Packages changed: MozillaFirefox (155.0 -> 155.0.1) boost-base boost-extra bubblewrap (0.11.2 -> 0.12.0) chrony clamav evolution-data-server ffmpeg-8 gegl (0.4.70 -> 0.4.72) gstreamer-plugins-bad gtk3 (3.24.52 -> 3.24.52+git59.b30343717d) hwdata (0.410 -> 0.411) ibus ibus_gtk4 libbpf libheif (1.23.2 -> 1.23.4) liblouis (3.38.0 -> 3.39.0) libvirt (12.6.0 -> 12.7.0) libxml2 (2.15.3 -> 2.15.4) libzypp (17.38.14 -> 17.38.15) lightdm-gtk-greeter-branding-openSUSE localsearch (3.11.1 -> 3.11.2) mariadb-connector-c nautilus (50.3 -> 50.3.1) perl-Cpanel-JSON-XS (4.430.0 -> 4.440.0) perl-MIME-tools (5.517.0 -> 5.518.0) python-numpy (2.5.2 -> 2.5.3) qemu (11.1.0 -> 11.1.1) rpcbind sg3_utils (1.48+35.c49e7c08 -> 1.48+36.936c7ae) wireless-regdb (20260530 -> 20260903) wireplumber (0.5.15 -> 0.5.17) zypper (1.14.98 -> 1.14.101) === Details === ==== MozillaFirefox ==== Version update (155.0 -> 155.0.1) Subpackages: MozillaFirefox-branding-upstream MozillaFirefox-translations-common - Mozilla Firefox 155.0.1 https://www.firefox.com/en-US/firefox/155.0.1/releasenotes * Fixed Firefox becoming unresponsive on some pages that use CSS blur and backdrop filters together. (bmo#2068836) * Fixed the sidebar not reappearing after restarting Firefox when the "Hide tabs and sidebar" option was turned on. (bmo#2065431) * Fixed some profile icons not being displayed in the account and application menus. (bmo#2064729, bmo#2067734) * Fixed the current device being listed among connected devices in the account menu. (bmo#2059763) ==== boost-base ==== Subpackages: boost-license1_91_0 libboost_filesystem1_91_0 libboost_filesystem1_91_0-x86-64-v3 libboost_iostreams1_91_0 libboost_iostreams1_91_0-x86-64-v3 libboost_locale1_91_0 libboost_locale1_91_0-x86-64-v3 libboost_program_options1_91_0 libboost_program_options1_91_0-x86-64-v3 libboost_thread1_91_0 libboost_thread1_91_0-x86-64-v3 - Also install the CMake package config for the header-only Boost.System during the base build: since CMake 4 removed the FindBoost module, find_package(Boost COMPONENTS system) falls through to BoostConfig.cmake, which requires a per-component boost_system-config.cmake that the top-level b2 install no longer generates now that the compatibility stub library is gone. Package it in libboost_headers-devel. ==== boost-extra ==== Subpackages: libboost_python-py3-1_91_0 libboost_python-py3-1_91_0-x86-64-v3 - Also install the CMake package config for the header-only Boost.System during the base build: since CMake 4 removed the FindBoost module, find_package(Boost COMPONENTS system) falls through to BoostConfig.cmake, which requires a per-component boost_system-config.cmake that the top-level b2 install no longer generates now that the compatibility stub library is gone. Package it in libboost_headers-devel. ==== bubblewrap ==== Version update (0.11.2 -> 0.12.0) Subpackages: bubblewrap-zsh-completion - update to 0.12.0: * The flag --not-a-security-boundary was added. If this is enabled then failure of some sandbox setup steps (like remounting a submount) are not fatal. * The license has been updated from LGPL 2.0 (or later) to LGPL 2.1 (or later). * This version removes the support for building a setuid bubblewrap. Changes in this version made it difficult to support and basically all modern linux distributions now support unprivileged user namespaces to some extent. * The assume_kernel build option was added, if specified no backwards compatiblity for kernels older than this is built in (and will result in hard failures at runtime). Currently specifying 5.6.0 or later will disable the fallback implementation of openat2(RESOLVE_IN_ROOT). * Bubblewrap now correctly resolves absolute symlinks during the sandbox setup by using openat2 with RESOLVE_IN_ROOT (or a fallback implementation). This fixes a security issue (GHSA-pxhw-h44j-8pfx) where file or directories created during sandbox setup could follow parent symlinks out of the sandbox. ==== chrony ==== Subpackages: chrony-pool-openSUSE - Create /var/lib/chrony via tmpfiles ==== clamav ==== Subpackages: libclamav12 libclammspack0 libfreshclam4 - Put libclamunrar into an optional subpackage, because it has a NonFree license. - Improve macro usage for the library subpackages. - Add clamav-libcheck-workarounds.patch to work around missing macros in libcheck-0.10.0 on SLE-12-SP5. ==== evolution-data-server ==== Subpackages: evolution-data-server-lang libcamel-1_2-67 libebackend-1_2-11 libebook-1_2-21 libebook-contacts-1_2-5 libecal-2_0-3 libedata-book-1_2-27 libedata-cal-2_0-2 libedataserver-1_2-27 libedataserverui-1_2-4 - Move %{_libexecdir}/evolution-data-server/evolution-data-server (without installed-tests) back to the main package (boo#1277935). ==== ffmpeg-8 ==== Subpackages: libavcodec62 libavfilter11 libavformat62 libavutil60 libswresample6 libswscale9 - Enable decoders in ffmpeg-8-mini that need no extra build dependencies. This makes it possible for some packages to run testsuites with e.g. WAV files. ==== gegl ==== Version update (0.4.70 -> 0.4.72) Subpackages: gegl-0_4 gegl-0_4-lang libgegl-0_4-0 typelib-1_0-Gegl-0_4 - Drop gegl-CVE-2026-18300.patch: This was applied upstream several versions back. Our original patch was a backport, and we still had an extra bit of code from that left over that still applied and nobody noticed since quilt rebases it so nicely for us. - Update to version 0.4.72: + Build: - Build with pure MSVC as well as wasm - Improvements to defcheck, - Minimum meson version bumped to 0.60 - More CI integration, harmonized with gimp/babl + Core: - Use G_{BEGIN|END}_DECLS in all header declarations - gegl_param_color_cmp, new function - Avoid crashes in gegl_path + Buffer: - Refactoring, comments and documentation comments in GeglBufferIterator - Avoid duplicate, aliasing stack allocations + OpenCL: - Update headers to OpenCL 3.0 - Use gmodule for loading, also on windows - Buffer access code refactored, unifying destruction code paths - Move kernels to operations part of directory hierarchy - Warn on console on initialization errors + Ops: - General: make more consistent use of title case (changing strings, affecting translations) - Factor out common deps for ops in meson - rgbe_load: bail if x or y dimension larger than max scanline width, also further robustness for corrupt files - exp_combine: use public rather than private APIs, qsort rather than g_sort_array - waterpixels, normal-map, gblur-1d: fix crashes due to stack allocations in loop - introspect: fix warnings in console - ff-load, ff-save: disable by default - rawbayer-load (in workshop, not built by default): avoid code execution - normal-map: fix scratch buffer allocations - sdl3-display: SDL3 variant of display op - workshop/sharpen: new operation implementing the classic GIMP sharpen filter - Add pkgconfig(sdl3) BuildRequires: New dependency. - Rebase gegl-CVE-2026-18300.patch with quilt. ==== gstreamer-plugins-bad ==== Subpackages: gstreamer-plugins-bad-lang libgstadaptivedemux-1_0-0 libgstanalytics-1_0-0 libgstbadaudio-1_0-0 libgstbasecamerabinsrc-1_0-0 libgstcodecparsers-1_0-0 libgstcodecs-1_0-0 libgstcuda-1_0-0 libgsthip-1_0-0 libgstinsertbin-1_0-0 libgstisoff-1_0-0 libgstmpegts-1_0-0 libgstmse-1_0-0 libgstphotography-1_0-0 libgstplay-1_0-0 libgstsctp-1_0-0 libgsturidownloader-1_0-0 libgstva-1_0-0 libgstvulkan-1_0-0 libgstwayland-1_0-0 libgstwebrtc-1_0-0 libgstwebrtcnice-1_0-0 - Disable msdk plugin, currently broken, and in practice abandoned upstream. It is also ranked as 0, so to even attempt to use it, users have to manually enable it via the command line. ==== gtk3 ==== Version update (3.24.52 -> 3.24.52+git59.b30343717d) Subpackages: gtk3-data gtk3-immodule-amharic gtk3-immodule-inuktitut gtk3-immodule-thai gtk3-immodule-tigrigna gtk3-immodule-vietnamese gtk3-immodule-xim gtk3-lang gtk3-schema gtk3-tools libgtk-3-0 typelib-1_0-Gtk-3_0 - Update to version 3.24.52+git59.b30343717d: + filechooser: Avoid converting CSS font size twice + a11y: Do not emit false focus changes for a notebook tab on page changes + Window: Free empty string set to gtk-menu-bar-accel + wayland: Align decoration layout fallback with GtkSettings + filechooserwidget: stop the location and load timeouts in dispose - Update to version 3.24.52+git48.b9cc75f19f: + menu: Avoid scrolling too far + gtkapplication: Fix gtk_application_dbus_register return value + gtk/window: NULL check settings before disconnecting handler + gtkwindow: Clear active state on disappearing pointer + gdk/wayland: Remove unused field in _GdkWaylandSelection + gdk/wayland: Make primary selection and clipboard updates less racy + gdk/wayland: Clear dnd targets + gdk/wayland: Set clipboard targets atomically + Focus does not return to the main window when closing File Chooser + gdk/wayland: Add support for wl_fixes.ack_global_remove + x11: Fix wrong display when getting xatom - Drop gtk3-fix-xi2-xatom.patch:fixed upstream. ==== hwdata ==== Version update (0.410 -> 0.411) - Update to version 0.411: * Update pci and vendor ids ==== ibus ==== Subpackages: ibus-dict-emoji ibus-gtk ibus-gtk3 ibus-lang libibus-1_0-5 typelib-1_0-IBus-1_0 - Backport patches to fix crashes with GNOME 51 (boo#1279542): + 1a331e695d84fc6bae8f2d11c52d4776df49647b.patch + 5bbe88a1936246185a65f76e58cc85871401e59a.patch ==== ibus_gtk4 ==== - Backport patches to fix crashes with GNOME 51 (boo#1279542): + 1a331e695d84fc6bae8f2d11c52d4776df49647b.patch + 5bbe88a1936246185a65f76e58cc85871401e59a.patch ==== libbpf ==== - Use make macros with -C ==== libheif ==== Version update (1.23.2 -> 1.23.4) Subpackages: gdk-pixbuf-loader-libheif libheif-aom libheif-dav1d libheif-ffmpeg libheif-jpeg libheif-openh264 libheif-openjpeg libheif-rav1e libheif-svtenc libheif1 - Update to version 1.23.4: * CVE-2026-XXXXX: The max_items security limit was not enforced for the child boxes of iinf, so a file could declare an unbounded number of items. * CVE-2026-XXXXX: Unbounded recursion in the reference-cycle check crashed the parser on a long chain of derived items, without bound when the item-count limit is disabled. * CVE-2026-XXXXX: Permanent decoder deadlock through a lock-order inversion in parallel grid tile decoding (enabled by default). * CVE-2026-XXXXX: Heap out-of-bounds read in the encoder pluginsi for images whose luma and chroma bit depths differ. * CVE-2026-XXXXX: Unreclaimable memory leak in heif_track_get_next_raw_sequence_sample(). * CVE-2026-XXXXX: Heap out-of-bounds read in the WebCodecs decoder plugin - includes fixes from 1.23.3: * CVE-2026-XXXXX: Heap buffer overflow (write) in the uncompressed (unci) mixed-interleave decoder when the two chroma components declare different bit depths. * CVE-2026-XXXXX: Permanent decoder deadlock through a reference cycle between an image and its alpha auxiliary image. * CVE-2026-XXXXX: Heap out-of-bounds read in the YCbCr 4:2:0 to 16-bit interleaved RGB conversion when the chroma planes have a lower bit depth than luma * CVE-2026-XXXXX: Heap buffer overflow in the SVT-AV1 encoder plugin when encoding a high-bit-depth alpha channel, and a double free on its send-picture error path. * CVE-2026-84451: Incomplete fix: the tile range check of the unci decoder (without icef) could still overflow, allowing an out-of-bounds read * CVE-2026-XXXXX: Heap out-of-bounds read when converting odd- height 4:2:0 frames of an uncompressed (uncv) image sequence to RGB. * CVE-2026-XXXXX: Out-of-bounds read in the RGB to YCbCr identity- matrix color conversion when the R, G, and B planes have different bit depths * CVE-2026-84450: A clap property combined with an oversized ispe reached an assert() in the Fraction arithmetic and aborted the process (incomplete fix). An error is returned instead. * Fix Several smaller findings * Fix Undefined behavior (negative shift) in the HDR bit-depth up-conversion for target bit depths above 16. Such conversions are now rejected. * A number of bug fixes ==== liblouis ==== Version update (3.38.0 -> 3.39.0) Subpackages: liblouis-data liblouis20 python3-louis - Update to version 3.39.0: + A lot of dedicated work by Bue, Tiago, Clive, Leonard, Anthony, Andrey, Dimitar, Danil Kostenkov, Dmitriy Lazarev, Christian Comaschi and Seeing Hands went into this release, and as always Bert did a lot of the work that holds it all together. It adds braille for Haitian Creole and for Māori, the latter following the policy of the Braille Authority of New Zealand Aotearoa Trust, which also brings new tables for English text in New Zealand. The Portuguese grade 1 table has been thoroughly overhauled, the English grade 3 table gained more than 5000 new hyphenation patterns, and the Russian tables gained mathematical braille definitions as well as the last of the grade 1 contractions. The Bulgarian, Italian and Biblical Hebrew tables all back-translate considerably better than before, and the UEB grade 2 shortforms have been cleaned up, which also makes the compiled table smaller. On the technical side several memory safety issues were fixed, building with clang and MSVC on Windows works again, and the ~spacing~ parameter of the translation functions has been deprecated. ==== libvirt ==== Version update (12.6.0 -> 12.7.0) Subpackages: libvirt-client libvirt-daemon-common libvirt-daemon-config-network libvirt-daemon-driver-network libvirt-daemon-driver-nodedev libvirt-daemon-driver-qemu libvirt-daemon-driver-secret libvirt-daemon-driver-storage libvirt-daemon-driver-storage-core libvirt-daemon-driver-storage-disk libvirt-daemon-driver-storage-iscsi libvirt-daemon-driver-storage-iscsi-direct libvirt-daemon-driver-storage-logical libvirt-daemon-driver-storage-mpath libvirt-daemon-driver-storage-rbd libvirt-daemon-driver-storage-scsi libvirt-daemon-lock libvirt-daemon-log libvirt-daemon-plugin-lockd libvirt-daemon-qemu libvirt-libs - Update to libvirt 12.7.0 - CVE-2026-18917, CVE-2026-77158, CVE-2026-77159 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v12-7-0-2026-09-01 ==== libxml2 ==== Version update (2.15.3 -> 2.15.4) Subpackages: libxml2-16 libxml2-tools - Update to version 2.15.4: + Security: - xmlregexp: Prevent out-of-bounds read in NXT macro - fix: add missing overflow checks in dict.c, uri.c, and valid.c - xmlregexp: Calc string length after null checking - xpointer: Check overflow in xmlXPtrEvalXPtrPart - xmlIO: Check for int overflow before calling writecallback - fix(xinclude): propagate parseFlags in xmlXIncludeProcess and xmlXIncludeProcessTree + Improvements: - Improve bound checks for xmlcatalog and xmllint arguments (out-of-bound) - Fix memory leak in static Windows library (memory-leak) - xmlreader: Copy DTD in xmlTextReaderDumpCopy - parser: Fix double free in xmlIOParseDTD (double-free) - parser: fix division-by-zero when maxAmpl is set to 0 - parser: Fix memory leak in xmlCtxtSetSaxHandler (memory-leak) - catalog: Make sure to reset catalog resolve cache - xmlAddChild: unlink node before free for text nodes (memory-leak) - Normalize entity values in attr in xmlNodeGetContent - Handle whitespace for date/time/duration types - catalog: Fix NULL deref for nextCatalog without 'catalog' attribute (null-deref) - Drop libxml2-CVE-2026-11979.patch: Fixed upstream. ==== libzypp ==== Version update (17.38.14 -> 17.38.15) - Prevent libgpgme from launching gpg-agents; we don't need them. - defaultLoadSystem: Hand out the ZYpp::Ptr as return value. - Log all solver problem rules (bsc#1277790) The log contains the most relevant problem rule, but sometimes it helps to know all rules associated with this problem. zypper shows them on demand as 'detail'. The log now remembers them as well. - Replace popen cat/zcat with solv_xfopen for testcase loaders (fixes #749) - repoGpgCheck: Strictly follow the repo_gpgcheck setting (bsc#1274625) There's been a legacy exception for unsigned repositories which were explicitly accepted in the past. After switching the repo_gpgcheck from off to on, they were allowed to stay unsigned until a first signed version was retrieved. From there on the handling was strict. Now the handling is strict as soon as the repo_gpgcheck turned on. The next set of metadata retrieved must be signed. - Iniparser: each new file starts in the unnamed section (bsc#1272534) - Fix hasCredentials() to require both username AND password to be non-empty (bsc#1273242) This avoids an unnecessary 2nd 401 response sending just the username in case the username but no password is known. Now it immediately fetches the credentials from disk if no password is known. - GPG Key hints in repoindex.xml require at least a long id to allow auto-import (bsc#1271730) The short Id (32bit/8byte) is not considered to be a safe identifier for a gpg key. A long id (64bit/16byte) or even better the full fingerprint is needed to identify the key. - zypp: Improve Testcase Loading for MCP Tools. - spec: Remove useless %bcond visibility_hidden (is always ON in cmake) - version 17.38.15 (35) ==== lightdm-gtk-greeter-branding-openSUSE ==== - Set default NumLock state as it is defined in KBD_NUMLOCK variable in /etc/sysconfig/keyboard using /run/numlock-on set by kbdsettings.service from kbd package and numlockx default. ==== localsearch ==== Version update (3.11.1 -> 3.11.2) Subpackages: localsearch-lang - Update to version 3.11.2: + Fix possible crash after a directory is deleted + Fix extraction errors with some EPUB files + Fix "localsearch status -f" when extractor is active + Prevent possible main thread stalls when handling many errors + Fix possible situations where files are needlessly re-extracted + Updated translations. ==== mariadb-connector-c ==== - ead038d.patch: fix regresssion in mysql_stmt_bind_result (bsc#1273612) ==== nautilus ==== Version update (50.3 -> 50.3.1) Subpackages: gnome-shell-search-provider-nautilus libnautilus-extension4 nautilus-lang - Update to version 50.3.1: + Bugfixes: Fix a possible crash when changing app defaults after closing the app chooser + Cleanups: Attempt using any sushi version ==== perl-Cpanel-JSON-XS ==== Version update (4.430.0 -> 4.440.0) - updated to 4.440.0 (4.44) see /usr/share/doc/packages/perl-Cpanel-JSON-XS/Changes 4.44 2026-09-02 (rurban) - Fix canonical sort infinite loop (GH #252 amelchio): malformed UTF-8 keys (e.g. Latin-1 byte strings mixed with Unicode) made utf16_cmp treat the decoder's (STRLEN)-1 malformed sentinel as a length, wrapping the buffer pointer. Now checked as 0 or > remaining length. ==== perl-MIME-tools ==== Version update (5.517.0 -> 5.518.0) - updated to 5.518.0 (5.518) see /usr/share/doc/packages/perl-MIME-tools/ChangeLog 5.518 2026-08-26 Dianne Skoll * VERSION 5.518 RELEASED * Add tests for encoded "boundary=XXX" parameters and set the ambiguous-parse flag if any are found. Patch courtesy of Dominik Csapak MIME::tools chooses to decode encoded boundary parameters. MUA behaviors differ; Claws-Mail decodes them while Thunderbird does not. * Don't ignore invalid whitespace after "boundary=XXX" parameter. Patch courtesy of Dominik Csapak * Ignore comments between tokens. A header parameter can be written foo(comment)=bar and it's the same as foo=bar. Patch courtesy of Dominik Csapak ==== python-numpy ==== Version update (2.5.2 -> 2.5.3) - update to 2.5.3: * Casting a fixed-width byte string array (``np.bytes_``) to ``StringDType`` now raises ``TypeError`` when the bytes are not valid UTF-8. Previously the invalid bytes were stored as-is and later caused undefined behavior in string operations. * ``MaskedArray._fill_value`` would become stale when ufuncs that change dtype left the result holding a fill_value typed for the old dtype. The mismatch was silent until something later called ``_check_fill_value``, such as ``.view()``, and then a ``TypeError`` would be raised. Now, when the copied fill_value is no longer valid for the new dtype, fall back to the default fill_value for that dtype instead of propagating the stale value. This may raise a ``ComplexWarning`` if the fill_value is complex and the new dtype is real. ==== qemu ==== Version update (11.1.0 -> 11.1.1) Subpackages: qemu-audio-spice qemu-block-curl qemu-block-nfs qemu-block-rbd qemu-chardev-spice qemu-guest-agent qemu-hw-display-qxl qemu-hw-display-virtio-gpu qemu-hw-display-virtio-gpu-pci qemu-hw-display-virtio-vga qemu-hw-usb-host qemu-hw-usb-redirect qemu-hw-usb-smartcard qemu-img qemu-ksm qemu-lang qemu-microvm qemu-pr-helper qemu-seabios qemu-tools qemu-ui-curses qemu-ui-gtk qemu-ui-opengl qemu-ui-spice-app qemu-ui-spice-core qemu-vgabios qemu-vmsr-helper qemu-x86 - Bugfixes (bsc#1277435, bsc#1263864): * file-posix: Tolerate unaligned hole at middle (bsc#1277435) * target/ppc/kvm: Use host compatibility mode for nested guests (bsc#1263864) * target/ppc/kvm: Add support for querying host compatibility mode (bsc#1263864) * linux-headers: Update to include KVM_CAP_PPC_COMPAT_CAPS (bsc#1263864) - Improve riscv64 handling: * [openSUSE][RPM] build all firmware on riscv64 and fix user tests * [openSUSE][RPM] spec: stub out all iotests when running under user emulation (e.g., for riscv64) - Fix broken build on aarch64: * [openSUSE][RPM] spec: disable GCS linker validation on aarch64 - Update to latest stable release (11.1.1) Full backport list here: https://lore.kernel.org/qemu-devel/20260827155607.639070-1-mjt@tls.msk.ru/ A selection of them is reported here below: target/riscv/tcg: sret in virtual user mode raises virtual instruction exception target/riscv: Allow UXL to be 3 in mstatus on rv128 target/riscv: Restore register dump zero padding tests/qtest: remove trace output from k230 watchdog test target/riscv: enforce even register constraints for Zdinx fcvt pairs target/riscv: reject FMV.X.W/FMV.W.X under Zfinx target/riscv: honor zicbo* envcfg gating in linux-user mode disas/riscv: Fix typo in th.lbib format disas/riscv: Fix isa decoding of rev8 disas/riscv: Fix rv32 encoding of zext.h target/riscv: allow menvcfg/henvcfg LPE and SSE bits on RV32 hw/riscv/riscv-iommu: preserve requested perm in spa_fetch() hw/riscv/riscv-iommu: fix U-bit check to apply only to leaf S/VS-stage PTEs disas/riscv: Decode unsigned vector immediates as unsigned disas/riscv: Use signed type for vector immediates disas/riscv: Fix 6-bit immediate extraction disas/riscv: Fix th.srri decoding tests/qtest: Add seed CSR zero extension test target/riscv: Fix seed CSR sign extension target/riscv: do not count ECALL in minstret target/riscv: Fix memory leak in riscv_trigger_unrealize() target/riscv: use SXL instead of MXL for read_sstatus target/riscv: Fix PC sync in trans_sspopchk for CFI exception handling whpx: i386: inject back db whpx: i386: work around Hyper-V FP state oddities whpx: i386: synchronise PAT too whpx: i386: enable fast hypercall output hw/i386: fw_cfg: do not set VMX feature control on WHPX whpx: i386: fix xsaves enablement in legacy probing path hw/watchdog: Add lower bound check for watchdogNumber tests/tcg/aarch64: Add regression test for whilewr/whilerw target/arm: Fix SVE2 WHILEWR/WHILERW zero diff boundary case tcg: Export tcg_gen_ussub_i{32,64,tl} hw/intc/arm_gicv3: Have GIC kconfig select GICv3 for HVF and WHPX hw/intc: Fix arm kvm gicv3 selection tcg: Defer tb_flush when initial thread region alloc fails tcg: Return success from tcg_region_alloc tcg: Return success from tcg_region_alloc__locked target/loongarch: check FPE before reading fcc in bceqz/bcnez meson: make linker warnings non-fatal on Linux serial: clear transmit retry callback on unrealize ... ==== rpcbind ==== - Fix stack-based buffer overflow in rpcinfo's rpcbdump() short-mode version-list formatting (bsc#1272340, CVE-2026-16461) * add 0001-rpcinfo-fix-stack-buffer-overflow-in-rpcbdump-short-.patch ==== sg3_utils ==== Version update (1.48+35.c49e7c08 -> 1.48+36.936c7ae) Subpackages: libsgutils2-1_48-2 - Update to version 1.48+36.936c7ae: * sg_inq: avoid including 0-bytes in SCSI name strings (bsc#1277106) ==== wireless-regdb ==== Version update (20260530 -> 20260903) - Update to version 20260903: * wireless-regdb: update regulatory database based on preceding changes * wireless-regdb: allow 320MHz channel width for Hong Kong (HK) * wireless-regdb: Update 2.4 and 5 GHz rules for South Africa (ZA) * wireless-regdb: Remove DFS flag from 60 GHz band for Togo (TG) ==== wireplumber ==== Version update (0.5.15 -> 0.5.17) Subpackages: libwireplumber-0_5-0 wireplumber-bash-completion wireplumber-lang wireplumber-zsh-completion - Update to version 0.5.17: * Highlights: - This release fixes a significant regression introduced in version 0.5.16. Users are strongly encouraged to upgrade to this release and avoid using 0.5.16. * Fixes: - Fixed factory-created device, node and link objects to stop sharing ownership with their registry global, fixing a regression from the WpClientContext introduced in 0.5.16 that broke proper object destruction in the monitor scripts. - Improved default-nodes to also rank on the object.serial of a node's device and on the node's own object.serial, so that route priorities are only compared between nodes of the same card, and the election no longer changes for no apparent reason when all other keys are equal. - Fixed m-lua-scripting to include the offending Lua type name in POD build errors - Update to version 0.5.16: * Additions & Enhancements: - Added WpClientContext, a second PipeWire connection running on its own thread that hosts WirePlumber's in-process media objects (loopback and filter-chain modules, LocalNode(), SpaDevice()), so that slow Lua event hooks on the main thread no longer stall their control path; the export core is retired in favor of this new client context - Added new WpDynamicRules class for matching rules with conditions, and updated filter-graph.lua to use it, allowing filter-graphs to be loaded and unloaded dynamically depending on whether other objects exist or not - Added wp_impl_module_unload() and LocalModule:unload(), giving scripts control to unload implemented modules at any time - Added a volume-set action to module-mpris to allow adjusting the volume of a remote MPRIS2 player from Lua - Added --yes flag to wpctl reset to skip the confirmation prompt - Added device.form-factor ALSA node property for use in ALSA rules, and made HDMI node descriptions include the name of the connected display when available - Refactored the Bluetooth monitor to use event hooks for handling devices and nodes, matching the design already used by the v4l2 and libcamera monitors - Overhauled the documentation: filled in every stub and missing Lua API and C API page, added a getting started guide, new wireplumber(1) and wpexec(1) man pages, and removed stale pages describing features renamed or removed in the 0.4 to 0.5 transition * Fixes: - Fixed monitors to always activate all device and node features, and made monitors wait for successful device activation before storing the devices and nodes as a managed objects - Fixed find-preferred-profile to skip a configured preferred profile that is not available, instead of leaving no profile selected - Fixed permission-manager to not include destroyed globals when rebuilding the permissions array on objects-changed, fixing some pipewire warnings in the log - Fixed a memory leak in WpSpaDevice by only collecting params from our own requests - Fixed filter-graph to correctly apply graphs defined for the same node across multiple configuration files - Fixed several nil-related crashes and correctness issues in Lua scripts - Improved apply-access to directly attach an already-active permission manager to the client instead of wastefully re-running activation on it - Improved state-stream change detection to avoid spurious state writes from volume rounding and from unset or empty properties - Fixed default-nodes to ignore smart filters when selecting the best default node - Removed the node.filter.forward-format setting and its script, which only worked with 0.4 and never really worked with 0.5 ==== zypper ==== Version update (1.14.98 -> 1.14.101) Subpackages: zypper-log zypper-needs-restarting - Show solver problem details per default in not-interactive mode (bsc#1277790) This way they see all details when capturing zypper's output because the (d)etail button can't be pressed in not-interactive mode. - version 1.14.101 - Add --servicesd-dir global option to relocate /etc/zypp/services.d (bsc#1257249) - version 1.14.100 - info: check for missing positional args before systemSetup (bsc#1274091) - Remove deprecated installRecommends option from zypper.conf. The system wide default for all libzypp based applications is defined in zypp.conf(5). It is not recommended to define this in zypper exclusively. - BuildRequires: libzypp-devel >= 17.38.0. Code uses some of the new libzypp log and string tools. - version 1.14.99