Please note that this mail was generated by a script. The described changes are computed based on the aarch64 DVD. The full online repo contains too many changes to be listed here.
Please check the known defects of this snapshot before upgrading: https://openqa.opensuse.org/tests/overview?distri=opensuse&groupid=3&version=Tumbleweed&build=20260622 Please do not reply to this email to report issues, rather file a bug on bugzilla.opensuse.org. For more information on filing bugs please see https://en.opensuse.org/openSUSE:Submitting_bug_reports Packages changed: bash (5.3.9 -> 5.3.15) blog (2.40 -> 2.42) dracut (110+suse.32.g36b00ba7 -> 110+suse.35.g9834432) file-roller (44.6 -> 44.7) gstreamer-plugins-bad (1.28.4 -> 1.28.4+24) libbacktrace (1.0+git20250210 -> 1.0+git20260601) libstorage-ng (4.5.331 -> 4.5.334) lrzip (0.651 -> 0.660) openSUSE-release (20260619 -> 20260622) patterns-base patterns-fonts transmission wireplumber (0.5.14 -> 0.5.15) xscreensaver === Details === ==== bash ==== Version update (5.3.9 -> 5.3.15) Subpackages: bash-loadables bash-sh - Add upstream patches * Bash-5.3 Official patch 10 -- bash53-010 Under some circumstances, a subshell or asynchronous job with an active EXIT trap that contains a call to `wait' can loop trying to wait for processes that are not its children. It usually inherits these jobs from its parent in the jobs list. * Bash-5.3 Official patch 11 -- bash53-011 If a `mapfile' callback unsets the array variable `mapfile' is using to save the lines it reads, `mapfile' can try to reference freed memory, which can cause corruption or shell crashes. * Bash-5.3 Official patch 12 -- bash53-012 If a subshell with an inherited EXIT trap receives a fatal signal before it clears the exit trap, and before it restores its original signal handlers, it's possible for it to inappropriately run the inherited EXIT trap. * Bash-5.3 Official patch 13 -- bash53-013 Comparing the value of a pointer returned from realloc/xrealloc to the original pointer passed is technically undefined behavior, which matters under some circumstances. * Bash-5.3 Official patch 14 -- bash53-014 Bash-5.3 patch 11 included an inadvertent extra line, which this patch removes. This also takes the opportunity to improve that patch, by looking up the variable each time through the line-reading loop only if there is a callback and it is invoked. * Bash-5.3 Official patch 15 -- bash53-015 There are circumstances under which index -1 is used to reference into the input buffer used by the `read' builtin. ==== blog ==== Version update (2.40 -> 2.42) Subpackages: libblogger2 - Update to version 2.42 Fix possible memory leaks, eliminate type punning, and resolve I/O blocking This update implements a series of systemic improvements to stability, security, and performance: 1. Memory Safety & Leak Resolution: - Implemented lcons_shutdown destructor to automatically purge the console list and close FDs on exit. - Fixed password buffer leak by using in closeIO, correctly matching the mmap allocation in shm_malloc. - Added cleanup for pwprompt in closeIO. 2. Elimination of Dangerous Type Punning: - Replaced the unreliable &cons->node pattern with a type-safe list_t lcons sentinel across the codebase. - Added __attribute__((may_alias)) to list_t in listing.h to prevent compiler strict aliasing optimizations from corrupting list traversals. 3. I/O Responsiveness & Stability: - Removed tcdrain() from the high-frequency epoll_console_in path to eliminate daemon freezes during heavy output. - Updated consinitIO to ensure CON_SERIAL devices remain in O_NONBLOCK mode, preventing freezes on slow serial lines. - Extended the tcdrain skip-list in closeIO to include CON_SERIAL, ensuring a hang-free shutdown. 4. Architectural Improvements: - Redesigned shm_malloc to use a tiered mapping strategy: prefers file-backed shared memory in /dev/shm with a graceful fallback to MAP_ANONYMOUS. - Optimized listing.h with always_inline attributes, __builtin_prefetch for cache efficiency, and list poisoning for safer debugging. - Update to version 2.41 * The __attribute__((noreturn)) for error() in libconsole.h added * The variable err with 0 initialized in thread_poll() * The variable cp.parity with {0} initialized in readpw() * feat(blogd): handle pending systemd password requests on coldstart * Initialize console pointer list as well * Check peer credentials before reading command * Make isinteger() string check usable for all architectures * Add some comments about warnings and translation for S390 ==== dracut ==== Version update (110+suse.32.g36b00ba7 -> 110+suse.35.g9834432) - Update to version 110+suse.35.g9834432: * fix(fips): handle zipl (bsc#1262515) * fix(network-legacy): sanitize DHCP values in dhclient-script.sh (bsc#1268322, CVE-2026-6893) * fix(network-legacy): add input validation to RFC 3442 route parser ==== file-roller ==== Version update (44.6 -> 44.7) - Update to version 44.7: + Bugfixes: - New Archive Dialog: allow input of an absolute path directly. - Check line length when parsing command output. - Java Utils: make sure the package name respects the max size. - Metainfo: Add screenshot caption. - Flatpak Improvements: remove zstd module; improve cleanup command; replace p7zip with 7zip; reduce libportal features; modernize manifest. + Updated translations. ==== gstreamer-plugins-bad ==== Version update (1.28.4 -> 1.28.4+24) Subpackages: libgstadaptivedemux-1_0-0 libgstanalytics-1_0-0 libgstbadaudio-1_0-0 libgstbasecamerabinsrc-1_0-0 libgstcodecparsers-1_0-0 libgstcodecs-1_0-0 libgstcuda-1_0-0 libgsthip-1_0-0 libgstinsertbin-1_0-0 libgstisoff-1_0-0 libgstmpegts-1_0-0 libgstmse-1_0-0 libgstphotography-1_0-0 libgstplay-1_0-0 libgstsctp-1_0-0 libgsturidownloader-1_0-0 libgstva-1_0-0 libgstvulkan-1_0-0 libgstwayland-1_0-0 libgstwebrtc-1_0-0 libgstwebrtcnice-1_0-0 - Update to version 1.28.4+24 (boo#1268406, boo#1268408, boo#1268410, CVE-2026-52720, CVE-2026-52721, CVE-2026-52722): + mxfdemux: fix remaining offsets index entry insertion call site + mxfdemux: fix essence track offsets array population + mxdemux: index entry: use intialized + rtmp2: Remove socket timeout after handshake completes + rtmp2: Don't retry on G_IO_ERROR_TIMED_OUT + vnmdec: Avoid integer overflows when rectangle positions and sizes + pcapparse: Add missing bounds checks to ensure packets are large enough + mpegpsdemux: Release stream lock when seeking fails + librfb: Validate framebuffer update rectangles against the framebuffer size ==== libbacktrace ==== Version update (1.0+git20250210 -> 1.0+git20260601) - Update to version 1.0+git20260601: * libbacktrace: support compressed block with no sequences * libbacktrace: Fix typos in various files * libbacktrace: support multiple zstd frames * libbacktrace: don't use ZSTD_CLEVEL_DEFAULT * Update copyright years. * Update copyright years. * libbacktrace: use correct names in #undef of ELF macros * libbacktrace: recognize PE bigobj objects at configure time * libbacktrace: Add hpux fileline support * bootstrap/119680 - fix cross-compiler build with --enable-host-shared * libbacktrace: Use correct type in backtrace_atomic_store_int ==== libstorage-ng ==== Version update (4.5.331 -> 4.5.334) Subpackages: libstorage-ng-lang libstorage-ng-ruby libstorage-ng1 - merge gh#openSUSE/libstorage-ng#1082 - updated swig template definitions - 4.5.334 - merge gh#openSUSE/libstorage-ng#1081 - fixed build on SLE 15 - 4.5.333 - merge gh#openSUSE/libstorage-ng#1080 - improved usleep function - improved memory handling - improved error reporting - use RAII for pid of child - 4.5.332 ==== lrzip ==== Version update (0.651 -> 0.660) - Update to version 0.660: * Do not clean up thread structures in decompression failure conditions, fixing a use-after-free in lzma_decompress_buf() and a NULL pointer dereference in ucompthread() on corrupt/malicious archives (CVE-2025-15570, boo#1258016; CVE-2025-15571, boo#1258023) * Handle -L given without a parameter, fixing a NULL pointer dereference (CVE-2025-9396, boo#1248598) * Add write bounds checking in libzpaq and sanity checks for maliciously encoded headers and oversized allocations * Various STDIO, portability and build fixes (OpenBSD support, non-x86 zpaq, autoconf warnings); drop Doxygen doc build - Switch Source to the upstream GitHub release tarball (0.660 is not published on ck.kolivas.org) and run autoreconf at build time - Drop fixasmstack.patch (merged upstream) ==== openSUSE-release ==== Version update (20260619 -> 20260622) Subpackages: openSUSE-release-appliance-custom openSUSE-release-dvd - automatically generated by openSUSE-release-tools/pkglistgen ==== patterns-base ==== Subpackages: patterns-base-apparmor patterns-base-base patterns-base-basesystem patterns-base-basic_desktop patterns-base-console patterns-base-enhanced_base patterns-base-minimal_base patterns-base-selinux patterns-base-sw_management patterns-base-x11 patterns-base-x11_enhanced - Disambiguate 32bit patterns and x11 patterns summaries (bsc#1267854) ==== patterns-fonts ==== Subpackages: patterns-fonts-fonts patterns-fonts-fonts_opt - Disambiguate fonts and fonts_opt pattern summaries (bsc#1267854) ==== transmission ==== Subpackages: transmission-common transmission-gtk - Add arm to ExcludeArch, 32bit arm does not build either. ==== wireplumber ==== Version update (0.5.14 -> 0.5.15) Subpackages: libwireplumber-0_5-0 wireplumber-bash-completion - Update to version 0.5.15: * Additions & Enhancements: - Added new WpPermissionManager API that centralizes access control for clients, with support for attaching permission managers to clients from Lua scripts; the client access scripts have been completely refactored to use the new API with a select-access event and a priority fallback mechanism: configuration, flatpak, snap, portal, and default (!797 (merged), !822 (merged), !825 (merged)) - Added new WpStateMetadata class that mirrors the persistent state into a PipeWire metadata object, allowing users to clear or change saved device profiles at runtime using pw-metadata (!818 (merged)) - Added set_param(), enum_params_sync() and params-changed signal to WpSpaDevice, and an event signal for SPA device events, allowing monitors to directly interact with SPA devices and react to profile changes without going through the global WpDevice object (!835 (merged), !842 (merged)) - Added list subcommand to wpctl for displaying PipeWire objects in a script-friendly format, with bash completions (!805 (merged), !823 (merged)) - Added reset command to wpctl to reset the state of WirePlumber and PipeWire to installation defaults (!848 (merged), !849 (merged)) - Enhanced wpctl to connect to the manager socket when available, giving the tool unrestricted access to the PipeWire graph (!814 (merged)) - Added new bluetooth.profile-preference setting to find-preferred-profile for selecting quality or latency A2DP profiles (!819 (merged)) - Added a cache for camera permission checks in the portal access module to avoid frequent D-Bus calls; also added a 3-second timeout and fixed the Set create parameter in portal-permissionstore (!820 (merged), !821 (merged)) * Fixes: - Fixed wpctl set-volume by PID to apply the same volume level to all matching nodes (#944 (closed); !829 (merged)) - Fixed portal clients to be un-gated immediately after permission setup, preventing them from remaining blocked (#941 (closed); !826 (merged)) - Fixed ALSA monitor to set the device profile to Off and restore it when a node enters an error state, forcing a close/reopen of the device to recover from broken ALSA device states (!837 (merged)) - Fixed voice call profile selection to not skip profiles with unknown availability (!834 (merged)) - Fixed memory leak in Lua scripting by only holding a strong reference of the Lua state when a script is activated, preventing leaked proxy warning messages on core disconnect (!844 (merged)) - Fixed state-stream to only use the media.role key when its value is Notification when forming the stream state lookup key (!845 (merged)) - Fixed pw-obj-mixin to apply the active filter when enumerating cached params and to deduplicate subscribed param IDs (!839 (merged), !840 (merged)) - Fixed m-lua-scripting to validate Bool values in Pod.Choice.Enum (!841 (merged)) - Fixed shutdown sequence to properly deactivate all objects and plugins before teardown (#881; !833 (merged)) - Fixed Bluetooth to not set bluez5.autoswitch-routes on BT devices (!811 (merged)) - Fixed null pointer dereference in permission-manager (!812 (merged)) - Fixed module destructor ordering to call the parent destructor before finalizing internal state (!813 (merged)) - Fixed nil value when logging in state-profile (!815 (merged)) - Fixed gobject-introspection issue on spa-pod to correctly generate Python bindings (!828 (merged)) - Updated translations: Chinese, Serbian, Serbian Latin ==== xscreensaver ==== Subpackages: xscreensaver-data xscreensaver-lang - Add xscreensaver-screenfade.patch: don't abort in openGL_context_for_window. Callers (e.g. the screen fade) treat a NULL return as "GL is unavailable" and fall back gracefully
