Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package libvpx for openSUSE:Factory checked in at 2026-10-11 15:14:47 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/libvpx (Old) and /work/SRC/openSUSE:Factory/.libvpx.new.3698736 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "libvpx" Sun Oct 11 15:14:47 2026 rev:56 rq:1383979 version:1.17.0 Changes: -------- --- /work/SRC/openSUSE:Factory/libvpx/libvpx.changes 2026-03-29 20:00:25.588774962 +0200 +++ /work/SRC/openSUSE:Factory/.libvpx.new.3698736/libvpx.changes 2026-10-11 15:14:55.432729930 +0200 @@ -1,0 +2,37 @@ +Thu Aug 27 12:17:34 UTC 2026 - Martin Pluskal <[email protected]> + +- Update to 1.17.0 "Yellowbilled Duck": + * ABI compatible with 1.16.0, SONAME stays at 12 + * VP9 high bitdepth input is now validated by default; out of range + values return VPX_CODEC_INVALID_PARAM. Disable with the new + VP9E_SET_VALIDATE_HBD_INPUT control or vpxenc --validate-hbd-input=0 + * VP9 now reports the actual image width and height instead of the + stride and aligned height, a behaviour change for callers relying + on the old values + * SVC is now rejected for 2-pass encoding + * Stricter API validation: vpx_img_alloc()/vpx_img_wrap() check the + image format, encoders reject unequal U and V strides, the external + rate control API and VP9 SVC spatial layer ids are validated + * ISO C11 is now enforced for C sources + * New Neon DotProd and AVX2/AVX512 paths, new --disable-x86-asm + * Heap and integer overflow fixes in vp9_postproc, vpx_setup_noise, + vp9_change_config, vp8_sixtap_predict, vp9-svc and others, plus + decoder crash and hang fixes for corrupt input + * Fixed a heap buffer overflow from a missing buffer full check in + write_superframe_index() (CVE-2026-2447, boo#1258388) +- Drop -std=gnu99 from --extra-cflags: it came after configure's own + -std=gnu11 and won, so the C11 static_assert in vp8/common/common.h + failed to compile +- Drop the obsolete Group tags +- Add _service: the tar and recompress buildtime services are what turn + the checked in obscpio into the Source0 tarball. Without it %prep dies + on a missing libvpx-%{version}.tar.xz, which is why this package was + red on every arch in the devel project + +------------------------------------------------------------------- +Sat Jun 27 12:41:24 UTC 2026 - Adrian Schröter <[email protected]> + +- switch to RemoteAsset to prepare git switch +- pbuild-ai generated update + +------------------------------------------------------------------- Old: ---- libvpx-1.16.0.obscpio New: ---- libvpx-1.17.0.obscpio ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ libvpx.spec ++++++ --- /var/tmp/diff_new_pack.EydSoG/_old 2026-10-11 15:14:56.616779420 +0200 +++ /var/tmp/diff_new_pack.EydSoG/_new 2026-10-11 15:14:56.618779504 +0200 @@ -20,12 +20,13 @@ %define sover 12 %define use_gcc13 0%{?suse_version} < 1600 Name: libvpx -Version: 1.16.0 +Version: 1.17.0 Release: 0 Summary: VP8/VP9 codec library License: BSD-3-Clause AND GPL-2.0-or-later -Group: Productivity/Multimedia/Other URL: https://www.webmproject.org/ +#!RemoteAsset: git+https://chromium.googlesource.com/webm/libvpx#v%{version} +#!CreateArchive Source0: %{name}-%{version}.tar.xz Source1000: baselibs.conf Patch2: libvpx-configure-add-arch.patch @@ -52,7 +53,6 @@ %package -n vpx-tools Summary: Utilies from the VP8/VP9 codec library License: BSD-3-Clause AND GPL-2.0-or-later -Group: Productivity/Multimedia/Other %description -n vpx-tools This package contains utilities around the vp8 codec sdk. @@ -67,7 +67,6 @@ %package -n %{name}%{sover} Summary: VP8/VP9 codec library License: BSD-3-Clause -Group: System/Libraries %description -n %{name}%{sover} WebM is an open, royalty-free, media file format designed for the web. @@ -80,7 +79,6 @@ %package devel Summary: Development files for libvpx, a VP8/VP9 codec library License: BSD-3-Clause AND GPL-2.0-or-later -Group: Development/Languages/C and C++ Requires: %{name}%{sover} = %{version} %description devel @@ -110,6 +108,9 @@ # It is only an emulation of autotools configure; the macro does not work export CFLAGS="%{optflags} -O3" export CXXFLAGS="%{optflags} -O3" +# No -std in --extra-cflags: 1.17.0 enforces C11 (static_assert in +# vp8/common/common.h) and configure already passes -std=gnu11; a later +# -std=gnu99 would come last on the command line and win. ../configure \ --prefix=%{_prefix} \ --libdir=%{_libdir} \ @@ -133,7 +134,7 @@ --target=armv7-linux-gcc \ --enable-runtime-cpu-detect \ %endif - --extra-cflags="-std=gnu99 -U_FORTIFY_SOURCE %{optflags}" \ + --extra-cflags="-U_FORTIFY_SOURCE %{optflags}" \ --extra-cxxflags="-U_FORTIFY_SOURCE %{optflags}" \ # size-limit to avoid CVE-2017-0641 DoS attacks. The limit is the # 8K Fulldome resolution and should be enough for all current use cases ++++++ _service ++++++ --- /var/tmp/diff_new_pack.EydSoG/_old 2026-10-11 15:14:56.645780633 +0200 +++ /var/tmp/diff_new_pack.EydSoG/_new 2026-10-11 15:14:56.648780758 +0200 @@ -4,7 +4,7 @@ <param name="scm">git</param> <param name="versionformat">@PARENT_TAG@</param> <param name="versionrewrite-pattern">v(.*)</param> - <param name="revision">v1.16.0</param> + <param name="revision">v1.17.0</param> </service> <service name="set_version" mode="manual"/> <service name="tar" mode="buildtime"/> ++++++ libvpx-1.16.0.obscpio -> libvpx-1.17.0.obscpio ++++++ ++++ 20141 lines of diff (skipped) ++++++ libvpx.obsinfo ++++++ --- /var/tmp/diff_new_pack.EydSoG/_old 2026-10-11 15:14:57.530817625 +0200 +++ /var/tmp/diff_new_pack.EydSoG/_new 2026-10-11 15:14:57.533817750 +0200 @@ -1,5 +1,5 @@ name: libvpx -version: 1.16.0 -mtime: 1767888100 -commit: 1024874c5919305883187e2953de8fcb4c3d7fa6 +version: 1.17.0 +mtime: 1787252795 +commit: 6df3ec34557879fff673706f4a1d9fbd0f3a6f0e
