Please note that this mail was generated by a script. The described changes are computed based on the aarch64 DVD. The full online repo contains too many changes to be listed here.
Please check the known defects of this snapshot before upgrading: https://openqa.opensuse.org/tests/overview?distri=opensuse&groupid=3&version=Tumbleweed&build=20260617 Please do not reply to this email to report issues, rather file a bug on bugzilla.opensuse.org. For more information on filing bugs please see https://en.opensuse.org/openSUSE:Submitting_bug_reports Packages changed: amarok gtk-vnc libcamera (0.7.0 -> 0.7.1) libnvme (1.16.1 -> 1.16.2) libsoup luajit nvme-cli polkit-default-privs (1550+20260603.7a43683 -> 1550+20260616.1f348eb) python-click (8.3.3 -> 8.4.1) sg3_utils (1.48+13.54da4276 -> 1.48+35.c49e7c08) suitesparse uriparser (1.0.0 -> 1.0.2) === Details === ==== amarok ==== - Add gcc16.patch to fix the broken build with GCC 16 ==== gtk-vnc ==== Subpackages: libgtk-vnc-2_0-0 libgvnc-1_0-0 libgvncpulse-1_0-0 - bsc#1266272 - "virt-manager" is crashing. bsc#1266372 - virt-manager SIGSEGV after few minutes in on_primary_owner_change (.... at ../src/vncdisplay.c:1944 009-let-GLib-manage-the-lifecycle-of-VncDisplay-GObject.patch ==== libcamera ==== Version update (0.7.0 -> 0.7.1) Subpackages: libcamera-base0_7 libcamera0_7 - Update to release 0.7.1 * The software now uses the C++20 dialect. * The "SoftISP" now supports multi-threaded Debaying. * Improved the RKISP1 IPA and Mali-C55 hardware specific code, including for enabling cmaera support on Renesas RZ/V2H and RZ/V2NP platforms. ==== libnvme ==== Version update (1.16.1 -> 1.16.2) Subpackages: libnvme-mi1 libnvme1 - Update to version 1.16.2: * tree: fix nvme_subsystem_scan_namespaces() return handling * fabrics: issue a warning on invalid traddr format (bsc#1248750) * fabrics: sanitize FC traddr (bsc#1248750) * nvme: expose tls mode in use (bsc#1259672) * fabrics: add helper to update tls and concat (bsc#1259672) * tree: avoid updating --tls in nvme_read_sysfs_tls() (bsc#1259672) * fabrics: add additional debug messages for --tls and --concat (bsc#1256043) * fabrics: add error if no dhchap-secret is specified with --concat (bsc#1256043) * fabrics: add error if --tls and --concat are invoked together (bsc#1256043) * fabrics: fix concat during nvme connect-all (bsc#1256043) * tree: Fix potential NULL pointer dereference in nvme_host_get_ids() ==== libsoup ==== Subpackages: libsoup-3_0-0 typelib-1_0-Soup-3_0 - Add libsoup-revert-dep-meson-0.62-part02-fd7ce01a.patch Revert upstream commit fd7ce01a, this request drop methods path() and build_root() which are deprecated on 0.62 but existed in 0.54. - This fix could enable the libsoup update to the latest verion in SLE-15-SP4 and SP5, which fix many CVE bugs. - This fix only enable on SLE-15-SP4 and SP5 in SPEC file. - Add libsoup-revert-dep-meson-0.62-part01-4209dbec.patch: Revert upstream commit 4209dbec, this request bump meson version from 0.54 to 0.62. - This fix could enable the libsoup update to the latest verion in SLE-15-SP4 and SP5, which fix many CVE bugs. - This fix only enable on SLE-15-SP4 and SP5 in SPEC file. - Add libsoup-revert-dep-meson-0.62-shim02-6b34bc58.patch: Revert upstream commit 6b34bc58, this request tell gir that doc-format is gi-docgen, this version() check function requires meson 0.62. - This fix only enable on SLE-15-SP4 and SP5 in SPEC file. - Add libsoup-revert-dep-meson-0.62-shim01-e315cf2d.patch: Revert upstream commit e315cf2d, this request add --quiet and - -warn-all args to gir in meson.build. - This fix only enable on SLE-15-SP4 and SP5 in SPEC file. ==== luajit ==== - riscv64-support.patch: apply bugfix from openresty/luajit2/pull/236#issuecomment-4706366520 ==== nvme-cli ==== Subpackages: nvme-cli-bash-completion - fabrics: add helper to update tls and concat (bsc#1259672) - nvmf-autoconnect: add NetworkManager dispatcher script (jsc#PED-14314) - updated spec: * add 0001-nvmf-autoconnect-add-NetworkManager-dispatcher-scrip.patch * add 0002-fabrics-add-helper-to-update-tls-and-concat.patch * install 80-nvmf-connect-nbft.sh ==== polkit-default-privs ==== Version update (1550+20260603.7a43683 -> 1550+20260616.1f348eb) - Update to version 1550+20260616.1f348eb: * profiles: added new systemd actions (bsc#1267504) ==== python-click ==== Version update (8.3.3 -> 8.4.1) - Update to 8.4.1: * get_parameter_source() is available during eager callbacks and type conversion again. * Zsh completion scripts parse correctly on Windows. * Shell completion of Enum values used as Choice options produces a valid completion result. * Fix empty byte-string handling in echo. * Fix closed file error with echo_via_pager. * Fix open_url on Windows when the file path contains spaces. Version 8.4.0: * ParamType typing improvements. - ParamType is now a generic abstract base class, parameterized by its converted value type. - ~ParamType.convert return types are narrowed on all concrete types (str for STRING, int for INT, etc.). - ~ParamType.to_info_dict returns specific ~typing.TypedDict subclasses instead of dict[str, Any]. - CompositeParamType and the number-range base are now generic with abstract methods. * Refactor convert_type to extract type inference into a private _guess_type helper, and add typing.overload signatures. * Parameter typing improvements. - Parameter is now an abstract base class, making explicit that it cannot be instantiated directly. - Parameter.name is now str instead of str | None. When expose_value=False, the name is set to "" instead of None. - The ctx parameter of Parameter.get_error_hint is now typed as Context | None, matching the runtime behavior. * Split string values from default_map for parameters with nargs > 1 or Tuple type, matching environment variable behavior. * Auto-detect type=UNPROCESSED for flag_value of non-basic types (not str, int, float, or bool), so programmer-provided Python objects like classes and enum members are passed through unchanged instead of being stringified. Previously type=click.UNPROCESSED had to be set explicitly. * The error hint now uses Command.get_help_option_names to pick non-shadowed help option names, so Try '... -h' no longer points to a subcommand option that shadows -h. The longest surviving name is shown (--help over -h) for readability. * Fix readline functionality on non-Windows platforms. Prompt text is now passed directly to readline instead of being printed separately, allowing proper backspace, line editing, and line wrapping behavior. * Use os.startfile on Windows to open URLs in open_url, replacing the start built-in which cannot be invoked without shell=True. * Fix Fish shell completion errors when option help text contains newlines. * Add NoSuchCommand exception with suggestions for misspelled commands. * Use ValueError message when conversion in FuncParamType would fail. * Add click.get_pager_file for file-like access to an output pager. * ~click.formatting.wrap_text now measures line width in visible characters, ignoring ANSI escape sequences. * Fix HelpFormatter.write_usage emitting only a blank line when called without args. The usage prefix and program name are now written even when no arguments follow, and the trailing separator space is stripped so the line ends at the program name. * Show custom error messages from types when prompt with hide_input=True fails validation, instead of always showing a generic message. Built-in type messages mask the input value. * Add capture parameter to CliRunner with two modes: sys (default) and fd. fd redirects file descriptors 1 and 2 via os.dup2 so output that bypasses sys.stdout (stale stream references, C extensions, subprocesses, faulthandler) is captured with proper isolation. * Revert the 8.3.3 change that exposed the original file descriptor via fileno() on the redirected CliRunner streams in the default capture mode. os.dup2(w, sys.stdout.fileno()) calls inside a CLI no longer mutate the host runner's stdout, which broke Pytest's fd-level capture teardown. C-level consumers that need a real fd should use capture="fd". * Mark additional built-in strings with gettext() to extend translation coverage. * Fix feature switch groups (several flag_value options sharing one parameter name) silently dropping an explicit default when a sibling option without an explicit default was declared first. Arbitration is now source-aware: a more explicit ParameterSource always wins, and within ParameterSource.DEFAULT, an option that received an explicit default= keyword wins over a sibling whose default was auto-derived. The 8.3.x first-wins fallback for remaining ties was reverted to the pre-8.3.x last-wins fallback. * Fix missing space between option help text and the (DEPRECATED) label, and localize the option label so it matches the command label. The label and the DeprecationWarning reason suffix are now produced by shared helpers. * Document short option stacking (-abc is parsed as -a -b -c) and clarify that multi-character short option names are not supported. ==== sg3_utils ==== Version update (1.48+13.54da4276 -> 1.48+35.c49e7c08) Subpackages: libsgutils2-1_48-2 - Update to version 1.48+35.c49e7c08: * configure.ac: reset version to 1.48 - Update to version 1.48+34.3c93ead5 - sg_inq: --export output conformance for SCSI name string and ATA fields (github: PR #83) (bsc#1267823, gh#doug-gilbert/sg3_utils#83) - Upstream fixes backported (bsc#1268201): * sg_logs: correct tape Device statisitics lpage [0x14] serial number parameters [0x40 and 0x41] per https://github.com/doug-gilbert/sg3_utils/issues/45 * sg_wr_mode: fix --contents and --cfile= handling; https://github.com/doug-gilbert/sg3_utils/issues/40 * rescan-scsi-bus.sh: github issue #76 a few shellcheck fixes; scsi_logging_level: add MIT license Xose Vazquez Perez; sg_ses: restore some help text, github PR #79 Paul Evans * sg_ses: re-add help description lost in v1.48 restructure * utils/hxascdmp: sprintf --> snprintf [From: orbisai0security <[email protected]>] * rescan-scsi-bus.sh: fix broken command existence checks for dmsetup and multipath * rescan-scsi-bus.sh: quote $id_serial in findmultipath call * sg_copy_results: bound device-reported sense data length to buffer size * sg_xcopy: fix undefined behaviour and out-of-bounds read * sginfo: set MODE SENSE(10) response length to buffer size * sg_vpd_vendor: fix buffer overflows from device-controlled data * rescan-scsi-bus.sh: Immediately check removable in testonline() * rescan-scsi-bus.sh Replace 'which' with build in 'command -v' * rescan-scsi-bus.sh Correctly read RMB bit on enquiry * sg_ses: fixed AES EI validation when EIIOE=1 * sg_logs: Fix parameter lengths in show_data_compression_page * configure.ac: Fix the getrandom() test * [PATCH 2/2] ci: Use the latest version of the Android NDK * [PATCH 1/2] Unbreak the Android build * sg_inq: fix indentation in std_inq_decode sgj_pr_hr strings (match main) ==== suitesparse ==== Subpackages: libamd3 libcamd3 libccolamd3 libcholmod5 libcolamd3 libsuitesparseconfig7 libumfpack6 - Don't build with openblas for SLE 16.1 ==== uriparser ==== Version update (1.0.0 -> 1.0.2) - Update to version 1.0.2: * Fixed: [CVE-2026-44927, bsc#1264578] Stop truncating ptrdiff_t to int * Fixed: [CVE-2026-44928, bsc#1264579] Fix EqualsUri with regard to .absolutePath * Fixed: [CVE-2026-42371, bsc#1262999] Protect from integer overflow in text range comparison * Fixed: Fix OOM related memory leak in CopyUriMm * Improved: Simplify internal function CompareRange into RangeEquals * Improved: Make function RangeEquals use size_t internally - cmake_fixes.patch: fix compilation with newer GTest
