition guessing tool * enhanced_base: drop the Recommends on zisofs-tools: tools for the zisofs compressed-ISO extension * enhanced_base: drop the Recommends on procmail: the sendmail-era local delivery agent, upstream dormant since 2001 * pattern-definition-32bit.txt: mirror the enhanced_base changes for the enhanced_base-32bit pattern * enhanced_base: correct the comment above the openSUSE-only block: it claimed the block lists packages missing from SLE-15, but the block is guarded by is_opensuse, so SLE of any version does not get these packages from this pattern - Stop pulling YaST into default Tumbleweed installations: * enhanced_base: drop the Recommends on pattern() = yast2_basis * x11_enhanced: drop the Recommends on pattern() = x11_yast, pattern() = yast2_desktop, yast2-control-center-gnome and yast2-network * apparmor: drop the Recommends on yast2-apparmor Drop YaST from the pattern recommendations. The YaST patterns and packages stay in the repository for anyone who has them or wants them; new installations simply come without YaST. Completes code-o-o#leap/features/173 for Tumbleweed defaults. ==== patterns-kde ==== - Drop the Tumbleweed-only Recommends on yast2-control-center-qt and pattern() = kde_yast from the kde pattern. [edited by fabian@ritter-vogt.de] ==== pciutils ==== Version update (3.14.0 -> 3.15.0) Subpackages: libpci3 - Update to version 3.15.0: * New capabilities are decoded: MMIO Register Block Locator, Flit Error Injection, Flit Logging. * Decoding of PCIe capabilities updated to Gen7. * lspci and setpci warn when the "-s" or "-d" option is given multiple times. * Improved display of interrupts in "lspci -vv": routing of interrupt pins is shown only if the pins are not disabled, routing of MSI(X) interrupts is shown when available. * Dump back-end can read the dump from stdin with "-" as file name. * libpci adds pci_filter_has_slot and pci_filter_has_id (backward compatible, sover stays 3). * FreeBSD supports 64-bit addresses; minor Windows back-end improvements. * Updated pci.ids. - Spec cleanup: drop obsolete Group tags. - Rebase pciutils-ocloexec.patch for the reworked dump and sysfs back-ends (stdin dump support). ==== pcsc-lite ==== Version update (2.3.3 -> 2.5.3) - Add merge-sysuser.patch: (boo#1287634) This merges our pcsc-lite.sysusers into the upstream sysuser file and also ensures that the pcscd user is also in the scard group as an additional group. - version 2.5.3 - pcscd.service: preserve card sessions across polkit restarts - correctly decode all ATRs (fix the fix suggested by AI) - Fix authorization for uid > 65536 - version 2.5.2 - hotplug_libudev: rescan "serial" readers in HPReCheckSerialReaders - fix minor issues found by AI tool - version 2.5.1 - Fix a bug (introduced in 2.5.0) with multi-slots readers - Add support of Haiku Operating System - version 2.5.0 - Do not limit to 16 readers only - Remove support of autotools - Fix a crash when rescanning serial configs - Fix a memory leak in Polkit - tokenparser: avoid a crash with corrupted Info.plist files - Some other minor improvements - version 2.4.1 - Add backward version support on the client side - Add backward version support on the server side - hotplug libudev: rescan the USB bus with "pcscd --hotplug" - fix a value in pcscd.service systemd file - meson: install systemd files even if libsystemd is not used - Some other minor improvements - version 2.4.0 - Run pcscd under a pcscd user instead of root when using systemd - Set PIDFile in systemd service file - Protect contextMapList modifications using a mutex - meson: . Fix libpcsclite.pc file . respect builtin meson default_library option . build and install spy lib & tool only when needed - UnitaryTests/*.py: fix pylint warnings - Improve Doxygen documentation ==== pipewire ==== Version update (1.6.9 -> 1.6.11) Subpackages: gstreamer-plugin-pipewire libpipewire-0_3-0 pipewire-alsa pipewire-modules-0_3 pipewire-pulseaudio pipewire-spa-plugins-0_2 pipewire-spa-tools pipewire-tools - Update to version 1.6.11: * This is a bugfix release that is API and ABI compatible with the previous 1.6.x releases. * Highlights - Backported a lot of bluetooth fixes. - Fix an issue with draining in the ALSA plugin that could cause lockups in applications. - Some smaller bugfixes and improvements. * PipeWire - Use extra buffer in reliable mode. * Modules - Fail client device export when device can't be started. Together with Wireplumber changes this avoids non-functioning devices in case of errors. - Fix potential crash in adapter. (#5549 (closed)) * SPA - Clean up some SPA_POD_Long arguments to make things work on 32bits. * Bluetooth - Backport some security fixes. - Handle some allocation errors better. - Fix handling of multiple concurrent profile registrations. - Fix BIS latency range checks. - Improve ofono compatibility. - Handle async device and node removal. - Avoid using stale transport or device pointers by using a unique serial instead. * ALSA plugin - Avoid going into XRUN when draining. (#5544 (closed)) - Update to version 1.6.10: * This is a bugfix release that is API and ABI compatible with the previous 1.6.x releases. * Highlights - Fix some potential crashes in the JACK layer. - Fix a regression in the PSD rear delay upmixing code. - Avoid pops and clicks when playing unsigned formats. - More small fixes and backports. * PipeWire - Initialize the error location in all cases when parsing properties. - Don't try to unlink ports without a node. (#5540 (closed)) * Modules - Fix a potential crash in the X11 module because error handlers can be called twice. * SPA - Fix a regression in the PSD rear delay upmixing code. A delay of 0 was not working and would result in a big delay instead. (#5490 (closed)) - Use per audio format clear function to avoid pops when draining on unsigned formats. (#5531 (closed)) * Pulse-server - Avoid queueing an unlimited amount of REQUEST commands for paused clients in some cases. (#5541 (closed)) * Bluetooth - Remove some old deprecated functions. - cancel RegisterApplication calls when adapter goes away. (#5096 (closed)) * JACK - Add locking around the port array and mixer list. (#5499 (closed)) - Avoid possible infinite loop. - Free port and buffers before disconnect. (#5455) * GStreamer - Set the plane strides and offsets correctly. - Avoid setting invalid max resolution values. * ALSA Plugin - Handle the XRUN case better. (#5524 (closed)) * Tools - Support more output formats by letting sndfile choose the byte order. ==== plasma5support6 ==== Version update (6.8.0 -> 6.8.2) Subpackages: libPlasma5Support6 - Update to 6.8.2 * New bugfix release * For more details please see: * https://kde.org/announcements/plasma/6/6.8.2 - Changes since 6.8.1: * Update version for new release 6.8.2 - Update to 6.8.1: * New bugfix release * For more details see https://kde.org/announcements/plasma/6/6.8.1 - Changes since 6.8.0: * Update version for new release 6.8.1 ==== plasma6-activities ==== Version update (6.8.0 -> 6.8.2) Subpackages: libPlasmaActivities7 plasma6-activities-imports - Update to 6.8.2 * New bugfix release * For more details please see: * https://kde.org/announcements/plasma/6/6.8.2 - Changes since 6.8.1: * Update version for new release 6.8.2 - Update to 6.8.1: * New bugfix release * For more details see https://kde.org/announcements/plasma/6/6.8.1 - Changes since 6.8.0: * Update version for new release 6.8.1 ==== plasma6-activities-stats ==== Version update (6.8.0 -> 6.8.2) Subpackages: libPlasmaActivitiesStats1 - Update to 6.8.2 * New bugfix release * For more details please see: * https://kde.org/announcements/plasma/6/6.8.2 - Changes since 6.8.1: * Update version for new release 6.8.2 - Update to 6.8.1: * New bugfix release * For more details see https://kde.org/announcements/plasma/6/6.8.1 - Changes since 6.8.0: * Update version for new release 6.8.1 ==== plasma6-browser-integration ==== Version update (6.8.0 -> 6.8.2) - Update to 6.8.2 * New bugfix release * For more details please see: * https://kde.org/announcements/plasma/6/6.8.2 - Changes since 6.8.1: * Update version for new release 6.8.2 - Update to 6.8.1: * New bugfix release * For more details see https://kde.org/announcements/plasma/6/6.8.1 - Changes since 6.8.0: * Update version for new release 6.8.1 ==== plasma6-desktop ==== Version update (6.8.0 -> 6.8.2) Subpackages: plasma6-desktop-emojier - Update to 6.8.2 * New bugfix release * For more details please see: * https://kde.org/announcements/plasma/6/6.8.2 - Changes since 6.8.1: * Update version for new release 6.8.2 * Update version for new release 6.8.2 * applets/kickoff: Tie sidebar item spacing to the compact list style (kde#524003) * applets/taskmanager: wrap labels anywhere (kde#526972) * dwellclicker: fix after click keep open when pinned * applets/kicker: use the containment's screen for the popup size limit (kde#527385) * folder: make row/column arrangement settings match actual behavior (kde#512993) * activitymanager: Crop activity wallpapers instead of stretching them (kde#478784) * applets/pager: Keep desktop labels and window icons bound to the model (kde#522322) * Do not use wallpaper context variable binding as it changes value incorrectly (kde#527569) * applets/kickoff: directly scroll list in ListOfGridsView (kde#526911) * applets/taskmanager: fix highlight effect signal order issue (kde#527229) * Shell package: correct size and position for the activity switcher (kde#527158) * runners/keys: Use KGlobalAccel QKeySequence (de)serialization code * Fix disappearing desktop icons - Update to 6.8.1: * New bugfix release * For more details see https://kde.org/announcements/plasma/6/6.8.1 - Changes since 6.8.0: * Update version for new release 6.8.1 * applets/kicker: set drag mimedata url only if we have one * applets/kicker: inherit LayoutMirroring (kde#525994) * applets/kicker: add ItemListView inner right margin if scrollable * containments_desktop: don't always forward Shift+key to krunner * kcms/mouse: Move QML property lines for better readability * kcms/mouse: Fix indentation of scroll-button behavior options * kcms/touchpad: Indent checkboxes with indicator width and spacing * Update version for new release 6.8.1 * kcms/landingpage: Fix showing default kcms when there are no most used kcms (kde#522711) * Fix action names ==== plasma6-integration ==== Version update (6.8.0 -> 6.8.2) Subpackages: plasma6-integration-plugin plasma6-integration-plugin-qt5 - Update to 6.8.2 * New bugfix release * For more details please see: * https://kde.org/announcements/plasma/6/6.8.2 - Changes since 6.8.1: * Update version for new release 6.8.2 - Update to 6.8.1: * New bugfix release * For more details see https://kde.org/announcements/plasma/6/6.8.1 - Changes since 6.8.0: * Update version for new release 6.8.1 ==== plasma6-nm ==== Version update (6.8.0 -> 6.8.2) Subpackages: plasma6-nm-openconnect plasma6-nm-openvpn - Update to 6.8.2 * New bugfix release * For more details please see: * https://kde.org/announcements/plasma/6/6.8.2 - Changes since 6.8.1: * Update version for new release 6.8.2 - Update to 6.8.1: * New bugfix release * For more details see https://kde.org/announcements/plasma/6/6.8.1 - Changes since 6.8.0: * Update version for new release 6.8.1 ==== plasma6-openSUSE ==== - Update to 6.8.2 - Update to 6.8.1 ==== plasma6-pa ==== Version update (6.8.0 -> 6.8.2) - Update to 6.8.2 * New bugfix release * For more details please see: * https://kde.org/announcements/plasma/6/6.8.2 - Changes since 6.8.1: * Update version for new release 6.8.2 * Play feedback when increasing/decreasing volume (kde#527775) * volumefeedback: Play the sound from the configured sound theme (kde#525954) - Update to 6.8.1: * New bugfix release * For more details see https://kde.org/announcements/plasma/6/6.8.1 - Changes since 6.8.0: * Update version for new release 6.8.1 * Fix HTML escaping and ampersands in tooltips ==== plasma6-print-manager ==== Version update (6.8.0 -> 6.8.2) - Update to 6.8.2 * New bugfix release * For more details please see: * https://kde.org/announcements/plasma/6/6.8.2 - Changes since 6.8.1: * Update version for new release 6.8.2 - Update to 6.8.1: * New bugfix release * For more details see https://kde.org/announcements/plasma/6/6.8.1 - Changes since 6.8.0: * Update version for new release 6.8.1 * kded: Track marker level notifications per printer ==== plasma6-systemmonitor ==== Version update (6.8.0 -> 6.8.2) - Update to 6.8.2 * New bugfix release * For more details please see: * https://kde.org/announcements/plasma/6/6.8.2 - Changes since 6.8.1: * Update version for new release 6.8.2 * Ensure SplitView maximumWidth > minimumWidth - Update to 6.8.1: * New bugfix release * For more details see https://kde.org/announcements/plasma/6/6.8.1 - Changes since 6.8.0: * Update version for new release 6.8.1 * ColumnConfigurationDialog: Add Window color (kde#527190) * Update version for new release 6.8.1 * Revert "table: Change ColumnConfigDialog search filter to filter on text edit" ==== plasma6-workspace ==== Version update (6.8.0 -> 6.8.2) Subpackages: plasma6-session plasma6-workspace-libs - Update to 6.8.2 * New bugfix release * For more details please see: * https://kde.org/announcements/plasma/6/6.8.2 - Changes since 6.8.1: * Update version for new release 6.8.2 * kcms/style: use consistent slider value * applets/digital-clock: Keep the system font's OpenType features for the time (kde#524257) * libnotificationmanager: Accept single-quoted attributes in notification markup (kde#506733) * applets/kicker: port old favoriteId format to new one (kde#527651) * components/timezoneselector: fix margins * components/calendar: Don't navigate to years before year 1 (kde#525980) * shell: Set entered edit mode to false on startup (kde#527738) * libtaskmanager: Re-filter launchers when a window changes screen (kde#527507) * wallpapers/color: Set the accent color from the configured color (kde#513851) * libkmpris: Don't auto-repeat the global play/pause shortcut (kde#521448) * Applets Layout Manager: don't take preferred size into account when restoring (kde#490687) * libtaskmanager: Let the compositor name desktops created from the pager (kde#501808) * libkmpris: Keep non-ASCII characters in the title and album fallbacks (kde#503405) * applets/activitybar: fix tab focus and arrow nav (kde#527235) * Image wallpaper: Make all image packages correctly load (kde#527150) * appmenu: auto focus search field (kde#525569) * launcher tasks model: Guard lookup to serviceMenuById * libtaskmanager: put tasks in place of their launchers (kde#527189) - Update to 6.8.1: * New bugfix release * For more details see https://kde.org/announcements/plasma/6/6.8.1 - Changes since 6.8.0: * Colors: unexportTopLevel on editor close (kde#527382) * klipper: request activation when showing popup (kde#527326) * shellcorona: Set default containment * Update version for new release 6.8.1 * devicenotifications: Ignore virtual screens * Scripting: save and restore correctly floating panel config (kde#526843) * wallpapers/image: Handle when type cannot be determined * freespacenotifier: Set XDG activation token on launch job and config * freespacenotifier: Fix configure action ==== podman ==== Version update (6.1.2 -> 6.1.4) - Own the zsh completion-dirs like we do for fish completion-dirs. - Update to version 6.1.4: * Fixed an issue where Podman would not function when run under WSL 3. * Updated gvproxy to v0.9.0, resolving CVE-2026-107935 (bsc#1284922) * Updated Buildah to v1.45.2 * Updated Storage to v1.64.2 - Update to version 6.1.3: * This release addresses CVE-2026-94603, where a podman run on a checkpoint * image (any image with the io.podman.annotations.checkpoint.runtime.name annotation) could disable all sandboxing, including sandboxing specified by the user, when the container was created. (bsc#1283732) * Removed support for checkpoint images in podman run due to serious security concerns with the different security models of running images and running checkpoints. Checkpoints ignore user-specified security configuration and are very difficult to run safely. ==== polkit-kde-agent-6 ==== Version update (6.8.0 -> 6.8.2) - Update to 6.8.2 * New bugfix release * For more details please see: * https://kde.org/announcements/plasma/6/6.8.2 - Changes since 6.8.1: * Update version for new release 6.8.2 - Update to 6.8.1: * New bugfix release * For more details see https://kde.org/announcements/plasma/6/6.8.1 - Changes since 6.8.0: * Update version for new release 6.8.1 ==== powerdevil6 ==== Version update (6.8.0 -> 6.8.2) - Update to 6.8.2 * New bugfix release * For more details please see: * https://kde.org/announcements/plasma/6/6.8.2 - Changes since 6.8.1: * Update version for new release 6.8.2 * applets/batterymonitor: set switch state on first open (kde#527560) * backlightbrightness: Also log error code when executejob fails - Update to 6.8.1: * New bugfix release * For more details see https://kde.org/announcements/plasma/6/6.8.1 - Changes since 6.8.0: * Brightness: Proper sizing of scrollview contents (kde#527261) * Update version for new release 6.8.1 * Show the brightness OSD when a brightness key is pressed at min/max (kde#505558) ==== python-SQLAlchemy ==== Version update (2.0.51 -> 2.1.6) - update to 2.1.6: * https://docs.sqlalchemy.org/en/21/changelog/changelog_21.html#change-2.1.6 * https://docs.sqlalchemy.org/en/21/changelog/changelog_21.html#change-2.1.5 * https://docs.sqlalchemy.org/en/21/changelog/changelog_21.html#change-2.1.4 * https://docs.sqlalchemy.org/en/21/changelog/changelog_21.html#change-2.1.3 * https://docs.sqlalchemy.org/en/21/changelog/changelog_21.html#change-2.1.2 * https://docs.sqlalchemy.org/en/21/changelog/changelog_21.html#change-2.1.1 * https://docs.sqlalchemy.org/en/21/changelog/changelog_21.html#change-2.1.0 ==== python-alembic ==== Version update (1.18.5 -> 1.20.1) - update to 1.20.1: * Drop support for SQLAlchemy 1.4; SQLAlchemy >= 2.0.0 is now required. * Add Python 3.14 and 3.15 to trove classifiers; use PEP 604 unions in type annotations. * Autogenerate: - Treat empty string comment as None to prevent repeated diff detections. - Render full set of arguments and dialect prefix for PostgreSQL DOMAIN types. - Strip type casts from PostgreSQL Computed columns to prevent false-positive warnings. - Fix false modified detection on expression-based indexes with type casts. - Detect addition and removal of named CHECK constraints via checkconstraint_byname plugin (now opt-in). - Render dialect-specific kwargs on ForeignKey and CHECK constraints in create_table directives. - Render warning comment above drop_constraint when constraint name is None. - Avoid duplicate CHECK constraints rendered for Enum and Boolean types in SQLAlchemy 2.1. * Batch mode: - Warn when unnamed CHECK constraint on reflected table is omitted from batch recreate. - Fix duplicate CHECK constraint emission and naming convention issues for Boolean/Enum types. - Apply batch_alter_table.naming_convention only to unnamed reflected constraints. * Operations / Engine: - Fix invalid ALTER TABLE on identity columns when existing_server_default is omitted on PostgreSQL. - Fix TypeError when loading plugins pointing to a module in alembic.plugins entrypoint. - Accommodate Float/Numeric and (rand()) expressions in compare_server_default on MySQL. - Offline stamp/downgrade to base no longer emits spurious DROP TABLE alembic_version. - Use target_tokens and target_table_key from SQLAlchemy 2.1 to resolve ForeignKey targets containing dots. ==== python-certifi ==== Version update (2026.7.22 -> 2026.10.23) - update to 2026.10.23 (bsc#1286261, bsc#1287723): * drop eMudhra Inc root CA - Update to 2026.10.19: Remove the compromised eMudhra CA certificates. ==== python-gobject ==== Version update (3.56.3 -> 3.58.1) Subpackages: python313-gobject python313-gobject-Gdk python313-gobject-cairo - Drop glib_version, gi_version, pycairo_version and libffi_version defines: set minimum versions on every (Build)Requires, geckopit handles this for us now. - Update to version 3.58.1: * (backport) Fix GStreamer crash with python-debug - Update version dependencies according to meson.build. - Update to version 3.58.0: + Stable release. - Update to version 3.57.1: + Add extra checks around construction of object destroy notifier + `GLib.Pid` should be a number with a special `close` method + Use `PathLike` objects for `Gtk.Template` + Fast marshalling of `bytearray` to `GBytes` + Prevent crashes where `GValue` is `NULL` - Update to version 3.57.0: + doc: Update tutorial and examples + Fix potential buffer overflow errors where the C API exposes + gio: Support creating `GFile` child with slash operator, similar to `pathlib.Path` + Refactor memory management for marshaller cache + Add missing msg argument to asyncio cancel() + Fix deprecation warning for register_object + Find libraries automatically on Windows + Fix crash when `user_data` is defined before callback + Avoid extraneous deprecation warnings + Support generic annotations on `Async` + fix: Simplify string prefix handling + doc: Use gobject-linter for linting GObject code ==== python-jsonpatch ==== Version update (1.33 -> 1.37) - update to 1.37: * Clean up in-place output after write errors * Reject invalid patch document containers * Use UTF-8 for JSON command-line file I/O * Handle source pointer objects in move location helpers - update to 1.36: * Honor optimization=False when generating patches * Preserve the original file when in-place CLI replacement fails - update to 1.35: * Refactor JsonPatch class and improve documentation * Add pytest configuration for non-standard test file naming * Document JSON Pointer escaping for special characters * Improve list diffing to avoid unnecessary item replacements * Use correct SPDX-Identifer * Improve coverage reporting by combining test runs * ci: run tests on every PR and pushes to master * Add support for Python 3.13 and 3.14 * Improve list diffing with sequence alignment to avoid cascading changes * Handle self-containing values in make_patch and add #180 regression tests * Only reject '-' in replace when it refers to an array * Reject moving any location into its own children, fixes #214 * Compare values in 'test' by JSON equality * Hash patch operations by their 'op' and 'path' * Require jsonpointer>=3.2 * Raise documented exceptions for malformed patches and "from": "/-" * Support whole document operations on scalar documents * Housekeeping: stale links, packaging cleanup, CI action versions * Find moves in make_patch without rewriting all later operations * Close test coverage gaps * Remove unreachable code from make_patch and the jsonpointer < 3.2 shim * Test the index helpers of PatchOperation and MoveOperation * Upload coverage to Coveralls again * Close the original input before in-place replacement * Install the command line programs as console_scripts - update to 1.34: * Update documentation to include a link to the GitHub repo and installation instructions * Support only currently supported Python versions (by @hf- kklein in #155, #156, @CyrilRoelandteNovance in #162, @stefankoegl in #193) * fix: remove unused exception variables (F841) * Avoid usage of unittest.makeSuite, removed from Python 3.13 * Handle the whole-document pointer in the sequence branch * Fix copying from the whole-document pointer * Add property-based tests using Hypothesis * DiffBuilder: fix reindexing of operations involving nested paths * fix: use deterministic comparison ordering * Fix `_compare_lists` treating `1` and `True` as equal in JSON diff by @stefankoegl with @Copilot in https://github.com/stefankoegl/python-json-patch/pull/181 * Update property test counterexamples for fixes from #175 and [#181] * Prevent RFC 6901 pointer indexing into strings * DiffBuilder: fix operation reindexing bug * Fix patch operations to not modify patch object during apply * Refactor DiffBuilder to use tuple paths and simplify operation handling * Fix ReadTheDocs configuration and documentation build * Clarify patch application semantics and fix documentation * Add PyPI publishing workflow and update release process ==== python-jsonpointer ==== Version update (3.1.1 -> 3.5) - update to 3.5: * Handle array-end pointers as CLI resolution errors * Read CLI JSON and pointer files as UTF-8 - update to 3.4: * Add `create` parameter to `set_pointer` for auto-creating missing paths - update to 3.3: * Preserve control-flow exceptions when joining pointer parts * Continue CLI batches after malformed JSON input - update to 3.2.1: * Report test coverage to Coveralls from GitHub Actions * Replace Travis CI link with GitHub Actions badge in README * Preserve trailing member-name spaces in pointer files - update to 3.2.0: * Run unittest discovery in the coverage target * [BUGFIX] JsonPointer should not index into strings * Preserve JsonPointer subclasses when joining * fix: validate assignment target in JsonPointer.set() * Normalize oversized array index conversion errors * Add VERBOSE_EXCEPTIONS flag to suppress doc content in JsonPointerException messages by @stefankoegl with @Copilot in https://github.com/stefankoegl/python-json-pointer/pull/72 * Improve jsonpointer CLI: support positional pointer argument * Add GitHub Actions workflow for PyPI publishing ==== python-maturin ==== Version update (1.15.0 -> 1.16.0) - Update to 1.16.0 * Update version mapping for GraalPy 3.13 gh#PyO3/maturin#3297 * properly normalize / validate abiflags and include in environment signature gh#PyO3/maturin#3299 * Fix MinGW stable ABI library names in generated PyO3 config gh#PyO3/maturin#3298 * fix: lossy-decode external command output in interpreter discovery gh#PyO3/maturin#3302 * build(deps): update rustls for RUSTSEC-2026-0285 gh#PyO3/maturin#3308 * Include SOABI_PLATFORM in Python 3.15 stable ABI extension filenames gh#PyO3/maturin#3305 * Sort compressed tag sets gh#PyO3/maturin#3315 * Update manylinux/musllinux policies to the latest main gh#PyO3/maturin#3322 * docs: recommend declaring the Rust MSRV gh#PyO3/maturin#3317 * Emit a WASI platform tag for non-bin extension wheels gh#PyO3/maturin#3321 * Don't include the cargo target directory or cache directories in wheels built from sdists gh#PyO3/maturin#3320 * fix: avoid global uv fallback in pixi environments gh#PyO3/maturin#3306 * Fix the cargo-deny advisories that fail Lint gh#PyO3/maturin#3328 * Update pyo3-introspection to 0.30 gh#PyO3/maturin#3329 * Ignore unreachable zip extract advisories in cargo deny gh#PyO3/maturin#3334 * Normalize Provides-Extra names from project.optional-dependencies gh#PyO3/maturin#3333 * Join a multi-line description into a single-line Summary gh#PyO3/maturin#3332 * Update https cert bundle for the eMudhra CA compromise gh#PyO3/maturin#3337 * fix: use the toolchain pyodide-build expects gh#PyO3/maturin#3338 * feat: upload emscripten wheels to pypi gh#PyO3/maturin#3340 * use system ca certificates instead of ureq's WebPki when building with native-tls gh#PyO3/maturin#3341 * Put all License-File entries at the sdist root gh#PyO3/maturin#3331 * Pass macosx_deployment_target to zigbuild gh#PyO3/maturin#3313 * Use the pp80 ABI tag for PyPy 3.12 in the bundled sysconfig gh#PyO3/maturin#3343 * feat: add configurable PGO dependency group gh#PyO3/maturin#3310 gh#PyO3/maturin#3278 * fix: update rustix to 1.1.5 gh#PyO3/maturin#3344 ==== python-pycparser ==== Version update (3.0 -> 3.12) - update to 3.12: * Emit one type definition for declarators that share it * raise ParseError for _Atomic applied to array or function type * Fix code generation for the _Pragma operator * Parse GNU statement expressions as primary expressions * Fix shared type declarations in switch cases * raise ParseError for typedef in a parameter declaration * Scope for loop init declarations to the loop * Enhanced C11 support * Drop an unneeded direct build depndency on wheel * fix: handle integer suffix in #line directive without crashing * Update default branch to main * fix: raise ParseError instead of AssertionError on unmatched '}' * Add support for Python 3.15 * Fix empty compound literal (type){} raising ParseError * Fix compound literal statements in C generator * Keep the contents of adjacent u8 string literals ==== python313 ==== - Require libexpat1 >= 2.8.5 for python313-base and raise the Expat build requirement accordingly. pyexpat uses XML_SetHashSalt16Bytes when built with Expat >= 2.8, but the automatic SONAME dependency permits older libraries, breaking imports and venv/ensurepip (bsc#1285433). ==== python313-core ==== Subpackages: libpython3_13-1_0 python313-base - Require libexpat1 >= 2.8.5 for python313-base and raise the Expat build requirement accordingly. pyexpat uses XML_SetHashSalt16Bytes when built with Expat >= 2.8, but the automatic SONAME dependency permits older libraries, breaking imports and venv/ensurepip (bsc#1285433). ==== qqc2-breeze-style6 ==== Version update (6.8.0 -> 6.8.2) - Update to 6.8.2 * New bugfix release * For more details please see: * https://kde.org/announcements/plasma/6/6.8.2 - Changes since 6.8.1: * Update version for new release 6.8.2 * MobileTextActionsToolBar: Fix popup not closing after an action is activated * MobileTextActionToolbar: Fix TextArea not showing contextual actions (kde#526591) - Update to 6.8.1: * New bugfix release * For more details see https://kde.org/announcements/plasma/6/6.8.1 - Changes since 6.8.0: * Update version for new release 6.8.1 * ToolButton: Fix flat mode not inheriting background color scheme (kde#526786) ==== qt6-base ==== Subpackages: libQt6Concurrent6 libQt6Core6 libQt6DBus6 libQt6Gui6 libQt6Network6 libQt6OpenGL6 libQt6OpenGLWidgets6 libQt6PrintSupport6 libQt6Sql6 libQt6Test6 libQt6WaylandClient6 libQt6Widgets6 libQt6WlShellIntegration6 libQt6Xml6 qt6-network-tls qt6-networkinformation-connman qt6-networkinformation-glib qt6-networkinformation-nm qt6-printsupport-cups qt6-sql-sqlite qt6-wayland - Add upstream fix: * CVE-2026-105924-qtbase-6.12.diff (CVE-2026-105924) ==== qt6-declarative ==== Subpackages: libQt6LabsAnimation6 libQt6LabsFolderListModel6 libQt6LabsPlatform6 libQt6LabsQmlModels6 libQt6LabsSettings6 libQt6LabsSharedImage6 libQt6LabsStyleKit6 libQt6LabsSynchronizer6 libQt6LabsWavefrontMesh6 libQt6Qml6 libQt6QmlCore6 libQt6QmlDesignSupport6 libQt6QmlLocalStorage6 libQt6QmlMeta6 libQt6QmlModels6 libQt6QmlNetwork6 libQt6QmlWorkerScript6 libQt6QmlXmlListModel6 libQt6Quick6 libQt6QuickControls2-6 libQt6QuickControls2Impl6 libQt6QuickDialogs2-6 libQt6QuickDialogs2QuickImpl6 libQt6QuickDialogs2Utils6 libQt6QuickEffects6 libQt6QuickLayouts6 libQt6QuickParticles6 libQt6QuickShapes6 libQt6QuickTemplates2-6 libQt6QuickTest6 libQt6QuickVectorImage6 libQt6QuickWidgets6 qt6-declarative-imports - Add upstream change (kde#527720) * 0001-Fix-teardown-hang-with-QuickPixmapReader.patch ==== rebootmgr ==== Version update (4.0+git20261008.76d8ee7 -> 4.3) - Update to version 4.3: * Release version 4.3 * Use logind varlink interface for reboot * rebootmgrd: more error handler fixes - Update to version 4.2: * Release version 4.2 * Fix error handling in case SELinux denies reboot [bsc#1287746] - Update to version 4.1: * Release version 4.1 * Use varlink for reboot, else posix_spawn * Update basics.h * calendarspec: check for error when resetting TZ * Fix URL of github project * supporting time_zones * initialize seed with random value ==== rootlesskit ==== Version update (3.2.0 -> 3.3.0) - Update to version 3.3.0: * v3.3.0 * pkg/api: replace github.com/gorilla/mux with stdlib * chore(deps): bump golang.org/x/net to v0.60.0 * Build(deps): Bump golang.org/x/sys from 0.48.0 to 0.49.0 * pkg/httputil: configure HTTP transport timeouts * port/builtin: probe source-ip-transparent backend in the detached netns * CI: test source IP propagation of the builtin port driver * api/client: add Close to Client * cmd/rootlessctl: use command context * fix: forward startup messages to logWriter * fix(pasta): remove --stderr option * v3.2.0+dev ==== rsync ==== - Add rsync-direct-interpreters.patch: use direct interpreter paths, #!/bin/bash for rsync-ssl and #!/usr/bin/perl for rsyncstats, instead of /usr/bin/env lookups. The scripts then declare a proper interpreter dependency rather than relying on PATH resolution at runtime. - Do not ship rsyncstats twice: the support documentation is copied without it, the script is installed once in /usr/bin. - Drop the unused rsyncd.rc source and the empty init.d and xinetd.d directory creation; the daemon runs through the systemd units. - Drop the grep and sed post requirements, no scriptlet of this package calls either tool. - Spec cleanup per the packaging guidelines: drop the obsolete Group tag and write the library build requirements in pkgconfig form. ==== rust-keylime ==== Version update (0.2.9+49 -> 0.2.10+12) - Add Cargo_toml.patch - Update zip to 9.1.2 bsc#1287921, CVE-2026-115905, CVE-2026-115906, CVE-2026-115907, CVE-2026-115908, CVE-2026-115909 - Update to version 0.2.10+12: * log Agent UUID at push agent startup * Limit actix-web workers * Fix clippy needless_late_init warnings * Unwrap OCTET STRING wrapped EK certificates * build(deps): bump rand from 0.9.4 to 0.10.1 * build(deps): bump glob from 0.3.3 to 0.3.4 * build(deps): bump reqwest from 0.13.3 to 0.13.4 * Check shutdown marker inside ml_extend loop * Fix clippy useless_borrows_in_formatting warnings * build(deps): bump tokio from 1.52.2 to 1.53.1 * Fix payload key upgrade regression by falling back to mTLS key * Accept any RSA key size for payload encryption * Bump version to 0.2.10 * keylime: use runtime OpenSSL algorithm detection instead of compile-time symbols ==== samba ==== Version update (4.25.0+git.473.e78e78fbf4 -> 4.25.1+git.476.bfc358351cb) Subpackages: libldb2 samba-ad-dc-libs samba-client samba-client-libs samba-libs - Update to 4.25.1 * CVE-2026-109411: Access control bypass via vfs_ceph_rgw case-insensitive open; (bso#16276); (bsc#1286540); * CTDB: Cannot find device "@": need to extract real interface names; (bso#16274). * generate_unique_u64() may not protect against veto_value; (bso#16200). * Rename with ReplaceIfExists to a target differing only in case creates a duplicate instead of replacing; (bso#16261). * Samba 4.25.0 fails to build on macOS; (bso#16263). * Python smbconf transaction_start() lacks a talloc stack frame with CTDB; (bso#16258). * Linux i686 build fails on dynamic_lookup; (bso#16265). * vfs_acl_xattr crashes on zero-sized flistxattr queries; (bso#16287). * Dynamic interface support in smbd is racy; (bso#16235). * CTDB database operations can be run against incorrect nodes; (bso#16254). * A node can be banned because it tries to run recovery after losing the cluster lock; (bso#16273). * All backend log should honor global log level "log level = "; (bso#15857). * fruit:time machine max size can only be set to an integer and is ignored if user sets a float; (bso#15324). ==== sdbootutil ==== Version update (1+git20261007.53bc127 -> 1+git20261026.4e266f0) Subpackages: sdbootutil-dracut-measure-pcr sdbootutil-snapper sdbootutil-tukit - Update to version 1+git20261026.4e266f0: * Add --version parameter * Do not propagate umount to the host * Do not add duplicate cmdline.d entries ==== sddm-kcm6 ==== Version update (6.8.0 -> 6.8.2) - Update to 6.8.2 * New bugfix release * For more details please see: * https://kde.org/announcements/plasma/6/6.8.2 - Changes since 6.8.1: * Update version for new release 6.8.2 - Update to 6.8.1: * New bugfix release * For more details see https://kde.org/announcements/plasma/6/6.8.1 - Changes since 6.8.0: * Update version for new release 6.8.1 ==== selinux-policy ==== Version update (20261019 -> 20261030) Subpackages: selinux-policy-targeted - Update to version 20261030: * Allow rebootmgr to initialize reboot and soft-reboot (bsc#1287746) * Allow httpd map its private runtime files * Allow qatlib get attributes of a hugetlbfs filesystem * Allow rhsmcertd list insights-client config dirs * Allow svirt_tcg_t to use the passt user-mode networking backend * Allow sshd_session_t to forward connections to a container runtime socket * Allow systemd-oomd the kill capability in the user namespace * Allow systemd-oomd signull all domains * Revert "Allow systemd-oomd signull systemd-resolved" * Update the nvme block devices regex in file context specification * Allow keepalived getpgid of its unconfined scripts * Allow init mounton system dbus pid socket files * Allow systemd-oomd signull systemd-resolved * Allow login_userdomain watch localization files for changes * Allow login_userdomain mounton gnome generic data home dirs * Revert Allow sdbootutil_t write access to /var/lib/sdbootutil (bsc#1281087) * Label /run/gnome-remote-desktop with gnome_remote_desktop_var_run_t * Allow systemd_nsresourced_t setuid/setgid inside a userns (bsc#1285095) * Allow access to systemd-nsresourced runtime socket (bsc#1284651) * Allow smbd watch public directories used for file transfer services * Allow sshd-session read systemd-nsresourced runtime socket file * Allow chrome_sandbox_t map its private tmpfs files * Allow sysadm_t to create iSCSI netlink sockets * Allow ktlshd connect to pcscd over a unix stream socket * Add iptables_dontaudit_read_var_run_dirs() interface * Allow polkit-auth read systemd-nsresourced runtime socket file * Allow systemd-nsresourced the sys_admin capability * Label /var/cache/boomaga with cupsd_rw_etc_t * Allow dirsrv to read filesystem sysctls * Allow cupsd create bluetooth sockets * Allow gnome-remote-desktop handle kerberos replay cache files * Allow multiple domains read systemd-nsresourced runtime socket file * Update mount_nnp_domtrans() with nosuid_transition * Label /run/systemd/coredump socket with systemd_coredump_var_run_t - Syncing with upstream rawhide selinux-policy up to: * 8a22f4474f77c7cb32cd6d18e3da75eaef8696de ==== sensors ==== - Stop using globs in filelist, removes rpmlint warning. - Own zsh-completion dirs, explicitly list files. ==== snowball ==== Version update (3.0.1 -> 3.1.1) - Update to version 3.1.1: + Numerous bug fixes and improvements, see full details in /usr/share/doc/packages/snowball/NEWS. - Rebase patches: + build-options.diff + python-dist.diff + shared-library.diff ==== spectacle ==== Version update (6.8.0 -> 6.8.2) - Update to 6.8.2 * New bugfix release * For more details please see: * https://kde.org/announcements/plasma/6/6.8.2 - Changes since 6.8.1: * Update version for new release 6.8.2 * Delete temporary OCR text file once job is done - Update to 6.8.1: * New bugfix release * For more details see https://kde.org/announcements/plasma/6/6.8.1 - Changes since 6.8.0: * Update version for new release 6.8.1 * Gui: Don't shadow Item.focusPolicy in the button containers * Fix transient popup CLI mapping for -u/-t * SpectacleCore: update current saved image URL so Save overwrites file after Save As (kde#526111) * Update version for new release 6.8.1 * ExportManager: fall back to default location if last save directory is missing (kde#526909) ==== speex ==== - Fix out-of-bounds write in speex_bits_read_whole_bytes() (CVE-2026-116741, bsc#1288101): speex-CVE-2026-116741.patch - Refresh speex-no-build-date.patch to be applied with -p1 ==== spice-vdagent ==== Version update (0.23.0 -> 0.23.0+git6.e940b00) - Update to version 0.23.0+git6.e940b00: * vdagent: Fix build using GTK 4 without X11 * fix(file-xfers): Reject path traversal in file transfer filenames * fix(udscs): Prevent integer overflow in udscs_write() buf_size calculation * vdagent/device-info: remove unused loop variable for gcc 16 * Revert "spice-vdagent.service: Fixing cyclical systemd dependencies" * spice-vdagent.service: Fixing cyclical systemd dependencies * Release v0.23.0 * chore: prepare for release, use "Keep a Changelog" format * spice-vdagent[d].service: Fix duplicated logs * spice-vdagent.service: Add missing PartOf dep - Drop obsolete Prevent-integer-overflow-in-udscs_write-buf_size-calculation.patch - Drop obsolete Reject-path-traversal-in-file-transfer-filenames.patch - Add wayland_native_vd_agent.patch from upstream Merge Request https://gitlab.freedesktop.org/spice/linux/vd_agent/-/merge_requests/57 ==== sqlite3 ==== Version update (3.53.2 -> 3.54.1) - Update to version 3.54.1: * https://sqlite.org/releaselog/3_54_1.html * Fix a possible heap-buffer overflow on 32-bit builds (64-bit builds are not affected). * Fix other problems in 3.54.0 reported by users. - Update to version 3.54.0: * https://sqlite.org/releaselog/3_54_0.html * CLI enhancements: prompt strings may contain escape sequences that expand to show state information, and the initial prompt is taken from the SQLITE_PS1 and SQLITE_PS2 environment variables if set. The default prompt honors NO_COLOR. * CLI: columnar output modes now show the column name header by default even if the query returns no rows. * CLI: the new ".diskused" dot-command (based on the new diskused() extension) replaces the separate sqlite3_analyzer utility, which is now deprecated upstream. * CLI: the .mode command gained the --rowcount, --titles, - -ifmt and --fpfmt options. * CLI: ending an SQL command with a line containing just "go" or "/" is discontinued unless compiled with - DSQLITE_SHELL_LEGACY_COMMAND_TERMINATOR. * Query planner improvements, including better optimization of "expr OR TRUE" / "expr OR FALSE", skipping needless updates of expression indexes, ignoring DISTINCT on the right-hand side of IN, and faster UNION queries with a LIMIT of exactly 1. * ALTER TABLE now raises an error on any attempt to add, drop, or rename columns named "ROWID", "_ROWID_" or "OID". * New %J and %j conversions to render JSON string literals in the built-in printf() and the format() SQL function. * New C-language interfaces: sqlite3_result_str() and sqlite3_incomplete(). * Date/time functions: added the "weekday -N" form of the weekday modifier and the "end of" modifier. * The authorizer callback is now invoked for SQL functions found in the DEFAULT clauses of CREATE TABLE statements. * Added SQLITE_LIMIT_SCHEMA and SQLITE_LIMIT_TRIGGER_STEPS to the sqlite3_limit() interface. * Use O_TMPFILE when generating temporary files on systems that support it. * About 4% faster as measured by counting CPU cycles in the speedtest1 benchmark. - Raise RLIMIT_DATA in %check so that the ASAN based tests can reserve their shadow memory region. ==== systemsettings6 ==== Version update (6.8.0 -> 6.8.2) - Update to 6.8.2 * New bugfix release * For more details please see: * https://kde.org/announcements/plasma/6/6.8.2 - Changes since 6.8.1: * Update version for new release 6.8.2 - Update to 6.8.1: * New bugfix release * For more details see https://kde.org/announcements/plasma/6/6.8.1 - Changes since 6.8.0: * Update version for new release 6.8.1 ==== taglib ==== Version update (2.3 -> 2.3.2) - Add fix-32bit-overflow.patch * Fix 32-bit overflows and i586 test suite - Update to version 2.3.2 (soname unchanged, libtag.so.2): * 2.3.1: Matroska crash and element-length fixes, MP4 cnID 64-bit/chapter fixes, QT stsc allocation guard, XM save fix. * 2.3.2: MP3 unsync/iTunes ID3 fixes, MP4 covr tolerance and new codecs, Ogg muxed Vorbis comments, ASF property improvements, RF64/BW64 support, Matroska scan/attachment fixes, crafted-input hardening (DoS/resource exhaustion). * Build: use Requires.private for zlib. - Modernize spec (pkgconfig zlib, drop Group tags). ==== tesseract-ocr ==== Version update (5.5.3 -> 5.5.4) Subpackages: libtesseract5 tesseract-ocr-common - Update to version 5.5.4: * Hardening release: crafted-traineddata guards, Coverity fixes, leak and robustness fixes, training-tool fixes * Drop upstreamed patches contained in 5.5.4 (fixes credited 2026-09-23): tesseract-CVE-2026-88047.patch, tesseract-CVE-2026-88048.patch, tesseract-CVE-2026-88049.patch, tesseract-CVE-2026-88050.patch, tesseract-CVE-2026-88051.patch, tesseract-CVE-2026-88052.patch, tesseract-CVE-2026-88053.patch, tesseract-CVE-2026-88054.patch * Raise pkgconfig(lept) floor to >= 1.80 per upstream * Fix double-free/UAF in AppendLinePolygon for RTL PAGE XML output CVE-2026-119338 bsc#1289080 * lstm: reject old-format WeightMatrix instead of aborting CVE-2026-119339 bsc#1289082 * Reject malformed dimensions in GENERIC_2D_ARRAY deserialization CVE-2026-119340 bsc#1289087 * Neutralise file-sourced pointers in ReadAdaptedClass before use CVE-2026-119341 bsc#1289088 ==== tevent ==== - Convert the package to _multibuild flavors: the man pages are now built from the "man" flavor of tevent.spec instead of a generated tevent-man.spec, so pre_checkin.sh, tevent-man.spec and tevent-man.changes are gone. No need to maintain duplicate files. - Merge the duplicated %if blocks in the spec file and give the man flavor its own summary and description. - Remove use of obsolete %py3* macros, use only the maintained ones from `python-rpm-macros` package. - Drop obsolete spec constructs (BuildRoot, %defattr, PreReq, legacy suse_version conditionals). - Build and install pycache files - fix deps * cmocka (>=1.1.8) ==== union6 ==== Version update (6.8.0 -> 6.8.2) - Update to 6.8.2 * New bugfix release * For more details please see: * https://kde.org/announcements/plasma/6/6.8.2 - Changes since 6.8.1: * Update version for new release 6.8.2 * AbstractElement: Set elementQuery at construction * IndicatorElement: Set indicator values at construction * TabElement: set hSpace and vSpace at construction * AbstractElement: Check if we already have this element and update it * output/widgets: scale the widget animation duration with the animation speed (kde#527527) * output/quick: Explicitly set the Style instance for TextArea's background (kde#527455) * input/css/breeze: Only round delegate backgrounds in list when highlighted (kde#527087) * output/quick: Also consider parent for inside-{list,table} hints * input/css/breeze: Use large spacing for menubar item horizontal padding (kde#527213) * output/widgets: Don't dereference potential nullptr value (kde#527459) - Update to 6.8.1: * New bugfix release * For more details see https://kde.org/announcements/plasma/6/6.8.1 - Changes since 6.8.0: * TreeViewElement: draw the branch arrow at the size of the indicator * UnionStyle: underline accelerators of selectable labels only with Alt * Update version for new release 6.8.1 * CheckBox/RadioButtonElement: Don't draw as a push button without a widget (kde#526764) * Elements: Add validity checks * :cherries: tools/styletool: Support Tar archived styles in install/inspect/update commands * tools/styletool: Add support for extracting files from a Tar archive * tools/styletool: Add support for reading existing archives to TarArchive * :cherries: tools/styletool: Refactor Tar to TarArchive and make it a proper class * ScrollAreaCornerElement: Fix validity check * UnionStyle: Remove unused QSplitterHandle check * CMakeLists: Remove Breeze QStyle dependency * delegate: Add focusframe * FocusElement: Fix validity check * AbstractElement: Add changed hint on _kde_highlight_neutral ==== userspace-rcu ==== Version update (0.15.6 -> 0.15.7) - update to 0.15.7: * call-rcu worker: set CPU affinity on first non-empty dequeue * Fix: leaky wfcq tests * Fix: test_build.c: Test output mismatch * Fix: workqueue leaks mutexes on FreeBSD * Fix: call-rcu leaks mutexes on FreeBSD * call_rcu: pin per-CPU worker at thread startup * urcu-pointer: Add rcu_dereference_sym2() taking the pointer address * urcu-pointer: Fix missing memory ordering in rcu_dereference_sym() ==== util-linux ==== Subpackages: libblkid1 libfdisk1 libmount1 libsmartcols1 libuuid1 - Wrap the lastlog2 and liblastlog2-2 package descriptions within the line length limit - Ship /var/lib/lastlog in the lastlog2 package; the directory is created by the tmpfiles entry but was missing from the file list - Drop the no-op %tmpfiles_create calls from the lastlog2 and uuidd scriptlets; both packages ship their tmpfiles.d entries, which the systemd file trigger processes at install time - Use the find -regextype name posix-extended instead of its posix-egrep alias in %install - List the header directories excluded from the systemd package explicitly instead of globbing the shared include directory ==== util-linux-systemd ==== Subpackages: lastlog2 liblastlog2-2 - Wrap the lastlog2 and liblastlog2-2 package descriptions within the line length limit - Ship /var/lib/lastlog in the lastlog2 package; the directory is created by the tmpfiles entry but was missing from the file list - Drop the no-op %tmpfiles_create calls from the lastlog2 and uuidd scriptlets; both packages ship their tmpfiles.d entries, which the systemd file trigger processes at install time - Use the find -regextype name posix-extended instead of its posix-egrep alias in %install - List the header directories excluded from the systemd package explicitly instead of globbing the shared include directory ==== vlc ==== Subpackages: libvlc5 libvlccore9 vlc-noX vlc-plugins-desktop - Update version dependencies according to configure.ac. - Migrate to xz compression and manual service run - Use legacy '#' instead of '%dnl' to comment: VLC is still being built for CODE15 branches outside of OBS, where %dnl is not supported. ==== wireplumber ==== Version update (0.5.18 -> 0.5.19) Subpackages: libwireplumber-0_5-0 - Update to version 0.5.19: * Additions & Enhancements: - Added wpctl get-profile and wpctl get-route to show the available and active profiles and routes of a device, including their priorities and the direction of each route (#989 (closed); !933 (merged)) - Added the node.slow-resume node property, together with the session.fast-capture-start and session.fast-playback-start client properties, which let clients keep slow-resume nodes idle instead of suspended while they are connected (!921 (merged)) - Added the monitor.camera.seat-monitoring feature, which makes the V4L2 and libcamera monitors enumerate cameras only while the logind session is active, so that cameras are no longer skipped when WirePlumber starts before the session gets access to them. This is enabled by default (#1049 (closed); !939 (merged)) - Added the bluetooth.autoswitch-switch-timeout and bluetooth.autoswitch-restore-timeout settings, and raised the default restore timeout to 4 seconds, so that applications reopening the microphone shortly after closing it keep the headset profile (#1050 (closed); !938 (merged)) - Improved Bluetooth A2DP duplex profiles support: the source loopback is now also created for these profiles, making their microphone usable, and autoswitch-bluetooth-profile no longer switches away from them (#1051 (closed); !940 (merged)) - Added the device.recover-on-error ALSA device property: closing and re-opening a device after a node error only helps some devices, so this recovery now only happens if the property is set (#1046 (closed); !929 (merged)) * Fixes: - Fixed the priority of UCM HiFi* nodes to match that of analog-* nodes, so that they no longer lose the default sink election to HDMI (!924 (merged)) - Fixed restricted and flatpak clients being wrongly given write and link permissions (#1044 (closed); !928 (merged)) - Fixed autoswitch-bluetooth-profile leaving headsets stuck in the headset profile after connecting devices that advertise the A2DP profile later (#1048 (closed); !931 (merged)) - Fixed all new streams getting corked after a card profile switch, until WirePlumber was restarted (#1030 (closed); !919 (merged)) - Fixed new streams that enable a smart filter being linked before the filters were relinked, which made them capture unfiltered audio for a short time (!922 (merged)) - Fixed an abort on shutdown with PipeWire 1.4 when V4L2 devices are present, by tearing down WpSpaDevice on the thread of its owning client context, and did the same for destroying WpImplNode (!934 (merged), !935 (merged)) - Fixed monitor.bluez.rules not being applied to the Bluetooth source loopback nodes (#1043 (closed); !927 (merged)) - Fixed wpctl list not listing some objects, such as video devices, by requesting the minimal object features (!930 (merged)) - Fixed object activation hanging forever if exporting an object to PipeWire fails, by returning an error instead (#1019; !937 (merged)) ==== xdg-desktop-portal-kde6 ==== Version update (6.8.0 -> 6.8.2) - Update to 6.8.2 * New bugfix release * For more details please see: * https://kde.org/announcements/plasma/6/6.8.2 - Changes since 6.8.1: * Update version for new release 6.8.2 - Update to 6.8.1: * New bugfix release * For more details see https://kde.org/announcements/plasma/6/6.8.1 - Changes since 6.8.0: * Update version for new release 6.8.1 * Use correct padding for window contents * PipeWireDelegate: Fix broken ComboBox height ==== xfsprogs ==== Version update (6.19.0 -> 7.2.0) - update to 7.2.0 - xfs_quota, xfs_spaceman, libfrog: hoist xfsquotactl into libfrog with quotactl_fd and mount-fd support, so xfs_quota can open the filesystem mountpoint directly for quota operations and xfs_spaceman's makecfg can reuse the same code path - mkfs, xfs_admin, xfs_spaceman, xfs_db: allow specifying and printing mkfs default options via a configuration file; mkfs also upgrades autofsck earlier automatically - xfs: fix an off-by-one in rtrefcount btree root level validation, a reflink-flag clearing issue with INO1_WRITTEN during exchange-range, a memory leak in xfs_dqinode_metadir_create(), a 32-bit pointer arithmetic bug, an exchmaps reservation limit check, and growfs delta computation not returning the updated block count - xfs: report case sensitivity via fileattr_get - xfs_copy: always align I/O to at least the page size, and log the errno on write failures - man: document that XFS_IOC_FS[G|S]ETXATTR can't be used on special files - update to 7.1.1 - fiemap: add a nosync option - xfs_scrub: fix spacemap scan for the data volume - mdrestore: fix extent length overflow in the v2 restore path - xfs_healer: install targets one at a time (build fix) - update to 7.1.0 - xfs: zero directory data block padding and header regions on write verification and at init, avoiding exposure of stale data - xfs_scrub: dozens of correctness and crash fixes across rtgroups, zoned and realtime filesystem handling, spacemap scans, media verification and work estimation; notably an integer overflow, a crash when reporting clean health, and several memory/scan-item leaks - mkfs: fix PQUOTA/GQNOENFORCE conflict, hardlink detection, symlink length checks, a PATH_MAX check and protofile handling in directory import; fix filesystem/log size units - libfrog: fix a buffer overflow in getparents' path_to_string - xfs_healer, xfs_healer_start: fix a getmntent race in weakhandle, statmount buffer sizing, listmount checks on --check, and monitor-fd aliasing; allow AF_UNIX socket access for xfs_healer instances - xfs_db: dump zoned filesystem superblock fields - xfs_scrub_all, xfs_scrub_media_fail: reduce security lockdowns that broke postfix mail notifications, and fix broken command-line array construction - update to 7.0.1 - xfs_healer, libfrog: fix build/runtime on targets missing the HAVE_LISTMOUNT flag or statmount kernel support (missing flags and fallback stubs) -- a portability fix for the health-monitoring code introduced in 7.0.0 - update to 7.0.0 - xfs_healer: new self-healing background daemon that monitors mounted filesystems for health events (metadata corruption, I/O errors, shutdowns) and automatically triggers spot or full repairs, picking repair mode from the autofsck fsproperty; adds a per-mount xfs_healer_start service to start it automatically - xfs_io: add listmount, statmount and a media verify command; monitor filesystem health events - xfs_scrub: use the new media-verify ioctl for phase 6 media scanning, extend it to cover the log region, raise media verification IO limits, and report truncated devices as media errors - mkfs: enable online repair by default when all backrefs are enabled - xfs_repair: don't fail on INCOMPLETE attrs in leaf blocks - xfs_scrub_all: fix a deadlock when lsblk produces a lot of output - xfs_scrub: drop the bogus warning about mixed bidirectional codepoints in names, warn about unicode variation selectors instead - xfs_quota: display default limits for users with zero usage ==== xkeyboard-config ==== - added xkeyboard-config-rpmlintrc as Source to Specfile - Drop the %ghost entries for /var and /var/lib; both directories are owned by the filesystem package. The /var/lib/xkb directories themselves stay as ghosts and keep being created by tmpfiles (jsc#PED-14831). - Drop the trailing slash from the /var/lib/xkb tmpfiles entry so the path matches the packaged file list. - Run fdupes over /usr/share/xkeyboard-config-2 and the locale tree: the base and evdev rules files and the xkeyboard-config and xkeyboard-config-2 message catalogues are byte-identical pairs, now linked instead of duplicated (about 4 MB of duplicated payload). - Collect the xkeyboard-config-2 message catalogues with %find_lang as well, so they carry %lang attributes like the xkeyboard-config ones. - Drop unused BuildRequires: intltool and perl(XML::Parser); nothing in the build uses either. - Add an rpmlintrc for the %post keymap-cache cleanup findings; the cleanup itself stays (bnc#662014). - Drop the Group tag, fix a spelling error in the description and add the missing patch tags. ==== xorg-x11-server ==== Version update (21.1.24 -> 21.1.25) Subpackages: xorg-x11-server-Xvfb - Update to version 21.1.25 * Security Update - supersedes the following patches: * 0001-xkb-NULL-text-pointer-after-free-in-_CheckSetDoodad-.patch * 0002-xkb-allocate-names-keys-to-MAP_LENGTH-in-XkbAllocNam.patch * 0003-xkb-widen-size_syms-num_syms-size_acts-num_acts-to-u.patch * 0004-xkb-fix-CheckKeySyms-overwriting-request-range-symsP.patch * 0005-randr-fix-size-and-offset-in-RRChangeProviderPropert.patch * 0006-Xi-validate-modifier-values-in-ProcXIPassiveUngrabDe.patch * 0007-glx-validate-dataBytes-against-cmdlen-in-RenderLarge.patch * 0008-present-unlink-notifies-from-window-list-in-present_.patch * 0009-dix-remove-passive-grabs-referencing-a-device-on-rem.patch * 0010-Xi-add-bounds-check-for-barrier-events-in-input_cons.patch * 0011-Xi-clean-up-gesture-sprite-traces-in-WindowGone.patch ==== xterm ==== Version update (411 -> 412) Subpackages: xterm-bin xterm-resize - update to 412: * improve fix for regex-selection of a wrapped line * correct limits for a partial screen clear operation * amend DECRQM 1046 response to return set when titeInhibit is set * update wcwidth tables to Unicode 18.0.0 * update config.guess and config.sub - Spec cleanup: drop obsolete Group tags, use macros for fonts dir and man extension, use pkgconfig(ncursesw) for the wide-curses dependency ==== xwayland ==== Version update (24.1.13 -> 24.1.14) - Update to version 24.1.14 * security release - supersedes the following patches * 0001-xkb-NULL-text-pointer-after-free-in-_CheckSetDoodad-.patch * 0002-xkb-allocate-names-keys-to-MAP_LENGTH-in-XkbAllocNam.patch * 0003-xkb-widen-size_syms-num_syms-size_acts-num_acts-to-u.patch * 0004-xkb-fix-CheckKeySyms-overwriting-request-range-symsP.patch * 0005-randr-fix-size-and-offset-in-RRChangeProviderPropert.patch * 0006-Xi-validate-modifier-values-in-ProcXIPassiveUngrabDe.patch * 0007-glx-validate-dataBytes-against-cmdlen-in-RenderLarge.patch * 0008-present-unlink-notifies-from-window-list-in-present_.patch * 0009-dix-remove-passive-grabs-referencing-a-device-on-rem.patch * 0010-Xi-add-bounds-check-for-barrier-events-in-input_cons.patch * 0011-Xi-clean-up-gesture-sprite-traces-in-WindowGone.patch * 0012-glamor-size-tmp_bits-buffer-for-source-coordinate-ra.patch ==== zvbi ==== Version update (0.2.45 -> 0.2.46) - update to 0.2.46: * Apply security updates. - fixes CVE-2026-110654 [bsc#1285571] ==== zypp-boot-plugin ==== Version update (0.0.13 -> 0.0.14) - Update to version 0.0.14: * added [packages] section in zypp-boot-plugin.conf * fixed tests for s390 * Drop 8.patch ==== zypper ==== Version update (1.14.101 -> 1.14.102) Subpackages: zypper-needs-restarting - list-patches: Show issue numbers that were not found (bsc#1275036, fixes #655) - Use RunCommand to execute the pager. - security: replace shell-based pager execution with execvp. - patch: Allow to select optional patches by category (bsc#1283249) Explicitly selecting optional patches by --category must imply - -with-optional. Otherwise the without-optional default would sort out the requested patches. - version 1.14.102