Packages changed:
  bind (9.20.24 -> 9.20.26)
  cryptsetup (2.8.6 -> 2.8.7)
  gcc (15 -> 16)
  gtk-vnc
  kernel-firmware-amdgpu (20260629 -> 20260717)
  kernel-firmware-bluetooth (20260629 -> 20260720)
  kernel-firmware-platform (20260629 -> 20260717)
  kernel-firmware-qcom (20260629 -> 20260717)
  libeconf (0.8.3 -> 0.8.4)
  libfastjson (1.2304.0 -> 1.2304.0+ga630254)
  libndp (1.8 -> 1.9)
  libpng16 (1.6.57 -> 1.6.58)
  libssh (0.11.4 -> 0.11.5)
  microos-tools (4.0+git24 -> 4.0+git26)
  multipath-tools (0.14.3+212+suse.f5d32098 -> 0.15~1+230+suse.d36a6a70)
  openSUSE-release (20260724 -> 20260726)
  openssh (10.3p1 -> 10.4p1)
  openssh-askpass-gnome (10.3p1 -> 10.4p1)
  permissions (1699_20260715 -> 1699_20260723)
  python-zstandard
  rsyslog
  unbound (1.25.1 -> 1.25.2)
  virtualbox (7.2.12 -> 7.2.14)
  virtualbox-kmp (7.2.12_k7.1.3_1 -> 7.2.14_k7.1.4_1)
  wicked (0.6.79 -> 0.6.80)
  zstd

=== Details ===

==== bind ====
Version update (9.20.24 -> 9.20.26)
Subpackages: bind-doc bind-utils

- Upgrade to release 9.20.26
  Security Fixes:
  * Correct verification of NSEC3 signer name.
    (CVE-2026-10723)
    [bsc#1271982]
  * Malformed DNSKEY records could trigger an assertion.
    (CVE-2026-10822)
    [bsc#1271983]
  * Fix handling of RPZ CNAME expansion that returns too-long name.
    (CVE-2026-11331)
    [bsc#1271984]
  * Prevent excessive validation work from crafted negative
    responses.
    (CVE-2026-11605)
    [bsc#1271985]
  * Prevent cache exhaustion under sustained attack.
    (CVE-2026-11622)
    [bsc#1271986]
  * Stop accepting invalid signed wildcard records.
    (CVE-2026-11721)
    [bsc#1271987]
  * Do not assert for some specific CNAME and DNAME queries.
    (CVE-2026-12617)
    [bsc#1271988]
  * Prevent crash from malformed NSEC/NSEC3 response.
    (CVE-2026-13204)
    [bsc#1271989]
  * Fix DNSSEC validation bypass via out-of-zone NSEC Next Field.
    (CVE-2026-13321)
    [bsc#1271990]
  * Reclaim memory promptly when DNSSEC validations are canceled.
  Removed Features:
  * Remove the secondary validator in query.c.
  Bug Fixes:
  * Fix a bug in DNS UPDATE processing with inline-signing enabled.
  * Properly detect private records before copying.
  * Tighten referral DS acceptance.
  * Don't synthesize negative responses with pending NSEC.
  * Check that an NSEC signer is at or above the name to be
    validated.
  * Don't evict DNSSEC-validated cache data on a CD=1 NXDOMAIN.
  * Fix a deny-answer-aliases configuration bypass issue.
  * Reject external referrals from forwarders.
  * Fix a zone transfer over TLS (XoT) issue when using the
    opportunistic TLS mode.
  * Unvalidated opt-out NSEC3 could be accepted in insecurity
    proof.
  * Check wildcard signer and NOQNAME signer match.
  * Fix CNAME resolution failure caused by a cached SERVFAIL
    response.
  * Reject unsupported RSA DNSKEY shapes during DNSSEC validation.
  * Fix a bug in GeoIP2 string matching.
  * Fix DNS-over-HTTPS (DoH) quota configuration issue.
  * Truncated reply to a TSIG query no longer stalls the resolver.
  * Ignore updates removing DNSKEY RRset with class ANY.
  * Ignore 0-byte reads in the TCP read callback.
  * Only print per-zone glue stats when zone-statistics is set to
    full.
  * CDS/CDNSKEY records were not removed when re-configuring the
    server.
  * Fix a crash when querying an empty non-terminal in a wildcard
    zone in RBTDB.
  * Stop reusing outgoing TCP connections the peer has already
    closed.
  * Fix DNSSEC validation failures for names under an apex DNAME.

==== cryptsetup ====
Version update (2.8.6 -> 2.8.7)
Subpackages: cryptsetup-doc cryptsetup-lang libcryptsetup12

- Update to 2.8.7:
  * Changes related to Linux kernel AF_ALG crypto userspace interface
    deprecation Linux kernel maintainers decided to deprecate the
    AF_ALG interface, which was heavily used by cryptsetup, with the
    plan to remove it (or severely limit it) for security reasons.
    Libcryptsetup uses userspace (primarily via AF_ALG) for processing
    LUKS keyslots and for on-disk metadata handling for other formats.
    Using AF_ALG ensured that the same set of algorithms is present in
    userspace and later in-kernel for device activation.
    While libcryptsetup has a concept of fallback to userspace library,
    it was not used in all situations.
    In this version, libcryptsetup can use a userspace crypto library,
    AF_ALG (if present), and in some situations (LUKS keyslots), fallback
    to a temporary dm-crypt mapping. The last option requires root
    privileges. This ensures that most operations will continue to work
    even when AF_ALG is disabled or limited.
    Unfortunately, removing the AF_ALG could cause severe compatibility
    issues if the required algorithm (or encryption mode) is not implemented
    in the userspace library. A typical example is the Adiantum cipher,
    which is implemented only in the kernel. Also, ciphers like Serpent or
    Twofish (in XTS mode) are missing from several userspace libraries.
    The cryptsetup benchmark for ciphers is no longer available if the
    AF_ALG interface is unavailable.
  * Keyring handling changes.
    Libcryptsetup can use the kernel keyring to transfer the volume key
    into the kernel, avoiding sending it as a parameter to system calls.
    In previous versions, the volume key could be stored in the thread
    keyring, which should be removed when the process exits. Unfortunately,
    the thread keyring can remain active in some situations (such as when
    allocating a loop device). This could be a problem after calling
    luksSuspend when the volume key could remain in memory.
    Instead of loading volume keys directly into the thread keyring,
    cryptsetup now creates an intermediary keyring linked into the thread
    keyring and loads volume keys there.
    The intermediary keyring is now removed in the libcryptsetup context
    destructor (usually on application exit).
    Note that in previous versions, volume keys persisted until the process
    exited (even after the context destructor was called).
  * Changes related to possible LUKS volume key digest collisions.
    LUKS on-disk metadata uses a volume key digest generated by the PBKDF2
    key-derivation algorithm to verify that the decrypted volume key is valid.
    The use of PBKDF2 (instead of a more suitable cryptographic digest
    algorithm) is part of the original LUKS design. It was retained for LUKS2
    for compatibility (it allows easy in-place conversion).
    However, PBKDF2 has several design flaws. As it is based on HMAC
    (Hash-based Message Authentication Code), it also inherits the weak-key
    HMAC issue. In HMAC, the key can be arbitrarily long. If the key is shorter
    than the hash internal block size, it is padded with zeroes to a full block
    size. This flawed padding causes any HMAC key (shorter than the specified
    block size) to collide with keys that have added trailing zeroes. A collision
    means that HMAC (and PBKDF2) has the same output for colliding keys.
    In LUKS, a PBKDF2 collision is not a security issue; it cannot compromise
    data confidentiality.
    Moreover, the colliding key has a different length and should be rejected
    by the underlying block cipher. Unfortunately, in some reencryption
    scenarios (e.g., a header without keyslots), a collision key could be
    accepted, leading to possible data corruption.
    Code now always validates the expected key length.
    This validation is now strictly implemented in LUKS metadata processing.
    In the long term, LUKS will need to upgrade to a better volume key digest
    algorithm, but that will make the format backward-incompatible.
  * Support Aria and Camellia ciphers in the libgcrypt cryptographic backend.
  * Fix pkg-config library entry for the Mbed TLS cryptographic backend.
  * Better document CRYPT_VOLUME_KEY_NO_SEGMENT and CRYPT_VOLUME_KEY_DIGEST_REUSE
    API flags. The keyslot created with the CRYPT_VOLUME_KEY_NO_SEGMENT flag must
    always be unbound (not assigned to the default data segment). The use of the
    CRYPT_VOLUME_KEY_DIGEST_REUSE flag does not make sense without the
    CRYPT_VOLUME_KEY_NO_SEGMENT or CRYPT_VOLUME_KEY_SET flags.
  * Fix several possible corner cases in OpenSSL cryptographic backend (based
    on AI analysis).
    These include checking before casting from size_t to int, checking return
    values for the old OpenSSL HMAC API, avoiding sending a partial buffer to
    the caller if the operation fails, and explicitly checking for buffer length
    overflow. Most of these cannot happen in the libcryptsetup context, but the
    cryptographic backend can be used for other projects.
  * Code hardening based on various AI analysis reports.
    Including a fix for snprintf truncation in libdevmapper code, avoiding
    possible leak of JSON keyslot object on error path, and a fix for
    reencryption temporary device name.
  * Fix jq (JSON commandline processor) use in testing scripts.
    After the security update for jq, it no longer processes JSON with
    trailing zeroes.
    Regression test scripts were updated to avoid using this scenario.
  * Add support for --integrity-legacy-hmac in integritysetup open command.
    Integritysetup open command incorrectly configured options for legacy
    HMAC devices. To use --integrity-legacy-hmac, it must now be used both
    on format and open.
  * Fix cryptsetup --tries option not to overflow for high values.
  * Remove patches upstream:
  - cryptsetup-Add-keyring-key-type.patch
  - cryptsetup-Load-volume-keys-in-intermediary-keyring-linked-in-t.patch
  - cryptsetup-Use-unique-intermediary-keyring-name-per-device.patch
  - cryptsetup-tests-revoke-keys-instead-unlinking-from-thread-keyr.patch
  - cryptsetup-tests-verify-VK-and-internal-keyring-cleanup-after-p.patch
  - cryptsetup-tests-refactor-keyring-helpers.patch
  - cryptsetup-tests-verify-intermediary-keyring-cleanup-after-cryp.patch

==== gcc ====
Version update (15 -> 16)

- Bump GCC version to 16, leave -build flavor at 13.
- Add packages for Algol 68.
- Disable gccgo for loongarch64.

==== gtk-vnc ====
Subpackages: gtk-vnc-lang libgtk-vnc-2_0-0 libgvnc-1_0-0 libgvncpulse-1_0-0

- Replace BuildRequires on python3-devel with python3-base

==== kernel-firmware-amdgpu ====
Version update (20260629 -> 20260717)

- Update to version 20260717 (git commit fb91c990e602):
  * amdgpu: DMCUB updates for various ASICs
  * amdgpu: DMCUB updates for various ASICs

==== kernel-firmware-bluetooth ====
Version update (20260629 -> 20260720)

- Update to version 20260720 (git commit 18cf97993f06):
  * linux-firmware: Add firmware file for Intel BlazarIW
  * linux-firmware: Update firmware file for Intel BlazarU core
  * linux-firmware: Update firmware file for Intel BlazarI core
  * linux-firmware: Update firmware file for Intel Scorpius core
- Update to version 20260703 (git commit c95059a3774b):
  * QCA: Add Bluetooth firmware for WCN6855 ROM 1.0

==== kernel-firmware-platform ====
Version update (20260629 -> 20260717)

- Update to version 20260717 (git commit fb91c990e602):
  * powervr: add firmware for Imagination Technologies BXM-4-64 GPU

==== kernel-firmware-qcom ====
Version update (20260629 -> 20260717)

- Update to version 20260717 (git commit fb91c990e602):
  * qcom: add ADSP firmware for hawi platform
  * qcom: Update DSP firmware for sa8775p platform

==== libeconf ====
Version update (0.8.3 -> 0.8.4)
Subpackages: libeconf0 libeconf0-32bit

- Update to version 0.8.4:
  * Described content of key_file in econf_readConfig* (#248)
  * Fix a missing word in README.md (#247)

==== libfastjson ====
Version update (1.2304.0 -> 1.2304.0+ga630254)

- update to upstream git revision ga630254 (boo#1272151)
  * fix: handle small buffered dump workspaces
  * docs: explain object child lookup traversal
  * benchmarks: address reproducibility review findings
  * speed up object child lookup
  * build: fix calloc transposed args
  * build: Use AC_CHECK_LIB to ensure libfastjson links against libm
  * Revert "build: link libfastjson against libm for modf()"
  * doc: clarify string buffer lifetime and thread safety
  * build: link libfastjson against libm for modf()
  * increment version number for next release cycle

==== libndp ====
Version update (1.8 -> 1.9)

- Update to version 1.9:
  * ndptool: add support for PREF64 option
  * libndp: add support for PREF64 option
  * libndp: valid route information option length
  * SubmittingPatches: update mailing list
- Drop libndp-CVE-2024-5564.patch: Fixed upstream.
- Use modern macros, make_install and ldconfig_scriptlets.

==== libpng16 ====
Version update (1.6.57 -> 1.6.58)
Subpackages: libpng16-16 libpng16-16-x86-64-v3

- version update to 1.6.58:
  * Fixed a regression introduced in version 1.6.56 that caused `png_get_PLTE`
    to return stale palette data after applying gamma and background transforms
    in-place.

==== libssh ====
Version update (0.11.4 -> 0.11.5)
Subpackages: libssh-config libssh4

- Update to 0.11.5:
  * Security:
  - CVE-2026-15370: Stack buffer overflow in SFTP server
    longname construction (bsc#1272162)
  - CVE-2026-59843: Denial of service via zero advertised
    channel packet size (bsc#1272164)
  - CVE-2026-59844: Denial of service via oversized SFTP read
    length (bsc#1272165)
  - CVE-2026-59845: Denial of service via unchecked ProxyCommand
    fork() failure (bsc#1272166)
  - CVE-2026-59846: Information disclosure via ProxyCommand %r
    username expansion (bsc#1272167)
  - CVE-2026-59847: Integrity downgrade via OpenSSL AES-GCM tag
    verification (bsc#1272168)
  - CVE-2026-59848: Denial of service via SFTP responses with
    unknown request IDs (bsc#1272169)
  - CVE-2026-59849: Denial of service via automatic certificate
    authentication loop (bsc#1272170)
  - CVE-2026-59850: Use-after-free via data callbacks on closed
    channels (bsc#1272171)
  - Zero-initialize every ssh_string
  * Compatibility:
  - Fix compatibility with C23 / gcc16
  * Bugfixes:
  - Fix multiple memory leaks, null checks, and error checks
  - Validate peer public key in DH key exchange
  - Avoid remote window overflow
  - Avoid off-by-one overflow during kbdint authentication
  - Avoid logging uninitialized sequence numbers
  - Avoid double conversion of SFTP version number
  - Send correct SFTP server version number
  - Avoid handling repeated SFTP INIT messages
  - Harmonize return values from SFTP server callbacks

==== microos-tools ====
Version update (4.0+git24 -> 4.0+git26)

- Update to version 4.0+git26:
  * test: Check if autorelabel files are removed after reboot
  * Move cp of /.autorelabel to /etc into rd_microos_relabel

==== multipath-tools ====
Version update (0.14.3+212+suse.f5d32098 -> 0.15~1+230+suse.d36a6a70)
Subpackages: kpartx libmpath0

- Update to version 0.15~1+230+suse.d36a6a70:
  * Even with the libudev wrapper code introduced in 0.14.0, multipathd ran into
    use-after-free errors in tests where multipathd was restarted frequently.
    Fix this by preventing thread cancellation during libudev calls.
    (gh#opensvc/multipath-tools#152).
  * libmultipath: async_checker: fix sync checker case (bsc#1272188)
- Update to version 0.15~1+222+suse.cdcde840 (0.15 pre-release)
  * All path checkers run in asynchronous mode now by default, using a new
    generic asynchronous checker framework. This improves the stability of
    multipathd in the presence of non-responsive devices when using path
    checkers other than `tur` and `directio`. Use the `force_sync`
    parameter in `multipath.conf` to switch back to the previous, synchronous
    behavior, especially if you observe strong spikes of CPU load on systems
    with a lot of path devices. Note that the likelihood of such spikes should
    be strongly reduced since multipath-tools 0.10.0. Commit 6f7daba ff.
  * The configuration options `rr_min_io`, `rr_min_io_rq`, and `rr_weight` are now
    deprecated and have no effect. These options have not been supported by the
    kernel since version 4.6. Users should remove them from `multipath.conf`.
  * Fix ALUA asymmetric access state descriptions in multipathd logs, so that
    the same terms are used as by the kernel ("lba-dependent", "transitioning").
  * Don't set a hardware handler for bio-based multipath devices. The kernel
    rejects this anyway.
- Bug fixes:
  * Fix WWID detection for legacy devices that use the older SCSI-2 VPD page
    0x83 format for their device identifier.
  * kpartx: Fix an integer overflow in the GPT partition table size calculation.
    A crafted partition table with an extremely large number of partition entries
    could trigger the overflow. (bsc#1268145)
  * kpartx: Fix several issues in the DASD partition table reader that could be
    triggered by a maliciously crafted disk image. (bsc#1268144)
  * Fix duplicate "checker timed out" log messages when `log_checker_err` is
    set to `once`. (bsc#1254094)
  * Avoid potential buffer overflows in the iet and datacore prioritizers.
  * iet prioritizer: avoid misleading error message with systemd 256 and
    newer, and properly use udev to derive path parameters.
    (gh#opensvc/multipath-tools#145)
  * An overlong partition delimiter (-p option) could cause kpartx to crash.
    Fix it.
  * Man page improvements.

==== openSUSE-release ====
Version update (20260724 -> 20260726)
Subpackages: openSUSE-release-appliance-custom openSUSE-release-dvd

- automatically generated by openSUSE-release-tools/pkglistgen

==== openssh ====
Version update (10.3p1 -> 10.4p1)
Subpackages: openssh-clients openssh-common openssh-server

- Add patch submitted to upstream to fix GSSAPI* options not
  working after servconf refactoring
  (https://bugzilla.mindrot.org/show_bug.cgi?id=3974):
  * 0001-Fix-GSSAPI-server-option-names.diff
- Rebase patches:
  * openssh-8.0p1-gssapi-keyex.patch
  * openssh-7.7p1-gssapi-new-unique.patch
- Update to openssh 10.4p1:
  = Potentially-incompatible changes
  * sshd(8): configuration dump mode ("sshd -G") now writes
    directives in mixed case (e.g. "PubkeyAuthentication") whereas
    previously it emitted only lower-case names.
  * sshd(8): on Linux systems with the seccomp sandbox enabled,
    failures to enable SECCOMP or NO_NEW_PRIVS are now fatal.
    Previously sshd(8) would log the error but continue operation,
    to support systems that lacked these features. Now systems that
    lack these should instead disable the sandbox at configure
    time.
  * ssh(1), sshd(8): make the transport protocol stricter by
    disconnecting if the peer sends non-KEX messages during a post-
    authentication key re-exchange. Previously a malicious peer
    could continue sending non-key exchange messages without
    penalty. These would be buffered, causing memory to be wasted
    up until the connection terminated or the server/client hit a
    memory limit. Implementations that do not restrict messages
    sent during key exchange as per RFC4253 section 7.1 may be
    disconnected. Reported by Marko Jevtic.
  = Security
  * sftp(1): when downloading files on the command-line using
    "sftp host:/path .", a malicious server could cause the file to
    be downloaded to an unexpected location. This issue was
    identified by the Swival Security Scanner.
  * scp(1): when copying files between two remote destinations, do
    not allow a malicious server to write files to the parent
    directory of the intended target directory.  This issue was
    identified by the Swival Security Scanner.
  * sshd(8): when using the "internal-sftp" SFTP server
    implementation (this is not the default), long command lines
    were previously truncated silently after the 9th argument. If a
    security-relevant option was in the 10th or later position, it
    would be discarded. Reported by Steve Caffrey.
  * sshd(8): add a documentation note to mention that the
    GSSAPIStrictAcceptorCheck option is ineffective when the server
    is joined to a Windows Active Directory. Reported by Yarin
    Aharoni of Safebreach.
  * sshd(8): DisableForwarding=yes didn't override PermitTunnel=yes
    as it was documented to do. Note that PermitTunnel is not
    enabled by default. Reported independently by Huzaifa
    Sidhpurwala of Redhat and Marko Jevtic.
  * sshd(8): avoid a potential pre-authentication denial of service
    when GSSAPIAuthentication was enabled (this feature is off by
    default). This was not mitigated by MaxAuthTries, but would be
    penalised by PerSourcePenalties. This was reported by Manfred
    Kaiser of the milCERT AT (Austrian Ministry of Defence).
  * sshd(8): fix a number of cases where the minimum authentication
    delay was not being enforced. Reported by the Orange
    Cyberdefense Vulnerability Team.
  * ssh(1): fix a possible client-side use-after-free if the server
    changes its host key during a key reexchange. This was reported
    by Zhenpeng (Leo) Lin of Depthfirst.
  = New features
  * All: add experimental support for a composite post-quantum
    signature scheme that combines ML-DSA 44 and Ed25519 as
    specified in draft-miller-sshm-mldsa44-ed25519-composite-sigs.
    This scheme is not enabled by default. To use it, you'll need
    to add it to HostKeyAlgorithms, PubkeyAcceptedAlgorithms, etc.
    Keys may be generated using "ssh-keygen -t mldsa44-ed25519".
  * ssh(1), sshd(8): replace the wildcard pattern matcher with an
    implementation based on an NFA. This avoids exponential
    worst-case behaviour for the old implementation.
  = Bugfixes
  * ssh-agent(1): fix incorrect reply to "query"
    SSH_AGENTC_EXTENSION requests. bz3967
  * sshd(8): avoid sending observably different messages for valid
    vs invalid users in GSSAPIAuthentication (disabled by default).
  * ssh(1), sshd(8): fix several bugs that incorrectly
    classified bulk traffic as interactive. bz3972, bz3958
  * ssh-keygen(1), ssh-add(1): skip unsupported key types when
    downloading resident keys from a FIDO token. Previously,
    downloads would abort when one was encountered. GHPR657
  * ssh(1): fix a potential use-after-free on an error path if
    cipher_init() fails.
  * sshd(8): perform stricter encoding and validation of transport
    state passed between sshd privilege separation subprocesses.
    This somewhat further hardens the server against attacks on
    sshd-auth or sshd-session subprocesses.
  * ssh-agent(1): avoid possible runtime denial of service by
    enforcing some limits on the length of usernames in key use
    constraints.
  * sftp(1): fix two separate one-byte out-of-bounds reads, in
    SSH2_FXP_REALPATH and batch command processing.
  * sftp-server(8): disallow use of the copy-data extension to read
    and write to the same inode simultaneously.
  * ssh(1), sshd(8): avoid strlen(NULL) crash if an X11 channel was
    created before the x11-req SSH_MSG_CHANNEL_REQUEST was sent.
    GHPR679
  * sftp(1), scp(1): avoid a situation where sftp_download() could
    get stuck in a loop if a broken server repeatedly returned zero
    length while reading a file.
    ... changelog too long, skipping 79 lines ...
  * fix-mac-validation-strsep-logic-bug.patch

==== openssh-askpass-gnome ====
Version update (10.3p1 -> 10.4p1)

- "Update" to openssh 10.4p1:
  * No changes for askpass, see main package changelog for
    details.

==== permissions ====
Version update (1699_20260715 -> 1699_20260723)
Subpackages: permctl permissions-config

- Update to version 1699_20260723:
  * profiles: add cap_net_admin for cloud-hypervisor (bsc#1270717)
- Update to version 1699_20260722:
  * profiles: fix ksystemstats6 bsc# reference syntax
  * profiles: add noisetorch cap_sys_resource (bsc#1270715)
- Update to version 1699_20260716:
  * profiles: reintroduce apptainer starter-suid (bsc#1268675)

==== python-zstandard ====

- Really build against system libzstd again: %pyproject_wheel does
  not honor %py_setup_args, so since the switch to the pyproject
  macros the bundled zstd copy was silently linked in statically.
  Pass --system-zstd via pip --config-settings instead.
- Add a check that the built module actually uses system libzstd,
  so this cannot regress silently again.
- BuildRequire packaging (imported by setup.py, previously pulled
  in only indirectly) and drop no longer needed wheel.

==== rsyslog ====

- fix imptcp regex-framing remote denial of service (bsc#1271910)
  * add 0001-imptcp-guard-regex-framing-match-at-line-start.patch

==== unbound ====
Version update (1.25.1 -> 1.25.2)
Subpackages: libunbound8 unbound-anchor

- Update to 1.25.2:
  * CVE-2026-14586: Assertion in libngtcp2 when under pressure in
    high concurrency DNS-over-QUIC environments
    [bsc#1271879]
  * CVE-2026-32665: Remote DNS-over-QUIC denial of service due to
    quic-size budget bypass
    [bsc#1271873]
  * CVE-2026-40691: Packet of death for DNSCrypt over TCP
    [bsc#1271875]
  * CVE-2026-41637: Degradation of resolution service from
    improperly accounted client-terminated DNS-over-QUIC queries
    [bsc#1271891]
  * CVE-2026-42955: Extra fix for CVE-2026-40622 to also clamp the
    TTL of A/AAAA records disallowing a one-time 'ghost domain'
    delegation renewal via glue records
    [bsc#1271892]
  * CVE-2026-44621: Libunbound applications configured with
    'unwanted-reply-threshold' could eventually be abruptly
    terminated
    [bsc#1271876]
  * CVE-2026-44687: Off-by-one error in 'harden-below-nxdomain'
    logic can shadow a stub/forward zone by a legitimate parent's
    NXDOMAIN
    [bsc#1271893]
  * CVE-2026-44690: Cross-zone wildcard cache poisoning via
    RRSIG.labels manipulation
    [bsc#1271877]
  * CVE-2026-46582: A wildcard replay, as another piece of data,
    triggers poisoning in the serve expired reply path
    [bsc#1271894]
  * CVE-2026-50045: 'max-global-quota' reset by DNSSEC validation
    restarts
    [bsc#1271878]
  * CVE-2026-50046: Possible heap use-after-free in an error path
    when a DoT forwarded query is jostled out
    [bsc#1271882]
  * CVE-2026-50243: 'response-ip'/'rpz' can rewrite BOGUS answers
    instead of returning SERVFAIL
    [bsc#1271880]
  * CVE-2026-50248: BOGUS configured primary hostname accepted for
    XFR in auth/rpz zones
    [bsc#1271881]
  * CVE-2026-50251: Attacker supplied 0.0.0.0/:: glue triggers
    defensive full-cache flush
    [bsc#1271883]
  * CVE-2026-50252: Possible cache poisoning attack by mapping
    source port population per thread
    [bsc#1271884]
  * CVE-2026-52863: Memory corruption could lead to crash and
    denial of service
    [bsc#1271885]
  * CVE-2026-54478: DNS Cookie bypass when combined with
    proxy-protocol use
    [bsc#1271895]
  * CVE-2026-55708: Privacy/configuration issue when adding local
    data in views through 'unbound-control'
    [bsc#1271896]
  * CVE-2026-55717: 'serve-expired-client-timeout' and
    'response-ip' CNAME redirect could lead to a crash
    [bsc#1271886]
  * CVE-2026-55973: 'dns-error-reporting: yes' leads to stack
    buffer overflow
    [bsc#1271874]
  * CVE-2026-55990: Packet of death for a DNSCrypt misconfigured
    Unbound
    [bsc#1271887]
  * CVE-2026-55991: Remote DNS-over-QUIC (DoQ) flow-control
    assertion failure in libngtcp2
    [bsc#1271888]
  * CVE-2026-56416: Possible heap buffer overflow when validator
    canonicalizes RDATA that contains domain name
    [bsc#1271889]
  * CVE-2026-56444: Degradation of resolution service when
    'discard-timeout' and 'serve-expired-client-timeout' are
    combined in unusual configuration
    [bsc#1271890]

==== virtualbox ====
Version update (7.2.12 -> 7.2.14)

- Update to release 7.2.14
  * VMM: Avoided querying/setting xcr0 for CPUs without xsave
    feature when using Windows Hyper-V as the virtualization engine
  * Linux Host: Added initial support for kernel 7.2
  * Linux Guest: Fixed support for updated RHEL 9.8 and 9.9 kernels
  * UEFI: Fixed possible bug check and reboot of Windows 11 when
    updating Secure Boot DBX entries
- Drop 0001-7.2-Backported-r174461-Linux-vboxdrv-Add-initial-sup.patch,
  0002-7.2-Backported-r174462-Linux-vboxnetadp-Add-initial-.patch
  (merged)

==== virtualbox-kmp ====
Version update (7.2.12_k7.1.3_1 -> 7.2.14_k7.1.4_1)

- Update to release 7.2.14
  * VMM: Avoided querying/setting xcr0 for CPUs without xsave
    feature when using Windows Hyper-V as the virtualization engine
  * Linux Host: Added initial support for kernel 7.2
  * Linux Guest: Fixed support for updated RHEL 9.8 and 9.9 kernels
  * UEFI: Fixed possible bug check and reboot of Windows 11 when
    updating Secure Boot DBX entries
- Drop 0001-7.2-Backported-r174461-Linux-vboxdrv-Add-initial-sup.patch,
  0002-7.2-Backported-r174462-Linux-vboxnetadp-Add-initial-.patch
  (merged)

==== wicked ====
Version update (0.6.79 -> 0.6.80)
Subpackages: wicked-service

- Update to version 0.6.80
  - Immutable Mode: conditionally install configs, scripts and extensions in /usr,
    document the /usr vs /etc config split in the manual pages, and render via new
    util/templatepp.gawk preprocessor (gh#openSUSE/wicked#1075,gh#openSUSE/wicked#1076)
  - xpath: fix gcc-15.x assignment discards 'const' warning (gh#openSUSE/wicked#1074)
  - nanny: use opaque id for managed-netif dbus path (gh#openSUSE/wicked#1070)
  - netlink: remove libnl-route dependency (gh#openSUSE/wicked#1068)
  - spec: guard the sle_version macro (gh#openSUSE/wicked#1067)
  - service: drop rcwicked* links on 16.x (jsc#PED-266,gh#openSUSE/wicked#1066)
  - client: add iaid show,get --iaid-format option (gh#openSUSE/wicked#1064)
  - ovs: suppress harmless ovs-vsctl discover call errors (gh#openSUSE/wicked#1063)
  - teamd: fix TEAM_LACP_ACTIVE default to true (gh#openSUSE/wicked#1062)
  - policy: cleanup managed objectmodel, fsm-policy match and transform processing
    (gh#openSUSE/wicked#1055,gh#openSUSE/wicked#1056,gh#openSUSE/wicked#1057,
    gh#openSUSE/wicked#1059,gh#openSUSE/wicked#1060)

==== zstd ====
Subpackages: libzstd1 libzstd1-x86-64-v3

- Cleanup .spec file