Packages changed: expat (2.8.2 -> 2.8.4) kernel-source (7.2.3 -> 7.2.4) libarchive (3.8.7 -> 3.8.9) libspelling nfs-utils openSUSE-release (20260908 -> 20260909) ovmf (202605 -> 202608) perl-Authen-SASL (2.200.0 -> 2.210.0) perl-LWP-MediaTypes (6.04 -> 6.50.0) perl-URI (5.360.0 -> 5.370.0) psutils (2.08 -> 3.3.17) python-dbus-python (1.3.2 -> 1.4.0) python313-packaging (26.2 -> 26.3) samba (4.24.5+git.481.dba78dbdea -> 4.24.6+git.488.e38f6c96c62) sdbootutil (1+git20260903.f91f636 -> 1+git20260909.7cfa1f0) selinux-policy (20260826 -> 20260908) xen (4.22.0_02 -> 4.22.0_04) === Details === ==== expat ==== Version update (2.8.2 -> 2.8.4) Subpackages: libexpat1 - update to 2.8.4: * Security fixes: * CVE-2026-66046, bsc#1275732: denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c * CVE-2026-76641, bsc#1275915: out-of-bounds read vulnerability that allows attackers to trigger memory corruption * CVE-2026-76957, bsc#1275859: lacks handler call depth tracking with custom encoding callbacks, use-after-free can occur * CVE-2026-76956, bsc#1275860: misinterpretation of getentropy's return code leads to insufficient entropy, vulnerable to hash flooding denial of service * Other fixes: * CMake: only add /source-charset:utf-8 when /utf-8 is not present * lib: resolve undefined behavior from overshifting a signed int * lib: support read-only hash table lookup with non-zero-terminated keys * lib: use a C99 bool for ENTITY.open * version info bumped from 13:3:12 to 13:4:12 - update to 2.8.3: * Security fixes: * CVE-2026-72522, bsc#1275594: out-of-bounds read and resultant infinite loop due to low surrogates being treated the same as high surrogates during Unicode processing * Other fixes: * fix support for 2+ GiB documents (regression from 2.8.2) * reject empty version in the XML declaration * fix printf format for AIX * CMake|AIX: enable EXPAT_DEV_URANDOM by default * version info bumped from 13:2:12 to 13:3:12 ==== kernel-source ==== Version update (7.2.3 -> 7.2.4) - Linux 7.2.4 (bsc#1012628). - platform/chrome: sensorhub: Fix dropped timestamp events and log spam (bsc#1012628). - ACPI: scan: Do not combine resources that overlap completely (bsc#1012628). - selftests/mm: fix on-fault-limit false failure under sudo-rs (bsc#1012628). - udf: Fix i_lenExtents truncation on 32-bit kernels (bsc#1012628). - timer: Keep debugobjects state consistent in migrate_timer_list() (bsc#1012628). - timekeeping: Check the return value of tk_get_aux_ts64 in __do_adjtimex() (bsc#1012628). - taskstats: fix cpumask parsing cutting off the last character (bsc#1012628). - smack: fix cred UAF in smack_file_send_sigiotask() (bsc#1012628). - signal: avoid shared siginfo namespace rewrites (bsc#1012628). - sticon/parisc: Detect default STI graphics card for console output (bsc#1012628). - sysctl: move the "cad_pid" entry from pid_table[] to kern_reboot_table[] (bsc#1012628). - tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout (bsc#1012628). - zloop: truncate finished zones to zone capacity (bsc#1012628). - xarray: honor XA_FLAGS_ACCOUNT in xas_split_alloc() (bsc#1012628). - w1: ds28e17: reject an oversize length on an I2C block read (bsc#1012628). - vsock/virtio: flush works in dependency order (bsc#1012628). - wifi: mt76: mt7996: validate default EEPROM firmware size (bsc#1012628). - wifi: mt76: mt7996: fix TX DMA mapping leak for AddBA req frames (bsc#1012628). - wifi: mt76: mt7996: bound the device EEPROM address before the EFUSE copy (bsc#1012628). - wifi: mt76: mt7925: cancel mlo_pm_work on stop (bsc#1012628). - wifi: mt76: mt7915: bound the device EEPROM address before the EFUSE copy (bsc#1012628). - wifi: mt76: mt7615: avoid waiting for mac work under the mt76 mutex (bsc#1012628). - wifi: rtw89: pci: add .shutdown callback to stop rfkill polling on reboot (bsc#1012628). - wifi: rtw88: pci: fix resource leak on failed NAPI setup (bsc#1012628). - wifi: rtw88: Fix potential memory leak in rtw_txq_push_skb() (bsc#1012628). - wifi: rtlwifi: rtl8192du: Fix possible memory leak in rtl92du_init_sw_vars() (bsc#1012628). - wifi: rtlwifi: rtl8192du: check QoS TID before indexing tids (bsc#1012628). - wifi: rtl818x: initialize eeprom_93cx6 struct to zero (bsc#1012628). - wifi: mwifiex: Detach sync cmd buffer on interrupted wait (bsc#1012628). - mm/kmemleak: report RCU-tasks quiescent states during the scan (bsc#1012628). - mm/kmemleak: stop the task stack scan early when interrupted (bsc#1012628). - crypto: atmel-ecc - avoid stale fallback key after set_secret failure (bsc#1012628). - crypto: atmel-ecc - clean up and improve ECDH comments (bsc#1012628). - crypto: iaa - unmap dst before software fallback on decompress (bsc#1012628). - fuse: copy request headers via a stack buffer for io-uring (bsc#1012628). - fuse: decouple fuse_ring creation from ent registration (bsc#1012628). - wifi: rtl8xxxu: fix use-after-free from rx_urb_wq on stop (bsc#1012628). - wifi: iwlwifi: dvm: fix memory leak in iwl_op_mode_dvm_start() (bsc#1012628). - wifi: brcmfmac: Fix memory leak in brcmf_sdio_read_control() (bsc#1012628). - i3c: renesas: Perform Dynamic Address Assignment on resume (bsc#1012628). - i3c: renesas: Restore STDBR and EXTBR registers on resume (bsc#1012628). - i3c: renesas: Reset the controller on resume (bsc#1012628). - i3c: renesas: Reconfigure the DATBAS register on re-attach (bsc#1012628). - i3c: renesas: Follow the reset deassert order used in probe (bsc#1012628). - i3c: renesas: Clean DATBAS register on detach (bsc#1012628). - i3c: renesas: Check that the transfer is valid before accessing it (bsc#1012628). - i3c: master: svc: bound IBI payload to the requested max_payload_len (bsc#1012628). - i3c: master: Fix info leak and UAF in device unregister path (bsc#1012628). - i3c: master: adi: initialize the lock before enabling interrupts (bsc#1012628). - i3c: Fix unlocked dereference of dev->desc in i3c_device_get_supported_xfer_mode() (bsc#1012628). - dm-pcache: fix use-after-free and invalid seg operations in kset_replay() (bsc#1012628). - dm-pcache: fix implicit u8 truncation of gc_percent in message handler (bsc#1012628). - dm-pcache: only hand out initialized cache segments ... changelog too long, skipping 1228 lines ... - commit b3d022a ==== libarchive ==== Version update (3.8.7 -> 3.8.9) - Update to 3.8.9: * unzip: Windows port (#3167) * various further bugfixes: https://github.com/libarchive/libarchive/compare/v3.8.8...v3.8.9 - 3.8.8: * zip: support for reading encrypted zipx formats (bzip2, lzma, ppmd, xz, zstd) (#2685) * build: fix build with glibc 2.43 (#2969) * libarchive core: various NULL pointer, double-free, buffer overrun and integer overflow fixes (#2905, #2927, #2928, #2942, #2957, #2971, #2973, #2988, #2998, #3009, #3010, #3011, #3012, #3019, #3036, #3037, #3040, #3064, #3083, #3114, #3146) * windows: remove support for WinCrypt, fix GetTempPathW TOCTOU race condition (#2739, #3044) * filters (bzip2, gzip, lz4, uu, zstd): fixes for large archives, truncated input handling and out-of-bounds access (#2526, #3033, #3050, #3054, #3073, #3085, #3093, #3100, #3103, #3115, #3132) * 7-zip: multiple heap overflow, hardening and streamable reading fixes (#2923, #2929, #2980, #2985, #3002, #3006, #3062, #3067, #3074, #3099, #3102, #3119) * cab: multi-volume parser fixes and hardening against invalid/truncated headers (#2979, #3000, #3144, #3145, #3153) * cpio: pathname validation and out-of-bounds read fixes (#2984, #3043, #3055, #3095, #3158, #3168) * iso9660: fix path normalization, Joliet overflow/infinite loop and memory leaks (#2968, #2974, #2978, #2983, #3017, #3021, #3029, #3045, #3117) * mtree: fix hex/time value parsers and NULL dereferences (#2930, #2982, #3007, #3008, #3018, #3032, #3057) * RAR/RAR5: fix bound checks, dangling pointers and integer underflow (#3004, #3015, #3047, #3048, #3081, #3087, #3091, #3105, #3121) * tar: harden timestamp parsing, fix OOB with empty wide character directory names (#2991, #3038, #3052) * warc: fix header allocation leak on overflow (#3061) * xar: fix integer overflows, memory leaks and OOB writer accesses (#3013, #3028, #3030, #3032, #3041, #3060) * zip: reject overlong/empty pathnames, limit LZMA memory usage (#2981, #2993, #2996) - Removed add-missing-tests.patch: upstream 3.8.9 tarball now ships test_read_format_cab_skip_malformed.c and .cab.uu again, the patch no longer applies and is no longer needed ==== libspelling ==== Subpackages: libspelling-lang libspelling1-2 - Better descriptions for libspelling1. - Relegate license info to License: field. ==== nfs-utils ==== Subpackages: libnfsidmap1 nfs-client nfs-kernel-server - Backport upstream memory leak fix in statd 0001-statd-fix-memory-leak-in-sm_mon_1_svc-when-existing-.patch ==== openSUSE-release ==== Version update (20260908 -> 20260909) Subpackages: openSUSE-release-appliance-custom openSUSE-release-dvd - automatically generated by openSUSE-release-tools/pkglistgen ==== ovmf ==== Version update (202605 -> 202608) Subpackages: qemu-ovmf-x86_64 - Update to edk2-stable202608 - Patches (git log --oneline --date-order edk2-stable202605..edk2-stable202608) 2970e5699ba6 EmbeddedPkg/AcpiLib: Fix memory corruption in AcpiAmlObjectUpdateInteger 86ecae29c69e Maintainers.txt: use my correct GitHub handle 816b35fe5238 MdeModulePkg/UefiHiiLib: Fix regression from 12828 c5aa7e7d94c0 BaseTools/Build: Output warning message for library class mismatch 909d1db4cb3b .pytool/Plugin/UncrustifyCheck: Update fork location in Readme.md e0d2cb29fea6 .pytool/Plugin/UncrustifyCheck: Run Black formatter 4074b5db5df8 .pytool/Plugin/UncrustifyCheck: Better support multi-repo workspaces d1c5d47014b1 MdeModulePkg: Fix unchecked return status 1cc0af9d6de6 MdeModulePkg: Fix missing NULL tests af24f366a425 MdeModulePkg: Fix comparison with wider widths 72d0846c4c0c MdeModulePkg: Fix conditionally uninitialized variables 77cf8c8c1016 MdeModulePkg: Fix missing NULL tests 476b78bbad7e MdeModulePkg: Fix Comparison overflow 1d63461c9159 MdeModulePkg: Fix missing NULL tests 8c66d989635d MdeModulePkg: Fix comparison with wider widths 9b3ceeb254db MdeModulePkg: Fix missing NULL tests dfd0edeb4e71 MdeModulePkg: Fix missing NULL tests 699382e3429a MdeModulePkg: Fix unchecked return status 0f0515f71ba3 MdeModulePkg: Fix unchecked return status 0bc1db4adfbd MdeModulePkg: Fix missing NULL tests bf0dc7d78701 MdeModulePkg: Fix comparison with wider widths fa41c179db1f ShellPkg/EfiDecompress: Fix Codeql issues 383e680c3cf6 ShellPkg/Comp: Extract helper functions 35a2f2754615 ShellPkg/EfiDecompress: Check presence of decompression protocol d9185d45c21b ShellPkg/Dmem: Refactor MainCmdDmem() f260ae037587 ShellPkg/EfiCompress: Extract OpenFileHelper() and CompressFile() c08909027823 ShellPkg/Pci: Extract ParsePciBdf() ba2f2169863d ShellPkg/Pci: Extract PciEnumerateAll() 42f1d004c070 ShellPkg/UefiShellDebug1: Lower indentation level in MainCmdXXX() (4/4) 642954d29564 ShellPkg/UefiShellDebug1: Lower indentation level in MainCmdXXX() (3/4) d395696428e7 ShellPkg/UefiShellDebug1: Lower indentation level in MainCmdXXX() (2/4) cad93da7e5ef ShellPkg/UefiShellDebug1: Lower indentation level in MainCmdXXX() (1/4) cebf8bc4ae7e ShellPkg/UefiShellDebug1: Extract MainCmdXXX() function (4/4) 0b6156b43a54 ShellPkg/UefiShellDebug1: Extract MainCmdXXX() function (3/4) 5bdbf4462bd5 ShellPkg/UefiShellDebug1: Extract MainCmdXXX() function (2/4) 6d0ef532c633 ShellPkg/UefiShellDebug1: Extract MainCmdXXX() function (1/4) cb7f7262d51a ShellPkg/Mm: Remove unnecessary goto adad73339ddf ShellPkg/ShellDebug1: Rationalize Package init/free c8279789102f ShellPkg/LoadPciRom: Fix memory leak 6dea226953e8 ShellPkg/UefiShellDebug1: Return if ShellCommandLineParse() failed (4/4) da181122b164 ShellPkg/UefiShellDebug1: Return if ShellCommandLineParse() failed (3/4) d23559e847f4 ShellPkg/UefiShellDebug1: Return if ShellCommandLineParse() failed (2/4) 7ee84dc437ec ShellPkg/UefiShellDebug1: Return if ShellCommandLineParse() failed (1/4) 4e1e73933849 ShellPkg/Ls: Remove double-free calls a3da9cde61fc ShellPkg/Edit: Remove unused code snippet f7052e2d029a SecurityPkg: Remove global use pre-memory ae8814ff6b3a OvmfPkg/LoongArchVirt: Add Hash2DxeCrypto to satisfy TcpDxe dependency 0af5cb9cd046 SecurityPkg/Tcg: Use TPM names in setup strings 4bd628ce9844 SecurityPkg/DeviceSecurity: Update libspdm submodule to 3.8.2 d45f882a1bf0 BaseTools: Fix Clang -Wtautological-overlap-compare in PcdValueInit.c 6c4a9a7659bb OvmfPkg/EmuVariableFvbRuntimeDxe: fix ValidateFvHeader in tdx mode 46591c981f18 OvmfPkg/RiscVVirt: Add Hash2DxeCrypto for TcpDxe 3120fb4b698d UefiCpuPkg/CpuDxeRiscV64: Read hardware state in GetInterruptState d91dff7cbeef UefiCpuPkg/CpuDxe: Read hardware interrupt state in GetInterruptState 3f97b8bc7fd8 MdeModulePkg/SmbiosDxe: fix table length check bc71cc972d5e MdeModulePkg/NvmExpressHci.c: Save time when BIOS reset with NVMes 21063e6b2319 DynamicTablesPkg: Remove ACPI_AML_STA_PROC_SUPPORTED 475ed476ac6b DynamicTablesPkg: Add support for _STA in SSDT topology tables d2936e9efa52 DynamicTablesPkg: Add StaToken to ProcHierarch CmObj 0d9c10b3a211 MdePkg: Update AML _STA macros ca8de19382c6 MdeModulePkg: MemoryBins: make GoogleTest page-granularity aware 6a4e543b09ac SecurityPkg/Test: add AARCH64 to host test DSC 10732648fb0c SecurityPkg/Test: use BaseRngLibNull for AARCH64 host tests 158c70987bb3 CryptoPkg/BaseCryptLib: add AARCH64 host unit test Rand source 2da91c23b9db PrmPkg: Host Test: Adding AArch64 target 2c74b5ecc9a4 DynamicTablesPkg: Host Test: Adding AArch64 target 4eba9cd69cbf DynamicTablesPkg: AcpiDbg2Lib: Adding host based instance a57c5b6da450 FmpDevicePkg: Host Test: Adding AArch64 target 47c48984c5d5 MdeModulePkg: Host Test: Adding AArch64 target 6c1505be6412 MdePkg: Host Test: Adding AArch64 target 8cdd6f77b7b4 UnitTestFrameworkPkg: Test: Adding AArch64 target 56e1e0420257 UnitTestFrameworkPkg: FunctionMockLib: Do not support AArch64 26800658dfd2 UnitTestFrameworkPkg: UnitTestDebugAssertLib: GCC support for AArch64 476c89e564c8 UnitTestFrameworkPkg: CmockaLib: Support float operations 4d024b0cde75 UnitTestFrameworkPkg: SampleUnitTestGenerateException: Fix for AArch64 d47954ceb475 UnitTestFrameworkPkg: SampleGoogleTestGenerateException: Support AArch64 1fa1a89382cc UnitTestFrameworkPkg: SampleGoogleTest: No divide-by-zero test for AArch64 668b5d7bb7f9 MdePkg: UnitTestHostBaseLib: Clean up source entries 94d9804c32d6 MdePkg: UnitTestHostBaseLib: Added preprocessor for AArch64 instances 70d2149e39e4 BaseTools: iasl: Update iasl binaries to 20230628 release abff40cb50ed DynamicTablesPkg: Support EL2 virtual timer in ArmGenericTimerParser 82dd8ab1b374 DynamicTablesPkg/AmiLib: Fix stack corruption in AmlCodeGenRdInterrupt 4d92f22a5c39 DynamicTablesPkg/AmlLib: Add AmlCodeGenMethodRetBuffer API 95a7323e8612 DynamicTablesPkg/AmiLib: Make AmlCodeGenMethod public 7c2ec06a93ef MdeModulePkg/UsbBusDxe: Fix UsbPortReset might run into recursive loop 708e440ddff5 PcAtChipsetPkg: Add VarPolicy to PcAtRealTimeClock variables a6a060f940f1 ManageabilityPkg: SsifWriteRequest post-refactor cleanup 150339f262fc ManageabilityPkg: SsifWriteRequest loop refactoring 598025e8660c ManageabilityPkg: fix/cleanup request size check in SsifWriteRequest e8cbfab461e2 ManageabilityPkg: refactor SsifWriteRequest #1 be62f3ded574 ManageabilityPkg: reorganise ManageabilityTransportSsifLib 40c898febeea ManageabilityPkg: simplify HelperManageabilityPayLoadDebugPrint () 71dc4edb9217 DynamicTablesPkg: Smbios Baseboard Information (Type 2) 7a3943da83d9 DynamicTablesPkg: Add Baseboard CM object and parser f7776de02e12 IntelFsp2Pkg: Fix markdownlint errors 2d43dcfc6ccf PcAtChipsetPkg/SerialIoLib: Allow configurable UART IO Port Base Address 99afb1ffb0c5 MdeModulePkg/HiiDatabaseDxe: Fix potential intrinsic error ... changelog too long, skipping 479 lines ... - Refresh ovmf-Revert-Add-Stack-Cookie-Support-to-MSVC-and-GCC.patch ==== perl-Authen-SASL ==== Version update (2.200.0 -> 2.210.0) - updated to 2.210.0 (2.2100) see /usr/share/doc/packages/perl-Authen-SASL/Changes 2.2100 2026-09-06 [Security fixes] - CVE-2026-86219: Replay attack in Authen::SASL::Perl::DIGEST_MD5 Thanks to TIMLEGGE (@timlegge) and the CPANSec team for the AI-assisted detection and fix! ==== perl-LWP-MediaTypes ==== Version update (6.04 -> 6.50.0) - updated to 6.50.0 (6.05) see /usr/share/doc/packages/perl-LWP-MediaTypes/Changes 6.05 2026-09-04 17:14:25Z - Drop the Test::Fatal test prerequisite, which now requires perl v5.12, so the distribution keeps its declared perl 5.6.2 support (GH#16) - Remove Authority section from dist.ini (GH#4) (Olaf Alders) ==== perl-URI ==== Version update (5.360.0 -> 5.370.0) - updated to 5.370.0 (5.37) see /usr/share/doc/packages/perl-URI/Changes 5.37 2026-09-03 22:49:36Z - Preserve leading and trailing whitespace in file:// URI paths instead of silently stripping it (GH#95) (Jacques Deguest) ==== psutils ==== Version update (2.08 -> 3.3.17) - Update to 3.3.17: * Major update see Release page on github * Now also with PDF support * Moved from C code to python * Warning: Requires ImageMagick and depends on that security settings ==== python-dbus-python ==== Version update (1.3.2 -> 1.4.0) - update to 1.4.0: * Automatically set the NO_REPLY message flag in call_async if there is no reply handler and no error handler * Add arg0namespace match rule support Hofstee) * Add argNpath match rules support * Generate a valid sdist from `meson dist` * Mention more alternatives to this package in the README * Don't require tomllib when generating dist tarball on Python ≥ 3.11 * Fix compilation with Python ≥ 3.13 in some situations * Avoid using distutils in setup.py (Simon McVittie) * Fix a typo in example code (dbus-python!25, Robert Ancell) * Safer handling of weak references (Simon McVittie) - add missing keyring - add Revert-using-Py_TPFLAGS_MANAGED_WEAKREF.patch from fedora, fixes testsuite failures on newer python versions ==== python313-packaging ==== Version update (26.2 -> 26.3) - update to 26.3: * Add a public :class:`~packaging.ranges.VersionRange` API and :meth:`SpecifierSet.to_range() `, representing the versions a specifier set accepts as an interval set that supports intersection, union, difference, complement, set relations, membership tests, and filtering. :meth:`~packaging.ranges.VersionRange.to_specifier_set` converts a range back to a :class:`~packaging.specifiers.SpecifierSet` where a PEP 440 form exists. (:pull:`1267`, :pull:`1270`, :pull:`1298`) * PEP 808: accept Metadata-Version: 2.6. (:pull:`1194`) * Add a limit argument to parse_tag() for compressed tag sets. (:issue:`1220`) * Add a prefer_sdist_predicate argument to Pylock.select() to prefer source distributions over wheels for selected packages. (:pull:`1334`) * Add :func:`~packaging.tags.pure_python_tags` to generate the pure-Python tags for a Python version without touching the running platform. (:pull:`1346`) * Add :meth:`SpecifierSet.is_subset() `, :meth:`~packaging.specifiers.SpecifierSet.is_superset`, and :meth:`~packaging.specifiers.SpecifierSet.is_disjoint`, which compare the versions two specifier sets accept. (:pull:`1313`) * Drop support for Python 3.8; packaging now requires Python 3.9 or later. (:pull:`1157`) * Prefer native linux_* platform tags over manylinux and musllinux tags on Linux. (:issue:`160`) * Raise InvalidVersion instead of TypeError when Version is given a non-string. (:pull:`1319`) * Raise InvalidVersion for non-string pre-release letters passed to Version.from_parts. (:pull:`1241`) * Fix an AttributeError when hashing internally trimmed versions. (:pull:`1242`) * Fix SpecifierSet.is_unsatisfiable for post-release boundary intersections. (:pull:`1257`) * Make Requirement.__hash__ consistent with __eq__ for trailing-zero-equivalent specifiers (e.g. foo==1.0.0 and foo==1.0.0.0), so equal requirements hash equal and deduplicate in sets and dicts. (:pull:`1232`) * Normalize requested extra names before comparing or hashing requirements. (:issue:`644`) * Preserve a Requirement's specifier prereleases override across a pickle round trip. (:issue:`1204`) * Raise InvalidRequirement instead of InvalidSpecifier when a requirement contains an invalid specifier. (:pull:`1332`) * Clarify the error for post-release prefix wildcards like ==1.0.post1.*. (:pull:`1299`) * Preserve quoting semantics when serializing marker values, so round-tripped markers parse back to the same marker. (:pull:`1213`) * Keep the parentheses of a nested group when serializing markers. (:pull:`1316`) * Normalize extra and dependency_groups values in nested markers at parse time. (:pull:`1246`, :pull:`1310`) * Raise UndefinedComparison when a set-valued variable like extras is used outside the membership form. (:pull:`1265`) * Raise UndefinedEnvironmentName (a KeyError subclass) for missing environment keys during marker evaluation. (:pull:`1276`) * Wrap malformed string literal errors in InvalidMarker / InvalidRequirement instead of leaking a low-level error. (:pull:`1249`) * Reject requirements and markers with a trailing line break. (:pull:`1345`) * Collect all from_email validation errors into one ExceptionGroup instead of raising the first. (:pull:`1268`) * Accept the UTF-8 charset case-insensitively in email payloads. (:pull:`1330`) * Reject malformed Description-Content-Type values. (:pull:`1329`) * Don't rewrite user values that contain {field} placeholders in error messages. (:pull:`1327`) * Route multipart email payloads to unparsed instead of asserting. (:pull:`1247`) * Make InvalidMetadata and CyclicDependencyGroup picklable. (:pull:`1328`) * Fold every line boundary str.splitlines recognizes when writing a header with :class:`~packaging.metadata.RFC822Message`. (:pull:`1356`) * Raise InvalidLicenseExpression for misplaced WITH clauses and empty LicenseRef- names. (:pull:`1266`) * Raise InvalidLicenseExpression instead of KeyError for a LicenseRef- with a + suffix. (:pull:`1219`) * Raise InvalidTag from parse_tag() for tags with the wrong number of components. (:pull:`1238`) * Reject empty tag components in parse_wheel_filename() and parse_tag(). (:pull:`1234`) * Reject an empty project name in the wheel and sdist filename parsers. (:pull:`1305`) * Reject wheel filenames with a trailing newline. (:pull:`1341`) * Reject wheel tags whose interpreter component is not an identifier. (:issue:`577`) * is_normalized_name now rejects names with collapsed double hyphens like a--b. (:pull:`1230`) * Fix duplicate explicit abi3t tags. (:pull:`1245`) ... changelog too long, skipping 58 lines ... * Use nox's uv integration. (:pull:`1057`) ==== samba ==== Version update (4.24.5+git.481.dba78dbdea -> 4.24.6+git.488.e38f6c96c62) Subpackages: libldb2 libldb2-32bit python3-ldb samba-ad-dc-libs samba-ad-dc-libs-32bit samba-client samba-client-32bit samba-client-lang samba-client-libs samba-client-libs-32bit samba-dcerpc samba-gpupdate samba-ldb-ldap samba-libs samba-libs-32bit samba-libs-python3 samba-python3 samba-winbind samba-winbind-libs samba-winbind-libs-32bit samba-winbind-libs-lang - Build and install pycache files; (bsc#1274812) - Update to 4.24.6 * leases torture test flappy (marked flappy); (bso#15978). * Memory leak in DRS when replication fails; (bso#16065). * vfs_ceph_snapshots: smbd panics on snapshot access for a share mounted at the CephFS root ("/"); (bso#16176). * race condition in pthreadpool when forking; (bso#16191). * witness test flappy needs to be fixed; (bso#16077). * temporary read of unrelated or non-existing memory in s3 dfs server; (bso#16093). * source4/dsdb/samdb/cracknames.c doesn't use ldb_binary_encode_string() consistently; (bso#16094). * dsgetdcname() may not detect an active directory domain if the netbios domain name is given and nmbd nor the nbt service is available; (bso#16153). * ndr_{push,pull,print}_{timeval,timespec} encode/decode the value twice; (bso#16199). * vfs_ceph_new: smbd crashes when mixing proxy and non-proxy CephFS shares; (bso#16186). * CTDB doesn't send tickle ACKs when taking over a released IP; (bso#15994). * CTDB can run nested elections, in rare circumstances; (bso#16152). - Update update-samba-security-profile for selinux Create and label /run/samba/nmbd and /run/samba/winbindd as this doesn't work properly in DC configurations (bsc#1268532) ==== sdbootutil ==== Version update (1+git20260903.f91f636 -> 1+git20260909.7cfa1f0) Subpackages: sdbootutil-dracut-measure-pcr sdbootutil-snapper - Update to version 1+git20260909.7cfa1f0: * Drop PCR warning when is not part of the policy - Update to version 1+git20260908.c641fc2: * Update the shim when required * Warn when recovery PIN is different from recovery key * Improves extra boot entries support * Better report when the default snapshot diverges * Explain how to do re-enrolling if recovery PIN fails * Explain why update-prediction fails and how to solve it * Hide comparison output * Add bootctl default entry in the prediction ==== selinux-policy ==== Version update (20260826 -> 20260908) Subpackages: selinux-policy-targeted - Update to version 20260908: * fix NetworkManager dnsmasq-forwarders.conf labeling (bsc#1260038) * Fix for (open)SUSE (bsc#1270243) * Fix for (open)SUSE (bsc#1277439) ==== xen ==== Version update (4.22.0_02 -> 4.22.0_04) - bsc#1276838 - VUL-0: CVE-2026-62437: xen: x86: DMs may cause mem leak by IRQ binding (XSA-509) 6a8f18ad-pass-through-disallow-pt_irq_create_bind-on-dying-domains.patch - bsc#1276839 - VUL-0: CVE-2026-79602: xen: x86: improper handling of HVM emulation return codes (XSA-510) 6a759f74-emul-cope-with-internal-handlers-returning-X86EMUL_RETRY.patch - bsc#1276841 - VUL-0: CVE-2026-79603: xen: unconditionally do TLB flushing ahead of page scrubbing (XSA-511) 6a71bd97-xen-page_alloc-ensure-TLB-flush-is-done-ahead-of-page-scrubbing.patch