Please note that this mail was generated by a script. The described changes are computed based on the aarch64 DVD. The full online repo contains too many changes to be listed here.
Please check the known defects of this snapshot before upgrading: https://openqa.opensuse.org/tests/overview?distri=opensuse&groupid=3&version=Tumbleweed&build=20260714 Please do not reply to this email to report issues, rather file a bug on bugzilla.opensuse.org. For more information on filing bugs please see https://en.opensuse.org/openSUSE:Submitting_bug_reports Packages changed: GraphicsMagick apache2-mod_php8 (8.5.7 -> 8.5.8) bash blog (2.45 -> 2.46) busybox (1.37.0 -> 1.38.0) busybox-links (1.37.0 -> 1.38.0) checkpolicy (3.10 -> 3.11) chrony cifs-utils (7.6 -> 7.7) cryptsetup erofs-utils (1.8.10 -> 1.9.2) ethtool (7.0 -> 7.1) freerdp (3.27.1 -> 3.28.0) freetype2 (2.14.2 -> 2.14.3) gimp grub2 gstreamer (1.28.4 -> 1.28.5) gstreamer-plugins-bad (1.28.4+24 -> 1.28.5) gstreamer-plugins-base (1.28.4 -> 1.28.5) gstreamer-plugins-good (1.28.4 -> 1.28.5) gstreamer-plugins-rs (1.28.4 -> 1.28.5) gstreamer-plugins-ugly (1.28.4 -> 1.28.5) ibus (1.5.33 -> 1.5.34) ibus_gtk4 (1.5.33 -> 1.5.34) kernel-firmware-amdgpu (20260614 -> 20260629) kernel-firmware-bluetooth (20260618 -> 20260629) kernel-firmware-i915 (20260610 -> 20260706) kernel-firmware-iwlwifi kernel-firmware-media (20260610 -> 20260706) kernel-firmware-mediatek (20260619 -> 20260629) kernel-firmware-nvidia kernel-firmware-platform (20260610 -> 20260629) kernel-firmware-qcom (20260619 -> 20260629) kernel-firmware-realtek (20260614 -> 20260629) kernel-firmware-sound (20260618 -> 20260706) libcamera (0.7.1 -> 0.7.2) libdovi (3.3.2 -> 3.4.0) libphonenumber (9.0.33 -> 9.0.34) libpsl (0.22.0 -> 0.23.0) libseccomp (2.6.0 -> 2.6.1) libselinux (3.10 -> 3.11) libselinux-bindings (3.10 -> 3.11) libsemanage (3.10 -> 3.11) libsepol (3.10 -> 3.11) libxml2 openSUSE-release (20260709 -> 20260714) openblas_openmp openblas_pthreads permissions (1699_20260512 -> 1699_20260707) php8 (8.5.7 -> 8.5.8) policycoreutils (3.10 -> 3.11) postfix (3.11.4 -> 3.11.5) publicsuffix (20260622 -> 20260708) python-Pillow (12.2.0 -> 12.3.0) python-semanage (3.10 -> 3.11) qemu (10.2.2 -> 11.0.2) sdbootutil (1+git20260506.25d47bf -> 1+git20260714.d9bb736) selinux-policy (20260618 -> 20260702) spice-gtk timezone (2026b -> 2026c) wget wpa_supplicant xrdb (1.2.2 -> 1.2.3) xset (1.2.5 -> 1.2.6) xsetroot (1.1.3 -> 1.1.4) === Details === ==== GraphicsMagick ==== Subpackages: libGraphicsMagick++-Q16-12 libGraphicsMagick-Q16-3 libGraphicsMagick3-config - added patches CVE-2026-13606: memory corruption via crafted Photo CD (PCD) file [bsc#1269891] * GraphicsMagick-CVE-2026-13606.patch ==== apache2-mod_php8 ==== Version update (8.5.7 -> 8.5.8) - fix build with GCC 16 (gh#php/php-src#22206) [boo#1267259] - added patch + php-fix-build-gcc16.patch - use system liburiparser [bsc#1270538] [bsc#1270539] - version update to 8.5.8 (CVE-2026-14355 [bsc#1270351]) CLI: Fixed bug GH-21901 (Stale getopt() optional value). Date: Fixed bug GH-18422 (int overflow in php_date_llabs). DOM: Fixed bug GH-22077 (UAF in custom XPath function). Opcache: Fixed tracing JIT crash when a VM interrupt is handled during an observed user function call. Fixed bug GH-21746 (Segfault with tracing JIT). Fixed bug GH-22004 (Assertion failure at ext/opcache/jit/zend_jit_trace.c). Fixed tailcall VM crash when a VM interrupt is handled from a VM helper. OpenSSL: Fix compatibility issues with OpenSSL 4.0. Standard: Fixed bug GH-21689 (version_compare() incorrectly handles versions ending with a dot). URI: Fixed CVE-2026-44927 (In uriparser before 1.0.2, there is pointer difference truncation to int in various places). (CVE-2026-44927) Fixed CVE-2026-44928 (In uriparser before 1.0.2, the function family EqualsUri can misclassify two unequal URIs as equal). (CVE-2026-44928) - Revert changes for building with GCC 16 ==== bash ==== Subpackages: bash-loadables bash-sh - Add workaround for msginit which ignores SOURCE_DATE_EPOCH (boo#1268542) ==== blog ==== Version update (2.45 -> 2.46) Subpackages: libblogger2 - Update to version 2.46 Implement Plymouth-compatible display-message and hide-message commands This commit adds support for the display-message and hide-message Plymouth commands, allowing external tools to print status updates directly to the boot console via blogctl. Key changes: Add MAGIC_SHOW_MSG and MAGIC_HIDE_MSG protocols to blogctl and parse the --text= argument using getopt_long_only(). Broadcast display-message payloads to all active hardware consoles via c->out() to ensure immediate visual feedback, while simultaneously logging it to /var/log/boot.log via copylog(). Add \r\n line endings to printed messages to prevent the staircase effect on serial terminals operating in raw mode. Handle hide-message as a visual no-op (replying with an ACK only) to deliberately avoid ANSI clear-screen sequences that would corrupt the output on line-based, half-duplex consoles like the s390x 3215. Update the blogctl.8 manual page to document the new commands and their specific behavior regarding screen clearing. Implement Plymouth-compatible ask-for-password and ask-question commands This commit extends blogctl to act as a lightweight, fully functional replacement for Plymouth's interactive prompt commands, allowing scripts to securely ask for passwords or questions on the system console. Key changes: Add support for ask-for-password and ask-question in blogctl. Use getopt_long_only() to robustly parse GNU-style long options (--prompt, --command, --number-of-tries, --dont-pause-progress). Offload the retry-loop and command execution (popen) entirely to the blogctl client, keeping the blogd daemon simple and secure. Fix an epoll EEXIST crash in console.c by separating the daemon's process state (asking) from the requested prompt type (ask_mode), resolving a race condition during socket handler registration. Comply strictly with the Plymouth protocol: enforce 1-byte prompt length limits, handle little-endian length headers (le32toh), and ensure null-terminated payloads via asprintf. Update the blogctl.8 manual page to document the new commands. Back to use constructor for initial seed for the process lifetime and inherited across fork() Make tty wait logic real and fix SIGHUP/inotify cleanup Better in-memory reversible obfuscation for cached passwords This is not cryptographic protection against a memory-reading attacker. It is only meant to avoid trivial/plaintext exposure in memory. Fix resource leaks and harden IPC validations This commit addresses several issues found by static code analysis, focusing on memory hygiene, file descriptor management, and robust error handling. Key changes: Fix memory and file descriptor leaks in error paths (proc.c, shm.c, tty.c) and ensure all pending coldstart requests are freed on shutdown. Harden the systemd ask-password interface by adding boundary checks for UNIX socket paths, verifying sendto payloads, and gracefully handling missing directories during early boot without fatal errors. Improve IPC protocol safety by strictly validating the MAGIC_CHROOT argument (must be an absolute path) and sending an explicit NACK on failure. Prevent stale terminal states on s390x by clearing the VMCP cache prior to parsing a new QUERY TERMINAL reply. User the --wait option of the blogctl quit command Add an --wait option specially for quit of blogctl Fix gh##7 setting blog.silent=true causes it to be non-silent Make shared library a executable Refactor daemon to use synchronous signalfd and epoll event loop This commit migrates the core architecture from traditional, asynchronous signal handling to a modern, synchronous event loop using signalfd. By integrating signal handling directly into the epoll multiplexer, we eliminate race conditions, unexpected EINTR interruptions during I/O operations, and complex reentrancy issues. Key changes: Add setup_signalfd() to block essential signals (SIGINT, SIGQUIT, SIGTERM, SIGSYS, SIGIO, SIGCHLD) globally and route them through a dedicated file descriptor monitored by epoll. Shield epoll_pwait() using a fully populated signal mask (omask) to guarantee uninterrupted I/O processing. Prevent socket handlers (MAGIC_SYS_INIT, MAGIC_CLOSE) from accidentally unblocking signals and resetting dispositions when signalfd is active. Sanitize the inherited signal mask in forked child processes (e.g., systemd password prompts on tty) by resetting it to an empty mask via sigprocmask(), ensuring agents run without restrictions. Replace the ALIGNED_SIZEOF macro with a cleaner align_up(type, boundary) macro and fix memset() sizes to correctly zero out trailing padding bytes. Update the Makefile to compile a stripped-down fallback object (signals_stripped.o compiled with -DNO_SIGNALFD) to ensure the passive libblogger.so library remains unaffected by the signalfd architecture. Some minor changes in quit and umount unit services The HVC consoles are like sclp console and can do colours as well - Silent some rpmlint warnings ==== busybox ==== Version update (1.37.0 -> 1.38.0) Subpackages: busybox-static - Update to version 1.38.0: * New applets: sha384sum, vmstat, ssl_server, lsblk, uuidgen * Security: Disallow path traversals in archival (CVE-2023-39810) * archival: Sanitize filenames on output to prevent control sequence attacks * ash/hush: Implement <<< here_string syntax and improve bash compatibility * libbb: Add yescrypt password hashing support * tls: Implement server-side code and support ECDHE_RSA * httpd: Add connection limits (-M), POSTDATA read timeouts, and CGI logging * telnet/telnetd: Rewrite to use generic fd polling and I/O loop * cut: Major fixes for empty delimiters, ranges, and output-delimiter support * cp: Fix 'cp -aT' overwriting symlink to directories * fdisk: Fix GPT disk size overflow and add 4K sector size support * top: Reduce flicker and show RSS instead of VIRT by default * udhcpc6: Fix potential buffer overflow * many other small fixes and optimizations - Remove patches included in the new version: * busybox-1.37.0-fix-conditional-for-sha1_process_block64_shaNI.patch * busybox-1.37.0-fix-regression-n2.patch * busybox-1.37.0-hexdump-add-tests-for-x-handle-little-big-endian-pro.patch * busybox-1.37.0-hexdump-fix-regression-for-uint16-on-big-endian-syst.patch * busybox-1.37.0-od-make-B-test-little-endian-only-add-variant-for-bi.patch * 0001-archival-libarchive-sanitize-filenames-on-output-pre.patch * 0001-nsenter-unshare-don-t-use-xvfork_parent_waits_and_ex.patch * 0001-tar-strip-unsafe-hardlink-components-GNU-tar-does-th.patch * 0002-tar-only-strip-unsafe-components-from-hardlinks-not-.patch * 0001-udhcpc6-fix-buffer-overflow.patch * 0002-udhcpc6-check-the-size-of-D6_OPT_IAPREFIX-option.patch ==== busybox-links ==== Version update (1.37.0 -> 1.38.0) Subpackages: busybox-coreutils busybox-diffutils busybox-ed busybox-findutils busybox-gawk busybox-grep busybox-gzip busybox-man busybox-psmisc busybox-sed busybox-which busybox-xz - Adapt to busybox 1.38, new applets: sha384sum, ssl_server, vmstat, lsblk, uuidgen - Keep passwd in shadow package (it was split in shadow-pw-mgmt in the full featured version) ==== checkpolicy ==== Version update (3.10 -> 3.11) - Update to version 3.11 https://github.com/SELinuxProject/selinux/releases/tag/3.11 - User-visible changes: - Fixed checkpolicy handling of out-of-range and complement at range boundaries for xperm rules (#530, #531). - Dropped legacy fscon statement support from checkpolicy - never used in SELinux policies for mainline kernels (#518). - Development-relevant changes: - Reformatted entire tree based on .clang-format and added new check-format/format make targets to check and/or reformat code to match. This is now a requirement for new patches. - Test fixes - Notable Bugfixes: - checkpolicy: remove unneeded malloc() casts - checkpolicy: add missing strdup() failure checks - checkpolicy: use calloc() so no need to do memset() - checkpolicy: replace malloc()+memset() with calloc() ==== chrony ==== Subpackages: chrony-pool-openSUSE - boo#1257934: support libnettle 4.0 (chrony-libnettle4.patch). ==== cifs-utils ==== Version update (7.6 -> 7.7) Subpackages: wb-cifs-idmap-plugin - Update cifs-utils to 7.7: * cifs.upcall: fix regression with krb5 + creduid * cifs.upcall: Avoid int overflow after year 2038 * mount.cifs: fix const correctness in parse_options * cifs.upcall: fix compiler warning with -Wvla * smbinfo: parse action and filename from change notifications ==== cryptsetup ==== Subpackages: cryptsetup-doc libcryptsetup12 - Fix for (bsc#1270254) to avoid undesired pinning of all volume keys (via the thread keyring) through the caller's credentials when the kernel opens a file. This is due to the refactoring in kernel commit a28d893eb327 ("md: port block device access to file") that accidentally causes the caller's thread keyring to be kept alive long beyond the caller's lifetime, the kernel part is tracked in (bsc#1270252). * Add keyring key type. [b6fb6fc0] * Load volume keys in intermediary keyring linked in thread keyring. [413a3dd0] * Use unique intermediary keyring name per device. [04ef07a7] * Add regression tests. [bfcb0c38, bb5e8e9f, e6573494, aa214c09] * Add upstream patches: - cryptsetup-Add-keyring-key-type.patch - cryptsetup-Load-volume-keys-in-intermediary-keyring-linked-in-t.patch - cryptsetup-Use-unique-intermediary-keyring-name-per-device.patch - cryptsetup-tests-revoke-keys-instead-unlinking-from-thread-keyr.patch - cryptsetup-tests-verify-VK-and-internal-keyring-cleanup-after-p.patch - cryptsetup-tests-refactor-keyring-helpers.patch - cryptsetup-tests-verify-intermediary-keyring-cleanup-after-cryp.patch ==== erofs-utils ==== Version update (1.8.10 -> 1.9.2) - Update to release 1.9.2 * Add 48-bit layout support for larger filesystems * Add metadata compression support * mkfs: Enable image creation from S3 storage and OCI registries * Implement an external mount helper for mounting remote EROFS filesystems * mount: Add support for mounting EROFS-native layers in OCI regs * mkfs: Support directory compression via the `--zD` option * mkfs: Enable isolated metadata zones to concentrate inodes and directories using the `--MZ` option * mkfs: Support customized lc,lp,pb properties for LZMA * mkfs: Add the `--xattr-inode-digest` option to enable page cache sharing by generating per-inode fingerprints * erofsfuse: Synchronize kernel patches to fix encoded extents and shared xattrs in the metabox * mkfs: Do not set LZ4_0PADDING for plain filesystems * fsck: Support extracting subtrees * mount: Fix a flag-clearing bug that can cause mount failures * mkfs: Fix a CPU spin that occurred when using `--tar=f` in conjunction with a closed stdin * mkfs: Fix crashes in the rebuild mode when the source images contains xattrs * mount: Add support for mounting EROFS images stored as S3 objects * mkfs: Add FULLDATA rebuild support for combining multiple layered EROFS filesystems * mount: Add support for Fanotify and UBLK backends * mkfs, tarerofs: Support inode digest generation when using `--sort=none` ==== ethtool ==== Version update (7.0 -> 7.1) - Update to release 7.1 * Added netlink support for RX CQE Coalescing params * netlink: module-eeprom: Add 'hex on pages on' option for page-organized hex dump * netlink: fec: Add missing newlines in FEC statistics output * ethtool: Add man page and bash completion for 'pages on|off' * ethtool: Update pause stats struct * ethtool: Add --disable-netlink to help output * qsfp: add support for newer SFF-8636 compliance codes * sfpid: add support for newer SFF-8472 compliance codes * sfpid: fix 10G Base-ER module detection - Delete bf023af442f63e16f1699128c7ce467eddc6d340.patch, d35d87fbcda97fe31df79d62277743214641892a.patch (merged) ==== freerdp ==== Version update (3.27.1 -> 3.28.0) Subpackages: libfreerdp3-3 librdtk0-0 libwinpr3-3 - Update to version 3.28.0: + Feature and bugfix release. * iOS client has been revived by @bho3538 * Android client build updates by @svncibrahim * Windows client did get some updates by @zorjen122 * Server side smartcard API by @joantolo * Improved client statistics interface, now also supports static channels * Improved fuzzer and unit tests * CMake preset support making it easier to create a working build configuration, see https://github.com/FreeRDP/FreeRDP/wiki/Compilation#presets + CVE fixes: * CVE-XXXX-XXXXX (GHSA-pjqx-v446-x7fc) * CVE-XXXX-XXXXX (GHSA-9g22-w2gr-vcmp) * CVE-XXXX-XXXXX (GHSA-f27x-frr8-j9hc) * CVE-XXXX-XXXXX (GHSA-72j9-356v-88xq) * CVE-XXXX-XXXXX (GHSA-v64m-xxfw-hrv6) * CVE-2026-57158 * CVE-2026-57157 * CVE-2026-57156 + Changes: * feat(client): Modernize iOS client. (iFreeRDP) (#12949) * [client,ios] remove some deprecation warnings (#12981) * Ios cmake (#12997) * [client,ios] add openh264 build (#13003) * [client,android] riscv64 support (#12923) * [client,android] make release configurable (#12929) * [client,android] allow overriding version name and code (#12931) * [client,android] redesign touch pointer (#12946) * [client,android] move external deps to own CMake file (#12992) * Android build (#12917) * [client,sdl] guard file clipboard (#12911) * [client,sdl] Askpass (#12925) * [client,sdl] throw a real exception instead of invalid bare throw (#12936) * [client,sdl] run sdl_OnUserNotificationEventHandler on SDL thread (#12941) * [client,sdl] fix mouse and touchpad natural scroll setting being ignored (#12967) * fix(client/win) Reset scroll offset when hiding scrollbars (#7536) (#12939) * feat(client/win): improve wfreerdp fullscreen floatbar controls (#12851) * Channel stats (#12964) * Statistics interface (#12968) * [core,channels] add freerdp_static_client_channel_stat_free (#12966) * Support RDPDR Device Control Responses (#12756) * Wlog appender context (#12907) * [winpr,image] bound unaligned bitmap read to declared image size (#12910) * [codec,color] add empty checks for copy (#12912) * Win credssp (#12913) * Adjustments for building on Windows with MSVC (#12916) * channel statistics and random gateway connection id (#12922) * [channels,video] bound frame copy to current surface size (#12919) * OSS-Fuzz: Add new fuzzers targets channels rail client (#12924) * [utils,smartcard] validate cbAtr against rgbAtr size on unpack (#12928) * [channels,rdpecam] fix device added notification parsing (#12930) * [emu,scard] bound select-by-AID compare to GIDS AID length (#12933) * Rails feature setting, xfreerdp kbd sync (#12927) * [core,orders] fix inverted overflow guard in update_read_delta_points (#12938) * [codec,mppc] add missing out of bounds check (#12942) * [channels,tsmf] bound visible rect read in update_geometry_info (#12943) * [channels,rdpecam] bound channel name read in device removed pdu (#12945) * [core,tcp] improve connection failure logging (#12950) * Warn fixes (#12951) * [codec,planar] fix range check, abort early (#12952) * [channels,rdpsnd,mac] recover audio after AVAudioEngine config change (#12958) * [codec,planar] range-check before control byte read in plane rle (#12956) * [channel,rail] fix tests and uninitialized variables (#12960) * [channels,rdpdr] fix off-by-one scan length in rdpdr_read_ustring (#12961) * [channels,remdesk] validate ctl pdu DataLength against received stream (#12955) * [channels,rdpsnd] bound client format pdu length to UINT16 (#12962) * Winpr harden parser checks (#12965) * [winpr,file] bound '?' wildcard match to file name length (#12969) * [channels,urbdrc] bound msusb descriptor reads to received length (#12971) * [core,update] fix the calling convention for Windows x86 (#12973) * [channels,drive] reject trailing '..' in contains_dotdot (#12974) * OSS-Fuzz: Add new fuzzer targeets WinPRClipboard processing (#12976) * Pr/12970 (#12975) * Cliprdr and rdpsnd fixes (#12980) * [channels,rail] fix order read/cleanup (#12979) * [core,utils] skip AuthenticateEx for RDP/TSL/SMARTCARD_PIN/FIDO_PIN (#12978) * replace NULL with nullptr (#12982) * [channels,cliprdr] fix pdu-tracker leak (#12983) * Fuzz fixes bmp (#12986) * [core,gateway] fix const warning (#12987) * [channels] bound dynamic channel message header to received length (#12988) * cmake: add minimal preset for lightweight builds (#12989) * Cleanup all (#12991) * Range checks (#12993) * Deprecations (#12994) * [winpr,string] fix winpr_strnstr needle length (gateway SIGSEGV) (#12995) * Bmp cache (#12999) * [codec,dsp] ensure out capacity in opus encode (#13001) * [winpr,string] match winpr_strnstr fallback to native strnstr (#13002) * Smartcard fixes (#13009) * [client,common] /smartcard-logon pass PEM directly (#13011) * Correct UTF-8 to UTF-16 length (#13012) ==== freetype2 ==== Version update (2.14.2 -> 2.14.3) - update to 2.14.3 - Important bug fixes * A bunch of potential security problems have been found. All users should update. - Miscellaneous * If configuration option `TT_CONFIG_OPTION_GPOS_KERNING` is active, GPOS-based kerning could miss some value pairs (bug introduced in version 2.14.0). - Added patch: * freetype-CVE-2026-50811.patch + upstream fix for issue #1436, bsc#1271045, CVE-2026-50811: out-of-bounds read vulnerabilityin src/truetype/ttgxvar.c in the TT_Get_Var_Design implementation used by FT_Get_Var_Design_Coordinates ==== gimp ==== Subpackages: gimp-plugin-aa gimp-plugin-python3 libgimp-3_0-0 libgimpui-3_0-0 - Add gimp-CVE-2026-58379.patch:Fix PSP File Parsing Heap Buffer Overflow (CVE-2026-58379, bsc#1270299) - Add gimp-CVE-2026-59089.patch:Fix Signed integer overflow (CVE-2026-59089, bsc#1270440) - Lower gexiv2_min_version to 0.14.3, the one Leap 16.1 has atm ==== grub2 ==== Subpackages: grub2-arm64-efi grub2-arm64-efi-bls grub2-common grub2-snapper-plugin grub2-systemd-sleep-plugin - Fix broken bash completion on arm64 images when the bash-completion package is not installed (bsc#1259132) * 0001-bash-completion-add-_init_completion-marker.patch ==== gstreamer ==== Version update (1.28.4 -> 1.28.5) Subpackages: gstreamer-utils libgstreamer-1_0-0 typelib-1_0-Gst-1_0 - Update to version 1.28.5: + Highlighted bugfixes: - Various security fixes and playback fixes - Fix subtitles cause green flickering with VA decoders on AMD GPUs - core: Fix sticky event raciness when pads are linked mid-push - appsrc: Uniformly handle EOS events being pushed - audio-resampler-neon fails to build for targets with neon but without thumb - avtp: Correct ptime generation from avtp timestamp - fmp4mux: Various fixes for splitting at fragment boundaries - gldownload: fix wrong DRM format negotiation causing R/B channel swap - gdkpixbufdec: Drop rank to NONE and handle resolution/format changes - gopbuffer: add support for H.266/VVC - h265decoder: Fix HEVC with alpha decoding - mp4mux: fix AC-3 template caps so muxer can accept input from ac3parse - mpegtsmux: Always assign PTS to output buffers in CBR mode - mpegtsmux: Output buffers with PCR-only bitrate-padding packets have wrong PTS - rtcpbuffer: Fix parsing of SR+SDES compound packets (regression from security fix) - rtspsrc2: Allow disabling SRTP/SRTCP encryption and SRTP authentication - tsdemux: Improve PTS rollover handling in ignore-pcr mode, fixing intermittent corruption with YouTube HLS streams - textaccumulate: output joined single buffer, add list as meta - threadshare: add ts-clocksync - webrtcsink: negotiation fixes and improvements - Various bug fixes, build fixes, memory leak fixes, and other stability and reliability improvements + gstreamer: - caps: fix field name leak in gst_caps_structure_simplify - info: Use a more optimized version of GST_TIME_ARGS - pads: Fix sticky event raciness when linked mid-push - typefindhelper: Drop unnecessary check for factories without a function - Use named pipes when spawning gst-ptp-helper on Windows ==== gstreamer-plugins-bad ==== Version update (1.28.4+24 -> 1.28.5) Subpackages: libgstadaptivedemux-1_0-0 libgstanalytics-1_0-0 libgstbadaudio-1_0-0 libgstbasecamerabinsrc-1_0-0 libgstcodecparsers-1_0-0 libgstcodecs-1_0-0 libgstcuda-1_0-0 libgsthip-1_0-0 libgstinsertbin-1_0-0 libgstisoff-1_0-0 libgstmpegts-1_0-0 libgstmse-1_0-0 libgstphotography-1_0-0 libgstplay-1_0-0 libgstsctp-1_0-0 libgsturidownloader-1_0-0 libgstva-1_0-0 libgstvulkan-1_0-0 libgstwayland-1_0-0 libgstwebrtc-1_0-0 libgstwebrtcnice-1_0-0 - Update to version 1.28.5: + amcviddec: Fix double-free happening when codec gets reconfigured + avtp: Correct ptime generation from avtp timestamp + ccconverter: Use truncated length when converting CEA608 raw to CEA708 CDP + curlsmtpsink: Use the correct content-type if known + d3d12: Fix command list leak + dtlsconnection: Allocate large enough buffer for the peer certificate subject DN + h264parse: Check for enough slice header data being available + h2654parse: Unset GValue in every code path + h265decoder: Fix HEVC with alpha decoding + h266parser: Avoid out-of-bounds read if too many exp slices are signalled + h266parser: Check bounds before writing to CTU entrypoint array + h266parser: Check aspect ratio index against lookup table length + h266parser: Heap-allocate parameter sets before parse to avoid stack overflow + h266parser: Use long bit skipping function for potentially large values + mpeg4videoparse: Ensure enough config data is available before extracting profile/level + mpegpsdemux: Release stream lock when seeking fails + mpegtsmux: Always assign PTS to output buffers in CBR mode + mpegtsmux: Output buffers with PCR-only bitrate-padding packets have wrong PTS + mxfdemux: fix essence track offsets array population + netsim: Fix racy test failures + pcapparse: Add missing bounds checks to ensure packets are large enough + pnmdec: Avoid overflows when calculating frame sizes + qroverlay: Fix use after free bug + rfbsrc: Use correct bpp for copying hextile data + rfbsrc: Validate framebuffer update rectangles against the framebuffer size + rtmp2: Don't retry on G_IO_ERROR_TIMED_OUT + rtmp2: Remove socket timeout after handshake completes + rtpsink: fix mutex not unlocked on invalid URI in set_property + tsdemux: YouTube HLS streams have intermittent corruption + tsdemux: Improve PTS rollover handling in ignore-pcr mode + v4l2decoder: Fix media_fd leak when video_fd open fails + va: surfacecopy: get surface's image in gst_va_surface_copy + va: VOBSUB: compositing error with VA decoder in NV12 + va: radeonsi: subtitles cause green flickering + va: radeonsi: Subtitles cause green flickering with VA decoders + videoparsers: Always clear LCEVC enhancement data when resetting frame + videoparsers: Leak of LCEVC user data + vnmdec: Avoid integer overflows when rectangle positions and sizes + vp9parser: Check that enough data is available for parsing superframe info + webrtcbin: validate remote dtls certificates + webrtcsdp: Fix inverted fingerprint existence logic ==== gstreamer-plugins-base ==== Version update (1.28.4 -> 1.28.5) Subpackages: libgstallocators-1_0-0 libgstapp-1_0-0 libgstaudio-1_0-0 libgstfft-1_0-0 libgstgl-1_0-0 libgstpbutils-1_0-0 libgstriff-1_0-0 libgstrtp-1_0-0 libgstrtsp-1_0-0 libgstsdp-1_0-0 libgsttag-1_0-0 libgstvideo-1_0-0 typelib-1_0-GstAudio-1_0 typelib-1_0-GstPbutils-1_0 typelib-1_0-GstTag-1_0 typelib-1_0-GstVideo-1_0 - Update to version 1.28.5: + appsink: Clear local sample storage when flushing + appsrc: Uniformly handle EOS events being pushed + audio-resampler-neon fails to build for targets with neon but without thumb + encoding-target: Validate that encoding profile name is UTF-8 before using it + gldownload: fix wrong DRM format negotiation causing R/B channel swap + opusdec: Don't use any channel positions for >64 channels + rtcpbuffer: Fix parsing of SR+SDES compound packets (regression from security fix) + subparse: Don't allow very small framerates for microdvd subtitles + typefind: assorted fixes for the image-rs plugin typefinding + typefindhelper: Drop unnecessary check for factories without a function + WBMP typefinding rejects a valid 1280x800 file + typefinding: detect animation on PNG (and WebP, GIF, AVIF) + typefindfunctions: remove Sun and Andrew raster format typefinders + uridecodebin3: deactivate input_item in erroneous ready->paused transition + vorbistag: Check for enough base64 data before trying to decode + xmptag: Don't allocate -1 bytes of memory if there's only a single tag + xmptag: Handle fractions with 0 denominator as invalid ==== gstreamer-plugins-good ==== Version update (1.28.4 -> 1.28.5) Subpackages: gstreamer-plugins-good-gtk - Update to version 1.28.5: + flacenc: Fix g_object_notify on loose-mid-side-stereo property + gdkpixbufdec: Drop rank to NONE and handle resolution/format changes + gdkpixbufdec: stop advertising Sun and Andrew raster formats + gdkpixbufdec announces unsupported raster mediatypes + matroskademux: Don't pass non-GstElement pointers to GST_ELEMENT_ERROR + matroska: Update lzo decompression implementation from latest ffmpeg + mp4mux: fix AC-3 template caps so muxer can accept input from ac3parse + pngdec: fix wrong macro being used for ICC support test + qtmoovrecover: Validate box sizes + rtpceltdepay: error out if anyone tries to use this element + rtpjpegdepay: Ensure that quantization table is big enough + rtpsbcdepay: Check for available data in the adapter before getting data + shapewipe: Fix missing mutex unlock in shutdown path + wavparse: Avoid NULL pointer dereference when parsing adtl in push mode ==== gstreamer-plugins-rs ==== Version update (1.28.4 -> 1.28.5) - Update to version 1.28.5: + fmp4mux: Various fixes for splitting at fragment boundaries + gopbuffer: add support for H.266/VVC + onvifmeta2relatiometa: fix inversion between width and height + rtprecv: fix buffer list split handling + rtspsrc2: digest authentication fixes + rtspsrc2: Allow disabling SRTP/SRTCP encryption and SRTP authentication + textaccumulate: output joined single buffer, add list as meta + threadshare: add ts-clocksync + webrtcsink: add support for h264 profile constrained-high + webrtcsink: allow change of interlace-mode in the input caps + webrtcsink: allow renegotiation if caps is missing interlace-mode + webrtcsink: fix negotiation for nvh264enc in the GLMemory case + webrtcsink: read rav1enc bitrate as i32 + webrtcsrc, webrtcsink: Fix SDP renegotiation bugs + Update dependencies ==== gstreamer-plugins-ugly ==== Version update (1.28.4 -> 1.28.5) - Update to version 1.28.5: + asfdemux: Ensure that enough data is available for reading all replicated extensions ==== ibus ==== Version update (1.5.33 -> 1.5.34) Subpackages: ibus-dict-emoji ibus-gtk ibus-gtk3 libibus-1_0-5 typelib-1_0-IBus-1_0 - Upstream update to 1.5.34 * no source changes from 1.5.34-rc2 * replace a tar artifact with the released one - Update version to 1.5.34-rc2(1.5.33.92) * Enhance panel --enable-wayland-im option without daemon * Enhance mouse position in Emojier category list * Enhance Emoji and Unicode notifications * Show Emoji annotations in GNOME * Refer QT_IM_MODULES to check Wayland configuration * Support input purpose and hints in ibus-wayland * Update simple.xml with xkeyboard-config 2.46 * Fix locale compose features * Fix Backspace after commit-text in Ghostty * Fix "no memory" error with focus changes in Sway * Fix latch key in Latvian(tilde) keymap in ibus-wayland * Fix memory leaks * Fix SEGV in ibus-x11 * Fix Panel bugs * Fix build issues * Replace ibus-daemon with ibus start in Github issue templace * IBus Wayland panel can run without --exec-daemon option for the debugging purpose * Follow mouse cursor in Emojier category list * Enhance the order of the loading locale compose file * Support to delete surrounding text feature with the Wayland input-method protocol * Add IBUS_INPUT_HINT_HIDDEN_TEXT * Enhance the pre-edit text in GNOME-Shell password including GDM * Show Emoji annotations in the candidate popup in GNOME * Update translators - Refresh setup-switch-im.patch ==== ibus_gtk4 ==== Version update (1.5.33 -> 1.5.34) - Upstream update to 1.5.34 * no source changes from 1.5.34-rc2 * replace a tar artifact with the released one - Update version to 1.5.34-rc2(1.5.33.92) * Enhance panel --enable-wayland-im option without daemon * Enhance mouse position in Emojier category list * Enhance Emoji and Unicode notifications * Show Emoji annotations in GNOME * Refer QT_IM_MODULES to check Wayland configuration * Support input purpose and hints in ibus-wayland * Update simple.xml with xkeyboard-config 2.46 * Fix locale compose features * Fix Backspace after commit-text in Ghostty * Fix "no memory" error with focus changes in Sway * Fix latch key in Latvian(tilde) keymap in ibus-wayland * Fix memory leaks * Fix SEGV in ibus-x11 * Fix Panel bugs * Fix build issues * Replace ibus-daemon with ibus start in Github issue templace * IBus Wayland panel can run without --exec-daemon option for the debugging purpose * Follow mouse cursor in Emojier category list * Enhance the order of the loading locale compose file * Support to delete surrounding text feature with the Wayland input-method protocol * Add IBUS_INPUT_HINT_HIDDEN_TEXT * Enhance the pre-edit text in GNOME-Shell password including GDM * Show Emoji annotations in the candidate popup in GNOME * Update translators - Refresh setup-switch-im.patch ==== kernel-firmware-amdgpu ==== Version update (20260614 -> 20260629) - Update to version 20260629 (git commit 3ee099cd4a20): * amdgpu: DMCUB updates for various ASICs * amdgpu: DMCUB updates for various ASICs ==== kernel-firmware-bluetooth ==== Version update (20260618 -> 20260629) - Update to version 20260629 (git commit 3ee099cd4a20): * QCA: Update Bluetooth QCA6698 firmware to 2.1.2-00072 ==== kernel-firmware-i915 ==== Version update (20260610 -> 20260706) - Update to version 20260706 (git commit 2c35b1ed46f6): * xe: Release GuC firmware for NVL-S - Update aliases from 7.1 / 7.2-rc1 ==== kernel-firmware-iwlwifi ==== - Update aliases from 7.1 / 7.2-rc1 ==== kernel-firmware-media ==== Version update (20260610 -> 20260706) - Update to version 20260706 (git commit 2c35b1ed46f6): * qcom: vpu: add Gen2 firmware binary for Purwa ==== kernel-firmware-mediatek ==== Version update (20260619 -> 20260629) - Update to version 20260629 (git commit 3ee099cd4a20): * mediatek MT7922: update bluetooth firmware to 20260605203811 * mediatek MT7925: update bluetooth firmware to 20260605184935 * linux-firmware: update firmware for MT7925 WiFi device * linux-firmware: update firmware for MT7922 WiFi device - Update aliases ==== kernel-firmware-nvidia ==== - Update aliases from 7.1 / 7.2-rc1 ==== kernel-firmware-platform ==== Version update (20260610 -> 20260629) - Update to version 20260629 (git commit 3ee099cd4a20): * linux-firmware: Update AMD SEV firmware * nxp: add firmware for IW61x WiFi device - Update aliases ==== kernel-firmware-qcom ==== Version update (20260619 -> 20260629) - Update to version 20260629 (git commit 3ee099cd4a20): * qcom: add LPAICP firmware for shikra platform - Update aliases ==== kernel-firmware-realtek ==== Version update (20260614 -> 20260629) - Update to version 20260629 (git commit 3ee099cd4a20): * rtw89: 8852a: add TX power track R34 - Update aliases ==== kernel-firmware-sound ==== Version update (20260618 -> 20260706) - Update to version 20260706 (git commit 2c35b1ed46f6): * cirrus: cs35l56: Update firmware for the ASUS UX5406SA - Update to version 20260703 (git commit c95059a3774b): * cirrus: cs42l45: Update CS42L45 SDCA codec firmware for Dell laptops * cirrus: cs35l56: Add firmware for Cirrus Amps for a few Dell laptops - Update to version 20260629 (git commit 3ee099cd4a20): * linux-firmware: qcom: sync audioreach firmwares from v1.0.4 build * linux-firmware: Add firmware for new projects - Update aliases ==== libcamera ==== Version update (0.7.1 -> 0.7.2) Subpackages: libcamera-base0_7 libcamera0_7 - Update to release 0.7.2 * Fixes two separate saturation handling bugs in both the SoftISP and the Raspberry Pi IPA. * On the SoftISP, 12-bit formats are now supported, black level correction is 'fixed' and there are interesting performance improvements with eGL buffer caching. * Within the IPA handling, support for Sony IMX678 was added, as well as Omnivision OV08x40 and OV01A10, and moved to a proportional AGC algorithm for the simple pipeline handler. - Delete libcamera-ov02e10-initial-support.patch ==== libdovi ==== Version update (3.3.2 -> 3.4.0) - Update to 3.4.0: * dovi_rpu_add_cmv40_safe_default_metadata: Adds CMv4.0 default metadata to an existing CMv2.9 RPU * dovi_generate_from_json: Allows generating a list of RPUs from JSON * dovi_rpu_remove_cmv40_metadata: Allows to completely remove CM v4.0 metadata from the RPU * dovi/level11: improve byte1 parsing and remove byte2 validation ==== libphonenumber ==== Version update (9.0.33 -> 9.0.34) - update to 9.0.34: * Updated alternate formatting data for country calling code(s): 34 * Updated phone metadata for region code(s): CM, ES, GY, HN, MZ, SR, TM, TZ, US, UZ * Updated geocoding data for country calling code(s): 504 (en) * Updated carrier data for country calling code(s): 46 (en), 255 (en), 258 (en), 352 (en), 381 (en), 592 (en), 597 (en), 886 (en), 998 (en) * Updated / refreshed time zone meta data. ==== libpsl ==== Version update (0.22.0 -> 0.23.0) - Update to version 0.23.0: * Properly handle leading dot in domains (CVE-2026-8924) * Using libidn as runtime now requires explicit configuration * Modernize configure.ac * Simplify license headers - Regenerate the built-in PSL and test DAFSA files from the system publicsuffix at build time, so they stay in sync with the packaged list and test-is-public-all no longer fails on version skew ==== libseccomp ==== Version update (2.6.0 -> 2.6.1) - Produce unique .src.rpm files per multibuild flavor. - Update to release 2.6.1 * Fixed incorrect 64-bit comparison merge that can weaken libseccomp filters. * Fixed issue where oversized libseccomp filters can trigger a double free. * Fixed issue where oversized libseccomp filters can trigger a heap corruption. * Fixed struct aliasing undefined behavior in the internal libseccomp hash algorithm. * Fixed issue where extraneous bytes were being copied to the destination buffer in seccomp_export_bpf_mem(). * Fix a bug where merged libseccomp filters failed to merge the notify_used flag, leading to no listener file descriptor being generated. - 62-sim-arch_transactions-remove-fuzzer.patch: removed upstream - Fixes in SPEC file. - Update make-python-build.patch to work with multiple versions of Python interpreters. - Add python-pip-packages.patch, modernize-python-build.patch - Enable _multibuild back. - Add support for generating of multiple versions of Python subpackages (using %python_subpackage_only). ==== libselinux ==== Version update (3.10 -> 3.11) Subpackages: libselinux1 selinux-tools - Update to version 3.11 https://github.com/SELinuxProject/selinux/releases/tag/3.11 - User-visible changes: - Several security improvements in libselinux - Rewrote libselinux selinux_restorecon(3) to eliminate TOCTOU issues in file relabeling if /proc is available - Fixed libselinux constructor to not clobber errno (#445). - Fixed libselinux selabel_partial_match(3) to correctly find partial matches. - Fixed libselinux selinux_init_policy_load() to still try to mount selinuxfs on /sys/fs/selinux even if the mount of sysfs on /sys fails - this can occur legitimately within a user namespace. - Improved restorecon related functionality in libselinux - Development-relevant changes: - Reformatted entire tree based on .clang-format and added new check-format/format make targets to check and/or reformat code to match. This is now a requirement for new patches. - Fixed libselinux build for non-pthread builds. - Multiple fixes for musl/llvm-based builds, including adding a new EXTRA_LD_FLAGS variable that can be set for libselinux builds to pass - -undefined-version through to lld (#511 thru #515). - Fixed uclibc build failure (#435). - Build shared libraries with -fPIC for LTO. - Notable bug fixes: - libselinux: avoid out-of-bounds access on zero-length lines - Packaging changes: - Drop patch restorecon-Only-log-error-on-readonly-fs-bsc-1232226.patch as it was accepted upstream - Rewrite skip_cycles.patch since the code path has been rewritten entirely upstream ==== libselinux-bindings ==== Version update (3.10 -> 3.11) - Update to version 3.11 https://github.com/SELinuxProject/selinux/releases/tag/3.11 - Development-relevant changes: - Reformatted entire tree based on .clang-format and added new check-format/format make targets to check and/or reformat code to match. This is now a requirement for new patches. - libselinux and python use system Python3 build module - Updated pywrap build targets for modern python builds using the Python3 build module. - Build shared libraries with -fPIC for LTO. - Packaging changes: - Add python-build as BuildRequires - Drop python3.6 build in 15.7, as python-build is not available for python3.6 - Add workaround in Makefile as python multi build does not work with the combined dist/ folder from upstream ==== libsemanage ==== Version update (3.10 -> 3.11) Subpackages: libsemanage-conf libsemanage2 - Update to version 3.11 https://github.com/SELinuxProject/selinux/releases/tag/3.11 - Development-relevant changes: - Reformatted entire tree based on .clang-format and added new check-format/format make targets to check and/or reformat code to match. This is now a requirement for new patches. - Test fixes - Notable bug fixes: - libsemanage: guard end of path in semanage_fc_find_meta - libsemanage: bunzip: guard against size overflow - libsemanage: genhomedircon: fix STR_COMPARATOR() passed to lfind() - libsemanage: genhomdircon: handle NULL bsearch() in get_users() - libsemanage: fix OOB cleanup in semanage_direct_list() - libsemanage: make expand-check a proper boolean option - libsemanage: use 'bool' for boolean options - libsemanage: Do not use vfork() - libsemanage: Do not discard âconstâ qualifier ==== libsepol ==== Version update (3.10 -> 3.11) - Update to version 3.11 https://github.com/SELinuxProject/selinux/releases/tag/3.11 - User-visible changes: - Fixed libsepol generation of constraint expressions with a list of names when writing policy.conf from CIL. - Fixed libsepol to generate constrain/validatetrans instead of mlsconstrain/mlsvalidatetrans when converting a module to CIL unless the constraint contains an expression based on level. - Fixed libsepol selection of tunableif or booleanif and to skip empty conditional blocks when converting a module to CIL. - Fixed libsepol/secilc reporting of CIL source file info. - Fixed libsepol to require at least one perm in a CIL classperm and to correctly count the number of elements in the avtab. - Fixed libsepol to link xperm rule permissions correctly. - Fixed libsepol off-by-one error in cats_ebitmap_len(). - Development-relevant changes: - Reformatted entire tree based on .clang-format and added new check-format/format make targets to check and/or reformat code to match. This is now a requirement for new patches. - Many hardening fixes spanning the entire tree - Notable bug fixes: - libsepol: cast to unsigned char in ctype calls - libsepol: bound type values in type_set_expand negset loop - libsepol/cil: fix double free of borrowed type datum on error path ==== libxml2 ==== Subpackages: libxml2-16 libxml2-tools - CVE-2026-11979: stack-based buffer overflows in the `xmlcatalog` utility when running in `--shell` mode (bsc#1269790) * Add patch libxml2-CVE-2026-11979.patch ==== openSUSE-release ==== Version update (20260709 -> 20260714) Subpackages: openSUSE-release-appliance-custom openSUSE-release-dvd - automatically generated by openSUSE-release-tools/pkglistgen ==== openblas_openmp ==== Subpackages: compatlibopenblas_openmp0 libopenblas_openmp0 - fixed wrong ownership of /usr/include for SLE16.1 builds and moved tests to non conflicting locations ==== openblas_pthreads ==== Subpackages: compatlibopenblas_pthreads0 libopenblas_pthreads0 - fixed wrong ownership of /usr/include for SLE16.1 builds and moved tests to non conflicting locations ==== permissions ==== Version update (1699_20260512 -> 1699_20260707) Subpackages: permctl permissions-config - Update to version 1699_20260707: * profiles: add cap_perfmon for ksystemstats6 (bsc#1262779) ==== php8 ==== Version update (8.5.7 -> 8.5.8) Subpackages: php8-ctype php8-dom php8-iconv php8-openssl php8-pdo php8-sqlite php8-tokenizer php8-xmlreader php8-xmlwriter - fix build with GCC 16 (gh#php/php-src#22206) [boo#1267259] - added patch + php-fix-build-gcc16.patch - use system liburiparser [bsc#1270538] [bsc#1270539] - version update to 8.5.8 (CVE-2026-14355 [bsc#1270351]) CLI: Fixed bug GH-21901 (Stale getopt() optional value). Date: Fixed bug GH-18422 (int overflow in php_date_llabs). DOM: Fixed bug GH-22077 (UAF in custom XPath function). Opcache: Fixed tracing JIT crash when a VM interrupt is handled during an observed user function call. Fixed bug GH-21746 (Segfault with tracing JIT). Fixed bug GH-22004 (Assertion failure at ext/opcache/jit/zend_jit_trace.c). Fixed tailcall VM crash when a VM interrupt is handled from a VM helper. OpenSSL: Fix compatibility issues with OpenSSL 4.0. Standard: Fixed bug GH-21689 (version_compare() incorrectly handles versions ending with a dot). URI: Fixed CVE-2026-44927 (In uriparser before 1.0.2, there is pointer difference truncation to int in various places). (CVE-2026-44927) Fixed CVE-2026-44928 (In uriparser before 1.0.2, the function family EqualsUri can misclassify two unequal URIs as equal). (CVE-2026-44928) - Revert changes for building with GCC 16 ==== policycoreutils ==== Version update (3.10 -> 3.11) Subpackages: policycoreutils-python-utils python313-policycoreutils - Move the sandbox subpackage to the separate selinux-sandbox package (bsc#1270534) drop policycoreutils-sandbox-fix-cleanup.patch - Update to version 3.11 https://github.com/SELinuxProject/selinux/releases/tag/3.11 - User-visible changes: - Several security improvements in dbus and gui - Dropped Python 2 support from audit2why - Added `setfiles -A` option to disable SELINUX_RESTORECON_ADD_ASSOC - restorecon only logs error on read-only filesystem instead of failing (allows relabeling with read-only BTRFS subvolumes) - Introduced a new SELINUX_RESTORECON_SKIP_MULTILINK flag to selinux_restorecon(3); if set, then selinux_restorecon(3) will refuse to relabel files with multiple hard links to prevent mislabeling them. Updated restorecond(8) to always pass this flag when relabeling files to prevent mislabeling hard links to files owned by others, e.g. when relabeling user home directories or /tmp. - Fixed semanage audit fd creation to avoid hitting RLIMIT_NOFILE on large semanage import operations (#291). - Improved semanage-fcontext(8) manpage - Fixed dispol and dismod to show all options in the -h text. - Development-relevant changes: - Reformatted entire tree based on .clang-format and added new check-format/format make targets to check and/or reformat code to match. This is now a requirement for new patches. - Updated pywrap build targets for modern python builds using the Python3 build module. - Disabled build isolation for sepolicy python module. - Fixed build errors with glibc 2.43. - Updated pywrap build targets for modern python builds using the Python3 build module. - Packaging changes: - Drop sepolicy-build-isolation.patch was accepted upstream - Drop sandbox-sandbox-fix-saving-file-changes.patch was accepted upstream - Add python-build as new BuildRequires - Rewrite policycoreutils-sandbox-fix-cleanup.patch Code was rewritten upstream, dropped the part in seunshare.c - Rewrite usr_etc.patch Did not apply anymore due to code changes ==== postfix ==== Version update (3.11.4 -> 3.11.5) - update to 3.11.5 This release addresses medium-impact problems that need to be fixed as some enable remote DOS, or local memory corruption. * Bug (defect introduced: Postfix 2.7, date: 20090617): out-of-memory condition with remote input in the postscreen dummy SMTP engine. This dummy engine is used after PREGREET or DNSBL checks fail, or when "after 220" protocol checks are enabled. * Bug (defect introduced: Postfix 2.0, date: 20030619): file system DOS: with smtpd_proxy_filter enabled, the before-filter SMTP server did not enforce the message size limit for mailbox From_ lines at the beginning of a message. With smtpd_proxy_filter disabled, the file size limit was still enforced by the cleanup daemon. * Bug (defect introduced: Postfix 2.3, date: 20060611): double ldap_msgfree(resloop) call during error handling when special_result_attribute is configured. An attacker who controls the LDAP server or can play attacker-in-the-middle could corrupt heap memory. * Bug (defect introduced: Postfix 3.4, date: 20190121): missing null termination in a postlogd process that was started with an EMPTY maillog_file setting, while receiving a message from a postlog command that was started with a NON-EMPTY maillog_file setting. Under these contradicting conditions, an unprivileged attacker could cause postlogd to write null bytes to stack memory as it tokenized text outside the receive buffer, and possibly gain 'postfix' privilege. * Bug (defect introduced: Postfix 2.3, date: 20060711): one-byte heap over-write in the Milter client with soft_bounce=yes while processing a malformed SMFIR_REPLYCODE Milter response. An attacker who controls the Milter or who can play attacker-in-the-middle could corrupt heap memory. * Bug (defect introduced: Postfix 2.1, date: 20030619): SMTP server panic() in smtpd_proxy_filter when handling long mailbox From_ lines at the beginning of a message. * Bug (defect introduced: Postfix 3.1, date: 20151129): a missing return statement in the SHOWQ_CLEANUP_AND_RETURN() macro. A local user could submit a crafted message that triggered a read-after-free and panic() in the unprivileged showq daemon (which scans the mail queue for the 'postqueue -p' and 'mailq' commands). This could happen only before a message had been picked up by the pickup(8) daemon. * Bug: (defect introduced: Postfix 3.10, date: 20240925): NULL pointer read in the TLSRPT client, caused by missing STR_OR_NULL() wrappers. * Bug (defect introduced: Postfix < alpha, date: 1997): missing recursion guard while processing :include: files that directly include other :include: files in local(8) aliases or .forward files. This could result in exhausting stack space (segfault) or file handles (fatal error). This is not a global DOS; it affected at most two parallel delivery processes for the local recipient who created the condition. * Bug (defect introduced: postfix-3.11.0-RC1, date: 20251222): heap memory over-read in the cleanup daemon as it handled a milter "shutdown" reply. The over-read memory was logged after masking unprintable content. * Bug (defect introduced: Postfix 2.3, date: 20050526): limited (<= 11 byte) heap over-read in the cleanup daemon. This could be triggered by local user with a crafted queue file, but the over-read content was not disclosed and there was no other impact. * Bug (defect introduced: Postfix < alpha, date: 19971221): a signal handler in the postdrop command could call unlink() with a pathname that was already wiped and free()d, but not yet reused. * Bug (defect introduced: Postfix 3.11, date: 20260219): In the non-BerkeleyDB re-indexing server, vstream_fopen_as() ignored the uid and gid arguments and opened a database source file read-only as the 'postfix' user instead of the file owner. * Bug (defect introduced: Postfix 2.2. date: 20040829): after a RAND_bytes() call failure, do not rely on stack-based pseudo-randomness for tlsmgr seed generation, and for timing jitter of tlsmgr seed refresh intervals. * Bug (defect introduced: Postfix 2.3, date: 20060711): In the Milter client, null-terminate the SMFIR_REPLYCODE response data to exclude stale data when processing the result as a C string. * Hardening: make sure that optimizers will not delete a memset() call in myfree() that wipes memory. * Allow zero-length memory allocation requests. Many people have experience with systems that allow this, therefore it should not trigger a panic in Postfix. * Safety: added a global recursion guard in the local delivery agent. ==== publicsuffix ==== Version update (20260622 -> 20260708) - Update to version 20260708: * Add dev.cv, store.cv, and sch.ac to PSL private domains for Code Fost Host (#2989) * Add grok.me (xAI) to PRIVATE section (#2993) * Remove info.at, biz.at (#2995) * remove mayfirst.org (#2994) * Add multiple dnsHome.de domains (#2916) * Add puter.site puter.app puter.work (#2914) ==== python-Pillow ==== Version update (12.2.0 -> 12.3.0) - Update to 12.3.0 (fixes CVE-2026-42311 (bsc#1270404), CVE-2026-54059 (bsc#1270409), CVE-2026-54060 (bsc#1270410), CVE-2026-55379 (bsc#1270411), CVE-2026-55380 (bsc#1270412)) * Remove non-image ImageCms modes * Speed up ImageChops operations * Speed up Image.filter() * Speed up Image.getchannel(), Image.merge(), Image.putalpha() and Image.split() * Speed up Image.fill(), Image.linear_gradient() and Image.radial_gradient(). * Speed up Image.resample() * Speed up alpha_composite, matrix, negative, quantize * Remove PyErr_Clear() of "weird" exceptions * Check realloc return value * Add max_length to PdfStream decode() * Return early when there is no fill region * Allow error to be raised if PyDict_SetItemString fails * Speed up Image.blend() * Raise OverflowError if number of vertices is too large for Path * Remove unused HSV and LAB matrix conversion from C * Prevent reusing ImagingDecoderObject.setimage * Raise ValueError if FPX tile size is not 64px by 64px * Only clear error if it is BufferError * Apply XOR mask to 1 and L mode CUR images * Do not raise error from unknown channel ID when parsing PSD layers * Raise ValueError if P;2L or P;4L data is truncated in frombytes() * Embed SBOM into wheels * Do not set eval() globals in ImageMath.unsafe_eval() * Add Tcl/Tk license to wheels * Ensure map stride is at least one full row of pixels * Raise OverflowError if text width exceeds INT_MAX * Raise error if image modes do not match ImageCms transform modes * Use int64_t for text height * Return if error occurs in Py_mod_exec slot * Add decompression bomb checks to FontFile classes * If C error is raised, return NULL * Prevent saving 1 mode images as TGA with run-length encoding * Raise ValueError if EPS BeginBinary bytecount is negative * Do not DECREF tuple until tuple items are no longer used * Do not update NumPy automatically * Simplified code * If realloc fails, do not reduce block size * DECREF PyDict_GetItemRef result * Use int64_t to calculate paste box dimensions * Calculate JPEG2000 total_component_width for each tile in isolation * Raise ValueError if value is not bytes for TIFF_BYTE or TIFF_ASCII tag * Release Py_Buffer on error * Use os.startfile() in WindowsViewer show_file() * Validate large filter sizes when initializing RankFilter * Add decompression bomb check to GdImageFile * Free image bands when an error occurs while splitting an image * Check PyList_Append return value * Check WebPMuxNew return value * Check PyCapsule_New return value * Do not return negative width for text length * Add args argument to METH_NOARGS methods * Check ImagingNewDirty return value * Use int64_t for text width * Move PyDateTime_IMPORT inside Py_mod_exec slot * Validate size and rank when initializing RankFilter * Raise ValueError if insufficient data is read from DDS RGB file * Correct IFDRational.__float__() return value * Correct length when accessing ImagePath.Path subscript * Release reference on non-flattened sequence error * Do not release Py_buffer until buf is no longer in use * Do not resize macOS retina screenshots by default * Add abstract BaseImageFont class * Cast before multiplying * Limit radius to half width or height of rounded rectangle * linesize is always xsize multiplied by pixelsize * Check annotate_hash_table return value * Catch KeyError when checking mode from PNG IHDR chunk * Only pass one argument to C expand * Raise error if declared JPEG2000 marker length is too small * In _dump(), use Python PPM save, instead of C * Raise error consistently from inside ImagingNewArrow * Simplify RankFilter.c check * Support opening and saving L mode AVIF images with libavif >= 1.3.0 * [pre-commit.ci] pre-commit autoupdate * Apply libtiff patch to fix CVE-2026-4775 * Remove duplicate code * Switch iOS back to macos-26-intel * Don't use list as default in PdfParser read_prev_trailer * Add support for Python 3.15 * Do not draw line or arc if width is zero * Use _accept check in WebP _open * Compare dist sizes vs latest PyPI release * Do not generate SBOM in scheduled run on fork * Use plugin method directly when saving PDFs * [pre-commit.ci] pre-commit autoupdate * Set Renovate prCreation to not-pending * Raise error if PNG transparency has incorrect type or length when saving * If PdfParser buffer is memoryview, release it when closing * Correct integer overflow in 16-bit resampling * SBOM: Use real versions from dependencies.json * Restrict SBOM upload to only Pillow JSON * Generate CycloneDX SBOM at release time via CI * Raise ValueError if ImageOps border has unsupported format * Unsafe pointer dereference from unchecked Python integer in Tk initialization ... changelog too long, skipping 11 lines ... https://pillow.readthedocs.io/en/stable/releasenotes/12.3.0.html ==== python-semanage ==== Version update (3.10 -> 3.11) - Update to version 3.11 https://github.com/SELinuxProject/selinux/releases/tag/3.11 - Development-relevant changes: - Reformatted entire tree based on .clang-format and added new check-format/format make targets to check and/or reformat code to match. This is now a requirement for new patches. - Fixed libsemanage pywrap target deps for parallel builds. - Packaging changes: - Drop 1266385-libsemanage-Require-LIBSO-before-SWIGSO-and-SWIGRUBY.patch was accepted upstream ==== qemu ==== Version update (10.2.2 -> 11.0.2) Subpackages: qemu-arm qemu-audio-spice qemu-block-curl qemu-block-nfs qemu-block-rbd qemu-chardev-spice qemu-guest-agent qemu-hw-display-qxl qemu-hw-display-virtio-gpu qemu-hw-display-virtio-gpu-pci qemu-hw-display-virtio-vga qemu-hw-usb-host qemu-hw-usb-redirect qemu-hw-usb-smartcard qemu-img qemu-ksm qemu-pr-helper qemu-tools qemu-ui-curses qemu-ui-gtk qemu-ui-opengl qemu-ui-spice-app qemu-ui-spice-core qemu-vgabios - Update to latest stable release (11.0.2) Full backport list here: https://lore.kernel.org/qemu-devel/[email protected]/ Bugs and CVEs fixed: - bsc#1268794 (CVE-2026-48914) A selection of them is reported here below: linux-user: Fix AT_PHDR when program headers are relocated into their own segment hw/pci: Replace assert with bounds check and return ppc/pnv_phb3: Error out on invalid config access linux-user/xtensa: fix unlock of uninitialized frame pointer on sigreturn linux-user/xtensa: save/restore FP registers across signal delivery target/xtensa: add cpu_set_fcr/fsr helpers to sync fp_status target/arm/hvf: Stop pre-allocating cpreg_vmstate arrays ui/sdl2: Set GL ES profile before creating initial GL context ui/sdl2: Explicitly specify EGL platform hw/9pfs: reject . and .. in Twstat rename hw/9pfs: fix abort due to illegal name with Twstat rename gdbstub: Update x86 control register bits target/i386: apply mod to immediate count of an RCL/RCR operation hw/uefi: fix parse_hexstr target/riscv: mask vxrm csrw write to the low 2 bits disas/riscv.c: fix inst_length() target/riscv/tcg: disable svnapot if satp_mode < sv39 target/riscv/cpu_helper.c: add PMA access fault target/riscv/cpu_helper.c: fault with reserved PTE.PBMT val target/riscv/insn_trans/trans_rvzicbo.c.inc: save opcode before helpers disas/riscv.c: add 'cbo' insns to disassembler target/riscv/csr.c: fix mstatus.UXL reserved value target/riscv/csr.c: do not allow mstatus MPV/GVA writes target/riscv/tcg: disable svpbmt if satp_mode < sv39 target/riscv/cpu_helper.c: allow LOAD_ADDR_MIS promotion to AMO fault virtio: Allow to fill a whole virtqueue in order amd_iommu: Reject non-decreasing NextLevel in fetch_pte() amd_iommu: Follow root pointer before page walk and use 1-based levels libvduse: fix buffer overflow in vduse_queue_read_indirect_desc() libvhost-user: fix buffer overflow in virtqueue_read_indirect_desc() tests/qtest: Add amd-iommu command buffer head wrap test amd_iommu: Update command buffer head ptr in MMIO region after wraparound amd_iommu: restrict command buffer head/tail ranges to ring size linux-user: add preadv2/preadv2 system/rtc: Fix a possible year-2038 integer overflow problem linux-user/strace: add fsmount series of syscalls linux-user: implement fsmount(2) series of syscalls fpu: Handle all rounding modes in partsN_uncanon_normal hw/usb/hcd-ohci: Clean up USBPacket before freeing ISO TD packet qed: Don't try to flush during incoming migration iotests: test shared mmap for fuse export block/export/fuse: set FUSE_DIRECT_IO_ALLOW_MMAP flag to fix regression block/export/fuse: use struct fuse_init_in qcow2: Fix data loss on zero write with detect-zeroes=unmap iotests/046: Test that discard/write_zeroes wait for dependencies qcow2: Fix corruption on discard during write with COW qemu-io: Add 'aio_discard' command virtio-blk: add missing VIRTIO_BLK_T_SCSI_CMD size check (CVE-2026-48914) block/io: fallback to bounce buffer if BLKZEROOUT is not supported because of alignment hw/i3c: fix CMD/data FIFO depth reset values to match real silicon s390x/pci: Fix interrupt forwarding disable for interpreted devices target/s390x: Make container ids in SysIB_15x 1-based lcitool: remove Cirrus CI support gitlab: remove x64-freebsd-14-build Cirrus job gitlab: add initial MacOS 15 on gitlab runner ci: drop cirrus MacOS build tests/unit: add test-envlist covering setenv/unsetenv name matching util/envlist: fix prefix-match in envlist_unsetenv() name lookup ... - Fix bsc#1268279, bsc#1268245, bsc#1263098: * [openSUSE][RPM] spec: fix post-build-checks failure for qemu-tools (bsc#1263098) * [openSUSE][RPM] spec: fix missing unversioned ppc64 cross-compiler binaries (bsc#1268245) * ppc/spapr: Skip system reset for quiesced CPUs (bsc#1268279) - Update to latest stable release (11.0.1) Full backport list here: https://lore.kernel.org/qemu-devel/[email protected]/ A selection of them is reported here below: block/graph-lock: fix missed wakeup in bdrv_graph_co_rdunlock() commit: Drain nodes across all of bdrv_commit() block: Add more defaults to DEFAULT_BLOCK_CONF block: Create DEFAULT_BLOCK_CONF macro ide-test: Test reset during TRIM ide-test: Factor out wait_dma_completion() ide: Clean up ide_trim_co_entry() to be idiomatic coroutine code ide: Minimal fix for deadlock between TRIM and drain block: Add flags parameter to blk_*_pdiscard() block: Add blk_co_start/end_request() and BDRV_REQ_NO_QUEUE blkdebug: Add 'delay-ns' option linux-user/sh4: Fix setup_sigtramp to match Linux kernel trampoline pattern linux-user/sh4: Fix target_ucontext tuc_link field type linux-user: Fix AT_EXECFN in AUXV for symlinked programs hw/nvme: fix admin cq msix setup target/arm/hvf: Fix WFI halting to stop idle vCPU spinning tests/functional/qemu_test/asset.py: Don't use setxattr when it doesn't exist hw/remote/machine.c: Mark x-remote machine as OK for AArch64 and AArch32 meson.build: Add -fzero-init-padding-bits=all tests/qtest/iommu-smmuv3-test: Skip if no TCG GICv3 device present ati-vga: fix ati_set_dirty address calculation hw/i2c/microbit_i2c: Don't index off end of twi_read_sequence[] aspeed/hace: Prevent total_req_len overflow aspeed/hace: Fix out-of-bounds read in has_padding() hw/misc/aspeed_sbc: Add bounds checking for OTP write operations hw/display/cirrus_vga: Fix packed-24 color-expansion transparent copies ... changelog too long, skipping 68 lines ... * [openSUSE][RPM] spec: enable passt support ==== sdbootutil ==== Version update (1+git20260506.25d47bf -> 1+git20260714.d9bb736) Subpackages: sdbootutil-dracut-measure-pcr sdbootutil-snapper - Update to version 1+git20260714.d9bb736: * tukit: do not fail if service is not found - Update to version 1+git20260713.d869cf8: * Ignore errors in the snapper plugin - Update to version 1+git20260709.7dfd021: * Remove the background process in the plugin * Fix missing initrd condition (bsc#1270420) * After reboot the shutdown service is not active * Disable the shutdown service after main service * Update uhmac dependencies (rust-openssl) bsc#1270192, CVE-2026-41676 bsc#1270995, CVE-2026-45784 bsc#1270922, CVE-2026-44662 bsc#1270863, CVE-2026-41898 bsc#1270742, CVE-2026-41681 bsc#1270670, CVE-2026-41678 bsc#1270616, CVE-2026-41677 bsc#1270471, CVE-2026-42327 * Add systemd transient service to update predictions * Install extra EFI binaries - Update to version 1+git20260625.7fa275e: * Remove duplicate code and parametrize timers * Check boot entry before kernel installation * Re-install an old kernel if initrd cannot be reused * Skip installation for already installed kernel * Add configurable devicetree entry support * Set explicit kernel and initrd paths * Remove the full tmpdir in the service * Fix /run/sdbootutil permissions * Execute predictions in the background * Add --disable-predictions parameter * Fix comparison operator * Add print-loader-path command ==== selinux-policy ==== Version update (20260618 -> 20260702) Subpackages: selinux-policy-targeted - Update selinux-policy-sandbox description (bsc#1270534) - Update to version 20260702: * Include key_socket in socket_class_set * Remove 14 permissive domains * ci: Run cockpit-machines tests in PRs * Remove the lockdown class from the policy * Allow systemd-logind the sys_ptrace capability in the user namespace * Allow systemd-sleep the perfmon capability * Allow sshd_session_t dyntransition to sftpd_t * Allow lttng kernel tracing * Allow loadkeys create and use its private tmpfs files * Allow journald create and use netlink_tcpdiag_socket * Fix typo in the comment of build.conf * Allow gpg_pinentry_t to write session dbus socket files * Allow systemd-hostnamed read hwdb files * Allow systemd-machined to manage nspawn runtime directory * Allow pcm-sensor-server the sys_admin capability * Allow nut/upsmon read nut_conf_t symlinks * Support new sanlock features - using libdm and SG_IO * Allow thumb_t mount proc filesystem * Allow aide connect to the GDM userdb provider socket * Allow postfix_postdrop_t/system_mail_t append to init unix domain stream sockets * Allow nfsd_t to create netlink_generic_socket (bsc#1267826) * Add anaconda_ioctl_fifo_files_install() and anaconda_write_fifo_files_install() * Allow install_t domain transition to insights_client_t * Allow staff user mounton /var/lib dirs * Allow systemd-coredump signull container runtime * Allow blueman get the attributes of a tmpfs filesystem * portage_compile_domain: Require xdm_xserver_tmp_t type * Add missing interface requirements * Dontaudit virt_driver_domain execmem * fixed file after comment from zpytela. * added caddy related paths. * Remove extra parameters from interface headers * Update bootupd policy for running lsblk * Allow pcscd_t to search cgroup - Syncing with upstream rawhide selinux-policy up to: * 3cf2aa66a844ba5e87fb2a8f04be08c62cf5538a - Update embedded container-selinux version to commit: * 9715eb09108e9fabb0fbaeee9044636b349370eb (v2.250.0) - Update to version 20260630: * Allow snapper_sdbootutil_plugin_t create transient units (bsc#1267377) * Allow bootctl access unconfined_t pid (bsc#1267377) * Refactor sdbootutil into seperate module (bsc#1267377) * Allow pcrlock to send kernel dgram (bsc#1267377) * Add tiny sdbootutil module for sdbootutil snapper plugin changes (bsc#1267377) ==== spice-gtk ==== Subpackages: libspice-client-glib-2_0-8 libspice-client-glib-helper libspice-client-gtk-3_0-5 - Add BuildRequires for python3-base ==== timezone ==== Version update (2026b -> 2026c) Subpackages: tzselect - Update to 2026c: * Alberta moved to permanent -06 on 2026-06-18 * Morocco moves to permanent +00 on 2026-09-20 * More integer overflow bugs have been fixed in zic ==== wget ==== - Fix buffer underflow in clean_metalink_link [bsc#1271033, CVE-2026-58469] * CVE-2026-58469.patch - Fix integer overflow in parse_content_range [bsc#1271034, CVE-2026-58470] * CVE-2026-58470.patch - Fix buffer size handling in filename conversion [bsc#1271035, CVE-2026-58471] * CVE-2026-58471.patch - Fix integer+buffer overflow in html_quote_string [bsc#1271036, CVE-2026-58472] * CVE-2026-58472.patch ==== wpa_supplicant ==== - Add Require-network_ctx-and-AKMP-match-for-accepting-PMK.patch https://w1.fi/security/2026-2/ - Add SAE-Fix-crash-due-to-NULL-pointer-dereference-in-H2E.patch https://w1.fi/security/2026-3/ - Add CVE-2026-58374.patch: Missing multi-link parsing validation in wpa_supplicant and hostapd (bsc#1269892) - Add wpa_supplicant_support_pem_encoded_chain.patch: OpenSSL: Support PEM encoded chain from ca_cert blob (bsc#1258365). ==== xrdb ==== Version update (1.2.2 -> 1.2.3) - Update to bugfix release 1.2.3 - switch to Meson build system ==== xset ==== Version update (1.2.5 -> 1.2.6) - Update to version 1.2.6: * Switch to Meson build system. * Add GPG validation for source archives. * The new release includes bugfixes. ==== xsetroot ==== Version update (1.1.3 -> 1.1.4) - Update to version 1.1.4 * -help should exit(0) not (1) * Accept --help & --version as aliases to -help & -version * Improve man page formatting * man page: fix warnings from `mandoc -T lint` * gitlab CI: drop the ci-fairy check-mr job * Strip trailing whitespace from source files * meson: Add option to build with meson - Switch to Meson build system
