Please note that this mail was generated by a script. The described changes are computed based on the aarch64 DVD. The full online repo contains too many changes to be listed here.
Please check the known defects of this snapshot before upgrading: https://openqa.opensuse.org/tests/overview?distri=opensuse&groupid=3&version=Tumbleweed&build=20261020 Please do not reply to this email to report issues, rather file a bug on bugzilla.opensuse.org. For more information on filing bugs please see https://en.opensuse.org/openSUSE:Submitting_bug_reports Packages changed: 7zip (26.03 -> 26.04) GraphicsMagick (1.3.48 -> 1.3.49) MozillaFirefox (157.0.1 -> 158.0) adobe-sourcecodepro-fonts (2.038 -> 2.042) erofs-utils (1.9.3 -> 1.9.4) gedit (50.0 -> 51.0) git graphviz gstreamer-plugins-bad kscreenlocker6 ldacBT (2.0.2.5 -> 2.0.2.6) lerc (4.1.0 -> 4.2.0) libaom (3.13.1 -> 3.15.2) libconfig (1.8.1 -> 1.8.2) libgedit-amtk (5.10.0 -> 5.11.0) libgedit-gfls (0.4.2 -> 0.5.0) libgedit-gtksourceview (299.7.1 -> 299.8.0) libgedit-tepl (6.14.0 -> 6.15.0) libpaper (2.2.8 -> 2.3.0) libzip (1.11.4 -> 1.12.1) live555 (2026.10.13 -> 2026.10.17) mjpegtools mozilla-nss (3.129 -> 3.130) netpbm (11.14.0 -> 11.16.1) ntfs-3g_ntfsprogs (2026.7.7 -> 2026.9.28) openSUSE-release (20261018 -> 20261020) os-prober (1.81 -> 1.85) polkit (127 -> 128) sdbootutil (1+git20260929.26b6989 -> 1+git20261007.53bc127) selinux-policy (20261014 -> 20261019) systemd (261.3 -> 261.4) upower (1.91.4 -> 1.91.5) vlc === Details === ==== 7zip ==== Version update (26.03 -> 26.04) - Update to 26.04: * Some bugs and vulnerabilities were fixed (no details published upstream). ==== GraphicsMagick ==== Version update (1.3.48 -> 1.3.49) Subpackages: libGraphicsMagick++-Q16-12 libGraphicsMagick-Q16-3 libGraphicsMagick3-config - Update to version 1.3.49 (security and bugfix release): * CVE-2026-109964: heap buffer underwrite in the PICT decoder via crafted files on 32-bit builds (boo#1285424) * CVE-2026-42326: heap buffer over-read in IPTC attribute handling via malicious input (boo#1268092) * Drop patches adopted upstream in this release: GraphicsMagick-CVE-2025-55154.patch, GraphicsMagick-CVE-2026-56379.patch, GraphicsMagick-CVE-2026-61464.patch, GraphicsMagick-CVE-2026-103118.patch * PICT arithmetic-overflow checks, MAT NULL-image guard, TIFF adjoin double-free fix (Debian#1146076), X11 NULL ximage guard, WPG NULL ps_data guard, PNG writer image-type support, LevelImage() 'black/white/mid' parsing, posix_fallocate() pixel cache * Spec cleanup: drop Group tags, use pkgconfig(libwmf) provider * CVE-2026-46559 (boo#1268121) is not affected: JP2 support is not built (--without-jp2) * CVE-2026-46692 (boo#1268120) is not affected: no distribute-cache feature exists in GraphicsMagick * CVE-2026-46557 (boo#1268123) is not affected: no fx operation exists in GraphicsMagick * CVE-2026-46521 (boo#1268124) is not affected: the MIFF coder has no LZMA path * CVE-2026-53465 (boo#1268100) is not affected: no SF3 encoder exists in GraphicsMagick (only SFW) ==== MozillaFirefox ==== Version update (157.0.1 -> 158.0) Subpackages: MozillaFirefox-branding-upstream - Mozilla Firefox 158.0 * https://www.firefox.com/en-US/firefox/158.0/releasenotes/ MFSA 2026-106 (bsc#1284493) * CVE-2026-109704 (bmo#2037979) Privilege escalation in the Application Update component * CVE-2026-109705 (bmo#2040905) Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the Networking component * CVE-2026-109706 (bmo#2053649) Use-after-free in the Storage: IndexedDB component * CVE-2026-109707 (bmo#2059150) Sandbox escape due to use-after-free in the Networking component * CVE-2026-109708 (bmo#2059151) Sandbox escape due to incorrect boundary conditions in the Networking component * CVE-2026-109709 (bmo#2067976) Information disclosure, privilege escalation in the Security: Process Sandboxing component * CVE-2026-109710 (bmo#2068338) Use-after-free in the Graphics: Text component * CVE-2026-109711 (bmo#2068344) Use-after-free in the Graphics: Canvas2D component * CVE-2026-109712 (bmo#2068420) Sandbox escape due to uninitialized memory in the Graphics component * CVE-2026-109713 (bmo#2068421) Use-after-free in the Crash Reporting component * CVE-2026-109714 (bmo#2069765) Incorrect boundary conditions in the Layout component * CVE-2026-109715 (bmo#2073267) Incorrect boundary conditions in the JavaScript Engine component * CVE-2026-109716 (bmo#2073269) Incorrect boundary conditions in the JavaScript Engine component * CVE-2026-109717 (bmo#2073647) Use-after-free in the DOM: Bindings (WebIDL) component * CVE-2026-109718 (bmo#2073692) Use-after-free in the XML component * CVE-2026-109719 (bmo#2073969) Race condition, use-after-free in the Graphics: CanvasWebGL component * CVE-2026-109720 (bmo#2074160) JIT miscompilation in the JavaScript: WebAssembly component * CVE-2026-109721 (bmo#2074161) Incorrect boundary conditions in the JavaScript Engine: JIT component * CVE-2026-109722 (bmo#2074164) JIT miscompilation in the JavaScript Engine: JIT component * CVE-2026-109723 (bmo#2074171) Integer overflow in the Layout: Text and Fonts component * CVE-2026-109724 (bmo#2074193) Use-after-free in the DOM: Core & HTML component * CVE-2026-109725 (bmo#2074208) Use-after-free in the DOM: Core & HTML component * CVE-2026-109726 (bmo#2074212) Use-after-free in the SVG component * CVE-2026-109727 (bmo#2074213) Use-after-free in the Audio/Video component * CVE-2026-109728 (bmo#2074625) Use-after-free in the DOM: Animation component * CVE-2026-109729 (bmo#2074632) Use-after-free in the JavaScript Engine: JIT component * CVE-2026-109730 (bmo#2074896) Integer overflow in the Graphics component * CVE-2026-109731 (bmo#2075436) Incorrect boundary conditions in the Graphics: Canvas2D component * CVE-2026-109732 (bmo#2075998) Use-after-free in the DOM: Streams component * CVE-2026-109733 (bmo#2076269) JIT miscompilation in the JavaScript Engine: JIT component * CVE-2026-109734 (bmo#1926318) Mitigation bypass in the DOM: Security component * CVE-2026-109735 (bmo#2028727) Use-after-free in the DOM: Animation component * CVE-2026-109736 (bmo#2029784) Frame poisoning in the Layout component * CVE-2026-109737 (bmo#2044525) Mitigation bypass in the Enterprise Policies component * CVE-2026-109738 (bmo#2047722) Use-after-free in the Audio/Video: Playback component * CVE-2026-109739 (bmo#2049069) Privilege escalation in the WebExtensions component * CVE-2026-109740 (bmo#2057113) Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component * CVE-2026-109741 (bmo#2058651) Use-after-free in the Storage: Bucket File System component * CVE-2026-109742 (bmo#2058800) Information disclosure in the PDF Viewer component * CVE-2026-109743 (bmo#2059195) Privilege escalation in the Panning and Zooming component * CVE-2026-109744 (bmo#2059211) Other issue in the DOM: File component * CVE-2026-109745 (bmo#2061784) Sandbox escape due to uninitialized memory in the DOM: Web Serial component * CVE-2026-109746 (bmo#2063005) Mitigation bypass in the DOM: Security component * CVE-2026-109747 (bmo#2065402) ... changelog too long, skipping 70 lines ... - rebased patches ==== adobe-sourcecodepro-fonts ==== Version update (2.038 -> 2.042) - Update to version 2.042 (uprights) / 1.062 (italics) / 1.026 (variable): * Re-compiled so static instances correspond to the Variable Font versions - Drop obsolete Group and BuildRoot tags ==== erofs-utils ==== Version update (1.9.3 -> 1.9.4) - Update to release 1.9.4 * Fixed an uninitialized mutex in mkfs ==== gedit ==== Version update (50.0 -> 51.0) - Update to version 51.0: * Updated translations. - Update version dependencies according to meson.build. - Update to version 51.alpha1: * News in 51.alpha1: + Copy the plugins from the gedit-plugins repository: Word Completion, Smart Spaces, Draw Spaces and Bookmarks. The gedit-plugins repository will be archived. + Guidelines: no LLM AI tools. + Replace git submodule of libgd by a simple copy of the needed sources. + Adapt the code after libgedit API changes. + MacOS: small build simplification. + Don't annotate get_type() functions with G_GNUC_CONST. + Small improvements here and there. * Updated translations. - Provide/Obsolete the merged plugin packages: gedit-plugin-bookmarks, gedit-plugin-drawspaces, gedit-plugin-smartspaces, and gedit-plugin-wordcompletion. ==== git ==== Subpackages: git-core git-email git-gui git-svn git-web gitk perl-Git - Add zsh BuildRequires: Needed due to zsh-completion dirs. ==== graphviz ==== Subpackages: libcdt6 libcgraph10 libgvc7 libpathplan4 libxdot5 - remove weirdly named nmame directory ==== gstreamer-plugins-bad ==== Subpackages: libgstadaptivedemux-1_0-0 libgstanalytics-1_0-0 libgstbadaudio-1_0-0 libgstbasecamerabinsrc-1_0-0 libgstcodecparsers-1_0-0 libgstcodecs-1_0-0 libgstcuda-1_0-0 libgsthip-1_0-0 libgstinsertbin-1_0-0 libgstisoff-1_0-0 libgstmpegts-1_0-0 libgstmse-1_0-0 libgstphotography-1_0-0 libgstplay-1_0-0 libgstsctp-1_0-0 libgsturidownloader-1_0-0 libgstva-1_0-0 libgstvulkan-1_0-0 libgstwayland-1_0-0 libgstwebrtc-1_0-0 libgstwebrtcnice-1_0-0 - Drop pkgconfig(webrtc-audio-coding-1) BuildRequires: Not needed nor used since 1.26.0. - Replace pkgconfig(webrtc-audio-processing-1) with pkgconfig(webrtc-audio-processing-2) BuildRequires: Use current upstream preferd version of webrtc-audio-processing. ==== kscreenlocker6 ==== Subpackages: kscreenlocker6-imports libKScreenLocker6 - Update to respun 6.8.0 tarball that may avoid some authentication issues: * greeter: do not defer locked check to authenticator objects * worker: drop time check (kde#526194) ==== ldacBT ==== Version update (2.0.2.5 -> 2.0.2.6) - Update to 2.0.2.6: no functional changes, upstream only re-shipped the bundled libldac tarball in the release - Spec cleanup via spec-cleaner ==== lerc ==== Version update (4.1.0 -> 4.2.0) - Update to version 4.2.0 * Enforce size limits: input data and compressed blob limited to 2 GB per band and 4 GB over all bands; oversized dimensions now report a new DimensionsTooLarge error instead of risking integer overflows from bogus blob headers * Coverity fixes and overflow checks * 4.1.1: fixed two security issues and minor bugs (no CVE IDs assigned upstream) - Refresh pylerc-use-syslib.patch for the 4.2.0 sources - Drop Group tag (spec-cleaner run) ==== libaom ==== Version update (3.13.1 -> 3.15.2) - Update to version 3.15.2 (ABI compatible, soname unchanged): * 3.14.0: layered-image compression/quality gains, external rate control API (experimental), new tuning modes and codec controls. * 3.15.0: force-max-q option, low-complexity VOD decode mode, IntraBC RTC improvements, VMAF/PSNR and speed work. * 3.15.1/3.15.2: encoder bug fixes. * Security fixes: - CVE-2026-56208: heap-buffer-overflow in AV1 encoder LAP mode (boo#1268650) - CVE-2026-56209: bounds-check bypass in AV1E_SET_SVC_LAYER_ID (boo#1268651) - CVE-2026-56210: OOB heap read via unchecked SVC layer_id (boo#1268653) - CVE-2026-56211: out-of-range SVC layer selection (boo#1268655) - CVE-2026-13906: heap OOB read in av1_int_pro_motion_estimation - Drop libaom-0001-Do-not-disable-_FORTIFY_SOURCE.patch: upstream no longer forces _FORTIFY_SOURCE=0. - Rebase system-gtest.patch, libaom-cmake.patch to restructured cmake/ tree. - Modernize spec file (drop Group tags). ==== libconfig ==== Version update (1.8.1 -> 1.8.2) - Update to release 1.8.2 * Minor documentation updates ==== libgedit-amtk ==== Version update (5.10.0 -> 5.11.0) Subpackages: libgedit-amtk-5-0 typelib-1_0-Amtk-5 - Update to version 5.11.0: * Factory: add create_model_button*() functions for creating GtkModelButton's. * Test-headerbar: + Demo for creating a GtkPopoverMenu with GtkModelButton's, and comment out the GMenuModel creation (GtkPopoverMenu is more flexible). + Demo of iconic buttons with tooltips, linked horizontally and placed in the GtkPopoverMenu. * Don't annotate get_type() functions with G_GNUC_CONST. * Updated translations. - Update version dependencies according to meson.build. ==== libgedit-gfls ==== Version update (0.4.2 -> 0.5.0) - Update to version 0.5.0: * Updated translations. - Update to version 0.5.alpha2: * News in 0.5.alpha2, 2026-10-07: + New class: GflsEncodingConverter. + New class: GflsUtf8AutoConverter (work-in-progress). + GflsValidatedString: make it a GObject class. + Change gfls_encoding_convert() API. + Remove GflsBytesRegion (no longer used). + Reference manual: + Write an introduction and a file loading overview. + Regroup related classes together in chapters. * News in 0.5.alpha, 2026-08-12: + New features: GflsByteArray, GflsValidatedString, GflsValidatedStringBuilder, GflsValidatedStringChunk, UTF-8 validation, and some utils functions. + Encoding conversion: more docs and more tests. + GflsEncoding: class copied and adapted from libgedit-gtksourceview. + Don't annotate get_type() functions with G_GNUC_CONST. * Updated translations. ==== libgedit-gtksourceview ==== Version update (299.7.1 -> 299.8.0) Subpackages: typelib-1_0-GtkSource-300 - Update to version 299.8.0: * Updated translations. - Update version dependencies according to meson.build. - Update to version 299.8.alpha: * News in 299.8.alpha, 2026-08-22: + GtkSourceFileLoader: code refactorings. + Words completion provider: code refactorings. + Use GflsEncoding, remove GtkSourceEncoding. + Don't annotate get_type() functions with G_GNUC_CONST. - Update version dependencies according to meson.build. ==== libgedit-tepl ==== Version update (6.14.0 -> 6.15.0) - Update to version 6.15.0: * TeplCodeCommentView: fine tune the behavior. * Don't annotate get_type() functions with G_GNUC_CONST. * Updated translations. - Update version dependencies according to meson.build. - Update version dependencies according to meson.build. ==== libpaper ==== Version update (2.2.8 -> 2.3.0) Subpackages: libpaper-tools libpaper2 - Update to 2.3.0: * Remove the previously-deprecated paperconf(1) utility. * Remove /etc/papersize and $XDG_CONFIG_HOME/papersize configuration; use the PAPERSIZE environment variable instead. - Run upstream test suite during build. ==== libzip ==== Version update (1.11.4 -> 1.12.1) - update to 1.12.1: * Protect against denial of service attack (GHSA-m3wq-j48p-jxwh, actually fixed in 1.12) * Fix compile issues. * Fix adding and replacing files in torrentzip archives * Fix error handling in zip_source_filep_create() - update to 1.12: * Keep order of local extra fields, even if an identical extra field is present in the central directory * Add zip_source_at_eof() and ZIP_SOURCE_AT_EOF * Consistently report CRC and decryption errors when reading exactly to end-of-file. * Remove Mbed TLS support - the required functions were made private * Securely clear passwords and key material before freeing it * Use SipHash hash function with per-table random keys. This prevents hash flooding attacks * Add compile time option to limit LZMA window size * Add more comprehensive fuzzers for metadata and write code paths * Fix zip_source_is_seekable() * Fix setting incorrect WinZIP AES version in some cases * Further improvements to overall stability and other minor adjustments have been made ==== live555 ==== Version update (2026.10.13 -> 2026.10.17) Subpackages: libBasicUsageEnvironment2 libUsageEnvironment3 libgroupsock33 libliveMedia120 - Update to version 2026.10.17: * Matroska: guard the AAC codec-private config string allocation against oversized values (boo#1254419, CVE-2025-65406). * BasicTaskScheduler: honor FD_SETSIZE in the select loop instead of a hardcoded descriptor limit. * Spec cleanup: drop obsolete Group tags, use %make_build. ==== mjpegtools ==== Subpackages: liblavfile-2_2-0 liblavjpeg-2_2-0 liblavplay-2_2-0 liblavrec-2_2-0 libmjpegutils-2_2-0 libmpeg2encpp-2_2-0 libmplex2-2_2-0 - Stop building support for Quicktime playback/recording: Drop pkgconfig(libquicktime) BuildRequires. - Modernizse spec: Use ldconfig_scriptlets, drop obsolete Group tag ==== mozilla-nss ==== Version update (3.129 -> 3.130) Subpackages: libfreebl3 libsoftokn3 mozilla-nss-certs mozilla-nss-tools - update to NSS 3.130 * bmo#2072042 - selfserv: drain connections before closing * bmo#2072396 - reduce core file detection frequency in CI runs * bmo#2074429 - applied clang-format on nss * bmo#2074515 - Include blapit.h to expose AES_BLOCK_SIZE and SHA_*_LENGTH * bmo#2073728 - remove some unused types and functions from lib/pki * bmo#2012680 - Testcases for DER_GetInteger error handling * bmo#2054712 - Don't accept post-handshake CertificateRequest in DTLS * bmo#1951159 - release the decoded certificate when CERT_NewTempCertificate fails * bmo#2072384 - remove unnecessary certs dependencies in CI graph * bmo#2072554 - add missing return in do_key_slot when no internal key slot * bmo#2072682 - initialize referenceCount in crlutil's CRL allocations * bmo#2072682 - take a reference in cmsutil's CMS decrypt-key callback * bmo#2072682 - release-assert softoken session and db reference counts * bmo#2072682 - release-assert stan object reference counts * bmo#2072682 - release-assert pk11wrap slot, module and symkey reference counts * bmo#2072682 - release-assert SSL reference counts * bmo#2072682 - release-assert CRL and GeneralNameList reference counts * bmo#2072682 - free never-live symkeys directly in pk11_getKeyFromList * bmo#2072682 - abort on detected key object double frees * bmo#2072633 - return CKR_HOST_MEMORY when PORT_NewArena fails in jpakesftk.c * bmo#2072389 - fix uninitialized SECItem.type in SECKEY_ConvertToPublicKey * bmo#2047359 - propagate the PKCS#12 max element length to nested decoders * bmo#2068001 - Switch NSS to WIN95 target and remove Windows fiber code * bmo#2030245 - Add Windows ARM64 build support to NSS * bmo#2019001 - Update policy for mlkem1024 named group and others * bmo#2061391 - perform session object removals under slot lock * bmo#2028690 - Keep the default input size limit in NSS_CMSMessage_CreateFromDER * bmo#2028690 - Thread element limits through the QuickDER decoder and raise them for CRLs * bmo#2028690 - Limit ASN.1 group element count and total streamed input * bmo#2028690 - Add SEC_QuickDERDecodeItemWithLimits * bmo#2028690 - Place a default size limit on ASN.1 decoder inputs * bmo#1951159 - populate NSSCertificate::id at creation * bmo#2064306 - avoid VLA in tls_ech_unittest.cc * bmo#2070118 - Change the error from decode_error to illegal_parameter for the case when update field in Key Update is neither update_requested nor update_not_requested * bmo#2064311 - Remove HPKE internals from public headers * bmo#2064306 - HPKE P-256 and P-384 KEMs * bmo#2070669 - NSS release process improvements * bmo#2070421 - Set _NSPR_BUILD_ for Windows builds * bmo#2064502 - add tsan build for NSS in treeherder - fix LD_LIBRARY_PATH setting to not include the current wd ==== netpbm ==== Version update (11.14.0 -> 11.16.1) Subpackages: libnetpbm11 - Update to 11.16.1: * 11.16.01: fix jbigtopnm failure on certain multi-image inputs, pnmnorm wrong output with huge images and memory corruption with - wvalue above maxval, and ppmglobe color-name background specs. * 11.16.00: new pamnoise tool; pnmtojbig long options and better errors; ppmtoarbtxt '#' substitution class; more precise pnmhisteq; many robustness fixes (picttoppm, jbigtopnm, sgitopnm, tgatoppm, winicontopam, xpmtoppm, pamtogif, pgmtexture, pjtoppm, thinkjettopbm, lispmtopgm, pbmtomda, mdatopbm, mrftopbm). * 11.15.00: new pbmtobrush tool; makeman is Python 3 only; fixes to pamcut, pbmtopgm, ppmtopict, pnmtoddif and imgtoppm. * 11.14.01: fixes to pamcut, pbmtopgm, ppmtopict and pnmtojbig. - Drop makeman-py3.patch (upstream uses Python 3 now) and netpbm-gcc-warnings.patch (upstream silences -Wreturn-type with pragmas now); refresh netpbm-security-code.patch for the new sources (sgitopnm, imgtoppm and mdatopbm hunks fixed upstream). - Spec cleanup: drop Group tags, pkgconfig BuildRequires, %make_build. - Disable pnmhisteq.test on all arches: upstream broke Test 4 in 11.15 (trailing whitespace after line continuations). ==== ntfs-3g_ntfsprogs ==== Version update (2026.7.7 -> 2026.9.28) Subpackages: ntfs-3g ntfsprogs - Update to version 2026.9.28 (including the 2026.9.18 security release; CVEs for its fixes are still pending, tracked by boo#): * Heap out-of-bounds read/write in ntfs_ie_add_vcn (boo#1281763), heap data corruption in ntfs_mapping_pairs_decompress (boo#1281762), heap buffer overflows in ntfs_external_attr_find (boo#1281761), ntfs_ea_check_wsldev (boo#1281760), ntfs_check_restart_area (boo#1281759), ntfs_same_sid (boo#1281757) and ntfs_acl_owner (boo#1281756), and denial-of-service in ntfs_inode_attach_all_extents (boo#1281758). * Guard against multiple creator-owner and creator-group ACEs during ACL inheritance; fix stale $MFTMirr data in ntfsresize. * Fix MST-fixup return-value regression, ntfslabel options starting with '-', and use-after-free/improper realloc cases. - Drop patches adopted upstream: * 1_ntfs-3g_2026.7.7-SA_2026-06-1_05.patch * 2_ntfs-3g_2026.7.7-SA_2026-06-1_07.patch * 3_ntfs-3g_2026.7.7-SA_2026-06-1_08.patch * 4_ntfs-3g_2026.7.7-SA_2026-06-1_10.patch * 5_ntfs-3g_2026.7.7-SA_2026-06-1_11.patch * 6_ntfs-3g_2026.7.7-SA_2026-06-1_12.patch * 7_ntfs-3g_2026.7.7-SA_2026-06-1_19.patch * 8_ntfs-3g_2026.7.7-SA_2026-06-1_20.patch - Soname bump: libntfs-3g.so.90 -> libntfs-3g.so.91. - Spec cleanup: drop Group tags, use pkgconfig() BuildRequires, explicitly require gcc and make. - Add CVE patch bundle: * bsc#1281763: 1_ntfs-3g_2026.7.7-SA_2026-06-1_05.patch * bsc#1281762: 2_ntfs-3g_2026.7.7-SA_2026-06-1_07.patch * bsc#1281761: 3_ntfs-3g_2026.7.7-SA_2026-06-1_08.patch * bsc#1281760: 4_ntfs-3g_2026.7.7-SA_2026-06-1_10.patch * bsc#1281759: 5_ntfs-3g_2026.7.7-SA_2026-06-1_11.patch * bsc#1281758: 6_ntfs-3g_2026.7.7-SA_2026-06-1_12.patch * bsc#1281757: 7_ntfs-3g_2026.7.7-SA_2026-06-1_19.patch * bsc#1281756: 8_ntfs-3g_2026.7.7-SA_2026-06-1_20.patch ==== openSUSE-release ==== Version update (20261018 -> 20261020) Subpackages: openSUSE-release-appliance-custom openSUSE-release-dvd - automatically generated by openSUSE-release-tools/pkglistgen ==== os-prober ==== Version update (1.81 -> 1.85) - Update to version 1.85: * Detect Windows 12 via refactored version matching in 20microsoft. * Make the EFI locale check locale-independent (LC_ALL=C). * Install path made usrmerge-compliant; support the noudeb profile. - All 25 SUSE patches still apply cleanly, no rebasing needed. - Spec cleanup: drop Group tag, pkgconfig(udev), use %make_build. ==== polkit ==== Version update (127 -> 128) Subpackages: libpolkit-agent-1-0 libpolkit-gobject-1-0 pkexec typelib-1_0-Polkit-1_0 - Update to version 128 (CVE-2026-4897 and CVE-2026-85498): * fix two authentication-helper input vulnerabilities (CVE-2026-4897 bsc#1260859 and CVE-2026-85498 bsc#1278714). * Sanitize values written to syslog from authorization requests * Fix a use-after-free in the authentication agent's session handling * Revalidate the administrator behind cached auth_admin_keep authorizations * Fix agent cleanup races, resource leaks, and several error-path leaks * Support systemd watchdog notifications and locked system accounts with systemd 257+ * Improve FreeBSD and Solaris portability, including tests without Linux user namespaces * Add a polkit-agent-helper manual page and expand contributor documentation * Remove the systemd service memory limits introduced in polkit 127 * Updated translations. - Update version dependencies according to meson.build. - Drop patches fixed upstream: * 0001-Revert-memory-limits-in-systemd-unit-to-mitigate-mem.patch * 0001-CVE-2026-4897-getline-string-overflow.patch ==== sdbootutil ==== Version update (1+git20260929.26b6989 -> 1+git20261007.53bc127) Subpackages: sdbootutil-bash-completion sdbootutil-dracut-measure-pcr sdbootutil-snapper - Update to version 1+git20261007.53bc127: * doc: add raw-disk-image architecture document ==== selinux-policy ==== Version update (20261014 -> 20261019) Subpackages: selinux-policy-targeted - Update to version 20261019: * Allow systemd_nsresourced_t setuid/setgid inside a userns (bsc#1285095) * broaden ld.so.cache regex to include temporary files (bsc#1270243) ==== systemd ==== Version update (261.3 -> 261.4) Subpackages: libsystemd0 libudev1 systemd-boot systemd-container udev - Import commit f408418369c8d20f9025b39c03f4ece2a0ee7041 (merge of v261.4) This update includes the following fixes: a9f077a4f3 seccomp: also refuse sched_setattr() in RestrictRealtime= (bsc#1285434) 1f8fca2185 nspawn: mask socket() arguments to 32 bits in the NETLINK_AUDIT filter (bsc#1284982) b9a6730266 seccomp: mask setns() nstype to 32 bits in RestrictNamespaces= (bsc#1284982) f739a5ac5a seccomp: mask socket() domain to 32 bits in RestrictAddressFamilies= (bsc#1284982) For a complete list of changes, visit: https://github.com/openSUSE/systemd/compare/3255daee1572366b74fe92f002a3d60ecbb27103...f408418369c8d20f9025b39c03f4ece2a0ee7041 Rebase 0001-Drop-or-soften-some-upstream-warnings.patch ==== upower ==== Version update (1.91.4 -> 1.91.5) Subpackages: libupower-glib3 typelib-1_0-UpowerGlib-1_0 - Update to 1.91.5: * Prefer live sysfs threshold values over hwdb CHARGE_LIMIT * Keep keyboard backlight event IO active on ENODATA/EINTR * Hide device batteries that report being offline * Remove all BlueZ devices when the service vanishes - Spec cleanup: drop obsolete Group tags, use pkgconfig() style BuildRequires ==== vlc ==== Subpackages: libvlc5 libvlccore9 vlc-codec-gstreamer vlc-noX vlc-plugins-desktop vlc-qt - Add conditional for pkgconfig(vpl) BuildRequires and plugin, exclude %{arm} ppc64le %{ppc} s390x. - Add conditional for pkgconfig(libnfs) BuildRequires and plugin, exclude %{arm}
