Packages changed: freerdp gstreamer (1.28.8 -> 1.28.9) gstreamer-devtools (1.28.8 -> 1.28.9) gstreamer-plugins-bad (1.28.8 -> 1.28.9) gstreamer-plugins-base (1.28.8 -> 1.28.9) gstreamer-plugins-good (1.28.8 -> 1.28.9) gstreamer-plugins-libav (1.28.8 -> 1.28.9) gstreamer-plugins-ugly (1.28.8 -> 1.28.9) harfbuzz (15.0.0 -> 15.1.0) kernel-source (7.3.1 -> 7.3.3) kirigami-addons6 (1.16.0 -> 1.16.1) libcloudproviders (0.4.1 -> 0.4.2) libplist (2.8.0 -> 2.8.1) openSUSE-release (20261108 -> 20261109) perl-Mail-DKIM (1.20240923 -> 1.20261105) perl-Mail-SPF (3.202.603.310 -> 3.202.611.50) pipewire qt6-declarative === Details === ==== freerdp ==== Subpackages: libfreerdp3-3 librdtk0-0 libwinpr3-3 - Fix build with SDL 3.4.20 with 0000-client-sdl-fix-version-guard.patch ==== gstreamer ==== Version update (1.28.8 -> 1.28.9) Subpackages: gstreamer-lang gstreamer-utils libgstreamer-1_0-0 typelib-1_0-Gst-1_0 - Update to version 1.28.9: * Highlighted bugfixes: + Various security fixes and playback fixes + decodebin3, playbin3: fix assertion that would crash music players with certain files and sources + qtdemux: fix seeking beyond the end of file in push mode + flvdemux: don't prematurely EOS on AVC/audio sequence end + rtspsrc: Reuse non-compliant URL fallback across tracks + H.264 and H.265 RTP depayloader header extension tracking fixes + level: Add 24 bits support + gtk4paintablesink: Mark EGL display as foreign to not terminate it + amfcodec: fix rate_control (H.265, AV1) and gop_size (H.265) properties + asio: fix stopping asio element causing crashes + cuda: Correctly save alpha and blend on property change + HLS: fix awss3hlssink EXT-X-PROGRAM-DATE-TIME moving at twice the speed of the target duration + hlssink3: Fix stream writing regression for CMAF and WebVTT sinks + isobmff: Fix NTP seconds roll-over past 2036 + Fix gap event regression in MPEG-PS demuxer with certain subtitle streams + qsv, d3d11, d3d12: Build fixes on latest msys2 environment + va: do not advertise unsupported formats in encoder caps + v4l2 video decoder fixes including delay negotiation for H.264 and H.265 for better decodebin2 compatibility + wayland: output hotplug fixes + webrtcsink: add support of mpph264enc encoder (rockchip) + Rust plugins: enable cross-compilation with sysroot in Meson build + cerbero: update ca-certificates and pip, and fix issue with rolling distro versions + Various bug fixes, build fixes, memory leak fixes, and other stability and reliability improvements * gstreamer: + paramspecs: Fix GType name mess with GstParamSpecArray/Fraction + taglist: don't critical when parsing random strings + value: Skip the caps attempt when a bracketed value can't be caps + value: unset the GValue when parsing a value token fails + value: validate int/double/fraction ranges when parsing + doc: Passing size=-1 to gst_buffer_extract_dup() returns all data + baseparse: Don't dereference frame->buffer after a zero-sized finish_frame() and explicitly forbid negative skip values from handle_frame() + base: Avoid memcpy()/memset() with NULL pointers and zero size + ptp: Make sure the ptp-helper tests are compiled and running unless tests are disabled ==== gstreamer-devtools ==== Version update (1.28.8 -> 1.28.9) - Update to version 1.28.9: * No changes, stable bump only. ==== gstreamer-plugins-bad ==== Version update (1.28.8 -> 1.28.9) Subpackages: gstreamer-plugins-bad-lang libgstadaptivedemux-1_0-0 libgstanalytics-1_0-0 libgstbadaudio-1_0-0 libgstbasecamerabinsrc-1_0-0 libgstcodecparsers-1_0-0 libgstcodecs-1_0-0 libgstcuda-1_0-0 libgsthip-1_0-0 libgstinsertbin-1_0-0 libgstisoff-1_0-0 libgstmpegts-1_0-0 libgstmse-1_0-0 libgstphotography-1_0-0 libgstplay-1_0-0 libgstsctp-1_0-0 libgsturidownloader-1_0-0 libgstva-1_0-0 libgstvulkan-1_0-0 libgstwayland-1_0-0 libgstwebrtc-1_0-0 libgstwebrtcnice-1_0-0 - Update to version 1.28.9: * amfcodec: fix rate_control(h265, av1) and gop_size (h265) properties * analyticsoverlay: Remove Visualization classifier * androidmedia: Fix drain deadlock when the srcpad loop stops * asfmux: Fix header size calculation for non-BMP characters in string tags * asfmux: Minor fixes * asio: fix stopping asio element causing crashes * codecparsers, videoparsers: Fix OOB accesses and undefined behaviour found by fuzzing * codecparsers: Fix undefined shift in nal_reader_get_ue * codecparsers: h265: Do not overflow conformance window size * codecparsers: h265: Free SEI payload when parsing fails * codecparsers: h26x: Reject NALs with forbidden_zero_bit set * codecparsers: vp9: Do not read past the end of the frame data * cuda: Correctly save alpha and blend on property change * cudaipc: Release Unix socket server resources on teardown * d3d12h264enc: Various fixes and enhancement * eagl and vulkan: Remove internal_view from the superview when finalizing * faac: support faac >= 2.0 (faac_* API) * festival: check read return value * h26*parse: Reject malformed NALs with forbidden_zero_bit set * h264 parsing : UB fixes * h264decoder: Fix division by zero on bogus SPS dimensions * h264parse: Don't finish a zero-sized frame when no start code follows * h265parse: only extrapolate duration for vcl nal * h265parse: Fix use of uninitialized HRD parameters * h265parser: Handle oversized SEI payloads * h266parser: Fix infinite loop parsing picture timing SEI * h266parser: Fix out-of-bounds write when parsing DCI * h266parser: Validate that rectangular slices fit into the tile grid * hlsdemux: Validate PKCS7 padding before unpadding decrypted fragments * ivfparse: Reject frame sizes that overflow the size check * mpeg4videoparse: Clamp VOS length when no terminating start code * mpegdemux: compare to segment position for sending gap updates * mpegts: Various OOB reads and similar * mpegts: Various fixes * mxf: Fix metadata creation by using g_object_new, not g_type_create_instance * mxfdemux: fix a typo and improve log * mxfdemux: fix out-of-bounds read when looking up delta entry by delta_id * qsv,d3d11,d3d12: Build fixes on latest msys2 environment * rfbsrc: Various fixes * tensordecoders: fix leaks in classifiertensordec * tsdemux: Check AC-3 descriptor length before reading its fields * unixfdsink: Fix race when starting and stopping quickly * v4l2codecs: h264, h265: negotiate with the first picture * v4l2codecs: vp9: Minimize memory allocation * va: do not advertise unsupported formats in encoder caps * va: {vp8,vp9,av1}enc: check the result of gst_va_encode_picture_new() * vc1parser: Zero-initialize parsed structures * video: fix undefined behaviour on empty unregistered user data meta * videoconvertscale: Don't scale in the padding described by GstVideoMeta * vmnc: Drop colour cursor on pixel format change and various other crash fixes * vmnc: Render the correct cursor part when clipped & don't produce invalid RGB shift masks * vulkan: fix memory leaks in decoders * vulkanh265dec: pass sps_scaling_list_data_present_flag from the SPS * wayland: output hotplug fixes * wpe2: Fix mouse pointer buttons mismatch ==== gstreamer-plugins-base ==== Version update (1.28.8 -> 1.28.9) Subpackages: gstreamer-plugins-base-lang libgstallocators-1_0-0 libgstapp-1_0-0 libgstaudio-1_0-0 libgstfft-1_0-0 libgstgl-1_0-0 libgstpbutils-1_0-0 libgstriff-1_0-0 libgstrtp-1_0-0 libgstrtsp-1_0-0 libgstsdp-1_0-0 libgsttag-1_0-0 libgstvideo-1_0-0 typelib-1_0-GstAudio-1_0 typelib-1_0-GstPbutils-1_0 typelib-1_0-GstTag-1_0 typelib-1_0-GstVideo-1_0 - Update to version 1.28.9: * appsink: keep queued sticky events across a flush * eagl and vulkan: Remove internal_view from the superview when finalizing * decodebin3 aborts on giostreamsrc + parsebin with ID3-tagged MP3 * decodebin3: Crash in GstPad playing a MP3 file * decodebin3: mq_slot_handle_stream_start: assertion failed: (collection) * decodebin3: Null-deref crash in gst_decodebin_input_link_to_slot with Strawberry player * discoverer: Fix use-after-free when a stream reuses its parent * parsebin: Handle lazy stream-id generation * qsv,d3d11,d3d12: Build fixes on latest msys2 environment * samiparse: Drop already parsed text from the HTML context buffer * samiparse: Fix when encountering unclosed tags to prevent slowdown * udmabuf: Allow disabling via env var * video: fix undefined behaviour on empty unregistered user data meta * video: vbi: reject pixel widths narrower than one conversion group * videoconvertscale: Don't scale in the padding described by GstVideoMeta ==== gstreamer-plugins-good ==== Version update (1.28.8 -> 1.28.9) Subpackages: gstreamer-plugins-good-gtk gstreamer-plugins-good-lang - Update to version 1.28.9: * adaptivedemux2: Ensure period stream access is protected by the right mutexes everywhere / Fix recursive scheduler lock double unlocks on stream preparation interruption * adaptivedemux2: Restrict URI schemes in the download helper * flvdemux: Don't report EOS on AVC/audio sequence end * hlsdemux: Validate PKCS7 padding before unpadding decrypted fragments * imagefreeze: keep the caps across a flush * level: Add 24bits support * mpegaudioparse: Avoid OOB read when looking for Xing header * qml6glsrc: Qt6GLWindow destructor abort due to active render thread callback * qml6glsrc: fix possible race with Qt6GLWindow::onSceneGraphInvalidated * qtdemux: Harden CENC parsing against crafted sample_count * qtdemux: fix seek beyond the end of file in push mode * rtph264depay: Fix out of bounds read in MTAP16/MTAP24 depayloading * rtph264depay: rtph265depay: Various delayed header extension tracking fixes * rtpsession: fix source use-after-free on DoS protection * rtpvrawdepay: Validate caps before using them * rtsp: unset response even on error path * rtspsrc: Reuse non-compliant URL fallback across tracks * scaletempo: drop empty buffer instead of outputting 0-sized with no GAP * v4l2: fix non-constant initializer in colorspace_variants * v4l2bufferpool: deactivate other pool on start failure * v4l2bufferpool: fix buffer leak on streamon failure * v4l2dec: fix POLLERR from dec loop * v4l2object: accept any colorimetry on coded OUTPUT caps * v4l2object: providing aligned size when propose allocation * v4l2videodec: Don't cancel pending source change when draining * v4l2videodec: fix codec_data leak * v4l2videodec: race condition between drain and source change * v4l2h265dec fails negotiation with H.265 stream using colorimetry=2:3:0:1 * vpxdec: Implement no-op drain callback ==== gstreamer-plugins-libav ==== Version update (1.28.8 -> 1.28.9) - Update to version 1.28.9: * avviddec: honor decode-only flag from buffers upstream ==== gstreamer-plugins-ugly ==== Version update (1.28.8 -> 1.28.9) Subpackages: gstreamer-plugins-ugly-lang - Update to version 1.28.9: * No changes, version bump only. ==== harfbuzz ==== Version update (15.0.0 -> 15.1.0) Subpackages: libharfbuzz-gobject0 libharfbuzz-icu0 libharfbuzz-subset0 libharfbuzz0 typelib-1_0-HarfBuzz-0_0 - Update to version 15.1.0: * Add buffer deserialization APIs that report progress as a byte offset, for use from introspection bindings. * Fix Indic shaping of the Unicode 18 Devanagari and Bengali additions. * Fix Arabic fallback shaping: wrong ligatures when a component is missing from the font, and disappearing marks in legacy fonts. * Fix `COLR` glyph extents and mark positioning in fonts with empty layers. * Fix AAT shaping: wrong `kerx` kerning (formats 1 and 2) and mark positioning (format 4, a 14.3.0 regression), and ignored `kern` and `mort` tables with a non-first initial state. * Various fixes to the Graphite2 shaper. * Report HarfRust shaping failures through `hb_buffer_allocation_successful()`. * Fix wrong outlines in `gvar` fonts with intermediate tuples. * Fix `hb_face_create_or_fail()` rejecting face indices with named-instance bits set. * Fix wrong fallback metrics: the vertical descender in fonts without `vhea`, and the hanging baseline for some scripts. * Fix `hb_ot_layout_lookup_collect_glyph_alternates()` collecting garbage from `AlternateSubst` and `SingleSubst` format 1 lookups. * Speed up shaping on faces with many shape plans, `hb_language_from_string()`, vertical text with `hb-ft`, and `CBDT` and `sbix` fonts. * Fix crashes and deadlocks with FreeType, including `hb_ft_font_set_funcs()` on immutable fonts and font queries from color paint callbacks. * Fix crashes with NULL result pointers in `hb_ot_metrics_get_position_with_fallback()`, `hb_ot_layout_get_font_extents()`, and `hb_ot_layout_get_font_extents2()`. * Fix use-after-free in `hb_map_update()` when updating a map from itself. * Various fixes for crashes, hangs, and memory use with malformed fonts. * Faster subsetting of large `GSUB` and `GPOS` tables, and smaller `CFF` output. * Partially instancing or desubroutinizing `CFF2` fonts with nested blends now fails instead of changing the outlines. * Subsetting now fails if a glyph mapping assigns another glyph to glyph 0. * Fix `hb_subset_axis_range_from_string()` reading past the given length. * Fix subsetting beyond-64k variable fonts losing `HVAR` advance deltas. * Various subsetting and instancing fixes, mostly for `CFF`, `CFF2`, and `COLR`. * Fix rotated and skewed rectangle clips hiding their contents in the raster library, and out-of-bounds access when extents change during painting. * Fix the vector library mirroring path clips in SVG, and writing PDFs with wrong page bounds and misplaced or clipped `COLR` gradients. * Fix wrong clipping of `COLR` layers in the GPU library. * Various Cairo integration fixes, including a memory leak per scaled font. * Fix `hb-info --list-*` crashes on unusual fonts. * Various build and CI fixes. * New API: +hb_buffer_deserialize_glyphs2() +hb_buffer_deserialize_unicode2() ==== kernel-source ==== Version update (7.3.1 -> 7.3.3) - Update patches.kernel.org/7.3.1-002-mm-damon-core-error-damos_commit_quota_goal-for.patch (bsc#1012628 CVE-2026-99240 bsc#1289193). - Update patches.kernel.org/7.3.1-003-Bluetooth-L2CAP-refuse-__l2cap_chan_add-if-chan.patch (bsc#1012628 CVE-2026-99239 bsc#1289189). - Update patches.kernel.org/7.3.1-005-tracing-Hold-trace_types_lock-when-updating-mod.patch (bsc#1012628 CVE-2026-99238 bsc#1289182). - Update patches.kernel.org/7.3.1-006-tracing-Hold-trace_types_lock-when-resetting-la.patch (bsc#1012628 CVE-2026-99237 bsc#1289181). - Update patches.kernel.org/7.3.1-007-tracing-Reject-incomplete-event-filter-expressi.patch (bsc#1012628 CVE-2026-99236 bsc#1289229). - Update patches.kernel.org/7.3.1-008-tracing-Save-the-event-file-instead-of-the-comp.patch (bsc#1012628 CVE-2026-99235 bsc#1289218). - Update patches.kernel.org/7.3.1-009-tracing-Unregister-field-variable-histograms-wh.patch (bsc#1012628 CVE-2026-99234 bsc#1289217). - Update patches.kernel.org/7.3.1-012-tracing-histograms-Verify-event_call-identity-w.patch (bsc#1012628 CVE-2026-99233 bsc#1289227). - Update patches.kernel.org/7.3.1-013-tracing-syscalls-Use-copy_from_user-for-the-fau.patch (bsc#1012628 CVE-2026-99232 bsc#1289228). - Update patches.kernel.org/7.3.1-017-io_uring-waitid-prevent-cancel-reference-wrap.patch (bsc#1012628 CVE-2026-99227 bsc#1289219). - Update patches.kernel.org/7.3.1-019-keys-Avoid-the-owner-account-dereference-in-nam.patch (bsc#1012628 CVE-2026-99226 bsc#1289220). - Update patches.kernel.org/7.3.1-020-keys-Check-the-authorization-payload-in-process.patch (bsc#1012628 CVE-2026-99225 bsc#1289221). - Update patches.kernel.org/7.3.1-021-keys-Protect-the-type-name-while-describing-a-k.patch (bsc#1012628 CVE-2026-99224 bsc#1289223). - Update patches.kernel.org/7.3.1-022-keys-make-keyring-indexes-independent-of-kernel.patch (bsc#1012628 CVE-2026-99223 bsc#1289224). - Update patches.kernel.org/7.3.1-023-keys-Protect-the-read-method-check-against-type.patch (bsc#1012628 CVE-2026-99222 bsc#1289209). - Update patches.kernel.org/7.3.1-024-KEYS-Fix-key_reject_and_link-race-with-keyring-.patch (bsc#1012628 CVE-2026-99245 bsc#1289347). - Update patches.kernel.org/7.3.1-026-keys-trusted_keys-return-immediately-after-TPM-.patch (bsc#1012628 CVE-2026-99221 bsc#1289204). - Update patches.kernel.org/7.3.1-027-asymmetric_keys-reject-trust-keys-without-IDs.patch (bsc#1012628 CVE-2026-99220 bsc#1289225). - Update patches.kernel.org/7.3.1-028-ftrace-Initialize-modname-and-offset-in-print_r.patch (bsc#1012628 CVE-2026-99219 bsc#1289188). - Update patches.kernel.org/7.3.1-029-coredump-hold-RCU-while-releasing-parked-thread.patch (bsc#1012628 CVE-2026-99218 bsc#1289176). - Update patches.kernel.org/7.3.1-038-pid_namespace-prevent-TIF_NOTIFY_SIGNAL-from-in.patch (bsc#1012628 CVE-2026-99244 bsc#1289343). - Update patches.kernel.org/7.3.2-017-io_uring-waitid-own-the-request-before-clearing.patch (bsc#1012628 CVE-2026-99231 bsc#1289215). - Update patches.kernel.org/7.3.2-018-io_uring-cmd-don-t-leave-list-poison-in-hash_no.patch (bsc#1012628 CVE-2026-99230 bsc#1289226). - Update patches.kernel.org/7.3.2-019-io_uring-wait-don-t-spin-on-a-stuck-overflow-li.patch (bsc#1012628 CVE-2026-99229 bsc#1289216). - Update patches.kernel.org/7.3.2-020-io_uring-io-wq-don-t-lose-the-signal-that-ends-.patch (bsc#1012628 CVE-2026-99228 bsc#1289222). - Update patches.kernel.org/7.3.2-021-io_uring-io-wq-don-t-hide-a-link-from-cancellat.patch (bsc#1012628 CVE-2026-99255 bsc#1289285). - Update patches.kernel.org/7.3.2-022-io_uring-don-t-flood-a-cancelling-task-with-tas.patch (bsc#1012628 CVE-2026-99254 bsc#1289306). - Update patches.kernel.org/7.3.2-024-io_uring-cancel-rearm-local-work-wake-up-before.patch (bsc#1012628 CVE-2026-99253 bsc#1289298). suse-add-cves - commit 69165fa - Linux 7.3.3 (bsc#1012628). - xen-blkback: Avoid UAF when reading I/O statistics (bsc#1012628). - xen-netback: defer xenvif_mcast_addr_list_free() (bsc#1012628). - xen-netback: Fix UAF when reading statistics data (bsc#1012628). - commit 380c3b2 - Linux 7.3.2 (bsc#1012628). - net: skbuff: propagate shared-frag marker in skb_zerocopy() (bsc#1012628). - ksmbd: wait for negotiation before receiving another PDU (bsc#1012628). - smb: smbdirect: don't wait for RDMA_CM_EVENT_DISCONNECTED in smbdirect_socket_destroy_sync() (bsc#1012628). ... changelog too long, skipping 985 lines ... - commit 8e02181 ==== kirigami-addons6 ==== Version update (1.16.0 -> 1.16.1) Subpackages: kirigami-addons6-lang libKirigamiAddonsComponents6 libKirigamiAddonsStatefulApp6 libKirigamiApp6 - Update to 1.16.1 https://carlschwan.eu/2026/11/06/kirigami-addons-1.16.1/ ==== libcloudproviders ==== Version update (0.4.1 -> 0.4.2) - Update to version 0.4.2: * Allow to use services installed on user side * Prevent many possible crashes * Plug several memory leaks * Improve the D-Bus interface documentation - Update version dependencies according to meson.build. ==== libplist ==== Version update (2.8.0 -> 2.8.1) - Update to version 2.8.1: * Hardening: length-based range checks for bplist object data, node-count limit against crafted reference expansion, geometric bytearray growth fixing quadratic appends on large plists * Fix use-after-free in plist_copy_node(), double-free in node_from_xml() error paths and leaks on allocation failure across the XML, binary and OpenStep parsers * Fix plist_get_date_val() rounding and sign handling so dates round-trip, handle out-of-range and NaN without UB * No SONAME or API change (libtool 12:0:0 -> 12:1:0, headers unchanged); libplist-2_0-12 subpackages carry over - Spec cleanup: ldconfig scriptlets, macro-ified paths and build calls, reordered dependencies (no functional change) ==== openSUSE-release ==== Version update (20261108 -> 20261109) Subpackages: openSUSE-release-appliance-custom openSUSE-release-dvd - automatically generated by openSUSE-release-tools/pkglistgen ==== perl-Mail-DKIM ==== Version update (1.20240923 -> 1.20261105) - updated to 1.20261105 see /usr/share/doc/packages/perl-Mail-DKIM/Changes 1.20261105 2026-11-06 Australia/Melbourne * Don't canonicalize ARC-Seals once the ARC chain has failed, and only match ARC-Authentication-Results at the start of a header field Thanks to Sidney Markowitz and the Apache SpamAssassin PMC * Check ARC signature tags and instance numbers before looking up keys * Speed up ARC-Seal canonicalization for long ARC chains * Check ARC instance numbers in the ARC signer, and limit it to 50 ARC sets * Speed up DKIM header canonicalization for long h= lists * ARC signer skips messages with unparseable ARC headers rather than dying, and matches ARC header names case insensitively * ARC-Seal canonicalization takes the ARC-Authentication-Results instance from the start of the field * ARC verifier fails a chain with a missing or extra ARC-Authentication-Results header, and no longer warns about a missing cv= tag * Speed up parsing of long header fields, and of header field names, tag lists, h= lists and policy records with long runs of whitespace Thanks to Sidney Markowitz and the Apache SpamAssassin PMC * Only check test timings under AUTHOR_TESTING, so slow machines don't fail them Thanks to Sidney Markowitz * Speed up verifying messages with many signatures and many header fields, by indexing the header once for all the signatures Thanks to Sidney Markowitz and the Apache SpamAssassin PMC * Fix slow matching of ARC-Seal and ARC-Message-Signature headers with a long run of whitespace and no i= tag * ARC verifier fails a chain with an ARC-Authentication-Results header whose instance can't be found or is outside 1..50, rather than ignoring it, so an AAR not covered by the seals can't sit alongside a passing chain; the ARC signer skips such a message ==== perl-Mail-SPF ==== Version update (3.202.603.310 -> 3.202.611.50) - updated to 3.202.611.50 (3.20261105) see /usr/share/doc/packages/perl-Mail-SPF/Changes 3.20261105 2026-11-06 Australia/Melbourne * * Thanks to Giovanni for these changes: - RFC 7208 says there MUST be a limit of no more than 10 MX records looked up and checked; throw a permerror when the limit is exceeded instead of silently truncating the list - RFC 7208 says implementations SHOULD limit "void lookups" to two; enable the corresponding regression tests - Ensure every module's $VERSION is set by Dist::Zilla at release time, and manage the version number in README the same way - Security: escape untrusted text in the Received-SPF header to prevent header field injection: - escape parentheses and backslashes in the explanation comment, so text from a malformed SPF record or the sender identity can no longer close the comment early and inject forged fields such as client-ip= - escape control characters (e.g. CR/LF) in the envelope-from and helo fields - Fix macro expansion stopping at the first line break in a macro string, leaving later macros unexpanded - Security: authority_explanation now escapes control and non-ASCII characters in the explanation string (exp= TXT record) published in DNS, and document that the result text() may contain untrusted data - Remove the check for includes of the same domain through CNAME aliases. Including a domain and a CNAME alias of it is legal in RFC 7208, but the check tried to throw a hard fail for it. With a real resolver it read an unpopulated Net::DNS internal field and so in practice did nothing, but where it did take effect (e.g. with Net::DNS::Resolver::Programmable) it could wrongly fail authorized senders, and it used CNAME targets from DNS as unescaped regular expressions, which could make process() die. It also made an extra CNAME lookup per include that was not counted towards the RFC 7208 DNS lookup and void lookup limits. The test suite's resolver now follows CNAMEs, which is what the RFC 7208 cname-aliasing test case needed - Security: an exception thrown by the DNS resolver, including Net::DNS refusing to compose a query for an invalid domain name, made the SPF result none, i.e. no policy, rather than temperror. As invalid names can come from macros expanded with the sender's local part or HELO name, a sender could turn a domain's -all policy into none. Invalid domain names (empty label, label longer than 63 bytes, or name longer than 253 bytes, counted the way Net::DNS does, i.e. in bytes of UTF-8 and reading escapes such as "\.") are now treated as non-existent without querying the resolver, per RFC 7208, and other resolver exceptions result in temperror - Check the IP address version in the ip6 mechanism using the public NetAddr::IP API, rather than enumerating the request's address via an overloaded array dereference and reading an internal field, which died if the request's IP address was a large network - Allow Mail::SPF::Server->process() to evaluate a proposed SPF record passed in via a new 'record' option, instead of querying DNS for the authority domain's record, so a not-yet-published record can be tested against real DNS state - Prefer SPF1 over SPF2 (Sender ID, which is deprecated) when a record could be parsed as either - When a domain publishes both "v=spf1" and "spf2.0" records, always select the "v=spf1" record. Previously the record was chosen by the order of the records in the DNS answer, so the result could vary between queries, although the documentation and RFC 4406 said "spf2.0" records were preferred. Sender ID is historic (RFC 6686), so "v=spf1" is now deliberately preferred - Security: a "p" macro in an explanation string (exp= TXT record) made a PTR look-up and up to 10 A/AAAA look-ups for every occurrence, not limited by the RFC 7208 DNS look-up limits, so a sender could make a single SPF check send thousands of DNS queries. The "p" macro value is now looked up at most once per SPF check and authority domain. Also, exceeding the void look-up limit while expanding the explanation made authority_explanation() die; it now falls back to the default explanation - Reject a network (e.g. '10.0.0.0/8') as a request's ip_address with an EInvalidOptionValue exception. NetAddr::IP accepted it, which made no sense for SPF and changed the meaning of the mechanisms' address checks - Ignore an explanation string (exp= TXT record) that contains anything other than printable ASCII characters and spaces, as RFC 7208 requires, and use the default explanation instead. Control characters were already escaped, but an MTA using the explanation in an SMTP reply would still have sent the escaped text of a malicious explanation - Return none without querying DNS when the identity's domain is empty (e.g. "MAIL FROM:", which queried the root zone) or a single-label name (e.g. "HELO mailhost", which the resolver may expand with its search list and so query the receiver's internal domains), as RFC 7208 requires - Security: spfd now escapes control characters in the values of its response, so text from DNS or the client cannot add lines to the response, and in its debug output - Security: fix spfd's privilege dropping with --set-user and - -set-group. An unknown user or group name was not reported (due to an operator precedence bug) and could leave spfd running as root, the invoking user's supplementary groups (e.g. root's) were kept, and --set-user without --set-group kept group ID 0. spfd now dies on unknown names, drops the supplementary groups when started as root, and changes to the user's primary group if no group is given - Security: limit spfd to 64 concurrent connections, 60 seconds per connection, and 32 request lines of at most 1024 bytes, so a local client can no longer exhaust the process table or memory with idle, ... changelog too long, skipping 13 lines ... starting with ">" truncated the file ==== pipewire ==== Subpackages: gstreamer-plugin-pipewire libpipewire-0_3-0 pipewire-alsa pipewire-jack pipewire-lang pipewire-libjack-0_3 pipewire-modules-0_3 pipewire-pulseaudio pipewire-spa-plugins-0_2 pipewire-spa-tools pipewire-tools - Replace the patch with the upstream version from the 1.6 branch which includes the required #include * 0001-spa-libcamera-device-0.8-compatibility.patch - Add patch from upstream to fix compatibility with libcamera 0.8 * 0001-spa-libcamera-device-0.8-compatibility.patch ==== qt6-declarative ==== Subpackages: libQt6LabsAnimation6 libQt6LabsFolderListModel6 libQt6LabsPlatform6 libQt6LabsQmlModels6 libQt6LabsSettings6 libQt6LabsSharedImage6 libQt6LabsStyleKit6 libQt6LabsSynchronizer6 libQt6LabsWavefrontMesh6 libQt6Qml6 libQt6QmlCore6 libQt6QmlDesignSupport6 libQt6QmlLocalStorage6 libQt6QmlMeta6 libQt6QmlModels6 libQt6QmlNetwork6 libQt6QmlWorkerScript6 libQt6QmlXmlListModel6 libQt6Quick6 libQt6QuickControls2-6 libQt6QuickControls2Impl6 libQt6QuickDialogs2-6 libQt6QuickDialogs2QuickImpl6 libQt6QuickDialogs2Utils6 libQt6QuickEffects6 libQt6QuickLayouts6 libQt6QuickParticles6 libQt6QuickShapes6 libQt6QuickTemplates2-6 libQt6QuickTest6 libQt6QuickVectorImage6 libQt6QuickWidgets6 qt6-declarative-imports - Re-add 0001-QML-engine-Correctly-compare-composites-when-multipl.patch (boo#1289020)