Packages changed: dracut (112+suse.29.gc0c5e1d -> 112+suse.34.g35e16b7) faad2 (2.11.2.git18 -> 2.11.3) libfprint libselinux libselinux-bindings postgresql18 (18.4 -> 18.6) python-M2Crypto (0.48.0 -> 0.49.0) python-Pygments (2.20.0 -> 2.21.0) python-rich qt6-base (6.11.1 -> 6.11.2) qt6-declarative (6.11.1 -> 6.11.2) qt6-imageformats (6.11.1 -> 6.11.2) qt6-location (6.11.1 -> 6.11.2) qt6-multimedia (6.11.1 -> 6.11.2) qt6-networkauth (6.11.1 -> 6.11.2) qt6-positioning (6.11.1 -> 6.11.2) qt6-qt5compat (6.11.1 -> 6.11.2) qt6-quick3d (6.11.1 -> 6.11.2) qt6-quicktimeline (6.11.1 -> 6.11.2) qt6-shadertools (6.11.1 -> 6.11.2) qt6-speech (6.11.1 -> 6.11.2) qt6-svg (6.11.1 -> 6.11.2) qt6-tools (6.11.1 -> 6.11.2) qt6-translations (6.11.1 -> 6.11.2) qt6-virtualkeyboard (6.11.1 -> 6.11.2) qt6-wayland (6.11.1 -> 6.11.2) qt6-webchannel (6.11.1 -> 6.11.2) qt6-webengine (6.11.1 -> 6.11.2) qt6-webview (6.11.1 -> 6.11.2) selinux-policy (20260810 -> 20260820) timezone tree-sitter unbound virtualbox (7.2.14 -> 7.2.16) virtualbox-kmp (7.2.14_k7.1.8_1 -> 7.2.16_k7.1.8_1) === Details === ==== dracut ==== Version update (112+suse.29.gc0c5e1d -> 112+suse.34.g35e16b7) - Update to version 112+suse.34.g35e16b7: * fix(devicetree-firmware): include Qualcomm X2 laptop model specific firmwares * fix(devicetree-firmware): include soc specific firmwares in install_generic() (bsc#1267865) * refactor(devicetree-firmware): make looping over fw_dir top-level loop * fix(resume): handle noresume kernel command line option (bsc#1274588) * fix(resume): actually get value from resume= kernel command line option ==== faad2 ==== Version update (2.11.2.git18 -> 2.11.3) - Update to version 2.11.3: * Fix ISO C warning in libfaad/fixed.h * Check for mp4config.frame.nsclices == 0 in frontend/mp4read.c to fix Heap Buffer Overflow * SBR: prevent heap overflow in channel-pair reconstruction * Fix off-by-one frame index check in mp4read_seek * Fix integer overflow in stszin/stscin allocation size checks * Bound sscanf field width in option parsing * Fix out-of-bounds iq_table read in iquant for -32768 * Prevent length_of_rvlc_sf underflow in rvlc_scale_factor_data * Fix out-of-bounds Xsbr write in hf_assembly sinusoid addition * Fix out-of-bounds X underflow in SBR low-power QMF assembly * Fix ssr_gc_function signature mismatch in ssr_gain_control * Fix signed overflow in estimate_current_envelope energy sum * Cap escape length in huffman_spectral_data_2 * Prevent num_bits_left underflow in ps_data extension parsing * Fix signed overflow in fixed-point sample rounding before saturation * Add sanity checks on the width in libfaad/specrec.c * Check the last swb_offset value is valid in libfaad/specrec.c * Return early from NeAACDecInit when the object type can't be supported * Fix null pointer dereferences in intra channel and long term prediction * Increase the ASC buffer from 10 to 64 bytes in frontend/mp4read.h ==== libfprint ==== Subpackages: libfprint-2-2 libfprint-2-tod1 - Add libfprint-tests subpackage with installed tests for gnome-desktop-testing-runner ==== libselinux ==== Subpackages: libselinux1 libselinux1-32bit selinux-tools - fix swig 4.5.0 compatibility (bsc#1275512). adding libselinux-Replace-PyString_FromString-with-PyUnicod.patch - Drop man_selinux_disabled_mismatch_kernel_config.patch, current libselinux doesn't behave like this anymore ==== libselinux-bindings ==== - fix swig 4.5.0 compatibility (bsc#1275512). adding libselinux-Replace-PyString_FromString-with-PyUnicod.patch ==== postgresql18 ==== Version update (18.4 -> 18.6) Subpackages: libpq5 postgresql18-contrib postgresql18-llvmjit postgresql18-server - Let llvmjit-devel require the llc and clang binaries to fix build of extensions on SLE-16.1 and newer. - Update to version 18.6: https://www.postgresql.org/docs/18/release-18-6.html https://www.postgresql.org/about/news/postgresql-186-1711-1615-1519-1424-and-19-beta-3-released-3365/ Security Fixes: - bsc#1275046, CVE-2026-6464: psql COPY FROM STDIN early failure processes data lines as psql commands (CVSS v3.1: 8.1) - bsc#1275044, CVE-2026-6469: ALTER TABLE ALTER TYPE resets extended statistics ownership (CVSS v3.1: 3.8) - bsc#1275043, CVE-2026-6470: Fails to check type USAGE privilege (CVSS v3.1: 4.3) - bsc#1275042, CVE-2026-6471: Logical decoding can dlopen arbitrary file (CVSS v3.1: 7.2) - bsc#1275001, CVE-2026-14662: tsvector and tsquery undersize allocations, via integer wraparound (CVSS v3.1: 8.8) - bsc#1275002, CVE-2026-14663: pgcrypto, for OpenSSL-disabled ciphers, silently encrypts to and decrypts from cleartext (CVSS v3.1: 6.5) - bsc#1275068, CVE-2026-14664: Regexp heap buffer overflow executes arbitrary code (CVSS v3.1: 8.8) - bsc#1275067, CVE-2026-14666: Row security caching disregards role modifications (CVSS v3.1: 4.2) - bsc#1275066, CVE-2026-14668: ctid type confusion in selectivity estimator discloses derivative of arbitrary read (CVSS v3.1: 8.1) - bsc#1275065, CVE-2026-14669: to_char heap buffer overflow executes arbitrary code (CVSS v3.1: 8.8) - bsc#1275064, CVE-2026-14670: plperl tied object heap buffer overflow executes arbitrary code (CVSS v3.1: 8.8) - bsc#1275063, CVE-2026-14671: refint plan cache type confusion executes arbitrary code (CVSS v3.1: 8.8) - bsc#1275062, CVE-2026-14672: Observable response discrepancy with non-default scram_iterations provides user existence oracle (CVSS v3.1: 5.3) - bsc#1275061, CVE-2026-14673: amcheck does not clear untrusted search path (CVSS v3.1: 3.8) - bsc#1275060, CVE-2026-14676: pg_stat_statements heap buffer overflow executes arbitrary code (CVSS v3.1: 8.8) - bsc#1275059, CVE-2026-14677: 32-bit pltcl and plperl undersize allocations, via integer wraparound (CVSS v3.1: 8.8) - bsc#1275058, CVE-2026-14678: pg_trgm picksplit reads past end of buffer (CVSS v3.1: 4.3) - bsc#1275057, CVE-2026-14679: Stack buffer overflow in argument match writes 0x0 and 0x1 to server memory (CVSS v3.1: 8.2) - bsc#1275056, CVE-2026-14680: Type confusion via "internal" arguments (CVSS v3.1: 8.8) - bsc#1275055, CVE-2026-14681: Improper enforcement of GSSAPI encryption when coupled with SSL (CVSS v3.1: 4.2) - bsc#1275054, CVE-2026-15741: Expression deparse allows SQL injection via EXTRACT argument (CVSS v3.1: 8.8) - bsc#1275053, CVE-2026-15742: fuzzystrmatch writes effectively-arbitrary addresses, via integer wraparound (CVSS v3.1: 8.8) - bsc#1275052, CVE-2026-16238: Type confusion in pg_restore_attribute_stats() executes arbitrary code (CVSS v3.1: 8.8) - bsc#1275051, CVE-2026-16239: Type confusion in cursor CLOSE + DECLARE executes arbitrary code (CVSS v3.1: 8.8) - bsc#1275050, CVE-2026-16241: ECPG integer underflow can crash the client (CVSS v3.1: 3.8) - bsc#1275049, CVE-2026-18024: ascii() function reads past end of buffer (CVSS v3.1: 4.3) - bsc#1275048, CVE-2026-18408: psql \unrestrict lets superuser of pg_dump origin server execute arbitrary code in psql client (CVSS v3.1: 8.8) - bsc#1275047, CVE-2026-19385: pg_dump heap buffer overflow executes arbitrary code (CVSS v3.1: 8.8) ==== python-M2Crypto ==== Version update (0.48.0 -> 0.49.0) - Update to 0.49.0: - defer unavailable ENGINE constant lookup - fixes problematic behaviour of pkcs11-provider - support TLS 1.0 contexts with modern OpenSSL - use Python 3 C APIs in handwritten SWIG code (bsc#1275165) - feat: Add AES-GCM (AEAD) support to M2Crypto - remove Black configuration from setup.cfg - release X509V3 config with its context - keep IOBuffer chains alive until destruction - test: free low-level OpenSSL objects in leak tests - avoid leaking X509V3 extension config - free RSA exponent on modulus conversion failure - free replaced EVP digest contexts - wrap created X509 name entries with ownership - own ASN1 values created from Python data - own PKCS7 certificate stack copies - release BIOs on explicit close - Add AuthorityKeyIdentifier extension support ==== python-Pygments ==== Version update (2.20.0 -> 2.21.0) - update to 2.21.0: * New lexers: + BitBake (#3103) + Caddyfile (#3225) + CEL (#3048) + PureScript (#1077, #3054) * Updated lexers: + Bash: Fix coloured keyword at the beginning of a name (#2926) + Boogie: Add missing Boogie and Civl Verifier keywords (#3156) + C#: - Recognize interpolated verbatim strings with either ``$@`` or ``@$`` prefixes (#2685) - Support dollar-prefixed and multi-quote raw strings (#3129, #2897) - Recognize ``union`` (#3182) + C/C++: - Add C23/C++26 attributes (#3084) - Add more C2Y keywords (#3092) - Highlight a function following a namespace body (#2928) - Fix C/C++ lexer support for multiline pre-processor comments (#3051) - Add ``.ipp`` as a file extension (#3141, #1008) + Clojure: Recognize named, octal and unicode character literals such as ``\space`` and ``\o377`` as a single token (#979) + Csound: Add missing opcode parameter type letter (#3161) + CUDA: Derive from the C++ lexer instead of C to highlight C++ constructs such as ``template``, ``class`` and ``namespace`` (#3127) + D: Allow non-ASCII (Unicode) identifiers (#1088) + Fish: Fix single quote backslash escape (#3138, #2821) + Go: Various lexer improvements (#3199) + GoogleSQL: Require a word break after ``SET`` (#3167) + Hexdump: Only match valid digits (#3200, #2847) + JavaScript: Highlight the ``arguments`` object (#3146) + Jsonnet: Recognize colons in array slice expressions (#2828) + JSX: Allow apostrophes in element text (#2816) + Julia: Fix rstrings backslash (#3140, #2537) + Kotlin: Support companion objects without an explicit name (#2525) + Kotlin: Don't let a nullable type marker (``?``) consume the following character, so ``Foo?,`` and ``a?:b`` tokenize correctly (#2964) + Kusto: Recognize member-access dots in dynamic objects (#2779) + Lua: Various improvements (#3143) + Macaulay2: Update symbols to 1.26.05 (#3120) + Markdown: - Highlight bold-italics (``***...***`` and ``___...___``) (#3067) - Fix mention regex to support hyphens in usernames (#3139, #3135) + Markdown, reStructuredText, TiddlyWiki5: Fix wrong token offsets for embedded code blocks (#3133) + Mathematica: Recognize ``\[Name]`` named-character escapes such as ``\[Nu]`` instead of emitting an ``Error`` token (#3097) + MATLAB, Octave, Scilab: Allow ``...`` line continuations in function definition signatures (#659) + MySQL: Require a word break after ``SET`` (#3110) + PostgreSQL: Add more keywords (#3066) + Python: - Recognize ``sentinel`` (#3114) - Recognize ``frozendict`` (#3119) - Recognize lazy imports (#3115) + reStructuredText: Allow ``.`` and ``+`` in directive/role names (#3085) + Ruby: Don't duplicate the body of an unterminated heredoc (#2998) + Ruby: Treat ``<<`` after ``)``, ``]`` or ``}`` as the shift operator rather than the start of a heredoc (#760) + SCSS: Recognize variable references in property values (#2818) + Shell: Recognize chevron prompts (#3096) + Smithy: Fix text blocks and add missing syntax (#3168) + Swift: Keep ``func`` a keyword in ``class func`` type methods (#1125) + Tcl: Stop ``$name`` variable references at a dash (#1720) + TeX: Recognize LaTeX math environments as math (#3034) + Twig: Allow uppercase letters at the start of identifiers (#3159, #2965) + TypeScript: Only treat ``module`` as a keyword when followed by whitespace, so identifiers like ``modules`` and ``module.exports`` are highlighted correctly (#2823) + Vala: Recognize verbatim strings before ordinary quoted strings (#2861) + Vala: Recognize conditional compilation directives (#2858) + Vim: - Bump the syntax file to vim 9.2 (#3183, #3174) - Small improvements to the VimScript lexer (#3173) + YAML: Add ``yml`` alias (#3169), recognize non-breaking spaces as valid scalar content (#2827) + WebAssembly: Recognize sign-extension operators (#2991, #3160) + XML: Mark SVG files as XML (#3093) * New styles: Night Owl (#3132) * Fix catastrophic backtracking in ``looks_like_xml`` (#2931, #3112) * Improve monokai theme colors (#3100) ... changelog too long, skipping 13 lines ... * HtmlFormatter: ``"`` and ``'`` now render literally (#3185) ==== python-rich ==== - Skip tests broken by Pygments 2.21.0 for now ==== qt6-base ==== Version update (6.11.1 -> 6.11.2) Subpackages: libQt6Concurrent6 libQt6Core6 libQt6DBus6 libQt6Gui6 libQt6Network6 libQt6OpenGL6 libQt6OpenGLWidgets6 libQt6PrintSupport6 libQt6Sql6 libQt6Test6 libQt6WaylandClient6 libQt6Widgets6 libQt6WlShellIntegration6 libQt6Xml6 qt6-network-tls qt6-networkinformation-connman qt6-networkinformation-glib qt6-networkinformation-nm qt6-platformtheme-gtk3 qt6-printsupport-cups qt6-sql-mysql qt6-sql-sqlite qt6-wayland - Update to 6.11.2 https://www.qt.io/blog/qt-6.11.2-released ==== qt6-declarative ==== Version update (6.11.1 -> 6.11.2) Subpackages: libQt6LabsAnimation6 libQt6LabsFolderListModel6 libQt6LabsPlatform6 libQt6LabsQmlModels6 libQt6LabsSettings6 libQt6LabsSharedImage6 libQt6LabsStyleKit6 libQt6LabsSynchronizer6 libQt6LabsWavefrontMesh6 libQt6Qml6 libQt6QmlCore6 libQt6QmlLocalStorage6 libQt6QmlMeta6 libQt6QmlModels6 libQt6QmlNetwork6 libQt6QmlWorkerScript6 libQt6QmlXmlListModel6 libQt6Quick6 libQt6QuickControls2-6 libQt6QuickControls2Impl6 libQt6QuickDialogs2-6 libQt6QuickDialogs2QuickImpl6 libQt6QuickDialogs2Utils6 libQt6QuickEffects6 libQt6QuickLayouts6 libQt6QuickParticles6 libQt6QuickShapes6 libQt6QuickTemplates2-6 libQt6QuickTest6 libQt6QuickVectorImage6 libQt6QuickWidgets6 qt6-declarative-imports - Update to 6.11.2 https://www.qt.io/blog/qt-6.11.2-released - Drop patch, merged upstream: * 0001-QQmlTableInstanceModel-refactor-QModelIndex-calculat.patch ==== qt6-imageformats ==== Version update (6.11.1 -> 6.11.2) - Update to 6.11.2 https://www.qt.io/blog/qt-6.11.2-released ==== qt6-location ==== Version update (6.11.1 -> 6.11.2) Subpackages: libQt6Location6 - Update to 6.11.2 https://www.qt.io/blog/qt-6.11.2-released ==== qt6-multimedia ==== Version update (6.11.1 -> 6.11.2) Subpackages: libQt6Multimedia6 libQt6MultimediaQuick6 libQt6MultimediaWidgets6 libQt6Quick3DSpatialAudio6 libQt6SpatialAudio6 qt6-multimedia-imports - Update to 6.11.2 https://www.qt.io/blog/qt-6.11.2-released ==== qt6-networkauth ==== Version update (6.11.1 -> 6.11.2) - Update to 6.11.2 https://www.qt.io/blog/qt-6.11.2-released ==== qt6-positioning ==== Version update (6.11.1 -> 6.11.2) Subpackages: libQt6Positioning6 libQt6PositioningQuick6 qt6-positioning-imports - Update to 6.11.2 https://www.qt.io/blog/qt-6.11.2-released ==== qt6-qt5compat ==== Version update (6.11.1 -> 6.11.2) Subpackages: libQt6Core5Compat6 qt6-qt5compat-imports - Update to 6.11.2 https://www.qt.io/blog/qt-6.11.2-released ==== qt6-quick3d ==== Version update (6.11.1 -> 6.11.2) Subpackages: libQt6Quick3D6 libQt6Quick3DAssetImport6 libQt6Quick3DAssetUtils6 libQt6Quick3DEffects6 libQt6Quick3DHelpers6 libQt6Quick3DHelpersImpl6 libQt6Quick3DParticleEffects6 libQt6Quick3DParticles6 libQt6Quick3DRuntimeRender6 libQt6Quick3DUtils6 libQt6Quick3DXr6 qt6-quick3d-imports - Update to 6.11.2 https://www.qt.io/blog/qt-6.11.2-released ==== qt6-quicktimeline ==== Version update (6.11.1 -> 6.11.2) - Update to 6.11.2 https://www.qt.io/blog/qt-6.11.2-released ==== qt6-shadertools ==== Version update (6.11.1 -> 6.11.2) - Update to 6.11.2 https://www.qt.io/blog/qt-6.11.2-released ==== qt6-speech ==== Version update (6.11.1 -> 6.11.2) Subpackages: libQt6TextToSpeech6 qt6-texttospeech - Update to 6.11.2 https://www.qt.io/blog/qt-6.11.2-released ==== qt6-svg ==== Version update (6.11.1 -> 6.11.2) Subpackages: libQt6Svg6 libQt6SvgWidgets6 - Update to 6.11.2 https://www.qt.io/blog/qt-6.11.2-released ==== qt6-tools ==== Version update (6.11.1 -> 6.11.2) Subpackages: libQt6Designer6 libQt6UiTools6 qt6-tools-qdbus - Update to 6.11.2 https://www.qt.io/blog/qt-6.11.2-released ==== qt6-translations ==== Version update (6.11.1 -> 6.11.2) - Update to 6.11.2 https://www.qt.io/blog/qt-6.11.2-released ==== qt6-virtualkeyboard ==== Version update (6.11.1 -> 6.11.2) Subpackages: libQt6HunspellInputMethod6 libQt6VirtualKeyboard6 libQt6VirtualKeyboardQml6 qt6-virtualkeyboard-imports - Update to 6.11.2 https://www.qt.io/blog/qt-6.11.2-released ==== qt6-wayland ==== Version update (6.11.1 -> 6.11.2) - Update to 6.11.2 https://www.qt.io/blog/qt-6.11.2-released ==== qt6-webchannel ==== Version update (6.11.1 -> 6.11.2) Subpackages: libQt6WebChannel6 libQt6WebChannelQuick6 qt6-webchannel-imports - Update to 6.11.2 https://www.qt.io/blog/qt-6.11.2-released ==== qt6-webengine ==== Version update (6.11.1 -> 6.11.2) Subpackages: libQt6WebEngineCore6 libQt6WebEngineQuick6 libQt6WebEngineWidgets6 qt6-webengine-imports - Update to 6.11.2 https://www.qt.io/blog/qt-6.11.2-released - Drop patch, merged upstream: * 0001-Fix-AMD-VA-API-flickering-on-Wayland-by-allowing-mul.patch ==== qt6-webview ==== Version update (6.11.1 -> 6.11.2) - Update to 6.11.2 https://www.qt.io/blog/qt-6.11.2-released ==== selinux-policy ==== Version update (20260810 -> 20260820) Subpackages: selinux-policy-targeted - Update to version 20260820: * Label the postgresql executables correctly (bsc#1274861) ==== timezone ==== Subpackages: tzselect - Install "right" files in SLES/Leap 16.x (bsc#1273508) ==== tree-sitter ==== Subpackages: libtree-sitter0_26 libtree-sitter0_26-x86-64-v3 - Do not emit treesitter_grammar_src() rpm symbols for relative require() paths (., .., ./, ../). Local relative requires are still followed to find nested external grammar deps. Fixes installcheck on grammars that share a sibling common/ directory (nothing provides treesitter_grammar_src(../common) for tree-sitter-php-devel). - Add an opt-in Python binding macro to the grammar framework. Review follow-up: generate a Python loader instead of compiling the upstream C binding, so the parser is not built a second time: * %treesitter_python_install installs upstream's pure-Python bindings/python package files as-is and replaces the compiled _binding extension with a generated _binding.py that loads the grammar library from %{_libdir}/tree-sitter via ctypes and hands its TSLanguage pointer to python-tree-sitter as the "tree_sitter.Language" PyCapsule the Language() constructor expects - no duplicate parser, no compiler, no wheel * New source tree-sitter-python-shim.py.in: the template the generated _binding.py comes from, shipped in %{_rpmconfigdir} so it is versioned and testable instead of inlined in a macro * %treesitter_python_build is a deprecated no-op; consumers no longer need the python devel/pip/wheel/setuptools/installer BuildRequires * The python subpackage pins the grammar package exactly (Requires: %{name} = %{version}-%{release}); library and binding come from the same source package and move in lockstep * %treesitter_python_install also takes an explicit multi-language form, MODNAME GRAMMAR..., for upstream modules that expose several grammars from one python package: each grammar yields a language_() function loading its own library, matching the upstream binding of tree-sitter-typescript (language_typescript and language_tsx, no plain language) * Consuming specs still carry the (now much smaller) singlespec template literally: the python-rpm-macros generator re-reads the raw spec text for the %package template, so an %include fragment cannot provide it (the BuildRequires alone could move to a fragment - the OBS scheduler does resolve %include - but splitting one small block across two files is not worth it) * Documented python subpackage dep is Suggests: python-tree-sitter >= 0.22, not Requires -- python-tree-sitter is not in Rings:1-MinimalX, so a hard Requires fails Staging installcheck for ring1 grammars (matching tree-sitter-bash) * No change for grammar packages that do not opt in ==== unbound ==== Subpackages: libunbound8 unbound-anchor - Add patch to fix build issue with swig 4.5 [unbound-swig-4.5-compat.patch] ==== virtualbox ==== Version update (7.2.14 -> 7.2.16) - Update to release 7.2.16 * GUI: Updated Catalan translations * GUI: Fixed OVF import warning visibility * GUI: Added graceful handling of inaccessible VMs * Graphics: VMSVGA 3D performance improvements * Video Recording: Fixed a hang when stopping recording after a large number of display updates * Host: OpenSSL 4.0 build fixes * Linux Host: Support for FRED * Linux Host and Guest: Improvements in shared clipboard handling in Wayland ==== virtualbox-kmp ==== Version update (7.2.14_k7.1.8_1 -> 7.2.16_k7.1.8_1) - Update to release 7.2.16 * GUI: Updated Catalan translations * GUI: Fixed OVF import warning visibility * GUI: Added graceful handling of inaccessible VMs * Graphics: VMSVGA 3D performance improvements * Video Recording: Fixed a hang when stopping recording after a large number of display updates * Host: OpenSSL 4.0 build fixes * Linux Host: Support for FRED * Linux Host and Guest: Improvements in shared clipboard handling in Wayland