Packages changed:
  AppStream (1.1.2 -> 1.1.3)
  MozillaFirefox (152.0.4 -> 152.0.6)
  PackageKit
  acl (2.3.2 -> 2.4.0)
  avahi
  avahi-glib2
  libgit2 (1.9.4 -> 1.9.6)
  libsoup
  libupnp (2.0.2 -> 22.0.4)
  libzypp (17.38.13 -> 17.38.14)
  multipath-tools (0.14.3+212+suse.f5d32098 -> 0.15~1+222+suse.cdcde840)
  open-iscsi
  openSUSE-release (20260718 -> 20260720)
  patterns-base
  perl (5.42.1 -> 5.44.0)
  policycoreutils
  python-pyasn1 (0.6.3 -> 0.6.4)
  shaderc (2026.2 -> 2026.3)
  suse-module-tools (16.1.5 -> 16.1.6)
  tar

=== Details ===

==== AppStream ====
Version update (1.1.2 -> 1.1.3)
Subpackages: AppStream-lang libAppStreamQt3 libappstream5

- Add upstream changes:
  * 0001-yaml-Fix-potential-crashes-when-encountering-missing.patch
  * 0001-yaml-Adjust-tests-and-emitter-to-work-around-libfyam.patch
  * 0001-yaml-Ensure-version-relations-are-consistently-quote.patch
  * 0001-trivial-yaml-Ensure-branding-color-values-are-also-c.patch
- Drop patch, no longer needed:
  * 0001-Disable-failing-test-with-old-libfyaml.patch
- Update to 1.1.3
  Features:
  * Officially support & read JXL images for icons, validate permitted filetypes
  * meson: Allow disabling command-line tools
  * news-convert: Recognize "=" as release block header
  * news-convert: Handle extra linebreaks better and add support for issue-blocks
  * compose: Create content hashes with Blake3 instead of MD5
  * Update static data for category and license additions
  * validator: Tags without namespace are an error
  Specification:
  * docs: Convert to Docbook 5
  Bugfixes:
  * yaml: Ensure certain values are always explicitly emitted as strings
  * Never emit usertags that are missing a namespace
  * compose: add bounds checks when parsing malformed translation files
  * Explicitly add fcfreetype.h include to asc-font.c
  * compose: Unref icon_policy in asc_compose_finalize
  * compose: Free array from asc_result_get_component_ids_with_hints
  Miscellaneous:
  * yaml: Improve string quoting heuristics
  * meson: Drop -Winline from maintainer flags
- Drop patch, merged upstream:
  * 0001-Explicitly-add-fcfreetype.h-include-to-asc-font.c.patch
- Drop no longer needed patch:
  * support-meson0.59.patch

==== MozillaFirefox ====
Version update (152.0.4 -> 152.0.6)
Subpackages: MozillaFirefox-branding-upstream MozillaFirefox-translations-common

- Mozilla Firefox 152.0.6
  https://www.firefox.com/en-US/firefox/152.0.6/releasenotes/
  MFSA 2026-67 (boo#1271403)
  * CVE-2026-15718 (bmo#2045443)
    Invalid pointer in the JavaScript: WebAssembly component
  * CVE-2026-15719 (bmo#2043820)
    Site isolation in the DOM: Navigation component
  * Smart Window includes several enhancements:
    Select text on a page and get quick access to summarize,
    explain, and more using the built-in assistant.
    (bmo#2034921)
    Added a row of shortcuts to New Tab, making it easier to
    get back to sites.
    (bmo#2048338)
  * Fix an issue that prevented email tracking protection from
    being disabled in the redesigned Firefox Settings.
    (bmo#2049331)
  * Fix the homepage not loading for some enterprise configurations
    that set it using a legacy autoconfig format.
    (bmo#2047962)
- Mozilla Firefox 152.0.5
  https://www.firefox.com/en-US/firefox/152.0.5/releasenotes/
  * Fixed the Manage payment methods list in Settings appearing
    empty when a saved payment card had no expiration date
    (bmo#2048383)

==== PackageKit ====
Subpackages: PackageKit-backend-zypp PackageKit-gstreamer-plugin PackageKit-gtk3-module PackageKit-lang libpackagekit-glib2-18 typelib-1_0-PackageKitGlib-1_0

- Add PackageKit-zypp-respect-libzypp-package-locks.patch:
  zypp: respect libzypp package locks
  (bsc#1263252, gh#PackageKit/PackageKit/commit/1263252).

==== acl ====
Version update (2.3.2 -> 2.4.0)
Subpackages: libacl1 libacl1-32bit

- Update to version 2.4.0:
  Major Issues Fixed:
  - The libacl library functions acl_get_file(), acl_set_file(),
    acl_extended_file(), and acl_delete_def_file() take a pathname argument
    and follow symbolic links.  When a privileged user calls one of those
    functions, an attacker that controls a pathname component can replace a
    file or directory with a symbolic link and redirect the operation to a
    different file.  This can lead to local privilege escalation.
    (CVE-2026-54369, bsc#1268867)
    The library functions cannot be fixed without breaking compatibility; the
    described behaviour is by design.
    Instead, version 2.4.0 of the acl package introduces the additional
    functions acl_get_file_at(), acl_set_file_at(), acl_extended_file_at(), and
    acl_delete_def_file_at().  These functions each take a dirfd file
    descriptor argument and an at_flags argument and accept the
    AT_SYMLINK_NOFOLLOW and AT_EMPTY_PATH flags.  Use these functions to
    control when to follow symbolic links. (CVE-2026-54370, bsc#1268867)
    In addition, the libacl functions acl_get_fd(), acl_set_fd(), and
    acl_extended_fd() functions always operate on the access ACL; the library
    previously did not offer a way to operate on the default ACL of a directory
    file descriptor.  The new functions remove that restriction.
    It will be up to each individual program to start using these new library
    functions where appropriate.
  - When walking directory trees, the getfacl, setfacl, chacl, and getfattr
    utilities constructed the full pathname of each file in the tree and use that
    pathname to access the file.  When a privileged user used those utilities,
    an attacker that controlled a pathname component could replace a directory with
    a symbolic link and redirect the operation to a different file, leading to
    a local privilege escalation. (CVE-2026-54371, bsc#1268867)
    This is fixed by using directory file descriptors and operating relative to
    those directory file descriptors.
  - When resolving the final pathname component, the getfacl, setfacl, chacl,
    getfattr, and setfattr utilities in some cases used functions that resolve
    symbolic links.  This includes the above mentioned libacl functions, but
    also stat(), chmod(), and chown().
    This is fixed by using symlink-safe functions throughout the code.
  - When restoring a backup, the setfacl and setfattr utilities read the full
    pathnames of files from the backup.  When those pathnames were resolved,
    pathname components that are symbolic links were traversed.  An attacker
    that controlled a pathname component could replace it with a symbolic link,
    causing a privileged user to operate on a file other than the one intended.
    This could lead to the same kind of local privilege escalation as discussed
    before.
    This is fixed by using openat2(RESOLVE_NO_SYMLINKS) to resolve the
    directory components of a pathname, but see Compatibility Notes below for
    the details.
  Minor Issues Fixed:
  - When a symbolic link was specified on the command line but symbolic link
    traversal was disabled using option -P (--physical), the getfacl and
    setfacl utilities previously silently ignored the symlink.  Now, an ELOOP
    ("Too many levels of symbolic links") error will result instead.
  - acl_delete_entry() now verifies that the specified entry belongs to the
    specified acl.
  - Numeric uids and gids that cannot be represented in types uid_t and gid_t
    are checked more carefully and invalid numbers are rejected.
  - Functions acl_get_file(), acl_get_file_at(), and acl_get_fd() will retry
    several times when the size of an ACL grows unexpectedly; previously, they
    only grew the allocated buffer once before giving up.
  - When passed a directory file descriptor, function perm_copy_fd() didn't
    copy the default ACL from one directory to the other.  It now does.
  - setfacl --restore accidentally ignored leading whitespace in filenames.  It
    no longer does.
  - setfacl --restore accidentally called chmod() when in --test mode.  It no
    longer does.
  - When the setfattr --restore option was used multiple times, a buffer was
    accessed after being freed. This no longer happens.
  - When the setfattr -h (--no-dereference) option was given after --restore,
    it was ignored.  Now, the options can be passed in any order.
  - The -h (--no-dereference) option of getfattr prevented getfattr from
    recursing into "symbolic link directories".  This is wrong.  When dirlink
    is a symbolic link that refers to a directory, "getfattr -Rh dirlink" will now
    visit that directory.  The -P (--physical) option can be used to prevent
    that.
  - Similarly, when a symbolic link referring to a directory was specified on
    the getfacl or setfacl command line, the -R option did not cause that
    directory to be visited.  This has been fixed so that those directories
    will now be visited.  The -P (--physical) option can be used to prevent
    that.

==== avahi ====
Subpackages: avahi-lang libavahi-client3 libavahi-client3-32bit libavahi-common3 libavahi-common3-32bit libavahi-core7

- Add avahi-CVE-2025-59529.patch: limit the number of simple
  clients (bsc#1255451 CVE-2025-59529).

==== avahi-glib2 ====

- Add avahi-CVE-2025-59529.patch: limit the number of simple
  clients (bsc#1255451 CVE-2025-59529).

==== libgit2 ====
Version update (1.9.4 -> 1.9.6)

- update to 1.9.6:
  * load_known_hosts: do not fail if homedir is invalid
- includes changes from 1.9.5:
  * Fix for blame error handling on hunk creation failures
  * CVE-2026-53586: give auth callback current host (boo#1271694)
  * CVE-2026-53587: heap out-of-bounds read in set_data (boo#1271695)
  * CVE-2026-53585: Unbounded Memory Allocation via Delta Object
    Result-Size Header (boo#1271696)
  * CVE-2026-53584: submodule: check paths for escaping (boo#1271697)
  * CVE-2026-53583: inverted IP SubjectAltName comparison in
    OpenSSL backend (boo#1271698)

==== libsoup ====
Subpackages: libsoup-3_0-0 libsoup-lang typelib-1_0-Soup-3_0

- Rename libsoup-CVE-2026-0716.patch to
  libsoup-CVE-2026-12478.patch to reflect the new CVE assignment
  (bsc#1271401 CVE-2026-12478).
- Add fix-samsung-tv-playback.patch: Update the content length
  decimal value when encoding is set to
  SOUP_ENCODING_CONTENT_LENGTH
- Refresh patches with quilt.

==== libupnp ====
Version update (2.0.2 -> 22.0.4)

- Update to release 22.0.4
  * Raise default SOAP content-length limit from 16K to 64K bytes.
  * Avoid potential double-unlocking of `GlobalHndRWLock` in
    function `UpnpSetContentLength`.
  * Stop resolving DNS during URI/GENA callback parsing
    [CWE-400 class issue].
  * Removed deprecated function `UpnpSetContentLength`.

==== libzypp ====
Version update (17.38.13 -> 17.38.14)

- zypp.conf: add solver.NoUpdateProvide (default: false) option.
  In general, packages that obsolete another package are treated as
  update candidates for the obsoleted package. However,
  SUSE-specific update rules prefer candidates that also explicitly
  'provide' the obsoleted package.
  Sometimes it is necessary or helpful to disable this rule.
  (may help in bsc#1261038)
- Use HttpHeader class for defining host specific http headers
  (bsc#1268321)
- Compile and link with -fPIE to build on sparc64 (fixes #742)
- version 17.38.14 (35)

==== multipath-tools ====
Version update (0.14.3+212+suse.f5d32098 -> 0.15~1+222+suse.cdcde840)
Subpackages: kpartx libmpath0

- Update to version 0.15~1+222+suse.cdcde840 (0.15 pre-release)
  * All path checkers run in asynchronous mode now by default, using a new
    generic asynchronous checker framework. This improves the stability of
    multipathd in the presence of non-responsive devices when using path
    checkers other than `tur` and `directio`. Use the `force_sync`
    parameter in `multipath.conf` to switch back to the previous, synchronous
    behavior, especially if you observe strong spikes of CPU load on systems
    with a lot of path devices. Note that the likelihood of such spikes should
    be strongly reduced since multipath-tools 0.10.0. Commit 6f7daba ff.
  * The configuration options `rr_min_io`, `rr_min_io_rq`, and `rr_weight` are now
    deprecated and have no effect. These options have not been supported by the
    kernel since version 4.6. Users should remove them from `multipath.conf`.
  * Fix ALUA asymmetric access state descriptions in multipathd logs, so that
    the same terms are used as by the kernel ("lba-dependent", "transitioning").
  * Don't set a hardware handler for bio-based multipath devices. The kernel
    rejects this anyway.
- Bug fixes:
  * Fix WWID detection for legacy devices that use the older SCSI-2 VPD page
    0x83 format for their device identifier.
  * kpartx: Fix an integer overflow in the GPT partition table size calculation.
    A crafted partition table with an extremely large number of partition entries
    could trigger the overflow. (bsc#1268145)
  * kpartx: Fix several issues in the DASD partition table reader that could be
    triggered by a maliciously crafted disk image. (bsc#1268144)
  * Fix duplicate "checker timed out" log messages when `log_checker_err` is
    set to `once`. (bsc#1254094)
  * Avoid potential buffer overflows in the iet and datacore prioritizers.
  * iet prioritizer: avoid misleading error message with systemd 256 and
    newer, and properly use udev to derive path parameters.
    (gh#opensvc/multipath-tools#145)
  * An overlong partition delimiter (-p option) could cause kpartx to crash.
    Fix it.
  * Man page improvements.

==== open-iscsi ====
Subpackages: iscsiuio libopeniscsiusr0

- Update to version 2.1.12.suse+0.8f77cf16:
  * Preparing for version 2.1.12 (#536)
  * Fix security issues recently discovered by Keith at Linneman Labs (#535)
    (CVE-2026-44943 and CVE-2026-44944)
  * iscsi-init.service: Use iscsi-gen-initiatorname
  * iscsi-gen-initiatorname use @IQN_PREFIX@ as default
  * avoid possible double free of found in idbm_rec_update_param (#528)
  * iscsi: validate interface IP against target address family (#527)

==== openSUSE-release ====
Version update (20260718 -> 20260720)
Subpackages: openSUSE-release-appliance-custom openSUSE-release-dvd

- automatically generated by openSUSE-release-tools/pkglistgen

==== patterns-base ====
Subpackages: patterns-base-apparmor patterns-base-base patterns-base-basesystem patterns-base-basic_desktop patterns-base-console patterns-base-enhanced_base patterns-base-minimal_base patterns-base-selinux patterns-base-sw_management patterns-base-x11 patterns-base-x11_enhanced

- Suggest sudo-rpm to give the solver a hint to prefer sudo.rpm
  over alternative dropins [bsc#1267899]

==== perl ====
Version update (5.42.1 -> 5.44.0)
Subpackages: perl-base

- update to 5.44.0
  * support named parameters in signatures
  * support aliased refs in mult-var foreach
  * enhanced /xx regexp pattern modifier
  * unicode 17.0 is supported
  * use of getentropy() for PRNG initialization
  * refreshed patches: perl-HiRes.t-timeout.diff

==== policycoreutils ====
Subpackages: policycoreutils-lang policycoreutils-python-utils python313-policycoreutils

- Drop /tmp cleanup to avoid TOCTOU issues (bsc#1271645)
  - can be dropped once "policycoreutils/scripts/fixfiles: drop /tmp cleanup" is
    in the upstream release
  - Add patch: 1271645-drop-tmp-cleanup.patch

==== python-pyasn1 ====
Version update (0.6.3 -> 0.6.4)

- Update to 0.6.4 (fixes CVE-2026-59884 (bsc#1271464),
  CVE-2026-59885 (bsc#1271465), CVE-2026-59886 (bsc#1271466))
  * CVE-2026-59885 (GHSA-8ppf-4f7h-5ppj): Fixed quadratic time complexity in
    the OBJECT IDENTIFIER and RELATIVE-OID decoders. A small crafted substrate
    encoding many arcs could consume excessive CPU. Arcs are now accumulated in
    linear time; decoded values are unchanged
  * CVE-2026-59884 (GHSA-m4p7-r5rc-7g4j): Limited BER long-form tag IDs to 20
    octets (140 bits), matching the OID arc limit introduced in 0.6.2.
    Unbounded tag IDs allowed a crafted substrate to consume excessive CPU and
    memory; longer tag IDs are now rejected with PyAsn1Error. Also fixed Tag
    and TagSet repr() failing on huge tag IDs due to the integer-to-string
    conversion limit
  * CVE-2026-59886 (GHSA-hm4w-wwcw-mr6r): Fixed excessive memory and CPU
    consumption in Real.__float__() for values with large base-10 exponents.
    Conversion no longer materializes huge intermediate integers; values too
    large to represent as a Python float raise OverflowError promptly, and
    prettyPrint() renders them as '<overflow>' as before. Also fixed base-10
    mantissa normalization to use exact integer arithmetic; mantissas larger
    than 2**53 could previously lose precision through float division
  * Pinned PyPI publish GitHub Action to an immutable commit

==== shaderc ====
Version update (2026.2 -> 2026.3)

- Update to release 2026.3
  * HLSL compilation (i.e. sources for Direct3D) is deprecated and
    will be removed in a future version.

==== suse-module-tools ====
Version update (16.1.5 -> 16.1.6)
Subpackages: suse-module-tools-scriptlets

- Update to version 16.1.6:
  * Add 65-md-raid-properties.rules (bsc#1261555, jsc#PED-16120)
    Always set serialize_policy sysfs attribute to 1 for RAID1 arrays

==== tar ====
Subpackages: tar-lang tar-rmt

- Add tar-acl_-prefix.patch: Avoid acl_ prefix for functions
  The acl.h header from libacl uses acl_ prefix for its functions.
  Avoid defining functions with the same name in order to protect
  its namespace.