Packages changed:
  crypto-policies
  gd
  gimp
  google-noto-fonts (20260701 -> 20260801)
  libgpg-error
  libphonenumber (9.0.34 -> 9.0.36)
  libraw (0.22.1 -> 0.22.2)
  mozjs140 (140.12.0 -> 140.13.0)
  mpg123 (1.33.6 -> 1.33.7)
  openSUSE-release (20260803 -> 20260804)
  polkit-default-privs (1550+20260623.563df94 -> 1550+20260803.90784eb)
  python-pip (26.1.2 -> 26.2)

=== Details ===

==== crypto-policies ====
Subpackages: crypto-policies-scripts

- Disable umac-128* in DEFAULT, FUTURE and BSI openssh policies (bsc#1259515)
  * Add patch:
    crypto-policies-Disable-umac-128-in-DEFAULT-FUTURE-and-BSI-openssh-policies.patch

==== gd ====
Subpackages: libgd3

- modified patches [bsc#1273101]
  * gd-CVE-2026-9672.patch (fix wrong backport)

==== gimp ====
Subpackages: gimp-plugin-aa gimp-plugin-python3 libgimp-3_0-0 libgimpui-3_0-0

- Add CVE fixes:
  + gimp-CVE-2026-66757.patch (bsc#1273151 CVE-2026-66757)
  + gimp-CVE-2026-66758.patch (bsc#1273152 CVE-2026-66758)
  + gimp-CVE-2026-66759.patch (bsc#1273153 CVE-2026-66759)

==== google-noto-fonts ====
Version update (20260701 -> 20260801)
Subpackages: google-noto-sans-arabic-fonts google-noto-sans-fonts google-noto-sans-symbols-fonts google-noto-sans-symbols2-fonts

- Update to 20260801:
  * Sans Batak: fix the lack of anchoring on the "A" letter (#14)

==== libgpg-error ====
Subpackages: libgpg-error0 libgpg-error0-32bit

- Add upstream patch to fix build on 32-bit arm:
  * libgpg-error-fix-armv7.patch

==== libphonenumber ====
Version update (9.0.34 -> 9.0.36)

- update to 9.0.36:
  * Updated alternate formatting data for country calling code(s):
    995
  * Updated phone metadata for region code(s):
    BD, EH, FO, GE, IL, LI, MA, ML, NO, SJ
  * Updated short number metadata for region code(s): FO, IT
  * Updated carrier data for country calling code(s):
    47 (en), 61 (en), 212 (en), 256 (en), 298 (en), 423 (en),
    972 (en), 995 (en)
- includes changes from 9.0.35:
  * Updated alternate formatting data for country calling code(s): 995
  * Updated phone metadata for region code(s):
    AC, CN, FO, GE, IR, KE, SE, UG, ZW
  * Updated short number metadata for region code(s): FR
  * Updated geocoding data for country calling code(s): 86 (en, zh)
  * Updated carrier data for country calling code(s):
    61 (en), 86 (en, zh), 93 (en, fa), 247 (en), 250 (en),
    254 (en), 256 (en), 263 (en), 298 (en), 420 (en), 976 (en),
    995 (en)

==== libraw ====
Version update (0.22.1 -> 0.22.2)

- update to 0.22.2:
  * Fixed 6yr old typos in USE_6BY9RPI 8- and 16- bit
    decoders
  * trimSpaces: Improved handling of zero-length strings
    and strings consisting only of spaces
  * Misc fixups
  * Fix links to license files in contributing document
  * removeExcessiveSpaces: handle zero-length strings
    the right way
  * contributing rules updated
  * Zero read buffers before fread
  * FP DNG loader: check for tile index;
    convertFloatToInt: avoid possible integer overflow
  * open_bayer(): reject images with raw size/visible
    size less than 22 (as in open_file/identify);
    vng_interpolate: do not interpolate images less than 8x8
  * PPM16 thumb: check against LIBRAW_MAX_THUMBNAIL_MB
  * open_bayer(): additional input data checks
  * Olympus/14bit: refuse incorrect wbits metadata
  * X3F decoder: initialise raw storage if
    LIBRAW_CALLOC_RAWSTORE defined
  * crx decoder: check plane size agains
    imgdata.rawparams.max_raw_memory_mb
  * Crx decoder: avoid possible int32 overflow on
    allocation size calculations
  * check for ifd->bps values in FP DNG decoder
  * fixed stack memory/previous image metadata exposure
    (reported by DMSAN)
  * LibRaw_memmgr: allow malloc to fail on local pointer
    array small allocation. It will definitely fall later on
    large-buffer allocation
  * rotated fuji: stricter image size limits;
    raw2image(ex): avoid possible 32-bit overflow on alloc size
    calculations
  * width/height and iwidth/height values documented
  * width/height and iwidth/height values documented
  * wavelet denoise: ensure allocation size not exceed
    4GB
  * unpack_thumb:  check JPEG thumbnail size before
    performing allocation;  Remove all allocation test results
    because LibRaw::calloc/malloc will raise exception if
    allocation fails
  * removed row_stride signed/unsigned mix; check
    row_stride value against buffer size
  * fixed possible next struct item override in
    x3f_parse
  * parse_phase_one: prevent buffer overrun if incorrect
    flat field data provided
  * Limit parse_mos recursion depth; parse_qt: raise
    exception, do not hide too depth nesting error
  * parse_qt: avoid too deep recursion

==== mozjs140 ====
Version update (140.12.0 -> 140.13.0)

- Update to version 140.13.0:
  + Various security fixes
  + See https://www.firefox.com/en-US/firefox/140.13.0/releasenotes/

==== mpg123 ====
Version update (1.33.6 -> 1.33.7)
Subpackages: libmpg123-0 mpg123-openal

- Update to version 1.33.7
  mpg123:
  * Fix information disclosure of uninitialied memory for
  - -auth-file without line endings.
  * Fix out-of-bounds read/write when combining --continue
  - -random --listentry <n> where n is larger than the playlist
    size.
  * Fix a harmless valgrind memory leak report by not nulling
    playlist name.
  * Fix a mostly harmless OOB read of 1 byte when printing USLT
    lyrics.
  * Fix leaking file descriptor on read error from --equalizer
    file.
  * Hardening of loading HTTP(S) via curl or wget against funky
    URLs by including the -- separator. No actual vulnerability,
    tough, just extra care.
  out123:
  * Fix heap overrun on --endian conversion with differing input
    and output channel counts.
  * Fix parsing of filter specs with whitespace before commas,
    which resulted in out-of-bounds writes before.
  libmpg123, mpg123: Harden memory realloc calls against
    multiplication overflow of size_t in arguments.
    Specifically, this addresses part of bug 389 with possible
    application abuse of mpg123_set_index64().
  libmpg123:
  * Fix possible use of uninitialized values in layer III
    dequantization.
    III_dequantize_sample() for consistent output also for
    strange input. The new code seems to be slightly faster
    after some rearrangements.
  * Fix a double free when deleting a handle after failed
    mpg123_decoder() call
    (possibly among others).
  * More strong wording in API that ID3 text convenience links
    are short-lived, but safeguard against ignorant use by
    nulling them early.
  * Prevent double free in mpg123_set_index() 32 bit wrapper
    being called with index size 0.
  * Harden against an application wielding a foot gun by handing
    in an undersized decoding buffer betwee seek and read
    (return error before trying to decode and discard frames in
    that case).
  * Do properly terminate ID3v2 texts coming in UTF16 encoding
    when they overwrite previous frames, like with other
    encodings. The symptom was a shorter second frame resulting
    in a combined text with the earlier longer frame.
  * Check and properly handle null source buffer and zero size
    in mpg123_store_utf8() instead of reading past (before)
    buffers.
  * Ensure clients get ID3v1 data with (unmotivated)
    mpg123_id3_raw() only if the parser decided that it is there,
    not possibly the last 128 bytes of a seekable stream without
    ID3v1 tag.
  * Prevent impossible NtoM resampling with too low target rate
    (like 1 Hz) which would trgger endless looping.
  libout123:
  * Fix deadlock in buffer mode when combined with (stereo) 24
    bit output. Now also mpg123 --buffer 4096 -e s24 shall
    actuallly work. Sorry.
  * Abort early on zero/negative rate and channel count in
    out123_start().
  * Fix divide by zero in WAV writing by catching channel counts
    that go zero in the 16 bit WAV header field.
  libsyn123:
  * Explictly reject mismatched format for appending filters with
    syn123_setup_filter(), preventing memory errors from that
    API-violating use.
  * Harden the dirty resampling interpolator against extreme
    rates (around 1e18 Hz)
    by fixing a sample offset check to not do the exact
    overflowing addition that it is supposed to guard against.
    The fine resampler was… fine.
  * Error out on trying to create a filter of order 0 instead of
    dividing by zero later.

==== openSUSE-release ====
Version update (20260803 -> 20260804)
Subpackages: openSUSE-release-appliance-custom openSUSE-release-dvd

- automatically generated by openSUSE-release-tools/pkglistgen

==== polkit-default-privs ====
Version update (1550+20260623.563df94 -> 1550+20260803.90784eb)

- Update to version 1550+20260803.90784eb:
  * profiles: renamed calamares (bsc#1273196)
  * build(deps): bump actions/checkout from 6.0.2 to 7.0.1

==== python-pip ====
Version update (26.1.2 -> 26.2)

- Update to 26.2 (bsc#1273090, CVE-2026-13346):
  [#] Deprecations and Removals
  - Newly published packages will no longer be immediately visible to
    pip if the index uses caching. To install a newly published
    package, use ``--refresh-package``.
  - Drop support for detecting legacy, non-:pep:`405`, ``virtualenv``
    (< 20) environments.
  - Constraints files, including ``PIP_CONSTRAINT``, no longer affect
    isolated build environments. Use ``--build-constraint`` or the
    ``PIP_BUILD_CONSTRAINT`` environment variable to constrain build
    dependencies instead.
    The ``--use-feature=build-constraint`` flag is now always enabled
    and has no effect.
  [#] Features
  - Declare support for Python 3.15
  - Support self-referential extras officially. pip has supported this
    by accident since version 21.2.
  - Add ``--only-deps`` flag to instruct pip to select only the
    dependencies of supplied packages. It cannot be used with
    ``--no-deps``, ``-r``, ``--group``, or
    ``--requirements-from-script``.
  - Cache simple responses in accordance to their ``Cache-Control``
    header instead of always revalidating on every request. To refresh
    cached package index responses and ensure newly published packages
    are found, use ``--refresh-package <package>``.
  - Add ``--no-require-hashes`` to disable automatic enablement of
    ``--require-hashes`` when encountering a requirement with hashes.
  - Honor ``--only-final`` when sourcing requirements with ``-r
    pylock.toml``.
  - Add support for ``pylock.toml`` ``upload-time`` field, so
    ``--uploaded-prior-to`` works with ``-r pylock.toml``.
  - Better error messages in case of conflicts with requirements from
    ``-r pylock.toml``.
  - Add experimental support for isolating build subprocesses by
    creating standard virtual environments. This will fix most (if not
    all) subtle isolation issues that can lead to broken builds
    exclusive to pip. The feature can be enabled via
    ``--use-feature=venv-isolation`` and will be enabled by default in
    a future release.
    Note that the feature has limited compatibility with
    ``--use-feature=inprocess-build-deps``.  While most builds should
    work with both features enabled, there are known edge cases.
    ``inprocess-build-deps`` will not be enabled by default until they
    are fixed.
  - Present more informative diagnostic errors on uncaught network
    errors.
  - Allow opting out of Git partial clones with
    ``PIP_NO_PARTIAL_CLONE_FOR_BROKEN_GIT_SERVER``.
  - Add a ``--no-proxy-env`` (or ``--proxy ""``) option to ignore
    proxies configured via non-pip environment variables or
    configuration files.  A proxy set with ``--proxy`` is still used.
  - Add support for pulling username from keyring subprocess provider
  - Speedup tab autocompletion by lazy-importing certain modules.
  - Improve cached wheel lookup performance when many cached wheels
    are checked for compatibility.
  - Speed up path compaction when displaying uninstall changes.
  [#] Bug Fixes
  - Only emit the invalid-metadata warning once per location per run,
    instead of repeating it during the same command.
  - Handle ``BrokenPipeError`` when pip output is piped to a command
    that closes early.
  - Follow symlinks while checking if installed scripts are on PATH.
  - Stop dropping extras from messages about candidates with
    inconsistent metadata.
  - Stop animating progress bars and status spinners when running on
    CI, even if ``FORCE_COLOR`` is set.
  - Ensure truststore feature remains active while initially
    connecting to a HTTPS proxy.
  - Address encoding warnings emitted when Python's UTF-8 Mode is
    enabled by continuing to use the configured locale.
  - Raise an error when the :pep:`658` ``.metadata`` file used during
    dependency resolution disagrees with the downloaded wheel's
    ``METADATA`` on ``Name``, ``Version``, ``Requires-Dist``,
    ``Requires-Python`` or ``Provides-Extra``.
  - Prevent system packages from leaking into isolated build
    environments on Python 3.15
  - Never use persistent wheel cache for local directory requirements
    even if there is a matching entry.
  - Avoid re-fetching a pinned Git commit that is already present
    locally.
  - Report the correct configuration level for ``cert`` in ``pip
    debug`` output.
  - Fix ``pip show`` crash when a distribution has no
    ``Metadata-Version``.
  - Remove empty ``http-v2`` cache directories when running ``pip
    cache purge``.
  - Report a copy failure in ``pip wheel`` instead of a misleading
    build failure.
  - Make ``pip install`` conflict checks independent of installed
    distribution iteration order.
  - Fix ``ProtocolError`` exceptions raised after an incomplete
    download from bypassing download resume logic and leading to a
    crash.
  - Fix caching bug where local directory requirements would be cached
    if the directory name contains a dash.
  - Avoid reparsing distribution metadata when formatting the default
    ``pip list`` columns output with the importlib backend.
  - Fix decoding the URL path twice while determining a link filename
    (CVE-2026-13346).
    ... changelog too long, skipping 38 lines ...
    requirement marker.