Packages changed:
  389-ds (3.3.1+8c2711bd6 -> 3.3.1+28b6d8afc)
  GraphicsMagick
  ImageMagick (7.1.2.34 -> 7.1.2.35)
  MozillaFirefox (158.0 -> 158.0.1)
  SDL3 (3.4.18 -> 3.4.20)
  SVT-AV1 (4.2.0 -> 4.3.0)
  aaa_base
  accountsservice (23.13.9 -> 26.27.3)
  adwaita-icon-theme (50.0+2 -> 51.0)
  apache2-mod_php8 (8.5.11 -> 8.5.12)
  apparmor
  at-spi2-core (2.60.7 -> 2.62.1)
  atkmm1_6
  aurorae6 (6.8.0 -> 6.8.2)
  b43-fwcutter (019 -> 021)
  bind (9.20.29 -> 9.20.30)
  binutils
  bluedevil6 (6.8.0 -> 6.8.2)
  bluez
  breeze6 (6.8.0 -> 6.8.2)
  breeze6-gtk (6.8.0 -> 6.8.2)
  brotli (1.2.0 -> 1.2.1)
  bubblewrap (0.12.0 -> 0.13.1)
  busybox
  bzip2
  ca-certificates-mozilla (2.90 -> 2.92)
  cdparanoia (3.10.2 -> 10.2)
  ceph
  cpio
  cracklib-dict-full (2.8.12 -> 2.10.3)
  cups (2.4.19 -> 2.4.20)
  curl
  dconf (0.49.0 -> 51.0)
  discover6 (6.8.0 -> 6.8.2)
  dnsmasq
  dracut (112+suse.57.g23bbfee -> 112+suse.62.g1b64cef)
  drkonqi6 (6.8.0 -> 6.8.2)
  dtc (1.7.2 -> 1.8.1)
  e2fsprogs (1.47.3 -> 1.47.4)
  efivar (38 -> 39)
  emacs
  emacs-vterm
  enchant (2.8.19 -> 2.8.21)
  ethtool (7.1 -> 7.2)
  evince
  evolution (3.60.2 -> 3.62.1)
  evolution-data-server (3.60.2 -> 3.62.1)
  evolution-ews (3.60.2 -> 3.62.1)
  expat (2.9.0 -> 2.10.0)
  f2fs-tools (1.16.0 -> 1.17)
  ffado
  ffmpegthumbnailer (2.2.3 -> 2.3.1)
  fftw3 (3.3.10 -> 3.3.11)
  firewalld (2.3.2 -> 2.5.2)
  flatpak-kcm6 (6.8.0 -> 6.8.2)
  fltk
  freerdp (3.32.1 -> 3.33.0)
  freetype2
  fwupd (2.1.8 -> 2.1.9)
  gdk-pixbuf (2.44.7 -> 2.44.8)
  gdm (50.3 -> 51.1.1)
  gettext-runtime
  ghostscript
  gjs (1.88.1 -> 1.90.1)
  glib-networking (2.80.1 -> 2.90.1)
  glib2 (2.88.4 -> 2.90.1)
  glibmm2 (2.88.1 -> 2.90.0)
  glibmm2_4
  glycin-loaders (2.1.5 -> 2.2.6)
  gnome-autoar (0.4.5 -> 0.5.2)
  gnome-calculator (50.0+16 -> 51.1)
  gnome-characters (50.0 -> 51.0)
  gnome-chess (50.0 -> 50.1)
  gnome-clocks (50.0 -> 51.0)
  gnome-connections (50.0 -> 51.0)
  gnome-console (50.0 -> 51.0)
  gnome-contacts (50.0 -> 51.0)
  gnome-control-center (50.4 -> 51.1)
  gnome-desktop (44.5 -> 51.0)
  gnome-keyring (50.0 -> 51.1)
  gnome-mahjongg (49.1.1 -> 51.1)
  gnome-maps (50.5 -> 51.2)
  gnome-remote-desktop (50.2 -> 51.0)
  gnome-session (50.1 -> 51.0)
  gnome-settings-daemon (50.1+6 -> 51.1)
  gnome-shell (50.5 -> 51.1)
  gnome-software (50.4 -> 51.1)
  gnome-sudoku (50.4 -> 51.0.1)
  gnome-system-monitor (50.0 -> 51.1)
  gnome-text-editor (50.1 -> 51.0)
  gnome-weather (50.0 -> 50.0+30)
  gnutls
  google-noto-fonts (20261001 -> 20261101)
  grub2
  gsettings-desktop-schemas (50.1 -> 51.0)
  gtk4 (4.22.5 -> 4.24.1)
  gtkmm3
  gtkmm4 (4.22.0 -> 4.24.0)
  gtksourceview5 (5.20.0 -> 5.22.0)
  gvfs (1.60.3 -> 1.62.0)
  harfbuzz (14.6.0 -> 15.0.0)
  hidapi (0.14.0 -> 0.15.0)
  ibus (1.5.34 -> 1.5.35~rc1)
  ibus_gtk4 (1.5.34 -> 1.5.35~rc1)
  inih (62 -> 63)
  iproute2 (7.2 -> 7.3)
  ipxe (2.0.0+git20260710.58ee55b3c -> 2.0.0+git20260914.7cd92e01d)
  java-25-openjdk (25.0.4.1 -> 25.0.5.0)
  jbigkit (2.1 -> 2.2)
  kactivitymanagerd6 (6.8.0 -> 6.8.2)
  kde-cli-tools6 (6.8.0 -> 6.8.2)
  kde-gtk-config6 (6.8.0 -> 6.8.2)
  kdecoration6 (6.8.0 -> 6.8.2)
  kdeplasma6-addons (6.8.0 -> 6.8.2)
  kernel-source (7.2.11 -> 7.3.1)
  kf6-baloo
  kglobalacceld6 (6.8.0 -> 6.8.2)
  kinfocenter6 (6.8.0 -> 6.8.2)
  kio_audiocd
  kirigami-addons6 (1.14.0 -> 1.16.0)
  kmenuedit6 (6.8.0 -> 6.8.2)
  kmod (34.2 -> 34.3)
  knighttime6 (6.8.0 -> 6.8.2)
  kpipewire6 (6.8.0 -> 6.8.2)
  krb5
  kscreen6 (6.8.0 -> 6.8.2)
  kscreenlocker6 (6.8.0 -> 6.8.2)
  ksshaskpass6 (6.8.0 -> 6.8.2)
  ksystemstats6 (6.8.0 -> 6.8.2)
  kwayland-integration6 (6.8.0 -> 6.8.2)
  kwayland6 (6.8.0 -> 6.8.2)
  kwin6 (6.8.0 -> 6.8.2)
  lame (3.100 -> 4.0)
  layer-shell-qt6 (6.8.0 -> 6.8.2)
  lcms2 (2.19.1 -> 2.20)
  libHX (5.4 -> 5.5)
  libadwaita (1.9.4 -> 1.10.0)
  libapparmor
  libarchive (3.8.9 -> 3.8.10)
  libconfig (1.8.2 -> 1.8.3)
  libdeflate (1.25 -> 1.26)
  libevent (2.1.12 -> 2.1.13)
  libgit2
  libglycin (2.1.5 -> 2.2.6)
  libglycin-gtk4 (2.1.5 -> 2.2.6)
  libheif (1.23.6 -> 1.23.7)
  libimobiledevice (1.4.0+0git.20251010 -> 1.4.0+9git.20260610)
  libimobiledevice-glue (1.3.2+git0.20250604 -> 1.3.3+git0.20261005)
  libjpeg-turbo (3.2.0 -> 3.2.1)
  libkcddb
  libkscreen6 (6.8.0 -> 6.8.2)
  libksysguard6 (6.8.0 -> 6.8.2)
  libmad (0.16.4 -> 0.16.5)
  libmaxminddb (1.13.3 -> 1.14.1)
  libnfs
  libnice (0.1.23 -> 0.1.24)
  libnotify (0.8.8 -> 0.8.9)
  libopenmpt (0.8.9 -> 0.8.10)
  libostree (2026.4 -> 2026.6)
  libp11 (0.4.17 -> 0.4.21)
  libplasma6 (6.8.0 -> 6.8.2)
  libqaccessibilityclient-qt6
  librsvg (2.62.4 -> 2.63.4)
  libshumate (1.6.3 -> 1.7.0)
  libsndfile
  libsolv (0.7.40 -> 0.7.41)
  libsoup (3.6.6 -> 3.8.1)
  libstorage-ng (4.5.363 -> 4.5.368)
  libtirpc (1.3.7 -> 1.3.8)
  libunistring (1.4.2 -> 1.5)
  libupnp (22.1.8 -> 22.1.10)
  libusb-compat
  libusbmuxd (2.1.0 -> 2.1.1)
  libvirt (12.8.0 -> 12.9.0)
  libwacom (2.19.1 -> 2.20.0)
  libzypp (17.38.16 -> 17.38.17)
  lightdm
  linux-glibc-devel (7.2 -> 7.3)
  live555 (2026.10.17 -> 2026.10.29)
  llvm23 (23.1.3 -> 23.1.4)
  localsearch (3.11.2 -> 3.12.0)
  loupe (50.0 -> 51.1)
  lsscsi (0.32 -> 0.33)
  lvm2 (2.03.38 -> 2.03.43)
  lvm2-device-mapper (2.03.38_1.02.212 -> 2.03.43_1.02.217)
  makedumpfile
  mariadb (12.3.2 -> 13.0.2)
  milou6 (6.8.0 -> 6.8.2)
  mokutil (0.7.2 -> 0.7.3)
  mutter (50.5 -> 51.1)
  myrlyn (1.0.0 -> 1.1.0)
  nano (9.2 -> 9.3)
  nautilus (50.4 -> 51.1)
  ncurses (6.6.20260926 -> 6.6.20261017)
  nghttp2 (1.70.0 -> 1.71.0)
  nghttp3 (1.18.0 -> 1.19.0)
  ngtcp2 (1.25.0 -> 1.26.0)
  nvidia-open-driver-G06-signed (580.178.04_k7.2.11_1 -> 580.196.07_k7.3.1_1)
  nvidia-open-driver-G07-signed (595.104.02_k7.2.11_1 -> 595.112.07_k7.3.1_1)
  nvidia-open-driver-G07-signed-cuda (615.71.09_k7.2.11_1 -> 615.71.09_k7.3.1_1)
  nvidia-settings (580.159.03 -> 580.196.07)
  ocean-sound-theme6 (6.8.0 -> 6.8.2)
  openSUSE-release (20261020 -> 20261105)
  openal-soft (1.24.3~179 -> 1.25.2~0)
  openexr (3.5.2 -> 3.5.3)
  orca (50.3 -> 51.1)
  pam_kwallet6 (6.8.0 -> 6.8.2)
  pam_mount (2.22 -> 2.23)
  pangomm (2.56.2 -> 2.58.0)
  pangomm1_4
  parted
  patterns-base
  patterns-desktop
  patterns-games
  patterns-kde
  patterns-media
  patterns-server
  patterns-xfce
  pciutils (3.14.0 -> 3.15.0)
  pcsc-lite (2.3.3 -> 2.5.3)
  perl-Clone (0.500.0 -> 0.510.0)
  perl-Cpanel-JSON-XS (4.520.0 -> 4.800.0)
  perl-DB_File (1.860 -> 1.861)
  perl-MIME-tools (5.518.0 -> 5.522.0)
  perl-URI (5.370.0 -> 5.400.0)
  permissions
  phodav (3.0 -> 3.2)
  php8 (8.5.11 -> 8.5.12)
  pipewire (1.6.9 -> 1.6.11)
  plasma5support6 (6.8.0 -> 6.8.2)
  plasma6-activities (6.8.0 -> 6.8.2)
  plasma6-activities-stats (6.8.0 -> 6.8.2)
  plasma6-browser-integration (6.8.0 -> 6.8.2)
  plasma6-desktop (6.8.0 -> 6.8.2)
  plasma6-disks (6.8.0 -> 6.8.2)
  plasma6-integration (6.8.0 -> 6.8.2)
  plasma6-nm (6.8.0 -> 6.8.2)
  plasma6-openSUSE
  plasma6-pa (6.8.0 -> 6.8.2)
  plasma6-print-manager (6.8.0 -> 6.8.2)
  plasma6-systemmonitor (6.8.0 -> 6.8.2)
  plasma6-thunderbolt (6.8.0 -> 6.8.2)
  plasma6-workspace (6.8.0 -> 6.8.2)
  polkit-kde-agent-6 (6.8.0 -> 6.8.2)
  postfix
  powerdevil6 (6.8.0 -> 6.8.2)
  publicsuffix (20260921 -> 20261022)
  python-Brotli (1.2.0 -> 1.2.1)
  python-Pillow (12.3.0 -> 13.0.0)
  python-Twisted (26.4.0 -> 26.10.0)
  python-argcomplete (3.6.3 -> 3.7.2)
  python-argparse-manpage (4.7 -> 4.8)
  python-certifi (2026.7.22 -> 2026.10.23)
  python-gobject (3.56.3 -> 3.58.1)
  python-msgpack (1.2.3 -> 1.2.4)
  python-pip (26.2.1 -> 26.2.2)
  python-pycares (5.0.1 -> 5.2.1)
  python-pycparser (3.0 -> 3.12)
  python-pypdf (6.19.0 -> 6.21.2)
  python-tornado6 (6.5.10 -> 6.6)
  python313
  python313-core
  qpdf (12.4.1 -> 12.4.2)
  qqc2-breeze-style6 (6.8.0 -> 6.8.2)
  qt6-base
  qt6-declarative
  qt6-qt5compat
  quadrapassel (50.2 -> 51.1)
  rav1e
  rdma-core (63.0 -> 65.0)
  rsync (3.5.1 -> 3.5.2)
  rsyslog
  ruby4.0 (4.0.7 -> 4.0.9)
  salt
  samba (4.25.0+git.473.e78e78fbf4 -> 4.25.1+git.476.bfc358351cb)
  screen (4.9.1 -> 5.0.2)
  sdbootutil (1+git20261007.53bc127 -> 1+git20261026.4e266f0)
  sddm-kcm6 (6.8.0 -> 6.8.2)
  selinux-policy (20261019 -> 20261030)
  sensors
  shotwell (33.0 -> 33.1)
  simdutf (9.3.0 -> 9.3.3)
  snapshot (50.0 -> 51.0)
  snowball (3.0.1 -> 3.1.1)
  socat
  spacenavd (1.3.1 -> 1.4)
  spectacle (6.8.0 -> 6.8.2)
  speex
  spice
  sqlite3 (3.53.2 -> 3.54.1)
  squashfs (4.6.1 -> 4.7.5)
  sso-mib (0.10.1 -> 0.11.0)
  strace (7.2 -> 7.3)
  sushi (50.0 -> 51.2)
  systemsettings6 (6.8.0 -> 6.8.2)
  taglib (2.3 -> 2.3.2)
  tecla-keyboard-layout-viewer (50.0 -> 51.0)
  tesseract-ocr (5.5.3 -> 5.5.4)
  tevent
  tftp (5.3 -> 5.4)
  tigervnc
  tinysparql (3.11.1 -> 3.12.0)
  totem
  tpm2-0-tss (4.1.3 -> 4.2.1)
  tpm2.0-tools (5.7 -> 5.8)
  transmission (4.1.3 -> 4.1.4)
  u-boot-rpiarm64 (2026.07 -> 2026.10)
  unbound (1.26.1 -> 1.26.2)
  union6 (6.8.0 -> 6.8.2)
  usb_modeswitch (2.6.1 -> 2.6.2)
  usbutils (019 -> 020)
  userspace-rcu (0.15.6 -> 0.15.7)
  util-linux
  util-linux-systemd
  vlc
  webkitgtk3 (2.54.1 -> 2.54.2)
  webkitgtk4 (2.54.1 -> 2.54.2)
  wireplumber (0.5.18 -> 0.5.19)
  xdg-desktop-portal-gnome (50.0 -> 51.0)
  xdg-desktop-portal-kde6 (6.8.0 -> 6.8.2)
  xf86-input-wacom (0.40.0 -> 1.2.0)
  xfsdump (3.2.0 -> 3.3.0)
  xfsprogs (6.19.0 -> 7.2.0)
  xkeyboard-config
  xorg-x11-libX11-ccache
  xorg-x11-server (21.1.24 -> 21.1.25)
  xscreensaver (6.16 -> 6.17)
  xterm (411 -> 412)
  xwayland (24.1.13 -> 24.1.14)
  yast2-trans (84.87.20261004.92ae53d41b -> 84.87.20261027.d68bd6c358)
  yelp (49.2 -> 49.2+12)
  zvbi (0.2.45 -> 0.2.46)
  zypper (1.14.101 -> 1.14.102)

=== Details ===

==== 389-ds ====
Version update (3.3.1+8c2711bd6 -> 3.3.1+28b6d8afc)
Subpackages: lib389 libsvrcore0

- bsc#1284028 - CVE-2026-86344 - incomplete LDAP messages sent in rapid succession can cause worker thread exhaustion
- bsc#1284034 - CVE-2026-86345 - smuggled plaintext commands sent alongside StartTLS requests can cause response forgery and authentication bypasses
- Update to version 3.3.1+28b6d8afc:
  * Issue 7919 - Coordinate PDU writer handoff and buffered reads
  * Issue 7919 - CVE-2026-86344 - Fix worker pool exhaustion via partial LDAP messages (DoS)
  * Issue 8001 - RFE - log total number of entries in each backend
  * Issue 8017 - Server can hang at shutdown after an aborted import (#8026)
  * Issue 7879 - Outbound SASL bind waits forever while holding krb5_lock (#7881) (#7926)
  * Issue 7827 - Preserve dsEntryDN case from DN cache (#7828)
  * Issue 7877 - UI - add view raw entry action (#7878)
  * Issue 7915 - UI - Reindexing single attribute does not show progress in modal (#7916) (#7930)
  * Issue 7953 - dsrate - should use server's ldif directory location (#7954)
  * Issue 7921 - Fix StartTLS plaintext buffer handling (#7922)
  * Issue 7912 - dsidm role create-filtered ignores --nsrolefilter and forces an interactive prompt (#7913)
  * Issue 7908 - dsctl cockpit open-firewall --zone passes a malformed argument (#7909)
  * Issue 7905 - man: fix dropped line in 99user.ldif(5) example (#7906)
  * Issue 7742 - memory leak in schema replication (#7894)
  * Issue 7848 - Reject incomplete MD5 and GOST-YESCRYPT hashes (#7849)
  * Issue 7744 - memory leak in search referral handling (#7884)
  * Issue 7702 - memory leak in send_specific_attrs() (#7883)
  * Issue 7745 - memory leak in replication replica init (#7892)
  * Issue 7887 - Prevent password reuse when changing multiple passwords (#7888)
  * Issue 4598 - Copy attribute syntax hashtables to each worker thread (#5693)
  * Issue 7835 -  rdn can be NULL when passed to bdb_has_spaces() in bdb_upgradedn_producer()
  * Issue 7837 - importing ldif with entry with long attribute name and subtype causes stack-buffer-overflow (#7838)
  * Issue 6270 - heap-use-after-free with pwp dictionary path (#7791)
  * Issue 7863 - remove redundant strcmp's in schema superset checking
  * Issue 7506 - CLI/UI - Add option to list accounts by status (#7818)
  * Issue 7627 - When it exists configured matching rule for an (#7628)
  * Issue 7832 - remove instance monitor directory when server is removed (#7839)
  * Issue 7772 - double-free when processing an invalid Session Tracking control (#7773)
  * iadvisories/GHSA-rgxx-hcc4-x3h4 / heap-buffer-overflow in rdn_av_swap (#7826)
  * Issue 7823 - CI: stabilize test_controltype_expired_grace_limit (#7824)
  * Issue 7815 - Support nsslapd-attribute-name-exceptions when adding entries

==== GraphicsMagick ====
Subpackages: libGraphicsMagick++-Q16-12 libGraphicsMagick-Q16-3 libGraphicsMagick3-config

- modified patches
  * GraphicsMagick-CVE-2026-46523.patch (refreshed)
  * GraphicsMagick-disable-insecure-coders.patch (refreshed)

==== ImageMagick ====
Version update (7.1.2.34 -> 7.1.2.35)
Subpackages: ImageMagick-config-7-SUSE libMagickCore-7_Q16HDRI10 libMagickWand-7_Q16HDRI10

- added patches [bsc#1282560]
  https://github.com/ImageMagick/ImageMagick/issues/9095
  * ImageMagick-tiff-correct-endianess.patch
- version update to 7.1.2.35
  * Divide by alpha in LinearBurn, Screen, Exclusion and Difference compose #9074
  * stop montage directory walk at the terminating nul #9075
  * build(deps): bump the codeql-action group with 3 updates #9070
  * build(deps): bump ubuntu from f144425 to c098726 in /.devcontainer #9065
  * Reject incomplete MTV frame headers #9055
  * add cmyko quantum to GetQuantumExtent #9060
  * build(deps): bump the codeql-action group with 3 updates #9051
  * build(deps): bump actions/create-github-app-token from 3.2.0 to 3.3.0 #9045
  * build(deps): bump ossf/scorecard-action from 2.4.4 to 2.5.0 #9046
  * build(deps): bump the codeql-action group across 1 directory with 3 updates #9032
  * build(deps): bump actions/upload-artifact from 7.0.1 to 7.0.2 #9028
  * build(deps): bump actions/download-artifact from 8.0.1 to 8.0.2 #9027
  * Draw SVG strokes in the internal SVG renderer again #9031
  * Draw SVG strokes in the internal SVG renderer again (#9031) #9030
  * https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7f2w-c8wf-xvf8 b45a28c
  * building out the shuffle images framework 955901b
  * support -shuffle operator 02a8cbc
  * restore switch case that was hosed 0e6ed70
  * Fixed build error on Windows. 2dc42f2
  * https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wvfx-g9wq-253w 139c692
  * Removed unused function for build where the distributed cache is disabled. 0054822
  * https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-gr4q-6v79-qj3g 28c1eb3
  * add shuffle demo ea642e5
  * completing the shuffle framework b1bc241
  * https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pp97-v3gv-9vh4 1b0cd97
  * https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pp97-v3gv-9vh4 a28f038
  * set reasonable max profile size ed50136
  * track parse entities exceptions 93c3733
  * throw proper exception when profile exceeds maximum 7e3e1d0
  * https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6xcw-8jvx-wh63 58ac439
  * https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-v86v-4xf8-xjq4 3f27cc7
  * https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-v86v-4xf8-xjq4 059c7f0
  * buffer clone nexus 1ec93e4
  * https://github.com/ImageMagick/ImageMagick/pull/9042 c950f69
  * https://github.com/ImageMagick/ImageMagick/issues/9040 06f5b60
  * https://github.com/ImageMagick/ImageMagick/issues/9041 e071d8e
  * https://github.com/ImageMagick/ImageMagick/issues/9039 578d94c
  * https://github.com/ImageMagick/ImageMagick/issues/9038 e20d7a4
  * https://github.com/ImageMagick/ImageMagick/issues/9037 4eb3c67
  * https://github.com/ImageMagick/ImageMagick/issues/9036 c0ca7f4
  * Improve readability. dfb852c
  * cosmetic ef8c025
  * https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-3pf7-cjfr-3fpq 6b833ce
  * https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-2pc3-3339-3qc9 ae72b12
  * https://github.com/ImageMagick/ImageMagick/issues/9049 e84e85b
  * https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-mf84-8w53-2f2c 5ac0936
  * https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-x3j8-cjwr-m4pv 00301ef
  * https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-m9p2-wqc3-mj22 d3a850a
  * https://github.com/ImageMagick/ImageMagick/issues/9057 816368f
  * https://github.com/ImageMagick/ImageMagick/issues/9053 a0ac982
  * Fixed build. 60de283
  * revert 949237a
  * Minor optimization. 4decb21
  * Added a check for empty profiles. 2ae4e07
  * Added new security option that can be used to limit the number of profiles an image can have (GHSA-2h6m-67xh-cm4p) 11313ac
  * Set the minimum limit to 1. 8f66633
  * Correct the return value. 10baa5f
  * Revert local test. b72361b
  * Check the number of profiles that will be added against the security policy. fa6bff5
  * add max policy count 985d464
  * Apply patch from #9061 to fix reading sixel file. c2a7577
  * Added new method to sanitize filenames and use that for GHSA-2pc3-3339-3qc9. 3a9639c
  * https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-q66g-3m63-78mh c5f2c6c
  * https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-p58q-7cv7-7w3m b3cb8ab
  * https://github.com/ImageMagick/ImageMagick/issues/9059 62fc3c1
  * eliminate compiler exception 692124a
  * improved UI/UX a9abe84
  * improved UI/UX b77302e
  * Correct encoding with group4 compression in tiff coder (#9058). 07883df
  * Added check to test if the tiff coder is available. f333f65
  * Corrected unit test. 915af29
  * revert 9f63ebd
  * check that columns 	  	rows are not zero bdf369b
  * https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-m2p5-qpx9-5mx6 813d6c0
  * https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-67p3-xhc7-g797 433b039
  * https://github.com/ImageMagick/ImageMagick/issues/9069 b9d501e
  * https://github.com/ImageMagick/ImageMagick/issues/9068 88cf314
  * eliminate compiler warning 7aa7b44
  * https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-hg5r-hf2p-g9xq 8c56a52
  * https://github.com/ImageMagick/ImageMagick/issues/9071 1ba75b6
  * https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-5jwm-r7f4-4m53 55a2d75
  * Updated configure. 6a30a28
  * Minor code cleanup. b456c0f
  * Match both slash- and backslash-separated paths and patterns during lexical and canonical path-policy evaluation on Windows (GHSA-hpjv-7vmp-f58w) 4f3be68
  * Updated the dependencies. 96abe79
  * Updated setting the values of the SBOM. 9446665
  * https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-c764-55gw-gj6c 3fd3608
  * https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-5v9f-r478-x7vx 28f6586
  * https://github.com/ImageMagick/ImageMagick/issues/9077 942e86f
  * add mix to pixel and meta content 8152030
  * discuss DPC security a9c4102
  * cosmetic 6ea6c0d
  * https://github.com/ImageMagick/ImageMagick/pull/9062 39ad88f
  * Also create a StrictReadInlineImage implementation (GHSA-h9f8-qmvx-p39m) 998773f
  * more conservative coder depth 21c25b4
  * Corrected typo. c18f444
  * Switch to macos-15. 1f1e4d5
  * Updated configure. 9ec53fd
  * Updated the dependencies. acaf7e4

==== MozillaFirefox ====
Version update (158.0 -> 158.0.1)
Subpackages: MozillaFirefox-branding-upstream

- Mozilla Firefox 158.0.1
  * https://www.firefox.com/en-US/firefox/158.0.1/releasenotes/
    MFSA 2026-111 (boo#)
  * CVE-2026-113399 (bmo#2079938)
    Incorrect boundary conditions in the SVG component
  * CVE-2026-113470 (bmo#2083382)
    Cryptographic issue in the Security Block-lists, Allow-lists,
    and other State component
  * CVE-2026-113400 (bmo#2061768)
    Uninitialized memory in the Audio/Video: cubeb component
  * CVE-2026-113401 (bmo#2073714)
    Denial-of-service in the PDF Viewer component
  * Mozilla blocked compromised eMudhra intermediate certificates
    via OneCRL on October 17th. The blocks were distributed to
    clients via Remote Settings the same day. This update contains
    the updated OneCRL block list, ensuring clients will block the
    compromised certificates even if RemoteSettings is disabled by
    policy or otherwise unavailable in the user's
    network environment
  * Fixed an issue where pages would unexpectedly scroll back to
    the top when selecting text (bmo#2081016)
  * Fixed an issue where Firefox was opening windows on the wrong
    monitor in multi-monitor setups on Linux (bmo#2076558)
  * Fixed an issue that could prevent the built-in VPN from turning
    on for some users (bmo#2055094)

==== SDL3 ====
Version update (3.4.18 -> 3.4.20)

- Update to release 3.4.20
  * Improved Wayland clipboard handling
  * Fixed color cursor alpha mask on X11
  * Fixed a crash when Vulkan texture memory binding fails
  * Fixed transparent windows using the Vulkan renderer
  * Improved handling of Nintendo Switch controller calibration
  * Fixed Nintendo Switch controllers failing because of missing
    stick and IMU calibration
  * Fixed reports stopping on the Flydigi Vader 5 Pro while the
    Flydigi Space Station service is running
  * Added support for rumble and trigger rumble on the Flydigi
    Vader 5 Pro
  * Added support for the 8BitDo Ultimate 2C Wireless controller
    via HIDAPI

==== SVT-AV1 ====
Version update (4.2.0 -> 4.3.0)

- Update to release 4.3.0
  * Improvedd the quality vs. speed tradeoffs across all presets:
  * ~5-8% improvement in cycle efficiency at similar quality levels
  * ~10-11% run time reduction in multi-threaded mode
  * Speed optimizations in MD pruning, RDOQ and coefficient cost,
    MV cost and subpel search, loop filter parameter derivation,
    and block copies
  * Now runs anti-aliasing-aware screen content detection only on
    I-frames in multi-threaded mode
  * Added low-delay tile parallelism
  * Added opt-in CBR pre-encode frame skipping
  * Added screen content tools for RTC: IntraBC on I-frames and
    palette on intra blocks of inter frames

==== aaa_base ====
Subpackages: aaa_base-extras

- Remove the /etc/init.d/boot.local and /etc/init.d/after.local ghost
  placeholders; nothing has executed these files since the sysvinit
  era and the spec already recorded the intent to drop them. This
  resolves the executable-marked-as-config-file errors on the pair
- Build the text-only subpackages extras, malloccheck, wsl and
  yama-enable-ptrace as noarch
- Drop the legacy aaa_base:/etc/DIR_COLORS provides from
  aaa_base-extras; nothing in Tumbleweed requires it
- Fix a typo in the yama-enable-ptrace description and wrap the main
  description line
- Drop the Group tags from all package sections
- Rework aaa_base-rpmlintrc: drop the filters whose targets no longer
  exist in the package (the wtmp log file group, the restricted
  hostname symlink and the deprecated init script filters for the
  removed .local files) and add reasoned filters for the remaining
  deliberate warnings (the nsswitch.conf backup copy in %post, the
  skel dotfiles, /var/adm and the sysconfig fillup templates)

==== accountsservice ====
Version update (23.13.9 -> 26.27.3)
Subpackages: typelib-1_0-AccountsService-1_0

- Update to version 26.27.3:
  + release notes are at
    https://gitlab.freedesktop.org/accountsservice/accountsservice
- Rebase accountsservice-sysconfig.patch and
  harden_accounts-daemon.service.patch.
- Drop accountsservice-mocklib-gcc14.patch and remove patched
  mocklib: fixed upstream.
- Add json-c to BuildRequires: new dependency.
- Rename libaccountsservice package to account for new sover.
- Make vala package noarch. It doesn't contain any binaries.

==== adwaita-icon-theme ====
Version update (50.0+2 -> 51.0)

- Update to version 51.0:
  + No changes, stable bump only.
- Update to version 51.beta:
  + XDG Projects folder.

==== apache2-mod_php8 ====
Version update (8.5.11 -> 8.5.12)

- version update to 8.5.12
    Core:
    Fixed GHSA-w8hw-w9fx-j79w, GHSA-6wmf-4rv5-p3rp (Avoid state corruption via bailout). (CVE-2026-109618, CVE-2026-109619) [bsc#1286027]
    Fixed bug GH-23644 (Optimizer leaves a constant-vs-constant comparison unfolded, crashing the VM in zval_undefined_cv).
    Fixed OSS-Fuzz 532353396 (assertion failure with static type).
    Fix GH-23662 (Avoid NAN warning in print_r()).
    Fix GH-21999: GC inconsistency with lazy object, var_dump(), and object comparison.
    Fixed OSS-Fuzz #536440507 (Immutable class incorrect assertion).
    Fixed AVX being reported as supported when the OS has not enabled AVX state.
    Fixed GH-23980 (ZEND_ASSERT violation @ ZEND_INCLUDE_OR_EVAL).
    Fixed use-after-free when a dl()-loaded extension declares a frameless function and a later request calls it.
    Fixed System V shared memory emulation for Windows attaching segments past the end of their mapping.
    Fixed exception thrown by destructor during GC in a Fiber not being rethrown into the frame that triggered the GC.
    BCMath:
    Fixed BcMath\Number results that truncate to zero keeping a negative sign and comparing less than zero.
    BZ2:
    Fixed double close of the descriptor and use-after-free of the inner stream when bzopen() is given a stream resource.
    CLI:
    Fix GH-22567 (Windows ZTS CLI SAPI should refresh its TSRMLS cache during request activation).
    Fixed bug GH-23764 (Built-in server leaks a file descriptor on every HEAD request for a static file).
    Fixed crash in the built-in server when a client is reset before being accepted.
    Fixed the built-in server truncating an error page and leaking its unsent part after a partial socket write.
    DOM:
    Fixed use-after-free when re-constructing a DOMXPath whose php:function registrations are freed while still reachable from the cycle collector.
    Fixed Dom\HTMLDocument::getElementById() not finding ids of SVG and MathML elements.
    Fixed Dom\HTMLDocument giving attributes the namespace of their element when a fragment is parsed with an xlink, xml or xmlns context element.
    Fixed bug GH-23887 (Dom\HTMLCollection::namedItem() assertion failure, hang, or missed first element).
    Fixed DOMXPath and Dom\XPath losing the context node and in-scope namespaces of an evaluation after a php:function() callback evaluated another expression on the same object.
    FFI:
    Fixed crashes with FFI callbacks created from __call() trampolines and array callables whose object is released.
    FTP:
    Fixed bug GH-23619 (cryptic error on servers that don't support TLS session resumption on data connection).
    GD:
    Fixed undefined behavior with GD2 images with `INT_MAX`-sized chunks.
    Fixed undefined behavior with GIFs with problematic LZW compression data.
    Intl:
    Fixed cloning IntlDateFormatter and MessageFormatter losing PHP-side state such as dateType, timeType, calendar and the message pattern.
    Fixed a crash when converting with a cloned UConverter that uses toUCallback/fromUCallback.
    Fixed Collator attribute and strength methods not rejecting an unconstructed Collator.
    Fixed crash in intl_error_set_custom_msg() without an active call frame.
    Fixed grapheme_strstr() and grapheme_stristr() returning incorrect substrings when supplementary characters precede the match.
    Fixed grapheme_strstr() and grapheme_strpos() missing canonically equivalent matches, and grapheme searches reporting ICU errors for empty haystacks.
    Fixed grapheme_strrpos() and grapheme_strripos() skipping overlapping matches when using a negative offset.
    Fixed IntlDateFormatter::parse(), localtime() and parseToCalendar() treating the offset as UTF-16 code units instead of bytes.
    Lexbor:
    Merge patches lexbor/lexbor@8a14bc0 and lexbor/lexbor@f67ce4b, fixing a heap buffer overflow in :lexbor-contains() parsing and buffer overflows in malformed decode replay.
    Merge patches lexbor/lexbor@859f100, lexbor/lexbor@a36e09a, lexbor/lexbor@b0f7412, lexbor/lexbor@1b215a8, lexbor/lexbor@385afff, lexbor/lexbor@e6c068f, lexbor/lexbor@327a8b6,
    lexbor/lexbor@917742f and lexbor/lexbor@e89c258, fixing dropped usernames containing an at sign, uninitialized memory in IDNA buffer growth, the encoding of a space before a
    query or fragment in an opaque path, a query or fragment lost after a dot segment in a path, replacement file drive paths, the output encoding used for percent-encoding, the
    URLSearchParams tail pointer and fragment serialization without a query.
    MBString:
    Fixed bug GH-23106 (mb_strpos() reads past the end of a haystack ending in a truncated UTF-8 sequence).
    Fixed mbstring functions emitting surrogates in UTF-8 output and flagging it as valid UTF-8.
    MySQLi:
    Fix GH-22854: Fixed failed assertion when accessing mysqli property after failed reconnection.
    MySQLnd:
    Fixed field_count not resetting on OK packet.
    Fixed memory leak when closing a prepared statement after its connection was killed.
    Opcache:
    Fixed OSS-Fuzz #546798343 (Heap-buffer-overflow in optimizer with FCCs and inlining).
    Fixed bug GH-23693 (Tracing JIT produces wrong results for a guard on a loop-invariant addition).
    Fixed OSS-Fuzz #5674034779193344 (Read of uninitialized memory in is_cacheable_stream_path()).
    Fix zend_analyze_calls() call_stack buffer overrun.
    Fixed bug GH-23628 (Tracing JIT reads undefined property slots of lazy proxy objects instead of forwarding to the real instance).
    Fixed bug GH-23679 (Tracing JIT writes a parent private property into a child's shadowing public property).
    Fix multiple incorrect DCE due to unsound escape analysis.
    Fixed bug GH-24063 (OPcache optimizer folds `$cond ? -0.0 : 0.0` into a single `-0.0` constant).
    Fixed crash when a file cache is reused with a different set of extensions declaring frameless functions.
    Fixed bug GH-23991 (JIT generates invalid IR for multiple recursive calls).
    Fix SCCP evaluation of isset()/empty() on dimension of non-escaping object.
    Fixed bug GH-20890 (Segfault in zval_undefined_cv with non-simple property hook with minimal tracing JIT).
    OpenSSL:
    Fixed stream_socket_enable_crypto() leaving the socket non-blocking after a handshake timeout.
    Fixed feof() on a TLS stream staying false after a close_notify on Windows.
    PCNTL:
    Fixed pcntl_signal_dispatch() dropping the queued signals when it runs while an exception is pending.
    Fixed pcntl_signal_dispatch() dropping the signals queued behind a handler that throws.
    Fixed bug GH-23986 (/proc/self paths resolve to the parent process after pcntl_fork()).
    PDO:
    Fixed PDOStatement::getColumnMeta() reading out of bounds for an invalid column index.
    Fixed PDOStatement::bindColumn() registering a binding for a column name that is not in the result set.
    Fixed PDOStatement::execute() leaving the previous result available after a failed execution.
    Fixed a use-after-free when bindValue()/execute()/closeCursor() is called from a bound parameter's __toString() during execute().
    Fixed bug GH-23962 (Destroying a persistent PDO instance rolls back a transaction still in use by another instance).
    Fixed PDO::setAttribute() installing a PDO::ATTR_STATEMENT_CLASS class whose constructor arguments it rejects.
    Fixed PDO::ATTR_STATEMENT_CLASS constructor_args type errors reporting "array given" regardless of the value passed.
    Fixed PDOStatement::bindParam() and bindColumn() leaking the driver options value.
    Fixed PDOStatement not reporting its bound parameters and columns to the cycle collector.
    Fixed PDOStatement::setFetchMode() not applying changes atomically.
    PDO_DBLIB:
    Fixed bug GH-23741 (segfault after a failed query inside a PDO transaction). Errors raised by beginTransaction(), commit(), rollBack() and lastInsertId() are now reported instead of being dropped.
    PDO_Firebird:
    Fixed bug GH-23758 (PDO_Firebird returns null for non-null empty BLOBs).
    PGSQL:
    Fixed pg_lo_write() rejecting data containing null bytes.
    Removed pg_service(), unavailable with any released libpq.
    Readline:
    Fixed a heap over-read in the interactive shell prompt when cli.prompt is set to an empty string.
    Reflection:
    ... changelog too long, skipping 25 lines ...
  * php-build-reproducible-phar.patch (refreshed)

==== apparmor ====
Subpackages: apparmor-abstractions apparmor-docs apparmor-parser apparmor-profiles apparmor-utils python3-apparmor

- add transmission-2246.patch: allow transmission to lock its
  lockfile (boo#1289007)
- Pass the distribution build flags to the plain make builds of the
  parser and the binutils programs, so apparmor_parser, aa-exec,
  aa-load and aa-status are built with fortify and stack-protector
  hardening like the rest of the package
- Drop the obsolete BuildRoot tag from both specs and use the pkgconfig
  spelling of the pkg-config BuildRequires

==== at-spi2-core ====
Version update (2.60.7 -> 2.62.1)
Subpackages: libatk-1_0-0 libatk-bridge-2_0-0 libatspi0 typelib-1_0-Atk-1_0 typelib-1_0-Atspi-2_0

- Update to version 2.62.1:
  * Fix baseline race in direct connection test.
  * Fix typecasting macros in atspi-application.h.
  * At-spi-bus-launcher: Clean up dbus-daemon when terminating from signals
    other than SIGTERM.
- Update version dependencies according to meson.build.
- Update to version 2.62.0.1:
  + This is functionally equivalent to 2.62.0, but the tag for
    2.62.0 was not signed.

==== atkmm1_6 ====

- Update version dependencies according to meson.build.
- Update URL to new home.

==== aurorae6 ====
Version update (6.8.0 -> 6.8.2)

- Update to 6.8.2
  * New bugfix release
  * For more details please see:
  * https://kde.org/announcements/plasma/6/6.8.2
- Changes since 6.8.1:
  * Update version for new release 6.8.2
- Update to 6.8.1:
  * New bugfix release
  * For more details see https://kde.org/announcements/plasma/6/6.8.1
- Changes since 6.8.0:
  * Update version for new release 6.8.1

==== b43-fwcutter ====
Version update (019 -> 021)

- Update to version 021:
  * Support extracting firmware from two more Broadcom driver blobs
    (wl_apsta.o, wlDSL-3580_EU.o_save)
  * Fix possible firmware filename truncation in driver
    identification output
  * Port the mklist.py helper script to Python 3
  * Upstream tarball format changed to .tar.xz; adjust Source
    URL accordingly
- Spec cleanup: drop obsolete Group, BuildRoot and %defattr, use
  %make_build, declare missing gcc and make BuildRequires
- Fix Supplements grouping: ssb rev02 belongs to b43legacy,
  both pcmcia IDs to b43

==== bind ====
Version update (9.20.29 -> 9.20.30)
Subpackages: bind-utils

- Upgrade to release 9.20.30
  Security Fixes:
  * Prevent exhaustion of CPU while parsing crafted DNS messages.
    (CVE-2026-19630)
    [bsc#1286575]
  * Prevent concurrent GSS-TSIG traffic from terminating named.
    (CVE-2026-94300)
    [bsc#1286578]
  * Fix a crash with redirect zones and strict QNAME minimization.
    (CVE-2026-96888)
    [bsc#1286579]
  * Fix a crash when resuming from a query initiated by RPZ.
    (CVE-2026-97313)
    [bsc#1286580]
  Bug Fixes:
  * Remove a spurious root trust anchor warning and recognize the
    new root key.
  * Do not accept HMAC keys and signatures for SIG(0) or DNSSEC.
  * Fix DNSSEC tool dates being read one hour late during Daylight
    Saving Time.
  * Reject URI records with an empty target.
  * Fix a crash when loading a zone in raw format.
  * Prevent dynamic update prerequisites from probing zones that
    refuse queries.
  * Fix a named-journalprint crash when using the -x option.
  * Honor server settings for keyed NOTIFY and DS queries.
  * Fix a catalog zone update bug.
  * Fix an out-of-bounds read in dig +dns64prefix.
  * Prevent excessive RRL table scans under load.
  * Make named-checkconf fail on invalid command-line arguments.
  * Remove the temporary file when saving a zone file fails.
  * Prevent the statistics channel from serving data on
    unregistered URL prefixes.
  * Fix a crash on OpenBSD when a signal reached an idle worker
    thread.
  * Resolve names in insecure zones whose apex answers with a
    CNAME.
  * Set GSS-TSIG keys to last as long as the negotiated context.

==== binutils ====
Subpackages: libctf-nobfd0 libctf0 libsframe3

- Add a couple more CVE fixes that meanwhile got upstream:
  * bsc#1280611 aka CVE-2026-91781 aka PR34449
  * bsc#1280605 aka CVE-2026-90828 aka PR34450
  * bsc#1275936 aka CVE-2026-19582 no PR
  * bsc#1275267 aka CVE-2026-19548 no PR
- Also fixed already:
  * bsc#1282138 aka CVE-2026-15003 aka PR34053
- Add patches for the above:
  binutils-fix-cve19582.diff, binutils-fix-cve19548.diff,
  binutils-fix-pr34450.diff, binutils-fix-pr34449.diff

==== bluedevil6 ====
Version update (6.8.0 -> 6.8.2)

- Update to 6.8.2
  * New bugfix release
  * For more details please see:
  * https://kde.org/announcements/plasma/6/6.8.2
- Changes since 6.8.1:
  * Update version for new release 6.8.2
- Update to 6.8.1:
  * New bugfix release
  * For more details see https://kde.org/announcements/plasma/6/6.8.1
- Changes since 6.8.0:
  * Update version for new release 6.8.1
  * kcm: Fix device section headers

==== bluez ====
Subpackages: bluez-auto-enable-devices bluez-cups bluez-obexd libbluetooth3

- Own zsh-completion dirs.

==== breeze6 ====
Version update (6.8.0 -> 6.8.2)
Subpackages: breeze6-cursors breeze6-decoration breeze6-style breeze6-style-qt5

- Update to 6.8.2
  * New bugfix release
  * For more details please see:
  * https://kde.org/announcements/plasma/6/6.8.2
- Changes since 6.8.1:
  * Update version for new release 6.8.2
- Update to 6.8.1:
  * New bugfix release
  * For more details see https://kde.org/announcements/plasma/6/6.8.1
- Changes since 6.8.0:
  * Update version for new release 6.8.1

==== breeze6-gtk ====
Version update (6.8.0 -> 6.8.2)
Subpackages: gtk2-metatheme-breeze6 gtk3-metatheme-breeze6 gtk4-metatheme-breeze6 metatheme-breeze6-common

- Update to 6.8.2
  * New bugfix release
  * For more details please see:
  * https://kde.org/announcements/plasma/6/6.8.2
- Changes since 6.8.1:
  * Update version for new release 6.8.2
- Update to 6.8.1:
  * New bugfix release
  * For more details see https://kde.org/announcements/plasma/6/6.8.1
- Changes since 6.8.0:
  * Update version for new release 6.8.1

==== brotli ====
Version update (1.2.0 -> 1.2.1)
Subpackages: libbrotlicommon1 libbrotlidec1 libbrotlienc1

- Update to release 1.2.1
  * Fixed an out-of-bounds write write permitting remote code
    execution [CVE-2026-111497]

==== bubblewrap ====
Version update (0.12.0 -> 0.13.1)

- update to 0.13.1:
  * bwrap now accepts multiple --sync-fd arguments and will handle
    all of the fds.
  * O_PATH is used when opening parent directories in the new root,
    fixing an error when read permission is missing.
- update to 0.13.0:
  * Linux kernel headers with __NR_pivot_root (Linux 2.3.41+) are
    required at build-time on all architectures
  * If compiled with -Dassume_kernel=5.12.0 or newer, then a kernel with
    the mount_setattr syscall is required at runtime, and kernel headers
    with __NR_mount_setattr are required at build-time on most
    architectures. On the x86_64, i386 and aarch64 architectures, a
    fallback is provided to be able to compile with pre-5.12 kernel
    headers.
  * On kernels that support it (5.12+), use mount_setattr() to remount
    filesystems with ro, nodev and/or nosuid.
  * Arguments that expect a path argument (--bind, --overlay-src, etc.)
    now reject empty strings. Previously they would sometimes be treated
    as the root directory due to implementation details, but this was
    unintended.
  * A new build option -Ddebug_logging=true can be used to enable
    verbose debug logging (not recommended for distro builds). These
    debug messages don't appear unless environment variable
    DEBUG_INVOCATION is set at runtime.
  * Fix build failures with older gcc or older -std argument
  * Fix build failure with musl
  * Fix test failure on systems that lack hostname(1)
  * Fix test failure on systems with a mount point containing a
    backslash
  * Fix test failure on systems with older xdg-desktop-portal
  * Don't leave a temporary file behind after running the test suite
  * CI improvements

==== busybox ====
Subpackages: busybox-static

- Note we are not affected by the following CVEs with no fixes upstream.
  The relevant applets are disabled in our config. Add comments to the
  config file warning that enabling them would expose the unfixed CVEs:
  * dpkg-deb extraction-root escape via per-ar-member deferred
    symlink flush, CONFIG_DPKG disabled
    (CVE-2026-90954, bsc#1285581)
  * dpkg stale field_start pointer causing out-of-bounds read and
    status file corruption, CONFIG_DPKG disabled
    (CVE-2026-88842, bsc#1285579)
  * HTTP request smuggling via pipelined requests in httpd reverse
    proxy, CONFIG_FEATURE_HTTPD_PROXY disabled
    (CVE-2026-88829, bsc#1285577)
- Fix denial of service via terminal escape sequences in process
  names displayed by netstat (CVE-2024-58251, bsc#1241700)
  * 0001-Fix-CVE-2024-58251-sanitize-process-names-when-calli.patch
- Fix tar extraction-root escape via deferred symlink/hardlink
  creation (CVE-2026-108119, bsc#1284987)
  * 0001-tar-protect-against-Symlink-Hardlink-attack.patch
- Fix integer underflow in udhcpc d4_recv_raw_packet() leading to
  a crash when processing short untrusted DHCP packets
  (CVE-2026-88833, bsc#1285315)
  * 0001-udhcpc-ensure-packet.data.cookie-exists-before-we-ac.patch
- Fix httpd authentication timing difference between existing and
  non-existing system users caused by a missing else clause after
  a failed getspnam_r() call (CVE-2026-88834, bsc#1285314)
  * 0001-httpd-do-not-try-to-use-obviously-bogus-password-fro.patch
- Fix path traversal in libarchive allowing a crafted archive with
  a ".." member name to create files outside the extraction
  directory (CVE-2026-92205, bsc#1286932)
  * 0001-tar-.-is-also-an-unsafe-filename-treat-as-such.patch

==== bzip2 ====
Subpackages: libbz2-1

- Remove the explicit Requires(pre) on libbz2-1: the bzip2 binaries
  already generate a libbz2.so.1()(64bit) dependency, which only
  libbz2-1 provides, so the effective requirement is unchanged, and
  bzip2 ships no %pre scriptlet for the (pre) qualifier to serve.
  Drop bzip2-rpmlintrc with it; its only filter hid the resulting
  explicit-lib-dependency error
- Hardlink the duplicated alias man-page stubs (bzcat.1/bunzip2.1
  and bzfgrep.1/bzegrep.1) with %fdupes
- Drop the Group tags

==== ca-certificates-mozilla ====
Version update (2.90 -> 2.92)

- Updated to 2.92 state (bsc#1286261 CVE-2026-114406 bsc#1287180)
  - Removed:
  - emSign ECC Root CA - C3
  - emSign ECC Root CA - G3
  - emSign Root CA - C1

==== cdparanoia ====
Version update (3.10.2 -> 10.2)
Subpackages: libcdda_interface0 libcdda_paranoia0

- Align version with upstream release numbering (III 10.2):
  3.10.2 -> 10.2. No source changes (same upstream tarball).
- Spec cleanup: drop obsolete Group tags, https Source/URL.

==== ceph ====
Subpackages: librados2 librbd1

- Disable RWL cache (bsc#1288097)

==== cpio ====
Subpackages: cpio-mt

- Remove the leftover update-alternatives %post fragment and its
  Requires(post) from the mt subpackage. cpio-mt migrated away from
  update-alternatives to a Conflicts strategy (bsc#1240092) and the
  SLE 16 band already ships without the fragment (jsc#PED-15643);
  as written it could never fire, since it deregisters the
  alternative only when gnumt is absent, while cpio-mt’s own %post
  always runs with gnumt installed
- Annotate the two %ghost files of the mt subpackage with %attr
  (0755 for the /usr/bin/mt symlink path, 0644 for its man page)
  to silence the zero-permission ghost warnings; the ghosts stay
  so a stale /usr/bin/mt keeps an owning package
- Drop the obsolete Group tags and the commented-out install-info
  prereq lines

==== cracklib-dict-full ====
Version update (2.8.12 -> 2.10.3)

- Switch wordlist Source URLs from ftp:// to http:// (ftp is not
  reachable from the build environment); three wordlists
  re-downloaded with identical content (gzip header only)
- Update to 2.10.3, following the cracklib 2.10.3 package
  (boo#1160062): rebuild the dictionaries with its current
  tools. No wordlist changes.
- Spec cleanup (spec-cleaner pass)

==== cups ====
Version update (2.4.19 -> 2.4.20)
Subpackages: cups-client cups-config libcups2 libcupsimage2

- fix_mailto_validation.patch is
  "Fix: mailto notifier rejects valid email addresses
  containing dots"
  https://github.com/OpenPrinting/cups/pull/1745
  "Regression: mailto notifier rejects valid email addresses
  containing dots/periods"
  https://github.com/OpenPrinting/cups/issues/1744
- Version upgrade to 2.4.20:
  See https://github.com/openprinting/cups/releases
  CUPS 2.4.20 provides amount of bug fixes and security fixes:
  Assigned CVE ids:
  CVE-2026-55480 (bsc#1284277)
  CVE-2026-61702 (bsc#1284278)
  CVE-2026-87875 (bsc#1279945)
  CVE-2026-87876 (bsc#1279944)
  CVE-2026-55453 (bsc#1284275)
  CVE-2026-55467 (bsc#1284276)
  CVE-2026-105326 (bsc#1284274)
  Several fixes use GHSA id of security advisory
  due long waiting time for CVE ids from CNA.
  Due our changed policy the fixes referencing GHSA id are for:
  * vulnerabilities with CVSS < 7.0, which we take
    as lower priority vulnerabilities,
  * issues which require print admin rights for triggering them,
  * issues where its fix is security hardening patch/feature.
  Per our security policy, issues which require print admin rights,
  or are security hardening patches, are not taken as vulnerability
  and they reference a security advisory due convenience, see
  https://github.com/OpenPrinting/cups?tab=security-ov-file
  More details in CHANGES.md - excerpts:
  * SECURITY-5.7: The scheduler did not open temporary PPD files
    in exclusive mode (CVE-2026-55480)
  * SECURITY-5.5: The scheduler did not remove all job status
    attributes from a job creation request (GHSA-7j85-5r23-xhvh)
  * SECURITY-5.3: The scheduler did not validate the request
    language value (CVE-2026-61702)
  * SECURITY-4.6: Attribute names were not validated
    as proper keyword values (GHSA-w9hj-hq9p-m7f6)
  * SECURITY-4.3: The `cupsUTF32toUTF8` function incorrectly
    treated UTF-32 values as 64-bit (CVE-2026-87875)
  * SECURITY-4.1: Held jobs for temporary print queues could
    crash the scheduler (GHSA-qqm8-4q5h-jg55)
  * SECURITY-3.3: The backend did not sanitize IPP attribute
    strings (CVE-2026-55453)
  * SECURITY-3.3: The scheduler did not filter out group separators
    from job submissions (GHSA-wjc4-qhjr-5m5x)
  * SECURITY-3.0: Quota and policy operations did not treat
    usernames as case-sensitive (CVE-2026-87876)
  * SECURITY-3.0: The scheduler's startup permission checks
    were vulnerable to TOU attacks (GHSA-gj33-wxpv-6fgg)
  * SECURITY-2.5: The scheduler did not sanitize
    fax numbers (CVE-2026-55467)
  * SECURITY-2.5: The 'mailto' notifier did not sanitize
    the recipient address provided to the sendmail
    command (CVE-2026-105326)
  * SECURITY-2.3: The scheduler could crash when modifying
    a class (GHSA-pwg4-pv39-8c22)
  * Fixed handling of multiple PPD: keywords from filters
    (Issue #1562, related to CVE-2026-34980)
  Issues are those at https://github.com/OpenPrinting/cups/issues
- Adapted downgrade-autoconf-requirement.patch for CUPS 2.4.20
- cups-2.4.19-CVE-2026-87875.patch
  is no longer needed because the issue is fixed upstream.
- avoid_C99_loop_initial_declarations.patch avoids
  "ppd-cache.c:2173:5: error: 'for' loop initial declarations
  are only allowed in C99 mode"
  which happens when building CUPS 2.4.20 on older SLE12
  https://github.com/OpenPrinting/cups/issues/1742

==== curl ====
Subpackages: libcurl4

- Make the wcurl subpackage noarch: it ships a single shell
  script wrapper, so the architecture-specific build was
  flagged by no-binary; also capitalise its summary
- Drop the obsolete Group tags from the fish and zsh
  completion subpackages

==== dconf ====
Version update (0.49.0 -> 51.0)
Subpackages: gsettings-backend-dconf libdconf1

- Update version dependencies according to meson.build.
- Update to version 51.0:
  + No changes since 51.rc.
- Update to version 51.rc:
  + Update overview regarding safe writer.
- Update to version 51.beta:
  + Implement safe GVDB writer and use it by default for homes on
    NFS
  + docs:
  - Describe DBDIR argument in man page
  - Fix a typo

==== discover6 ====
Version update (6.8.0 -> 6.8.2)
Subpackages: discover6-backend-flatpak discover6-backend-fwupd discover6-backend-packagekit discover6-notifier

- Update to 6.8.2
  * New bugfix release
  * For more details please see:
  * https://kde.org/announcements/plasma/6/6.8.2
- Changes since 6.8.1:
  * Update version for new release 6.8.2
  * Update version for new release 6.8.2
  * fwupd: Do not pass the FwupdBackend object to the connect thread
  * AppsModel: Remove dup'd stream class
  * UpdateModel: React when resources disappear
  * Set X-KDE-AliasFor for Discover's hidden desktop entries (kde#511886)
- Update to 6.8.1:
  * New bugfix release
  * For more details see https://kde.org/announcements/plasma/6/6.8.1
- Changes since 6.8.0:
  * Update version for new release 6.8.1
  * Prepare ResourcesUpdatesModel before running headless updates (kde#519082)

==== dnsmasq ====

- Add upstream security fixes:
  * CVE-2026-93006, bsc#1288828: TFTP server can serve the wrong
    file contents because a recently used transfer cache is not
    invalidated when a transfer finishes
    (dnsmasq-CVE-2026-93006.patch).
  * CVE-2026-93007, bsc#1288829: TCP DNS service uses a small fixed
    pool of child processes and does not set a receive timeout on
    client connections (dnsmasq-CVE-2026-93007.patch, partial fix).
  * CVE-2026-93008, bsc#1288830: Records for the CNAME target were
    cached without checking that they belong to the responding
    server's zone (dnsmasq-CVE-2026-93008.patch).
  * CVE-2026-93009, bsc#1288831: Out-of-bounds read in the DHCPv6
    FQDN option parser (dnsmasq-CVE-2026-93009.patch).
  * CVE-2026-93011, bsc#1288833: One-byte heap overflow of a name
    buffer in the DNSSEC validator (dnsmasq-CVE-2026-93011.patch).

==== dracut ====
Version update (112+suse.57.g23bbfee -> 112+suse.62.g1b64cef)

- Update to version 112+suse.62.g1b64cef:
  * fix(bluetooth): always install HID drivers that can be needed
  * fix(bluetooth): mark installed hostonly files
  * fix(nvmf): prevent nvmf's installkernel failure when no nbft present
  * test(DRACUT-CPIO): fix unbound CPIO_TESTDIR variable
  * test(STORAGE): fix condition to add disk2

==== drkonqi6 ====
Version update (6.8.0 -> 6.8.2)

- Update to 6.8.2
  * New bugfix release
  * For more details please see:
  * https://kde.org/announcements/plasma/6/6.8.2
- Changes since 6.8.1:
  * Update version for new release 6.8.2
- Update to 6.8.1:
  * New bugfix release
  * For more details see https://kde.org/announcements/plasma/6/6.8.1
- Changes since 6.8.0:
  * Update version for new release 6.8.1

==== dtc ====
Version update (1.7.2 -> 1.8.1)

- add fix-32bitbuild.patch to fix build
- Update to 1.8.1:
  * Build system ported to Meson; Makefiles are deprecated
  * New libfdt APIs: fdt_get_property_namelen_w and
    fdt_setprop_namelen variants
  * dtc: informative error for stray identifiers, improved type
    guessing and label/phandle restoration when decompiling to dts
  * fdtdump: return an error code on wrong tag value instead of
    silently proceeding
  * dtdiff: accept dtbo files as dtb input; fdtput: prefer strtol
    over sscanf
  * New overlay checks: warn about missing #address-cells for
    interrupt parents
  * Revert accidental ABI breakage introduced in 1.8.0
  * Fix UBSAN null pointer dereference in fdt_property
  * FreeBSD and non-GNU linker compatibility improvements
  * Build against pkgconfig(yaml-0.1) instead of libyaml-devel
- Drop ce1d858.patch and 9a1c801a1a3c102bf95c5339c9e985b26b823a21.patch:
  both are upstream in this release

==== e2fsprogs ====
Version update (1.47.3 -> 1.47.4)
Subpackages: libcom_err2 libext2fs2

- Update e2fsprogs.keyring
- Update to 1.47.4:
  * mke2fs: support multiple -E options and a new root_selinux
    option setting the SELinux label of the root directory;
    suppress large-block-size warnings when the kernel supports
    block sizes greater than page size
  * mke2fs -d: handle copying files larger than 2 GiB; no longer
    create oversized orphan-file inodes with 64k block size
  * e2fsck: stop flagging fast symlinks with large external EAs
    (EA-inode backed) as corrupt; check EA-inode values for
    invalid zero size
  * e4defrag: fix crash defragmenting inline-data files
  * e2scrub: fix lvremove retry loop on temporary busy failures
  * fuse2fs and libext2fs: many correctness fixes found running
    xfstests (superblock error flags, refuse inconsistent mounts,
    read-only/offset mounts, permissions, ACLs, inline data,
    fallocate, FITRIM, statfs, relatime)
  * Man page cleanups
- Spec cleanup (spec-cleaner): drop obsolete Group tags and ppc64
  Obsoletes, https Source URLs, pkgconfig-style dependencies

==== efivar ====
Version update (38 -> 39)

- Add efivar-bsc1286645-revert-file-wrapper-removal.patch to revert
  the removal of "File()" (bsc#1286645)
- CVE-2026-6862: efivar: stack overflow in device path node parsing
  can cause a denial of service (bsc#1262696)
  * efivar-bsc1262696-fix-stack-overflow-in-device-path-parsing.patch
- Update to 39:
  * efivar CLI: -A accepts hex values, -a can create a
    non-existent variable
  * Revamped efi_well_known variable handling
  * File device paths no longer print "File(" or ")"
  * Fixed IPv4 and IPv6 device path printing
  * Handle non-ACPI systems in device_get
  * Headers gained extern "C" for easier use by C++
  * Build fixes: musl libc, i686 format error, riscv64 -march,
    gcc-13, invalid free in main
  * Make-based build: LLD detection fixes, removed deprecated
  - -add-needed linker flag, docs can be disabled
  * Upstream moved from rhinstaller to the rhboot organization
- Drop efivar-bsc1202209-fix-glibc-2.36-build.patch,
  efivar-adjust-dependency.patch and
  efivar-bsc1206388-revamp-efi_well_known-variable-handling.patch:
  all fixed upstream in this release
- Rebase efivar-filter-gcc-march.patch for the upstream riscv64
  rework (boo#1231368)
- Rebase libefiboot-export-disk_get_partition_info.patch for the
  upstream extern "C" header rework
- Switch Source to the rhboot tag archive: upstream published no
  release tarball for 39

==== emacs ====
Subpackages: emacs-el emacs-eln emacs-info emacs-nox etags

- Avoid cleaning the default native compilation cache when
  using --init-directory  (boo#1287635)

==== emacs-vterm ====

- Remove the now redundant site-start.d script. boo#1277717
- Avoid lexical binding warning on Emacs 31.1+ boo#1277717

==== enchant ====
Version update (2.8.19 -> 2.8.21)
Subpackages: enchant-2-backend-hunspell enchant-data libenchant-2-2

- Move documentation from library package (where it violates SLPP) to the -data
  package.
- Update version dependencies according to configure.ac.
- Update to version 2.8.21:
  + This release fixes two bugs in composite dictionaries: first,
    if any dictionary creation failed during creation of a
    composite dictionary, dictionaries already created would be
    leaked; and secondly, the broker error status could end up
    indicating an error incorrectly when one provider or language
    failed and a fallback later succeeded. Thanks to @lpyuu for the
    report and fixes.
- Changes from version 2.8.20:
  + This release improves the man page for enchant(1), mostly by
    documenting Ispell command-line options and pipe-mode commands
    that it ignores.

==== ethtool ====
Version update (7.1 -> 7.2)

- Update to release 7.2
  * Feature: support for KSZ87xx PHY tunables (--{get,set}-phy-tunable)
  * Fix: cmis: fix printing of Tx bias current (-m)
  * Fix: cmis: fix printing of channel-level flags (-m)
  * Fix: cmis: fix printing of CDB EPL pages (-m)
  * Fix: printing of transmitter technology for CMIS transceivers (-m)
  * Fix: avoid undefined behavior with CMIS transceivers (-m)
  * Fix: add missing CMIS transmitter technologies (-m)
  * Fix: printing of attenuation and wavelength (-m)
  * Fix: printing of link length (-m)
  * Fix: sfpid: print all implemented options (-m)
  * Fix: sfpid: print all compliance codes (-m)
  * Fix: qsfp: print all compliance codes (-m)
  * Fix: module-eeprom: clamp data length to attribute payload size (-m)
  * Fix: validate module EEPROM offset and length (-m)
  * Fix: rss: bound hash function masks in text and JSON output (-x)
  * Fix: fbnic: fix off-by-one shift in reg dump parser (-d)
  * Fix: fbnic: Fix various TX and RX CSR fields decoding (-d)
  * Fix: fbnic: Fix register dump names and bit labels (-d)

==== evince ====
Subpackages: evince-plugin-pdfdocument libevdocument3-4 libevview3-3

- Update version dependencies according to meson.build.

==== evolution ====
Version update (3.60.2 -> 3.62.1)
Subpackages: evolution-plugin-spamassassin

- Update to version 3.62.1:
  * Updated translations.
- Update version dependencies according to CMakeLists.txt.
- Update to version 3.62.0:
  + Bug Fixes:
  - Composer: De-duplicate inline images before send
  - junk-filters: Do not leak the child stdin pipe into
  concurrent spawns
  - Default to not use read-only calendars for reminders and
  conflict search
  - EUIParser: Notify about accelerators moved by an action
  rename
  - Mail: Validate clickable preview elements are generated by
  Evolution
  - Mail: Remove deprecated SHA1 signature algorithm
  + Miscellaneous: docs: Add API index for newly added symbols in
    3.62 for e-util
  + Updated translations.
- Drop pkgconfig(gnome-autoar-gtk-0) BuildRequires: this was
  vendored back with 3.59.1 and has since been dropped in
  gnome-autoar.
- Own %{_datadir}/GConf and %{_datadir}/GConf/gsettings: legacy
  migration directories.
- Update to version 3.61.3:
  + Bug Fixes:
  - Use gnome-shell-calendar-server for Reminders in GNOME
  - Composer: Add 'Remove Formatting' option
  - Mail: Do not replace first thread message with the latest
  - Composer: Remove sender's CSS color styles in HTML reply
  - EMailFormatter: Error text hard to read in dark theme
  - EMFolderTree: Cache folder icons for quicker drawing
  - EActivityProxy: Hide frame shadow
  - MessageList: Add style option for important mail color
  - Appointment cannot be saved when an e-mail is attached to it
  - Composer: Unsetting text color in HTML does not work
  - Mail: Embed file-based images in saved HTML signatures
  - Fix signature editor window headerbar
  - CI: Convert the tests into real CTest tests
  + Miscellaneous:
  - flatpak: Return back the libmspack build
  - e_util_ignore_accel_for_focused: Ignore accels when a button
    is focused
  - EMenuBar: Set tooltip on a menu button
  - SetupBuildFlags.cmake: Add `-Wunused-function`
  - test-web-view-jsc: Correct the tests for newer WebKitGTK
  - e_util_ignore_accel_for_focused: Ignore on GtkTreeView only
    when its search is on
  - test-web-view-jsc: Stop test early when script execution fails
  + Updated translations.
- Update to version 3.61.2:
  + Bug Fixes:
  - Fails to import Chinese Outook PST file (charset) ][
  - Marcus Bains line is displayed on the wrong day ][
  - EMFolderTree: Unexpected scroll after context menu dismiss
  - Can't toggle email labels in popover via keyboard
  - EShellSearchbar: When changing search type, field contents
    are erased
  - cal_shell_view_transfer_selected: Incorrect data type used
    when moving events
  - EShellSearchbar: Hide Saved Search submenu when none is saved
  - Fix translation of "Collection Account" menu item
  + Miscellaneous:
  - RSS: Reorder when a new folder flags are set and folder
    summary created
  - Addressbook: Improve accessibility of the card view widgets
  - ETreeViewFrame: Set tooltip on toolbar buttons
  - flatpak: Workaround autoreconf issue in the flatpak build
  - flatpak: Remove libmspack module from the build
  + Updated translations.
- Update to version 3.61.1:
  + Bug Fixes:
  - Mail: Don't disable folder tree sensitivity after search
    setup
  - Do not offer to create a folder under an RSS account
  - Add composer format override per folder, recipient, and
    account
  - Localization is not applied for the date field in the email
    preview
  - Composer open delayed by gpg call with stale gpg lock
  - itip-formatter: Guess attendee for REQUEST without attendees
  - Mail: Allow to save emails as .eml via drag & drop
  - Better integration of custom layout dialog
  - Composer: Add 'View->Use Theme Colors' for HTML mode (view
    only)
  - EUIAction: Declare alternative label for popup menus
  - Truncated file stored in the (mail) cache
  - prefer-plain: Empty body when prefer plain with HTML and no
    plain text
  - Fails to import Chinese Outook PST file (charset)
  - tnef: Fix OOB read when PR_ATTACH_DATA_OBJ buffer is too
    short
  - tnef: Fix PT_UNICODE property over-read via strlen()
  - Marcus Bains line is displayed on the wrong day
  - Work Week/Day view overlaps text for multi-day events with
    times
  - Inconsistent timezone for completed tasks
  - IMAP: Add "Manage subscriptions" into "Receiving options"
  - WebDAVBrowser: Do not save collection color when None is set
  - Fix line breaks for <p> and heading elements in
    ... changelog too long, skipping 52 lines ...
  + Updated translations.

==== evolution-data-server ====
Version update (3.60.2 -> 3.62.1)
Subpackages: libebackend-1_2-11 libebook-1_2-21 libebook-contacts-1_2-5 libecal-2_0-3 libedata-book-1_2-27 libedata-cal-2_0-2 libedataserverui-1_2-4

- Update to version 3.62.1:
  * Updated translations.
- Update version dependencies according to CMakeLists.txt.
- Update to version 3.62.0:
  + Bug Fixes:
  - GOA EWS: Do not require OABUrl in autodiscover
  - EBackend: Document how OAuth2 sources should ask to be
  authenticated
  - CalDAV: Ignore Bad Request (400) on overwrite
  - ESourceRegistry: Name the credentials source in failed-lookup
  debug message
  + Updated translations.

==== evolution-ews ====
Version update (3.60.2 -> 3.62.1)

- Update to version 3.62.1:
  * Bug Fixes
  * Updated translations.
- Update version dependencies according to CMakeLists.txt.
- Update to version 3.62.0:
  + Bug Fixes:
  - Add a per-folder coalescing gate for sync and refresh
  - camel: Do not save the folder summary in the subclass dispose
  + Updated translations.
- Update to version 3.61.3:
  + Bug Fixes:
  - m365: Mail: Flagged and priority indicators are mixed
  - Stuck on stream read after proxy error response
  - m365: Incorrect timezone used with recurring events
  + Miscellaneous:
  - SetupBuildFlags.cmake: Add `-Wunused-function`
  - Update windowsZones.xml to 2021a version
  + Updated translations.
- Update to version 3.61.2:
  + Miscellaneous:
  - Camel: Reorder when a new folder flags are set and folder
    summary created
  - e-ms-oapxbc-util: Adapt to recent API changes in e-ms-oapxbc
  + Updated translations.
- Update to version 3.61.1:
  + Bug Fixes:
  - Calendar: Crash when cancelling meeting with empty notice
  - m365: Event time in UTC incorrectly changes to local timezone
  - ews-test-common: remove GLIB_CHECK_VERSION(2,35,0)
  - m365: Use delta sync for calendar events
  - Camel: Clean up provider conf entries definitions
  - m365: Validate host of server-provided nextLink and deltaLink
    URLs
  - ews: Fix path traversal in attachment filename from server
  - lzxd: Add bounds checks in lzxd_read_lens() to prevent buffer
    overrun
  - oab: Fix integer overflows, memory leaks, and decompression
    bombs
  - oab-decoder: Fix crash on unknown properties, string list
    bug, and DoS
  - m365: URI-escape id parameter in construct_uri to prevent
    path injection
  - e-cal-backend-m365: Fix a compiler warning
  - Make CMAKE_BUILD_TYPE enumeration for cmake-gui
  - Convert to CamelDataCache atomic write API
  - build: Add CAMEL_LDFLAGS into oab-decode-test
  - Use "--output-on-failure" for ctest in "make test"
  + Updated translations.

==== expat ====
Version update (2.9.0 -> 2.10.0)
Subpackages: libexpat1

- update to 2.10.0:
  * Security fixes:
  * CVE-2026-113351, bsc#1286599: denial of service with use of
    XML_ParserReset
  * CVE-2026-115506, bsc#1287856: detect billion laughs attacks
    quicker and more of its variations
  * CVE-2026-117610, bsc#1288868: fix initial non-final empty
    subparser parse calls, was segfaulting
  * CVE-2026-118370, bsc#1288849: protect attIndex and nPrefixes in
    storeAtts from signed integer overflow
  * Bug fixes:
  * Initialize m_parsingStatus.finalBuffer in parserInit
  * Improve XML_Parse for XML_CONTEXT_BYTES == 0
  * Use C99 length modifiers for ptrdiff_t and size_t
  * Check isCalledFromInsideHandler first in XML_Parse
  * Add missing check for a character handler reset
  * Library version bumped from 14:0:13 to 14:1:13

==== f2fs-tools ====
Version update (1.16.0 -> 1.17)

- Update to release 1.17
  * mkfs.f2fs: Introduce configurable reserved sections
  * f2fs_io: support new commands: checkpoint, precache_extents,
    move_range, gc_range, move_range, get_advis, fadvise, freeze,
    thaw, fdatasync, ioprio.
  * f2fs-tools: add noatime for quota file
  * f2fs-tools: Support different block sizes
  * libf2fs: Accept Sparse files with non 4K Blocksize
  * f2fs-tools: add write hint support
  * mkfs.f2fs: add device aliasing feature
  * Introduce new utility inject.f2fs
- Delete build logic for Leap < 15.5
- Delete c23.patch (merged)

==== ffado ====

- libffado-date_time.patch: avoid mismatched format string types
  and args

==== ffmpegthumbnailer ====
Version update (2.2.3 -> 2.3.1)
Subpackages: libffmpegthumbnailer4

- Update to version 2.3.1:
  * Add audio file thumbnails (new ENABLE_AUDIO_THUMBNAILER option)
  * Add additional Matroska MIME types
  * Build against newest ffmpeg, require C++14
  * Fix mingw and static builds
- Drop ffmpegthumbnailer-update-for-newest-ffmpeg.patch: fixed
  upstream (PR#240)

==== fftw3 ====
Version update (3.3.10 -> 3.3.11)

- improve summaries
- Use HTTP to download sources instead of FTP.
- Update to version 3.3.11:
  * New API fftw_copy_plan().
  * Support SVE SIMD instructions.
  * Support LoongArch LSX and LASX SIMD instructions.
  * Support Apple ARM, RISC-V and LoongArch cycle counters.
  * Fix SSE2 double-precision unaligned access segfaults.
  * threads/openmp/mpi-devel now require pkgconfig(fftw3/f/l)
    (provided by fftw3-devel); man pages ship as regular files.
- Modernize spec file (spec-cleaner, drop Group/BuildRoot).

==== firewalld ====
Version update (2.3.2 -> 2.5.2)
Subpackages: firewalld-bash-completion python313-firewall

- Update to version 2.5.2:
  * fix(nftables): prerouting cannot reliably determine egress
  * fix(ci): git: use https protocol
  * fix(runtime-to-permanent): copy empty config fields
  * fix(firewall-cmd): don't shadow config import
  * fix(firewall): prefer values() over items()
- Changes from version 2.5.1:
  * fix(check_config): do not check combined zone file name length
  * doc(firewall-cmd): remove duplicate --permanent
  * fix(firewall-cmd): avoid extra newline with empty message
  * fix(dispatch): OUTPUT and POSTROUTING should terminate with ACCEPT
- Changes from version 2.5.0:
  * feat(firewall-config): support gnome automatic dark theme
  * feat(watcher): log warning if configuration changed
  * feat(service): add Solr
- Changes from version 2.4.4 - 2.3.4: Please see
  https://github.com/firewalld/firewalld/releases
- Update to version 2.3.4:
  * This is a bug fix only release.
    + fix(firewall-config): _load_store_append(): properly get runtime zone
    + fix(check-config): check combined zones
    + fix(firewall-cmd): dbus: wait for connection
    + fix(check_config): do not check combined zone file name length
    + fix(build): dist: add missing policy xmlschema
    + fix(firewall-cmd): use config.VERSION for --version
    + fix(firewall-cmd): handle no options when not running
- Changes from version 2.3.3:
  * This is a bug fix only release.
    + fix(nftables): batch ipset elements in set_restore to avoid O(n²)
    insertion cost
    + fix(firewalld): spin trying to acquire dbus
    + fix(systemd): do not wait on dbus
    + fix(zone): forward: support timeout
    + fix(policy): support timeouts
    + fix(cli): policy: allow timeout with --ingress-zone/--egress-zone
    + fix(watcher): delete timeout before calling callback
    + fix(watcher): disable while writing configuration
    + fix(watcher): clear timeouts on reload
    + fix(service): steam-streaming: add ports for VR
    + fix(bash): add completion for --service
    + fix(policy): use PK_ACTION_CONFIG for set{ZoneSettings2,PolicySettings}
    + fix(rpm): drop dependency on dbus-x11
- Drop 0003-CVE-2026-4948-fix-dbus-setter-authorization.patch: fixed upstream.
- Add zsh BuildRequires: Needed due to zsh-completion dirs.

==== flatpak-kcm6 ====
Version update (6.8.0 -> 6.8.2)

- Update to 6.8.2
  * New bugfix release
  * For more details please see:
  * https://kde.org/announcements/plasma/6/6.8.2
- No code change since 6.8.1
- Update to 6.8.1:
  * New bugfix release
  * For more details see https://kde.org/announcements/plasma/6/6.8.1
- No code changes since 6.8.0

==== fltk ====

- added patches
  CVE-2026-116723: stack-based buffer overflow in `Fl_BMP_Image:load_bmp_()` can lead to crash or code execution [bsc#1288053]
  CVE-2026-116724: integer overflow in `Fl_BMP_Image:load_bmp_()` can lead to heap corruption [bsc#1288054]
  * fltk-CVE-2026-116723,116724.patch

==== freerdp ====
Version update (3.32.1 -> 3.33.0)
Subpackages: libfreerdp3-3 librdtk0-0 libwinpr3-3

- Update to version 3.33.0:
  * What is new:
    + Webassembly support, now can run from within your browser
    + Improved SDL client RAILS
    + Experimental UDP support for direct (without gateway) RDP connections
    + Unicode keyboard input pipe now supported by all clients (on systems that
    support mkfifo unix style pipes)
    + Experimental windows shadow server support. It is back from the dead!
    + Mac OS file clipboard support without FUSE (all clients)
    + Initial support for translation of messages The influx of pull requests
    and feedback for bugs/regressions/... was huge, so we will do a patch
    release with all the papercuts and bug still in the backlog soon.
  * CVE:
    + Https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-hhfh-fvm7-7w65
    + Https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-pq35-c472-69w2
    + Https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-v7hr-xh82-79p7
    + Https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-9r9q-9r7p-4mr6
    + Https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-76c4-7552-ffhv
    + Https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-j5pq-cm28-qm6v
    + Https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-2hm9-2h5q-x525
    + Https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-hj6g-r86h-wrcg
    + Https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-fw6x-h8gw-778w
    + Https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-q8p6-8mmj-j4ph
    + Https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-r664-f94r-rgg6
    + Https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-4g67-jhpc-q5xp
    + Https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-8m87-jj8p-2fqc
    + [core,nla] report NTLM rejected
    + [codec,av1] fix colours of decoded YUV444 frames
    + [core,peer] skip disconnect sequence when MCS not established
    + [client,sdl] send one wheel axis per event
    + Rail: initialize client status before deferred RemoteApp execution
    + Fix stale signature pointer in v1 cert writer
    + [client,sdl] strip the terminating \0 from text for local applications
    + [codec,dsp] only create an Opus coder for Opus formats
    + [client,x11] Send Backspace and Delete as scancodes in Unicode mode
    + [codec,channels] guard new Android MediaCodec/AAudio APIs behind their
    introduced-in level
    + Must have feature: pretend that a movie or gstreamer pipeline is your
    camera
    + [channels,rdpdr] add 64-bit, file information and volume drive APIs to
    the server
    + [codec,h264] add Apple VideoToolbox decoder
    + [client,sdl] resend the window layout to a new display channel
    + [channels,rdpsnd] allow some slack before dropping samples as overrun
    + [channels,rdpsnd,winmm] keep a little audio queued ahead
    + Kerberos realm prompter fixes
    + [client,sdl] log a failed display layout as such
    + [channels,rdpsnd,pulse] default target latency, and silence in front when
    playback restarts
    + [winpr,clipboard] fix HTML synthesizer destination format checks
    + [client,x11] add deferred alt forwarding option to prevent alt keys from
    being prematurely sent to remote
    + [client,x11] keep keyboard mappings across MappingNotify reloads
    + [core,connection] Send client messages stateless
    + [core,connection] go on after the server Monitor Layout PDU
    + [common,settings] add canary for freerdp_device_free
    + [core,gateway] clear completed RDG header state
    + [core,multitransport] client side UDP multitransport
    + [core,settings] keep desktop and device scale factors apart
    + [core,proxy] fix length of HTTP basic auth string
    + [codec,av1] decode with WebCodecs in Emscripten builds
    + [client,x11|sdl] wait the resize delay after DisplayControlCaps
    + [core,proxy] allow ignoring proxy servers
    + [core,gateway] unify rts_syntax_id_new/free
    + [channels,rdpsnd] add a Web Audio backend for Emscripten builds
    + [client,sdl] test the system configuration in TestSDLPrefs
    + [channels,rdpsnd] relink when the JavaScript library changes
    + [client,common] sso-mib: decode req_cnf as base64url
    + [codec,h264] decode with WebCodecs in Emscripten builds
    + [core,connection] detect a broker redirect
    + [core,connection] leave the active state before disconnecting
    + [client,sdl] pass the activating click to RemoteApp windows
    + [channels,audin] add a Web Audio microphone backend for Emscripten builds
    + [client,sdl] no connection dialog window in Emscripten builds
    + [winpr,sync] yield to the browser through a MessageChannel
    + [client,sdl] browser clipboard for Emscripten builds
    + [winpr,utils] abort PNG write on size wrap or realloc failure
    + [client,sdl] RemoteApp fixes and cleanups
    + [client,sdl] Emscripten: a page may split the canvas into monitors
    + [client,sdl] stop server output only when every monitor window is hidden
    + [client,sdl] add Windows support for RemoteApp
    + [client,common] stop auto-reconnect when a reconnect attempt is rejected
    + [client,sdl] fix RemoteApp popups dragged
    + [core,fastpath] discard input events before activation
    + [client,common] fill in the touch contact count
    + [client,sdl] RemoteApp window position, size and minimize fixes
    + [shadow,win] follow encoder preferred fps in capture loop
    + [codec,video] add android mediacodec support
    + [client,sdl] rail: keep popups whose SDL parent goes away; do not
    disconnect on orders for unknown windows
    + [client,x11] do not send cliprdr data on a torn down channel
    + [client,sdl] send keys as unicode with /kbd:unicode
    + [codec,h264] harden emscripten NAL parser
    + [client,sdl3] register the signal cleanup handler again
    + [client,sdl] send the physical monitor size in millimetres
    + [client,sdl] rail: never activate WS_EX_NOACTIVATE windows
    + [core,rdstls] add more failure logging
    + [core,listener] listen on a Unix socket on Windows too
    + [channels,rdpear] add workaround for older windows versions
    ... changelog too long, skipping 125 lines ...
    + [client,sdl] renegotiate the desktop size in fullscreen

==== freetype2 ====

- fix description

==== fwupd ====
Version update (2.1.8 -> 2.1.9)
Subpackages: fwupd-bash-completion libfwupd3 typelib-1_0-Fwupd-2_0

- Update to version 2.1.9:
  * This release adds the following features:
    + Add an instance ID for each Redfish HPE device class and target pair
    + Include if the machine is a container or hypervisor in the report data
    + Require libusb 1.0.27 when building the daemon
  * This release fixes the following bugs:
    + Add After=local-fs.target to fwupd.service to fix a CoreOS mount issue
    + Create a dbx device with version 0 when the variable is missing
    + Delete the efi helper when using fwupdtool reboot-cleanup
    + Do not show GPIO devices in the fwupdmgr emulation-tag device list
    + Do not truncate 64-bit values when exporting firmware as XML
    + Fix a small memory leak when installing dell-kestrel firmware
    + Fix the DFU footer size check
    + Ignore parent battery reports when updating the Jabra GNP child
    + Process all releases to set the version on a 2023-only dbx
    + Remove command aliases from bash-completion
    + Use absolute paths when sending the filename hint
  * This release adds support for the following hardware: Pixart PID 38CA
- Update version dependencies according to meson.build.
- rename Polkit rules to give it a 10- prefix, allowing them to gain priority
  over the SUSE-specific rules generated in
  /etc/polkit-1/rules.d/90-default-privs.rules (bsc#1279948).

==== gdk-pixbuf ====
Version update (2.44.7 -> 2.44.8)
Subpackages: gdk-pixbuf-query-loaders libgdk_pixbuf-2_0-0 typelib-1_0-GdkPixbuf-2_0

- Update to version 2.44.8:
  + glycin: Support x-/y-dpi options for png, tiff and jpeg
  + Updated translations.

==== gdm ====
Version update (50.3 -> 51.1.1)
Subpackages: gdm-schema gdm-systemd gdm-xdm-integration libgdm1 typelib-1_0-Gdm-1_0

- Add gdm-timeout-for-plymouth-quit.patch: Use a separate timeout
  for the plymouth quit (bsc#1270027 glgo#GNOME/gdm!414)
- Update to version 51.1.1:
  * Fixed headless user display creation erroring out.
- Update to version 51.1:
  * Improve the reliability of our GPU-is-ready detection (corrected the code
    that checks for the boot_display sysfs attribute)
  * Restricted which PAM stacks GDM will run, to defend against malicious
    greeters
  * Oo7 enablement for Arch Linux's PAM stacks
  * Fixed bug where gnome-headless-session@<user>.service would stop working if
    the user logs out from within the headless session
  * Changed behavior of RemoteDisplayFactory API to wait for the new headless
    display to have a `session-id` set before returning/exporting it. This is a
    backwards-compatible change that makes it easier to use this API
  * Code cleanups
  * Updated translations.
- Update version dependencies according to meson.build.
- Update to version 51.0:
  + Fixed some memory leaks
  + Correctness improvements to GDM's PAM extensions
  + Fixes to remote login with Kerberos
  + Updated translations.
- Rebase gdm-initial-setup-hardening.patch.
- Update to version 51.rc:
  + Follow-up bugfix for $GDM_AUTH_SESSION_ID
  + Follow-up bugfix for redone PAM service loading logic
  + Follow-up bugfix for pam_gdm keyring buffer bounds check
  + Fixed a couple crashes and memory leaks
  + Introduced pre-authenticated remote displays, for Kerberos
    authentication in gnome-remote-desktop
  + Updated Fedora's PAM rules to include support for oo7 instead
    of gnome-keyring
  + Translation updates
- Update to version 51.beta:
  + Fixed autologin bypass where a compromised greeter could
    request autologin for any local account by sending arbitrary
    usernames via BeginAutoLogin
  + Dropped unused `enable-web-authentication` and
    `enable-passkey-authentication` gsettings keys from the
    `org.gnome.login-screen` schema
  + Introduced PAM substack safety net, such that authentication
    cannot by bypassed on systems where authselect hasn't
    configured a PAM service file for a specific authentication
    method (i.e. `gdm-switchable-auth`)
  + Fixed double-free in session worker
  + Reworked build script for installing PAM service files into
    modern search path
  + Redid PAM service loading logic in GDM, to introduce meaningful
    error messages whenever PAM services aren't found
  + Fixed memory leaks in PAM extensions
  + Fixed denial of service where an invalid session name from the
    greeter would cause the entire daemon to exit, terminating all
    active sessions
  + Adjusted D-Bus object path generation for
    /org/gnome/DisplayManager/Displays/* to fix ASLR leak
  + Fixed input sanitation when forwarding unknown usernames to
    audit subsystem
  + Fixed passphrase handling in pam_gdm to wipe cached plaintext
    passwords before freeing and to bound the keyring buffer walk
    preventing out-of-bounds reads
  + Fixed path traversal vulnerability where a compromised greeter
    could load arbitrary .desktop files via SelectSession,
    potentially executing attacker-controlled commands as the
    authenticated user
  + Introduced $GDM_AUTH_SESSION_ID environment variable, which
    communicates the logind session ID of the caller that requested
    authentication. This will be used for smartcard redirection for
    remote sessions
- Update to version 51.alpha:
  + Compatibility with kmsconvt
  + Add checks to make sure PAM plugins don't drop fsuid privilges
    and break GDM
  + Reworked the way GDM constructs XDG_DATA_DIRS for its launch
    environment, so that it will no longer hard-code /usr/share at
    a higher priority than /usr/local/share. This behavior would
    prevent people from locally hacking on gnome-shell with
  - -prefix=/usr/local without also having to rebuild GDM with the
    same prefix
  + Reworked conflicting session logic to use logind for
    enumeration. Previously, GDM would only look for sessions it
    started itself, but that would cause it to miss conflicting
    sessions started externally, such as those from ThinLinc or
    TigerVNC
  + Fixed bug where plymouth never quit on headless or no-monitor
    systems, which would prevent the system from ever reaching
    graphical.target
  + Added setting to change the fallback session. This is the
    session that gets used whenever a user doesn't have a preferred
    session selected, or their preferred session is unusable.
    Sysadmins can use this setting to change the selected session
    for users that have never logged into the system before
  + Fixed bug where GDM would start X11 sessions with
    XDG_SESSION_TYPE=wayland
  + Fixed PAM handling code to notify PAM modules when we've
    switched user and are about to exec the session leader. This
    fixes PAM modules like pam_cap.so in its `defer` mode
  + Removed unnecessary `SetRemoteId` method from the remote
    display DBus API
    ... changelog too long, skipping 22 lines ...
    https://gitlab.gnome.org/GNOME/gdm/-/work_items/1059

==== gettext-runtime ====
Subpackages: envsubst libtextstyle0

- Add ldconfig calls to the gettext-tools scriptlets: the package
  ships libgettextpo.so.0 but never ran ldconfig for it; the calls
  join the existing %post and a new %postun
- Add gettext-spit-shebang.patch: /usr/bin/spit used an
  /usr/bin/env python3 shebang, name the interpreter directly
- Extend the frozen gettext-linkdupes.sh hardlink list to cover
  the examples and data files added since it was generated
  (hello-go, hello-go-http, hello-c++20, hello-objc-gnome2, the
  GNOME m4 files, the shared po/LINGUAS files and the nls.m4
  pair under /usr/share); the list stays frozen and is extended
  by hand rather than replaced by live %fdupes runs, because a
  BuildRequires on fdupes would create a build loop (its
  dependency chain reaches back into gettext)
- Drop the stale removal of gettext.jar from %install: no jar is
  built since the Java support was dropped, and the line missed
  the buildroot prefix
- Fix the libtextstyle0 summary wording (text styling)
- Drop the deprecated Group: tags
- rpmlintrc: drop the filters for the fixed gettext-tools ldconfig
  findings and the gettext-csharp filters (that package is built
  from a different source package)
- The remaining rpmlint error, non-devel-file-in-devel-package
  for libgettextpo.so.0 in gettext-tools, is a checker problem,
  not a package defect: gettext-tools is the designated devel
  package for libgettextpo (it ships the headers, the unversioned
  symlink and Provides: gettext-devel). It is tracked on the
  rpmcrab side and is deliberately not restructured or filtered
  in this package

==== ghostscript ====
Subpackages: ghostscript-x11

- Ghostscript version 10.08.0 also fixes the following
  security issue (cf. the below entry dated "Tue Oct 13"):
- CVE-2026-110133
  "Heap buffer overflow in Ghostscript TrueType outliner
  due to nPointsTotal integer underflow during retry rollback"
  https://bugs.ghostscript.com/show_bug.cgi?id=709573
  (bsc#1288957)
- Build --without-local-brotli to not use the brotli sources
  in Ghostscript but the system brotli library to avoid
  CVE-2026-111497: ghostscript: brotli: "Brotli decoder
  out-of-bounds write permits remote code execution"
  (bsc#1287815)

==== gjs ====
Version update (1.88.1 -> 1.90.1)
Subpackages: libgjs0 typelib-1_0-GjsPrivate-1_0

- Update to version 1.90.1:
  * First bugfix release for GNOME 51. This release contains several fixes for
    crashes related to toggle references and garbage collection, and a fix for
    filtering of source files when generating code coverage reports.
  * Closed bugs and merge requests:
    + Object: Fix reference leak for GObject that already has a wrapper
    + Object: Don't modify wrapped GObject list while iterating it
    + Some other commits included
    + Coverage: Fix source file filtering
- Disable testsuite run for arm, it currently fails all tests. Let it build
  anyway as an best effort kind of thing.
- Update version dependencies according to meson.build.
- Update to version 1.90.0:
  + build failure: tests don't specify dependency on
    sysprof_capture
- Update to version 1.89.90:
  + This is the release candidate for GNOME 51. This release brings
    primarily minor bug fixes and internal type-safety
    improvements.
  + Backwards-incompatible change: Gio.DBus.makeProxyWrapper()
    returns a class expression, which should be called as a
    constructor, not as a function. Calling it as a function still
    works, but will print a deprecation warning. To migrate your
    code, just add `new`.
  + Backwards-incompatible change: Don't use the
    `GJS_ALWAYS_INLINE` macro from gjs/macros.h. It was not meant
    to be public and will print a deprecation warning if used.
  + Closed bugs and merge requests:
  - Various maintenance
  - Maps are terribly slow when planning for a route
  - Check for char* returns of ambiguous ownership using
    clang-tidy
  - testConsole fails if source directory contains
  - Revert "Gio: Rewrite _makeProxyWrapper as a class expression"
    and print a deprecation warning instead

==== glib-networking ====
Version update (2.80.1 -> 2.90.1)

- Update to version 2.90.1:
  * Bugs fixed:
    + CVE-2026-103963: Unbounded TLS 1.3 session ticket queue growth in
    glib-networking allows remote denial of service
    + CVE-2026-112963: glib-networking macOS OpenSSL backend incorrectly
    trusts non-SSL policy certificates as TLS anchors
    + CVE-2026-113624: glib-networking TLS client session cache key not rebuilt
    after certificate property change, allowing stale session resumption
    + CVE-2026-113622: glib-networking: Missing TLS purpose validation in
    glib-networking OpenSSL backend allows Extended Key Usage bypass
    + CVE-2026-113623: glib-networking: Unbounded memory growth in glib-
    networking GnuTLS backend application data buffer during TLS handshake
    allows remote denial of service
    + openssl: consult errno on syscall failure
  * Updated translations.
- Update version dependencies according to meson.build.
- Update to version 2.90.0:
  + Bugs fixed:
  - meson: Remove version checks that are always true
  + Updated translations.
- Update to version 2.90.alpha:
  + Bugs fixed:
  - test fails with openssl 3.4.x
  - (CVE-2025-60018) (#YWH-PGM9867-106) Out of Bond Reads on
    glib-networking through tls/openssl/gtlscertificate-openssl.c
    via "g_tls_certificate_openssl_get_property()" due to
    Incorrect BIO_write Return Value Validation in Certificate
    PEM Export
  - (CVE-2026-2574) (#YWH-PGM9867-150) OOB Read on
    glib-networking through
    tls/openssl/gtlsclientconnection-openssl.c via
    g_tls_client_connection_openssl_get_property()
  - (CVE-2026-10028) (#YWH-PGM9867-278) Infinite loop in
    certification path building
  - meson: Introduce option for enable/disable tests
  - openssl: check return value of g_tls_bio_alloc() and BIO_new()
  - openssl: delete support for OCSP stapling
  - Fix file database and PKCS11 test failures and update CI!
  - Fix miscellaneous safety issues reported by bug hunters
  - Delete gtlshttp
  - Fix connection test reusing a GError
  - openssl: fix error code confusion
  - ci: add catch for reporting stack traces
  - Require OpenSSL 1.1.1 or newer
  - Some fixes found with kiro
  - Fix various memory leaks
  - openssl: refactor error handling code
  - openssl: use ERR_clear_error() all over the place
  - gnutls: always notify accepted-cas property after handshake
  + Updated translations.
- Drop CVE-2026-10028.patch: Fixed upstream.

==== glib2 ====
Version update (2.88.4 -> 2.90.1)
Subpackages: glib2-tools libgio-2_0-0 libgirepository-2_0-0 libglib-2_0-0 libgmodule-2_0-0 libgobject-2_0-0 libgthread-2_0-0 typelib-1_0-GIRepository-3_0 typelib-1_0-GLib-2_0 typelib-1_0-GLibUnix-2_0 typelib-1_0-GModule-2_0 typelib-1_0-GObject-2_0 typelib-1_0-Gio-2_0

- Update to version 2.90.1:
  * Bugs fixed:
    + Add address and thread sanitizer scheduled CI job
    + inotify: cancelling monitor through symlink alias removes watch
    used by still-active monitors
    + g_file_trash() returns FALSE without setting the GError when trashing a
    non-empty directory for `DT_UNKNOWN` nodes
    + tools: Add another variant of an existing suppression to glib.supp
    + giochannel: Fix strncmp() off the end of the buffer
    + gvariant: Handle get_data_as_bytes() for corrupted variants
    + utils: Add missing ENUMERATOR_AVAILABLE_IN
    + rcbox: Turn assertion into error
    + gdbusauthmechanismsha1: Don't split into too many tokens
    + logging: Don't stack overflow with too many fields
    + regex: Handle empty matches at end
    + unicode:
  - Fix error handling in normalization
  - Don't read past limits
  - Prevent overflow in normalization
    + gmarkup: Be careful in error paths
    + gresource: Avoid underflow
    + gcharsetconverter: Avoid closing invalid iconv descriptors
    + gregex: Fix some trivial typos in the docs
    + gfileenumerator: Reformat docs to fully use gi-docgen and match
    style guide
    + fileutils: Check the mode before creating the file
    + Clarify various inconsistencies with g_socket_address_new_from_native()
    + tests: Avoid a ubsan warning about passing NULL to strncmp()
    + glib.supp: Mark a TLS variable as not really a leak
  * Updated translations.
- Drop gsettings.zsh (_gsettings completion) as source, no longer
  needed as zsh ships its own gsettings completions (boo#1284142).
- Update to version 2.90.0:
  + Bugs fixed:
  - G_DEFINE_TYPE parent_class variable trips clang 23's
    `-Wunused-but-set-global`
  - `-Wtypedef-redefinition` warnings from `GDBusActionGroup`
    when building 2.89.4 with clang
  - fix: handle long filenames in trash by truncating from front
  - tests: allocate an adequate alternate signal stack
  - gtestutils: Mark a TLS variable as not really a leak
  - goutputstream: Fix an unused-variable warning with
    G_DISABLE_ASSERT
  + Updated translations.
- Update to version 2.89.4 (Unstable):
  + Improve support for nanosecond source timeouts
  + Fix installed service file containing build path
  + Support clicking notification icons on Windows
  + Improve stream splice performance by increasing buffer size
  + Updated translations.
- Update to version 2.89.3 (Unstable):
  + Support systemd-style UAPI file masking and drop-ins for
    `GKeyFile`
  + Add some string and date convenience API,
    `g_string_free_deep()` and `g_set_date_time()`
  + Add some convenience API to `GUnixFDList`
  + Bugs fixed:
  - Support UAPI file masking and drop-ins in GKeyFile
  - gio/tests: iptosmessage does not compile on Solaris
  - fd leak in `g_file_set_contents_full()` on error?
  - gio-tool: crash (assertion failed) when running 'gio help
    help'
  - Add g_string_free_deep
  - datetime: Add g_set_date_time
  - giostream: Clarify is_closed() method docs for streams
  - gunixfdlist: Add g_unix_fd_list_append_take,
    g_unix_fd_list_peek, g_unix_fd_list_lookup,
    g_unix_fd_list_lookup_peek
  - gtestutils: Fix a minor typo in a documentation comment
  - tests: Minor compiler warning fixes for GCC16
  - build: Fix a deprecation warning from Meson 1.12
  - docs: Use dedicated docblocks for new enum members
  - docs: Annotate callbacks rather than user_data
  - Add finer accuracy g_timeout APIs
  - gdbusnameowning: Don't print any logs when connection is
    closed
  - Avoid reserved identifiers in public macros
- Update to version 2.89.2 (Unstable):
  + Fix potential miscompilation with GCC 17 with `G_GNUC_CONST` on
    `get_type()` functions
  + Update toolchain requirement to C11; previously this was just
    strongly recommended
  + Various bugs fixed.
  + Updated translations.
- Update to version 2.89.1 (Unstable):
  + g_thread_yield() may not yield control to another thread as
    expected on Linux.
  + gio: gmemorymonitordbus: Fix fallback backends can't be
    properly loaded
  + gregex: Remove "array length" annotations
  + win32-build.md: Update Visual Studio build info
  + Don't use slow content type for icons when only fast content is
    queried
  + Performance improvements to GVariant/GDBusMessage
  + docs: fix wrong reference to gint16 for gint32 types in
    glib/types.md
  + Add missing finish-func annotations
  + gregex: g_match_info_fetch_pos() and g_match_info_fetch_all()
    will now work after partial matches as well
    ... changelog too long, skipping 27 lines ...
    https://gitlab.gnome.org/GNOME/glib

==== glibmm2 ====
Version update (2.88.1 -> 2.90.0)
Subpackages: libgiomm-2_68-1 libglibmm-2_68-1

- Update URL to new home.
- Update version dependencies according to meson.build.
- Update to version 2.90.0:
  + API is identical to glibmm 2.89.1.
  + Meson build: Fix missing dependencies, making it possible to
    build with https://github.com/michaelforney/samurai instead of
    ninja. (syntheticsweet)
- Update to version 2.89.1 (Unstable):
  + Glib:
  - SignalTimeout: Add connect_ns(), connect_ns_once().
  - Source: Add get_time_ns().
  + Gio:
  - ApplicationCommandLine: Add property_is_remote().
  - DesktopAppInfo: Add property_filename().
  - UnixFDList: Add peek(), lookup(), append_take().
  + Build: Require glib >= 2.89.4
- Update to version 2.89.0 (Unstable):
  + Drop G_GNUC_CONST as in GLib.
  + Glib: Markup::ParseContext: Add get_attribute_position().
  + Gio: Emblem and DBus::ActionGroup: Don't derive gtkmm__Gxxx
    types. The underlying C classes are final types since GLib
    2.89.2.
  + Documentation: Remove duplicate of Glib::MarkupError
    documentation.
  + Build: Require glib >= 2.89.0
- Update to version 2.88.1+7:
  + Gio::DBus::ActionGroup: Improve the test whether
    GDBusActionGroup is final
  + Gio: Emblem and DBus::ActionGroup: Don't derive gtkmm__Gxxx
    types
  + Glib::Markup::ParseContext: Add get_attribute_position()
  + Regenerate docs.xml and .defs files, using files from glib
    2.89.1
- Use source service to generate tarball.
- Add mm-common, libxslt-tools and perl-XML-Parser BuildRequries:
  Needed now that we are using a git checkout.
- Pass build-documentation=false to meson setup, skip building
  documentation.
- Pass maintainer-mode=true to meson setup, needed since we are
  using a git checkout.

==== glibmm2_4 ====
Subpackages: libgiomm-2_4-1 libglibmm-2_4-1

- Update version dependencies according to meson.build.
- Update URL to new home.

==== glycin-loaders ====
Version update (2.1.5 -> 2.2.6)

- Update to version 2.2.6:
  * This release contains the following new component versions
    + libglycin 2.2.6
    + libglycin-gtk4 2.2.6
  * Fixed: meson: Fix build configuration failing if either libglycin or
    libglycin-gtk4 option being enabled.
- Stop passing libglycin=true to meson setup in glycin-loaders.spec.inc
  following upstream changes yet again.
- Update to version 2.2.5:
  * This release contains the following new component versions:
    + Glycin-core 4.0.5
    + Glycin 4.0.5
    + Glycin-builtin 4.0.5
    + Glycin-external 4.0.5
    + Libglycin 2.2.5
    + Libglycin-gtk4 2.2.5
  * Fixed:
    + Require gufo-exif 0.5.5 to avoid reading exif values from incorrect
    positions in some images.
    + Libglycin: Don't panic when trying to lookup an infinite pixel density.
    Instead, don't return any pixel density.
    + Meson/thumbnailer: Ensure that libglycin is built before
    glycin-thumbnailer.
- Pass libglycin=true to meson setup in glycin-loaders.spec.inc following
  upstream changes.
- Update to version 2.2.4:
  * This release contains the following new component versions:
    + Glycin-core 4.0.4
    + Glycin-image-rs 2.2.4
    + Glycin 4.0.4
    + Glycin-builtin 4.0.4
    + Glycin-external 4.0.4
    + Libglycin 2.2.4
    + Libglycin-gtk4 2.2.4
  * Fixed:
    + Require gufo-exif 0.5.4 to avoid a panic in exif lookup for certain
    images.
    + Glycin: Longer magic byte strings in config identifiers now have a higher
    priority. This fixes cursors being sometimes identified as TGAs.
- Update to version 2.2.3:
  * This release contains the following new component versions:
    + Glycin-core 4.0.3
    + Glycin-image-rs 2.2.3
    + Glycin 4.0.3
    + Glycin-builtin 4.0.3
    + Glycin-external 4.0.3
    + Libglycin 2.2.3
    + Libglycin-gtk4 2.2.3
  * Fixed:
    + Require gufo-exif 0.5.3 which fixes parsing issues with non-Canon
    MakerNote entries. This can cause images not to be rotated according to
    the Orientation tag.
    + Image-rs/animation: Drop thread after the Image.done D-Bus method is
    called.
    + Image-rs: Prevent channel with animation frames from filling up, causing
    a effective memory leak.
    + Libglycin: Don't block main thead in `get_mime_types`.
  * Changed: Glycin: Canonicalize paths of "Exec" keys when loading configs.
- Update to version 2.2.2:
  * This release contains the following new component versions:
    + Glycin-core 4.0.2
    + Glycin 4.0.2
    + Glycin-builtin 4.0.2
    + Glycin-external 4.0.2
    + Libglycin 2.2.2
    + Libglycin-gtk4 2.2.2
  * Fixed: Set the unix socket sending the image data to the loader to
    non-blocking. Otherwise, small socket send buffer configurations might lead
    to infinite blocking.
- Update to version 2.2.1:
  + This release contains the following new component versions:
  - glycin-utils 5.0.1
  + Fixed: Don't mmap already write sealed memfds as shared. This
    is only supported since Linux 6.7
    <https://lkml.indiana.edu/2310.1/06395.html>.
- Update to version 2.2.0:
  + This release contains the following new component versions:
  - glycin-common 2.0.0
  - glycin-core 4.0.0
  - glycin-heif 2.2.0
  - glycin-image-rs 2.2.0
  - glycin-jxl 2.2.0
  - glycin-raw 2.2.0
  - glycin-svg 2.2.0
  - glycin-test 2.2.0
  - glycin-thumbnailer 2.2.0
  - glycin-utils 5.0.0
  - glycin 4.0.0
  - glycin-builtin 4.0.0
  - glycin-external 4.0.0
  - libglycin-gtk4-rebind 0.2.0
  - libglycin-gtk4-rebind-sys 0.2.0
  - libglycin-rebind 0.2.0
  - libglycin-rebind-sys 0.2.0
  - libglycin 2.2.0
  - libglycin-gtk4 2.2.0
  + Fixed:
  - glycin/sandbox: Fix compilation on 32 bit architectures
- Update to version 2.2.beta.1:
    ... changelog too long, skipping 165 lines ...
  + Changed: svg: Don't limit the size of elements in the SVG

==== gnome-autoar ====
Version update (0.4.5 -> 0.5.2)

- Update to version 0.5.2:
  + No changelog provided
- Changes from version 0.5.0:
  + format-filter: Add zstd to supported formats
  + compressor: Don't use wildcard query string
  + Remove gnome-autoar-gtk
  + doc: migrate to gi-docgen
  + build: Rename docs option
  + Various CI fixes until it worked again
  + Add release script
- Change -Dgtk_doc meson parameter to -Ddocs: follow upstreams
  rename of the otion.
- Replace gtk-doc BuildRequires for pkgconfig(gi-docgen): follow
  upstreams port to gi-docgen.
- Drop gnome-autoar-gtk related subpackages:
  libgnome-autoar-gtk-0-0, typelib-1_0-GnomeAutoarGtk-0_1, and
  gnome-autoar-gtk-devel

==== gnome-calculator ====
Version update (50.0+16 -> 51.1)
Subpackages: gnome-shell-search-provider-gnome-calculator

- Update to version 51.1:
  * Updated translations.
- Update to version 51.0:
  + Updated translations.
- Update to version 51.rc:
  + Updated translations.
- Update to version 51.beta:
  + Show exponent in the current base
  + Update and remove some currencies
  + Persist calculation history across sessions
  + Report the name entry as invalid on the a11y layer
  + Keep rational arithmetic exact (using gmp)
  + Fixed compile warnings
  + Updated translations.
- Update to version 51.alpha:
  + Improve search provider
  + Style fixes
  + Fixed help not opening
  + Fixed compile issues
  + Updated translations.

==== gnome-characters ====
Version update (50.0 -> 51.0)
Subpackages: gnome-shell-search-provider-gnome-characters

- Update version dependencies according to meson.build.
- Update to version 51.0:
  + Updated translations.
- Update to version 51.rc:
  + meson: Add check parameter to run_command
  + Stop using G_GNUC_CONST in _get_type functions
  + flatpak: Disable gnome-desktop's qr feature
  + Updated translations.

==== gnome-chess ====
Version update (50.0 -> 50.1)

- Update to version 50.1:
  + Updated translations.

==== gnome-clocks ====
Version update (50.0 -> 51.0)
Subpackages: gnome-shell-search-provider-gnome-clocks

- Update version dependencies according to meson.build.
- Update to version 51.0:
  + Updated translations.
- Update to version 51.rc:
  + meson: Require meson 1.7
  + flatpak: Disable gnome-desktop's qr and systemd features
  + Updated translations.
- Drop obsolete Groups tag.

==== gnome-connections ====
Version update (50.0 -> 51.0)

- Update to version 51.0:
  + Updated translations.
- Update to version 51.rc.1:
  + Fixed Flatpak build
  + Updated translations.
- Update to version 51.rc:
  + Updated translations.
- Update to version 51.beta2:
  + Fixed focus chain of authentication dialog
  + Added captions to app screenshots
  + Fixed propagation of cursor changes
  + Enabled h264 in flatpak
  + Self-build libhandy
  + Fixed connection to IPv6 URIs
  + Actualized descriptions of protocols in assistant
  + Handle NULL Common Name in RdpConnection
  + Do not remove POINTER_MOTION_MASK
  + Do not store already stored connections
  + Updated gtk-frdp
  + Updated translations.

==== gnome-console ====
Version update (50.0 -> 51.0)

- Update to version 51.0:
  + Updated translations.
- Update to version 51.rc:
  + Updated translations.
- Update to version 51.beta:
  + This cycle has seen a focus on stability with our ever
    expanding testsuite helping us iron out some rough edges,
    alongside tackling issues found in the wild, all whilst keeping
    pace with developments in the wider platform.
  + Updated translations.
- Update source service to align with current packaging for git
  managed GNOME.

==== gnome-contacts ====
Version update (50.0 -> 51.0)
Subpackages: gnome-shell-search-provider-contacts

- Update version dependencies according to meson.build.
- Update to version 51.0:
  + Contact photos now persist correctly in the Flatpak version
    after restarting the application
  + Import errors are now announced to screen readers, improving
    accessibility of the import dialog
  + Updated translations.

==== gnome-control-center ====
Version update (50.4 -> 51.1)
Subpackages: gnome-control-center-color gnome-control-center-goa gnome-control-center-user-faces gnome-control-center-users

- Update to version 51.1:
  * Accessibility: Make text-size slider reflect changes under the hood
  * Keyboard: Fix reverted condition for updating modifier option buttons
  * Location: Hide invalid "last-access-time" app labels
  * Mobile Networks: Fix APN dialog header bar buttons visibility
  * Printers: Accept hyphenated supply marker types
  * System: Fix class declaration macros typos
  * Updated translations.
- Update version dependencies according to meson.build.
- Update to version 51.0:
  + Main Window: Revert "reparent sidebar on small screens" since
    it broke sub page animations
  + Remote Desktop: Add translation comments to "Verify
    Fingerprint" string
  + Updated translations.
- Update to version 51.rc.1:
  + Build: Bump dependency on gsettings-desktop-schemas to 51.beta
  + Main Window: Move focus to the panel content when activating
    item in the sidebar
  + Accessibility:
  - Fix "Configure Screen Reader" button not launching Orca
    settings
  - Fix segfault when launching "Sound" settings from "Hearing"
    page
  + Apps:
  - Add drop-shadow style to default app combo icons
  - Fix a11y of default app combo items (so screen readers can
    read it)
  - Request global-shortcuts portal to rebind shortcuts on
    removal
  + Color: Improve keyboard navigation of devices list (a11y)
  + Fingerprints:
  - Fix margings in dialog status page
  - Fix critical for packing verify button in AdwPreferencesPage
    directly
  + Keyboard: Fix crash when removing key combos for global
    shortcuts
  + Mobile Networks
  - Align no-sim status page vertically
  - Port APN selection dialog to AdwDialog
  + Notifications: Hide apps not set for the current desktop
    environment (.desktop OnlyShowIn)
  + Users:
  - Fix changing user avatar not updating visible page
  - Rename fingerprint row title
  + Updated translations.
- Update to version 51.beta:
  + Build: Require libgnome-desktop >= 51.alpha
  + About:
  - Add button to open GNOME release notes
  - Show "GNOME Shell Version" instead of "GNOME Version"
  + Apps: Show icons in the default-apps drop down options
  + Accessibility: Add setting to disable focus timeout
  + Date and Time: Disable ellipzation for one AdwComboRow
  + Global shortucts: Add "ConfigureShortcuts"
  + Graphic Tablets (Wacom): Modernize the button mapping fallback
    dialog
  + Network: Hide automatic DNS and route toggle in Manual mode
  + Main Window (Shell): Rework the navigation view and loading of
    panel pages
  + Users:
  - Add new fingerprint management interface
  - Disable keeping user data if deleting a homed user
  - Disable auto-login for homed users
  + Wi-Fi: Fix visible overflow on the Wi-Fi list widget
  + Updated translations.
- Update to version 51.alpha:
  + Remove Flatpak build support
  + Merge all panels CSS files into a single global stylesheet
  + Apply clang-format globally and update coding style
  + Drop "development" profile
  + Accessibility:
  - Add description to the screen reader settings button
  - Add semantic accessible names to cursor sizes
  - Fix keyboard navigation between cursor sizes
  - Give CcSplitRow's radio group a label and role
  + About (System Details):
  - Remove Windowing System field
  - Reorder "Software/Hardware" information groups
  - Merge system details into toplevel about page
  - Port "Copy" button to AdwButtonRow
  + Applications:
  - Call GNOME Software via D-Bus instead of CLI
  - Define GNOME Software desktop id only once
  + Color: Avoid dead nested assignment
  + Date & Time: Use GtkEnumList
  + Display:
  - Add "Auto Rotate" row for devices with accelerometer
  - Add center-aligned snapping for horizontal edges
  - Don't allow disabling if it's the last display available
  - Update cursor styles for hover and drag interactions
  + Keyboard:
  - Fix compose key 'á' example
  - Don't update shortcuts when closing dialog
  - Improve "Press Esc to cancel [...]" hint
  - Drop only the colliding combo when rebinding shortcuts
  - Turn CcKeyboardShortcutDialog into a subpage
  - Drop nested navigation view in shortcuts page
  - Port GtkShortcutLabel to AdwShortcutLabel
    ... changelog too long, skipping 61 lines ...
- Add pkgconfig(gnome-qr-gtk-4) BuildRequires: New dependency.

==== gnome-desktop ====
Version update (44.5 -> 51.0)
Subpackages: libgnome-desktop-3_0-common libgnome-desktop-4-2 typelib-1_0-GnomeBG-4_0 typelib-1_0-GnomeDesktop-4_0

- Update version dependencies according to meson.build.
- Update to version 51.0:
  + Updated translations.
- Update to version 51.alpha:
  + New API to generate qr codes. See gnome-qr.h and gnome-qr-gtk.h
    for details of the api. The new apis are installed as separate
    shared libraries (libgnome-qr-4.so and libgnome-qr-gtk-4.so).
    To use in your code, use the pkg-config files gnome-qr-4.pc
    and gnome-qr-gtk-4.pc.
  + Bugs fixed:
  - Introduce gnome-qr library
  - build: Enable tests again
  - thumbnail: Fix overly broad path check in can_thumbnail
  + Updated translations.
- Drop typelib-1_0-GnomeRR-4_0 sub-package, no longer built,
  dropped upstream.
- Bump libgnome-desktop soname to 3-21 following upstream changes.
- Package new sub-packages: libgnome-qr-4-0, libgnome-qr-gtk-4-0,
  typelib-1_0-GnomeQR-4_0 and typelib-1_0-GnomeQRGtk-4_0.
- Split out shared library in its own sub-package: libgnome-bg-4-2

==== gnome-keyring ====
Version update (50.0 -> 51.1)
Subpackages: gnome-keyring-pam libgck-modules-gnome-keyring

- Update to version 51.1:
  + daemon: Fix double unref of session.
- Update to version 51.0+1:
  + fix: plug memory leaks on early returns.
- Update to version 51.0:
  + daemon:
  - Register the login collection on D-Bus on creation
  - Fix D-Bus double response issue in secret service methods
  - Fix crash when prompt is dismissed
  - Don't leak session on GetSecret/Unlock
  - Fix memory leaks in DH key exchange that grow with every
    client connection
  + build: Restore gettext i18n init broken during meson port
  + Fix potential FD leak in gkm_rpc_layer_startup
  + Drop conversion from GConf
  + Updated translations.
- Drop 04a6bc68ff4350676c5fc55d1b244a17224fbea2.patch: fixed
  upstream.
- Add check section and call meson_test therein through
  dbus-run-session. (except on i586; test suite has no priority to
  upstream on 32bit architectures).

==== gnome-mahjongg ====
Version update (49.1.1 -> 51.1)

- Update to version 51.1:
  + Fix a crash in the Scores dialog
  + More balanced light background color for Smooth theme
- Update to version 51.0:
  + Add new animation for showing pause menu
  + Add missing mnemonic to 'Resume Game' button
  + Add missing translations for 'Clear Scores' string
  + Bump minimum GTK version to 4.22
  + Upgrade license to GPLv3+
  + Updated translations.

==== gnome-maps ====
Version update (50.5 -> 51.2)

- Update to version 51.2:
  * Avoid some GTK warnings when rendering public transit itineraries
  * Do not try rendering shape layers if loading is not complete
  * Updated translations.
- Update version dependencies according to meson.build.
- Update to version 51.1:
  + Fix showing correct POI type names in some cases that were
    broken in our import script from id-tagging-schema since
    changes lately
  + Updated translations.

==== gnome-remote-desktop ====
Version update (50.2 -> 51.0)

- Update version dependencies according to meson.build.
- Update to version 51.0:
  + Fix pid reuse vulnerability in the smartcard redirection
  + Add smartcard redirection documentation
  + Signal full range BT.709 in the AVC bitstreams
  + Misc bug fixes & cleanups
  + Updated translations.
- Update to version 51.rc+4 (boo#1276523):
  + daemon-utils:
  - Use pidfd instead of pid to get session ID
  - Add helper to get a session ID from a pidfd
  - Remove unnecessary g_steal_pointer()
  + Updated translations.
- Update to version 51.rc:
  + Add support for Kerberos multi user remote login
  + Fix Vulkan image allocation
  + Fix building on 32 bit architectures
  + Misc bug fixes & cleanups
- Register gnome-remote-desktop-pcscd.service as systemd_unit, to
  ensure the rpm scriptlets handle that service too.
- Update to version 51.beta:
  + Fix video corruption when using VA-API
  + Add support for smartcard redirection
  + Misc bug fixes & cleanups
  + Updated translations.
- Update to version 51.alpha:
  + Simplify GDM remote display handling
  + Updated translations.

==== gnome-session ====
Version update (50.1 -> 51.0)

- Update to version 51.0:
  + Fixed bug where oo7-daemon.service never starts by default
  + Updated translations.
- Update to version 51.rc:
  + Switched to dbus for looking up logind graphical session
  + Downgraded logout inhibitors from strong to weak, as a stop-gap
    fix for buggy inhibitor behavior
  + Updated translations.
- Update to version 51.beta:
  + Added `SessionIsLocked` and `SessionClass` properties on D-Bus
  + Updated mimeapps.list: removed Shaper, since it was split out
    of GTK into its own app
  + Fixed regression in screen blanking / idle handling
  + Updated translations.
- Update to version 51.alpha:
  + Enabled use of oo7-portal as the implementation of the Secret
    portal
  + Updated mimeapps.list for removal of gcr3, and expansion of
    Loupe's supported mime types
  + Applied various code cleanups from gobject linter
  + Fixed a double-free bug
- Drop hicolor-icon-theme Requires, gnome-session does not need
  this anymore.

==== gnome-settings-daemon ====
Version update (50.1+6 -> 51.1)

- Update to version 51.1:
  * Housekeeping: Update donation notification to fetch the ongoing campaign
    message from https://donate.gnome.org/api/campaign, and provide
    distro/campaign information for analytics in the URL opened by the "Donate"
    button in the notification.
  * Updated translations.
- Update version dependencies according to meson.build.
- Rebase g-s-d-skip-donation.patch.
- Update version dependencies according to meson.build.
- Update to version 51.0:
  + Updated translations.
- Update to version 51.rc:
  + Power: Avoid overlap between panel dimming and idle sleep
    notification
  + CI improvements
  + Updated translations.
- Update to version 51.beta:
  + Usb-protection:
  - Refactors and improvements
  - Rely on newer gnome-session for active session tracking
  + Updated translations.
- Rebase patches with quilt.
- Drop patch fixed differently upstream:
  + 0001-usb-protection-Treat-hubs-and-HID-devices-like-any-o.patch
- Update to version 51.alpha:
  + Update gnome-volume-control dependency
  + Housekeeping:
  - Fix launching baobab
  - Fix use-after free
  + Power: Make temporary unidle play well with inhibitors
  + Updated translations.

==== gnome-shell ====
Version update (50.5 -> 51.1)
Subpackages: gnome-shell-calendar

- Update to version 51.1:
  * Improve web login and banner layout
  * Fix workspace thumbnail centering in RTL
  * Fix legacy auth services messages interfering with SSSD
  * Fix applying color filter when using full grayscale
  * Fix closing mount notification on drive disconnect
  * Use gnome-autoar for extracting extensions
  * Allow mutter to fall back to XCursor
  * Fix clock position on lock screen
  * Fix quick settings preventing direct scanout
  * Plugged leaks
  * Misc. bug fixes and cleanups
  * Updated translations.
- Update version dependencies according to meson.build.
- Update to version 51.0:
  + Don't duplicate locale keyboard layout
  + Fix activating network items in quick settings
  + Improve lock/login screen styling
  + Cancel mount password dialogs when locking screen
  + Validate serilized image data before creating pixbuf
  + Fixed crash
  + Plugged leaks
  + Misc. bug fixes and cleanups
  + Updated translations.
- Drop e5c2018d.patch: fixed upstream.
- Add e5c2018d.patch: status/network: Restore chain up on
  activate() with a Clutter.Event. Fixes VPN connection not being
  activatable from the GNOME Shell menu.
- Update to version 51.rc:
  + Fix glitch when switching workspaces with direct scanout
  + Use glycin to load and cache background images
  + Support building with libical4
  + Refuse to unlock screen after screen time limit was reached
  + Fix blocking when toggling wireless toggle
  + Continue port from raw event handlers to controllers
  + Fix focusing calendar app from reminder notification
  + Don't show busy cursor when activating actions
  + Fix race condition that prevents password prompt from showing
  + Fix glitch when cancelling lock screen prompt with Esc
  + Track magnifier mouse position without polling
  + Limit parallel texture loading operations
  + Focus first menu item when opened via keyboard
  + Fix race condition when enabling extensions
  + Open windows created via new-window action on correct workspace
  + Plugged leak
  + Misc. bug fixes and cleanups
  + Updated translations.
- Add pkgconfig(glycin-2) BuildRequires: new dependency, moved to
  gnome-shell from mutter.
- Update to version 51.beta:
  + Fix glitch when switching to minimized window on another
    workspace
  + Add initial support for 'reduced-motion' setting
  + Explicitly disallow async disable() methods in extensions
  + Add SVG-based cursor implementations
  + Continue port from raw event handlers to controllers
  + Improve keyboard navigation of screenshot area selection
  + Support COPY, CUT and PASTE action keys in entries
  + Fix miscaled magnified cursor on HiDPI
  + Fix sound glitch when pushing redundant volume changes
  + Refine auth prompt UX
  + Add support for web login and unified auth mechanism
  + Handle event reminder notifications
  + Fix removing arbitrary provider when removing unregistered
    search provider
  + Misc. bug fixes and cleanups
  + Updated translations.
- Add pkgconfig(librsvg-2.0) BuildRequires: new dependency for SVG
  based cursors.
- Update to version 51.alpha:
  + Fix autorun notification for connected USB drives
  + Fix reapplying layout on `xkb-options` changes
  + Expose slow-down-factor in looking glass
  + Improve app grid accessibility
  + Support touch scrolling in ScrollView
  + Use custom sound effects instead of sound theme
  + Use more readable St.ButtonMask values
  + Save and restore monitor brightness
  + Support elogind as libsystemd provider
  + Prevent workspaces from being removed mid-animation
  + Support version 2 of text_input_v3 protocol
  + Improve UI for conflicting sessions on login screen
  + Announce search result description to screen readers
  + Improve animation when expanding app grid label
  + Replace GLSLEffect with ClutterShaderEffect
  + Fix spacing in lock screen media notifications
  + Add support for start/end text-align
  + Pass params object to popupMenu open()/close() methods
  + Split extensions-app into its own repository
  + Plugged leak
  + Misc. bug fixes and cleanups
  + Updated translations.
- Bump mutter_api define to 51 and mutter_req define to 51.alpha
  following upstream changes.
- Drop gnome-extensions sub-package, split out to new stand-alone
  package upstream
- Filter typelib(Malcontent) from the dependency list: the latest
  upstream version cannot be included in openSUSE due to pending
  CVEs, where upstream confirmed not having time to address them
    ... changelog too long, skipping 82 lines ...
  package upstream

==== gnome-software ====
Version update (50.4 -> 51.1)
Subpackages: gnome-software-plugin-packagekit

- Update to version 51.1:
  * Various user interface fixes
  * Fix an unlikely crash when downloading icons
  * Fix triggering a second refresh on the updates page
  * Updated translations.
- Update to version 51.0+22:
  * src: Ensure broken markup won't leave stale text in labels
  * gs-plugin-loader: Add missing NULL check for icon downloader
  * Updated translations.
- Update version dependencies according to meson.build.
- Disable parental control (malcontent) for now: upstream does not
  have resources to maintain malcontent and address CVEs. We do not
  want to ship it to our users in this case.
- Update to version 51.0:
  + Updated translations.
- Update to version 51.rc:
  + Various user interface fixes
  + Updated translations.
- Update to version 51.beta:
  + Improve performance of icons loading
  + Improve performance of PackageKit repositories refine
  + Change statistical approach for average rating scores
  + Updated translations.
- Update to version 51.alpha:
  + Extend Flatpak file permissions list
  + Warn before installing end-of-life apps
  + Add tooltips to icon-only buttons in narrow mode
  + Reuse cached AppStream data on start-up to improve performance
  + Fixed few memory leaks
  + Updated translations.
- BuildRequire pkgconfig(glib-testing-0): new dependency.
- Temp disable testsuite, it currently fails!

==== gnome-sudoku ====
Version update (50.4 -> 51.0.1)

- Update to version 51.0.1:
  + Fix flatpak.
- Update to version 51.0:
  + Update translations.
- Update to version 51.rc:
  + Fix redo button visibility not updating when toggling Show
    Timer
  + Partly fix numbers sometimes leaving artifacts on removal
  + Updated translations.
- Update to version 51.beta:
  + Separate the vertical UI from the small UI
  + Ship more icons with the application: clock, play and pause
  + Use the sudoku namespace for icons shipped with the application
  + Hide redo button over earmark mode button when size constrained
  + Expand grid margin from top left, this is a 2 pixel difference
  + Fix numbers rarely having different sizes
  + Scale paused label with height aswell as width
  + Scale paused label on resize
  + Updated translations.
- Replace appstream-glib with AppStream BuildRequires:
  appstream-cli is what meson setup checks for.
- Update to version 51.alpha:
  + Add a new user interface for vertical aspect ratios and small
    screens
  + Limit long press to touch based devices
  + Update slate, teal and pink accent colors in light mode
  + Replace the clock by a medal if a highscore is achieved
  + Always focus suggested responses in alert dialogs
  + Add accessibility label for the clock
  + Updated translations.

==== gnome-system-monitor ====
Version update (50.0 -> 51.1)

- Update to version 51.1:
  * Remember window location on X11
  * Fixed crash on systems without libselinux
  * Updated translations.
- Update version dependencies according to meson.build.
- Update to version 51.0:
  + Updated translations.
- Update to version 51.rc:
  + Updated translations.
- Update to version 51.beta:
  + Fixed summary units in process table
  + Improve code of systemd/selinux/cgroups
  + Improved process actions wording
  + Use correctly translatable disk read/write rate units
  + Fixed multiple Icon text on preferences
  + Improve cgroups performance
  + Fixed compile failure
  + Updated translations.
- Drop pkgconfig(catch2-with-main) BuildRequires: No longer needed,
  nor used.
- Refresh patch with quilt.

==== gnome-text-editor ====
Version update (50.1 -> 51.0)

- Update to version 51.0:
  + Fix tooltip for subtitle when using document portal
  + Updated translations.
- Update to version 51.beta:
  + Allow move-next and previous when search bar is closed
  + Build/CI updates
  + Minor code cleanups

==== gnome-weather ====
Version update (50.0 -> 50.0+30)
Subpackages: gnome-shell-search-provider-gnome-weather

- Update to version 50.0+30:
  * Updated translations.
- Update version dependencies according to meson.build.

==== gnutls ====
Subpackages: libgnutls-dane0 libgnutls30

- FIPS: Perform RSA-PSS self-tests. (bsc#1286296)
  * fips: perform RSA self-tests using RSA-PSS instead of PKCS#1
    v1.5 (ed0c45d)
  * pk: use deterministic RNG for RSA-PSS in self-tests (35c56812)
- FIPS: Mark internal HMAC-SHA-1 when session tickets are enabled
  as non approved (bsc#1284342)
  * Add gnutls-FIPS-SLI-session-ticket.patch
- FIPS: Mark TLS 1.2 cipher suites using HMAC-SHA-1 for record
  authentication as non approved (bsc#1284341)
  * Add an additional GNUTLS_MAC_AEAD check to independently
    evaluate the MAC algorithm
  * Add gnutls-FIPS-SLI-record-MAC.patch
- FIPS: Mark SHA-1 in TLS v1.0 PRF as non approved (bsc#1284343)
  * Add gnutls-FIPS-SLI-tls10-PRF.patch
- FIPS: TLS 1.3 initialized using empty input (bsc#1284344)
  * TLS 1.3 key schedule was initialized using an empty input
    instead of the zero-filled value specified by RFC 8446.
  * secrets: pass actual zeroes in _tls13_init_secret2 (7fad16dc)
  * Add gnutls-FIPS-zeros-in_tls13_init_secret2.patch

==== google-noto-fonts ====
Version update (20261001 -> 20261101)
Subpackages: google-noto-sans-arabic-fonts google-noto-sans-fonts google-noto-sans-symbols-fonts google-noto-sans-symbols2-fonts

- Update to 20261101:
  * Sans Mongolian:
  * Various vertical typesetting fixes
  * Follow the chachlag onset mvs forms in the shaping locks
  * Include ligatures for p, f, k and kh with l and m
  * Sans Music: Improve the spacing of the augmentation dot

==== grub2 ====
Subpackages: grub2-arm64-efi grub2-arm64-efi-bls grub2-common grub2-snapper-plugin grub2-systemd-sleep-plugin

- Fix out-of-bound memory write and uninitialized read in
  add_multiple_nvme_bootdevices() when adding boot device to PowerPC
  OpenFirmware's boot list (bsc#1284464)
  * 0001-osdep-unix-platform-Fix-NVMe-boot-device-buffer-boun.patch
  * 0002-osdep-unix-platform-Handle-missing-IEEE1275-NVMe-boo.patch
  * 0003-osdep-unix-platform-Fix-memory-leaks-in-add_multiple.patch
- Fix memory leak in error path, add missing error return check in
  grub_initrd_component(), ensure NULL check before memset() in
  grub_cryptokey_discard() (bsc#1284464)
  * 0009-Add-crypttab_entry-to-obviate-the-need-to-input-pass.patch
  * 0002-discard-cached-key-before-entering-grub-shell-and-ed.patch
  * Fix-the-size-calculation-for-the-synthesized-initrd.patch
- Fix out-of-bound memory write in add_multiple_dm_multipath_bootdevices() when
  adding boot device to PowerPC OpenFirmware's boot list
  * 0001-ieee1275-support-dm-multipath-bootlist.patch
- Rebase patches
  * 0002-Restrict-cryptsetup-key-file-permission-for-better-s.patch
  * 0001-Improve-TPM-key-protection-on-boot-interruptions.patch
- Reduce the size and number of TPM 8 PCR events (bsc#1278206)
  * 0001-script-execute-Do-not-measure-.-block-bodies-into-PC.patch
  * 0002-script-execute-Free-argv-on-error-paths-in-grub_scri.patch
  * 0001-grub-mkconfig-Track-and-deduplicate-emitted-modules.patch
  * 0002-00_header-Deduplicate-device-preparation-for-theme-f.patch
  * 0003-31_efi_bootnext-Consolidate-EFI-platform-check.patch
- Fix overflow in grub-mkpasswd-argon2 (bsc#1284464)
  * 0001-grub-mkpasswd-argon2-validate-argument-ranges-to-avo.patch
- Fix overflow in MFA key protector (bsc#1284464)
  * 0001-mfa-fix-key-size-calculation-when-keyfile_size-is-0.patch
  * 0002-mfa-reject-keyfile-offset-at-EOF-to-prevent-empty-ke.patch
  * 0003-mfa-wipe-key-buffer-on-file-read-error.patch
  * 0004-mfa-require-both-factors-to-provide-non-empty-keys.patch
- Rebase patches
  * grub-install-force-journal-draining-to-ensure-data-i.patch
  * grub2-btrfs-05-grub2-mkconfig.patch
  * grub2-efi-xen-cmdline.patch
  * grub2-suse-remove-linux-root-param.patch

==== gsettings-desktop-schemas ====
Version update (50.1 -> 51.0)

- Update to version 51.0:
  + Updated translations.
- Update to version 51.rc:
  + Added setting for custom pointer acceleration profile
  + Remove gconf schema migration files
  + Updated translations.
- Update to version 51.beta:
  + Add setting to configure the focus ring visibility timeout
  + Add 'orientation-lock' setting to take over the g-s-d setting
  + Updated translations.
- Update to version 51.alpha:
  + Add scroll speed setting for touchpads
  + Add the ability to enable button scrolling on a mouse
  + Increase default maximum thumbnail cache from 512MB to 2GB
  + Updated translations.

==== gtk4 ====
Version update (4.22.5 -> 4.24.1)
Subpackages: gtk4-schema gtk4-tools libgtk-4-1 typelib-1_0-Gtk-4_0

- Update to version 4.24.1:
  + Bugs fixed:
  - search-entry: Needs extra touch to show OSK although it has
    focus
  - text-input: Preedit gets cleared due to text-change-cause
  - GtkSvgWidget can't parse '@media' if it is not on a new line
  - gtkmain: Split out debug code
  - gtkgstsink: release GL context on disposal
  - Post-release version bump
  - Fix typo in CONTRIBUTING.md
  - texthandle: fix transformation issues & relative movement
  - Fix typo ('witten' should be 'written')
  - searchbar: Show OSK when search-mode gets enabled
  - docs: Correct docs for allocation functions
  - textbuffer: Fix tag colors in accessible text attributes
  - gtk/inscription: Refresh GtkInscription's PangoLayout when
    rooted
  - text: Protect against invalid offset
  - macos: fix cursor keys
  - various fixes
  - gl: Create 2 fbos per frame instead of 1 per image
  - textview: Make text handles visible after giving them a
    position
  + Updated translations.
- Update version dependencies according to meson.build.
- Update to version 4.24.0:
  + Bugs fixed:
  - Animated SVG frequently disappears
  - Drop-performed class handlers read a phantom timestamp and
    send it in XdndDrop
  - GtkColumnView: sortable column headers expose no AT-SPI
    action, so sorting is unreachable for assistive technology
  - Media queries are not respected
  - svg: if the only animations in an svg are visibility
    animations elementa stay at initial value
  - Crash triggered by gtk_text_accessible_text_get_extents()
  - CUPS Secret Service authentication causes use-after-free in
    lookup_auth_info_cb()
  - Fix mismatches between parameters in four signal declarations
    and the corresponding class slots
  - gtkaccesskitcontext: Expose GActions as custom actions
  - gtk: Repair action muxer subscriptions
  - gsk: Allow conics with weight zero
  - docs: Update release howto
  - vulkan: Always update global buffer descriptor set
  - svg: Fix run mode discrete
  - memoryconvert: Pass the correct pointer address
  - curve: Add gsk_curve_get_extrema
  - Some frame clock fixes
  - gdkclipboard-x11: don't call a NULL converter
  + Updated translations.
- Update to version 4.23.4:
  + Bugs fixed:
  - AT-SPI attempts to use /org/a11y/atspi/cache before it is
    ready w/gtk4 apps
  - GtkListView misses items
  - Issue: Fix Memory Leaks and Potential Crashes in GTK
    Components
  - GtkConstraintLayout: non-required inequality constraints
    release an error variable twice
  - Wayland: SIGSEGV in text_input_preedit_hint() when using IBus
    Chewing in GTK 4 applications
  - (GtkTextView) Cutting, pasting, or deleting text does not
    reset virtual cursor position
  - GtkText's input interceptor logic is too eager
  - gtk4-demo empty context menu on tabs
  - The menu bar focusing with F10 is wrong
  - GtkAccessibleTextInterface mismatch between interface
    documentation and its implementations
  - `gtk_test_init` docs incorrect about locale
  - Shortcut labels in menus started showing keypad/numpad keys
    instead of regular ones
  - Enable ubsan in the sanitizers CI build
  - rendernode: Add bilevel opacity flag
  - listbase: Sanity-check alignment values
  - inspector: Add a frametime overlay
  - gsk/vulkan: put the globals in a UBO instead of push constant
  - demos/gtk-demo: Drop nonexistent session-id property
  - android/contentfile: Return NOT_SUPPORTED for foreign copy
    sources
  - Update glib and GStreamer deps and move Fedora CI to F45
  - svg: Make symbolic rendering opt-in
  - svg: Add tests for symbolic rendering
  - svg: Avoid a crash
  - svg: Serialize gpa:rendering
  - placesview: Small cleanup
  - various fixes
  - gsk: Fix a typo in quad printing
  - gsk/gpu: avoid GPU draw ops for zero-ink glyphs
  - rendernodeparser: Allow naming paths
  - svg: Fix some state handling mishaps
  - icons: Add folder-projects-symbolic
  - adjustment: Respect the reduced-motion setting
  - gdkcontentserializer: close the string serializer's converter
    stream
  - color scale: Make vertical alpha scales work
  - svg: Avoid unnecessary rendering work
  - Add a setting for accent color
  - color scale: Make vertical alpha scales work
    ... changelog too long, skipping 93 lines ...
  + Updated translations.

==== gtkmm3 ====

- Update URL to new home.

==== gtkmm4 ====
Version update (4.22.0 -> 4.24.0)

- Update URL to new home.
- Update version dependencies according to meson.build.
- Update to version 4.24.0:
  + Gdk:
  - KeymapKey: New class.
  - Add Display::map_keyval()
  + Gtk: Add Settings::property_gtk_accent_color().
  + Build:
  - Require glibmm >= 2.89.0
  - Require gtk >= 4.23.4
  - Meson build: Fix missing dependencies, making it possible to
    build with https://github.com/michaelforney/samurai instead
    of ninja.
- Update to version 4.23.2:
  + Some unstable API has been removed.
  + The corresponding API was removed in gtk 4.23.3.
  + Drop G_GNUC_CONST as in glib
  + Gdk:
  - Graphene::Point: Add Point(cobst Vec2& src), distance(),
    interpolate().
  - Graphene::Size: Add scale(), interpolate().
  - Add Graphene::Vec2.
  - Graphene::Rect: Add get_vertices(), join(), intersection(),
    offset(), inset(), round_extents(), interpolate(), expand(),
    scale().
  - Don't derive gtkmm__GdkXxx GTypes from final types and
    internal types.
  - Such declarations have been added to many GdkXxx classes.
  - Add enum FrameResult.
  - FrameTimings: Add get_result().
  + Gsk:
  - tools/m4/enum.m4: Flags operators are constexpr also in
    namespace Gsk.
  - Add classes Path, PathBuilder, PathMeasure, PathPoint,
    Stroke.
  - Add enums LineCap, LineJoin, PathDirection.
  + Gtk:
  - Rename EnumList to EnumListBase, add template EnumList.
  - Snapshot: Add push_fill(), push_stroke(), append_fill(),
    append_stroke().
  - Deprecate EventControllerKey::forward().
  - Application: Remove save(), forget(),
    property_support_save(), property_autosave_interval(),
    signal_restore_window(), signal_save_state(),
    signal_restore_state().
  - ApplicationWindow: Remove signal_save_state().
  - Remove enum RestoreReason.
  - ATContext: Add property_realized().
  - Editable: Add set/unset/get/property_input_interceptor(),
    signal_input_intercepted().
  - Settings: Add property_gtk_keyboard_focus_visible_timeout().
  - ShortcutTrigger: Add ShortcutTrigger::create_with_aliases(),
    create_for_menu().
  - SvgWidget: Add property_svg().
  + Documentation: Gtk::AlternativeTrigger: Update class
    description.
  + Demos: DropDown demo: Add a DropDown using EnumList.
  + Build:
  - Meson: Don't export Vulkan as an installed dependency.
  - Require gtk4 >= 4.23.3
- Update to version 4.23.0+17:
  + Gtk: Remove API as in gtk 4.23.3
- Update to version 4.23.0+16:
  + meson: Don't export Vulkan as an installed dependency
  + Drop G_GNUC_CONST as in glib
  + Gdk: Don't derive gtkmm__GdkXxx GTypes from internal types
  + Deprecate Gtk::EventControllerKey::forward()
  + Gdk::Graphene::Rect: Add get_vertices(), etc.
  + Update gtk_docs_override.xml
  + Gdk::Graphene::Point: Remove distance_squared()
  + Gtk::Snapshot: Add push_fill(), etc.
  + Gsk: Add classes Path, PathBuilder, PathMeasure, PathPoint,
    Stroke
- Switch to source service for tarball:
  + Pass -Dmaintainer-mode=true to meson: the generated C sources
    are not in git and need thus be generated.
  + Add mm-common, m4, and perl-XML-Parser BuildRequires: needed
    for C source generation.
- Update to version 4.23.0:
  + Gdk: contentformats.[ccg|hg]: Add Glib::Value wrapper for
    GdkFileList. Add Value<std::vector<Glib::RefPtr<Gio::File>>>
    specialization.
  + Gtk:
  - Gtk::AccelKey: include <gdk/gdk.h>. Since gtk 4.23.0 it's not
    possible to include only gdk/gdkkeysyms.h.
  - Application: Add save(), forget(), property_support_save(),
    property_autosave_interval(), signal_restore_winodw(),
    signal_save_state(), signal_restore_state().
  - Editable: Add get/property_complete_text().
  - Add enum RestoreReason
  - Settings: Deprecate
    property_gtk_application_prefer_dark_theme(),
    property_gtk_shell_shows_app_menu(),
    property_gtk_shell_shows_menubar(),
    property_gtk_shell_shows_desktop().
  - Svg: Add set/get/property_overflow(),
    set/get/property_stylesheet(), set_settings().
  - SvgErrorExtra: Add get_input().
  - Window: Add signal_force_close().
    ... changelog too long, skipping 8 lines ...
  + Fix build with build-deprecated-api=false.

==== gtksourceview5 ====
Version update (5.20.0 -> 5.22.0)

- Update version dependencies according to meson.build.
- Update to version 5.22.0:
  + Reject non-regular files before opening them in
    GtkSourceFileLoader
  + Add a configurable GtkSourceFileLoader max-size limit,
    defaulting to 1 GiB, for file, stream, and decompressed input
  + Report oversized loads with
    GTK_SOURCE_FILE_LOADER_ERROR_TOO_BIG
  + Centralize checked arithmetic for input sizes and buffer growth
  + Unwind buffer output streams when file loading fails
  + Handle stream-based loads without a file location in profiler
    marks
  + Expand file loader tests for size limits, compressed input,
    load failures, and arithmetic boundaries
  + Fix gutter renderer list and gutter lines leaks
  + Break a circular reference when line numbers are enabled
  + Avoid temporary region and text mark allocations in search
    context intersection checks
  + Avoid per-line timer allocations in the syntax highlighting
    engine
  + Avoid rescanning UTF-8 text to determine line character counts
  + Reduce scrolling overhead in GtkSourceMap
  + Fix GtkSourceMap slider sizing and positioning when the map is
    taller than its contents
  + Reduce allocations and per-line work when drawing source mark
    backgrounds
  + Reduce array access overhead in gutter lines
  + Fix vertical alignment when jumping to text positions
  + Improve Vim emulation for command repetition, r, and cw/cW
  + Add Vim support for +, X, gu, gU, g~, and visual-mode ~
  + Add Vim Ctrl-A and Ctrl-X support for signed decimal numbers
  + Add Vim :set aliases and :noh/:nohlsearch commands
  + Expand Vim input tests for commands, motions, and repetition
  + Use canonical property names and static strings for properties
  + Add missing API version annotations and correct function
    attributes
  + Updated translations.
- Update to version 5.21.0:
  + This is an unstable release for GNOME 51.alpha
  + GtkSourceFileLoader now rejects non-regular files before
    opening
  + GtkSourceFileLoader now bounds expanded input size, including
    decompressed input, and reports oversized loads cleanly
  + GtkSourceFileLoader now unwinds buffer output streams on load
    failure
  + Fix gutter and gutter lines leaks
  + Break a circular reference when line numbers are enabled
  + Improve Vim emulation for repeated commands, r, cw/cW, +, X,
    gu, gU, g~, Ctrl-A, Ctrl-X, and :set aliases
  + Fix vertical alignment when jumping to iters
  + Improve context engine and search context performance
  + Use canonical property names and static strings for properties
  + Updated translations.

==== gvfs ====
Version update (1.60.3 -> 1.62.0)
Subpackages: gvfs-backend-afc gvfs-backend-goa gvfs-backend-gphoto gvfs-backend-samba gvfs-backends gvfs-fuse

- Update version dependencies according to meson.build.

==== harfbuzz ====
Version update (14.6.0 -> 15.0.0)
Subpackages: libharfbuzz-gobject0 libharfbuzz-icu0 libharfbuzz-subset0 libharfbuzz0 typelib-1_0-HarfBuzz-0_0

- Update to version 15.0.0:
  * Support for the new tables and formats in the ISO Open Font Format (OFF)
    5th edition is now enabled by default:
    + New tables and formats for 24-bit glyph indices (a.k.a. beyond-64k): the
    `GLYF`, `LOCA`, `GVAR`, `MAXP`, `HHEA`, `HMTX`, `VHEA`, and `VMTX`
    tables, `cmap` format 15, `VORG` version 2, `COLR` `PaintGlyph2`, the
    24-bit `GSUB`, `GPOS`, `GDEF`, `BASE`, and `JSTF` formats, and extended
    TrueType Collection directories. A test font, `NotoSans-beyond64k.ttf`,
    which merges the Noto Sans fonts into a single font, can be found at:
    https://drive.google.com/file/d/1vMQI9mZMzfKIMHD96Iie40Oyo9NnnweH/view
    + Cubic curves in `GLYF` outlines.
    + The `DMAP` table, supported since 14.6.0.
  * Support instancing axes not referenced by retained `VARC` data. The latest
    `VARC` test fonts can be found at:
    https://github.com/notofonts/noto-cjk-varco/releases/tag/v0.005
  * The raster (`libharfbuzz-raster`), vector (`libharfbuzz-vector`), and GPU
    (`libharfbuzz-gpu`) libraries are no longer considered experimental. This
    means that the HarfBuzz API and ABI stability guarantees now apply to
    these libraries as well.
  * Fix possible use-after-free in `hb_font_set_face()`, which now resets the
    font functions to the defaults for the new face. The function is now
    deprecated. Use `hb_font_create()` instead.
  * Fix heap-buffer-overflow in `hb_font_set_variation()` after
    `hb_font_set_face()` switches to a face with more variation axes.
  * Subsetting `CFF` and `CFF2` fonts whose subroutine calls are not preceded
    by an immediate subroutine number now fails instead of silently dropping
    the table, unless desubroutinizing.
  * Overriding atomic operators at compile time is not supported anymore.
  * Rewrite the number parser without Ragel, fixing various edge cases.
  * Harden the experimental WebAssembly shaper against malicious fonts.
  * Update the experimental Rust shaper (HarfRust) to 0.15, and the
    `fontations` font functions to read-fonts 0.46.
  * Update the `kbts` shaping backend to `kb_text_shape` 2.28g, and support
    font variations in it.
  * Various subsetting and instancing fixes, especially for `CFF2`, `COLR`,
    and variable layout tables.
  * Various fixes to the raster and vector libraries.
  * Various variable font fixes.
  * Various fixes for malformed fonts.
  * Various documentation fixes.
  * Various build and CI fixes.
  * Deprecated API: -hb_font_set_face()

==== hidapi ====
Version update (0.14.0 -> 0.15.0)

- Update to 0.15.0:
  * general: add hid_send_output_report() (#677)
  * general: add hid_read_error() (#721)
  * winapi: add hid_winapi_set_write_timeout (#700)
  * winapi: improve hid_get_report_descriptor and descriptor
    reconstruction (#707)
  * hidraw: report only Top-Level Usage_page/Usage pairs
    as unique devices (#601)
  * macOS: add option to mimic 1.0.0 compatibility version (#709)
  * NetBSD: UHID native backend implementation (#612)
  * libusb: allow building using non-POSIX runtime; support
    Xbox 360/One controllers (#572)
  * various other fixes and improvements
- Spec cleanup: use %ldconfig_scriptlets, drop Group tags

==== ibus ====
Version update (1.5.34 -> 1.5.35~rc1)
Subpackages: ibus-dict-emoji ibus-gtk ibus-gtk3 libibus-1_0-5 typelib-1_0-IBus-1_0

- Update to version 1.5.35~rc1:
  + Build with Meson 1.5 or later
  + Support XKB latch keys in Wayland input-method
  + Support use-system-keymap setting in Wayland input-method
  + Support forwarding key events in Wayland input-method V2
- Drop upstream merged patches:
  + 1a331e695d84fc6bae8f2d11c52d4776df49647b.patch
  + 5bbe88a1936246185a65f76e58cc85871401e59a.patch
  + c534999a9dbea2666864250d74e058ecfb46e76f.patch
- Backport one more patch to fix another GNOME 51 / GTK4 crash:
  + c534999a9dbea2666864250d74e058ecfb46e76f.patch (glgo#GNOME/gtk#8503)

==== ibus_gtk4 ====
Version update (1.5.34 -> 1.5.35~rc1)

- Update to version 1.5.35~rc1:
  + Build with Meson 1.5 or later
  + Support XKB latch keys in Wayland input-method
  + Support use-system-keymap setting in Wayland input-method
  + Support forwarding key events in Wayland input-method V2
- Drop upstream merged patches:
  + 1a331e695d84fc6bae8f2d11c52d4776df49647b.patch
  + 5bbe88a1936246185a65f76e58cc85871401e59a.patch
  + c534999a9dbea2666864250d74e058ecfb46e76f.patch
- Backport one more patch to fix another GNOME 51 / GTK4 crash:
  + c534999a9dbea2666864250d74e058ecfb46e76f.patch (glgo#GNOME/gtk#8503)

==== inih ====
Version update (62 -> 63)

- Update to version 63 (CVE-2025-71450 bsc#1289163)
  * Report file read errors
  * Normalize CR LF line endings to just LF in test file
  * Fix multiline continuation names after no-value keys
  * Expose INI_MAX_SECTION and INI_MAX_NAME in ini.h
  * Assert on NULL arguments
  * Bug Fix: OOB Read in ini_parse_stream()

==== iproute2 ====
Version update (7.2 -> 7.3)

- Update to release 7.3
  * ip: add OVPN device mode support
  * ss: stop displaying dccp sockets
  * seg6: add support for lookup attribute in SRv6 encap routes
  * ip nexthop: support fdb destination port
  * ip/bond: add lacp_strict support

==== ipxe ====
Version update (2.0.0+git20260710.58ee55b3c -> 2.0.0+git20260914.7cd92e01d)

- Marke the QEMU rom subpackage noarch to deal with bsc#1288051
- Fix bsc#1271200. Patchs added:
  * virtio-Fix-MSI-X-caps-control-register-offset-in-leg.patch
  * virtio-Fix-virtio-net-PXE-boot-on-legacy-BIOS-VMs-wi.patch
- Update to version 2.0.0+git20260914.7cd92e01d:
  * [tls] Handle TLS version 1.3 client Finished
  * [tls] Do not schedule sending of unused records in TLS version 1.3
  * [tls] Ignore TLS version 1.3 NewSessionTicket
  * [tls] Handle TLS version 1.3 server Finished
  * [tls] Transition to handshake traffic keys after receiving ServerHello
  * [tls] Allow for scheduled traffic phase changes
  * [tls] Allow for variable-length verification data
  * [tls] Add support for binding via a CertificateVerify record
  * [tls] Add support for parsing TLS version 1.3 Certificate record
  * [tls] Handle inner plaintext for TLS version 1.3
  * [tls] Allow support for newer TLS versions to be optimised out
  * [tls] Discard received Change Cipher records under TLS version 1.3
  * [tls] Exclude sequence number from authentication for TLS version 1.3
  * [tls] Allow for sequential cipher initialisation vectors
  * [tls] Limit to TLS version 1.2 in transmitted record headers
  * [tls] Remove the concept of a pending cipher specification
  * [tls] Add support for the key share extension
  * [tls] Add ClientHello to transcript before selecting named group
  * [tls] Handle TLS version 1.3 session ID echoing
  * [tls] Use HKDF-based key schedule for TLS version 1.3 or later
  * [crypto] Refuse to allow zero-length ServerKeyExchange parameters
  * [crypto] Ensure TLS signable digests cover a shared secret
  * [tls] Detect version downgrade attacks
  * [tls] Add support for the supported versions extension
  * [tls] Add definitions for TLS version 1.3 cipher suites
  * [tls] Record named group rather than key exchange algorithm
  * [crypto] Add AES acceleration using the Arm Cryptographic Extensions
  * [crypto] Add support for AES-NI hardware acceleration
  * [crypto] Align AES round keys within the AES context
  * [crypto] Allow for AES hardware acceleration
  * [librm] Enable the use of SSE instructions if supported by the CPU
  * [librm] Preserve CR0 across virt_call()
  * [librm] Preserve CR4 across virt_call() if FXSR is supported
  * [librm] Skip runtime check for FXSR support in 64-bit builds
  * [librm] Remove conditionalisation of the Tivoli VMM workaround
  * [librm] Clarify layout of saved GDTR/IDTR
  * [librm] Always disable paging when switching to protected mode
  * [crypto] Treat high tag numbers as invalid
  * [test] Add Project Wycheproof RSA-PSS signature verification tests
  * [test] Add a build target for slow self-tests
  * [test] Add Project Wycheproof ECDSA signature verification tests
  * [crypto] Reject non-canonical ECDSA signature encodings
  * [crypto] Reject indefinite and unrepresentable length encodings
  * [crypto] Reject ASN.1 unsigned integers holding negative values
  * [crypto] Reject non-canonical ECDSA signature data structures
  * [test] Simplify class hierarchy for Project Wycheproof import tool
  * [test] Derive comment labels from Project Wycheproof input files
  * [test] Derive algorithm names from Project Wycheproof input files
  * [test] Use a single shared class for Project Wycheproof test flags
  * [test] Add Project Wycheproof RSA PKCS#1 signature verification tests
  * [test] Add Project Wycheproof RSA PKCS#1 signature generation tests
  * [test] Allow for invocation of individual Project Wycheproof tests
  * [crypto] Reject non-canonical RSA inputs
  * [crypto] Add OID-identified algorithms for RSA with SHA512/224 and SHA512/256
  * [test] Add Project Wycheproof RSA PKCS#1 decryption tests
  * [crypto] Add missing padding length check in RSA decryption
  * [test] Allow for public-key algorithm tests with incomplete key pairs
  * [test] Allow for per-group definition code in Project Wycheproof tests
  * [test] Add schema and count validators in Project Wycheproof tests
  * [test] Add Project Wycheproof AES-GCM tests
  * [crypto] Reject zero-length IVs for GCM ciphers
  * [test] Add ability to test for cipher key and IV failures
  * [test] Add Project Wycheproof HKDF tests
  * [test] Allow for HKDF tests without an expected PRK
  * [test] Add Project Wycheproof HMAC tests
  * [test] Allow for HMAC tests with partial expected output digest values
  * [test] Reduce duplication in Project Wycheproof import tool
  * [test] Add Project Wycheproof import tool and key exchange tests
  * [tls] Reject a duplicate ServerHelloDone
  * [crypto] Ensure that a closed channel is left with unusable ciphers
  * [crypto] Guard against mutation of certificate chain during validation
  * [tls] Add documentation to assist future code review
  * [tls] Make certificate processing visibly safe at point of use
  * [tls] Make certificate sending visibly safe at point of use
  * [tls] Treat secure channel's cipher algorithm as definitive
  * [tls] Ensure that ServerKeyExchange parsing method is always non-NULL
  * [tls] Use null key exchange algorithm as default for DHE and ECDHE
  * [tls] Ensure that broken cipher suites can never be selected
  * [tls] Remove redundant cipher suite name components in debug messages
  * [tls] Use null handshake digest algorithm for the null cipher suite
  * [tls] Use null MAC digest algorithm for AEAD ciphers
  * [tls] Guarantee that receive data buffer list is non-empty
  * [tls] Use standalone secure channel and key schedule implementations
  * [crypto] Add a standalone implementation of the TLS key schedules
  * [crypto] Add a generic implementation of a secure channel
  * [tls] Clean up session management
  * [tls] Clarify purpose of stored key exchange algorithm
  * [tls] Separate the concepts of key schedule and secure channel
  * [tls] Unify handling of ServerKeyExchange and ClientKeyExchange
  * [crypto] Avoid out-of-bounds read when using uninitialised AES context
  * [arm] Add missing condition code clobbers to inline assembly
  * [s390x] Add missing condition code clobbers to inline assembly
  * [tls] Model classic RSA key transport as a key exchange algorithm
  * [dns] Add redundant explicit check for CNAME validity
    ... changelog too long, skipping 95 lines ...
  * [hermon] Add missing write barrier after initiating reset

==== java-25-openjdk ====
Version update (25.0.4.1 -> 25.0.5.0)
Subpackages: java-25-openjdk-headless

- Modified patch:
  * JDK-8395142-25u.patch
    + augment the patch with upstream changes following the
    annoucement of eMudhra's exit from global SSL/TLS certificate
    business
    + it removes the set of impacted root CA certificates related to
    eMudhra (bsc#1287962, CVE-2026-114820)
- Update to upstream tag jdk-25.0.5+8 (Octobre 2026 CPU)
  * Security fixes
    + JDK-8383530: Enhance Javadoc Searching
    + JDK-8383689, CVE-2026-87255, bsc#1286483: Enhance Vector
    Processing
    + JDK-8383679, CVE-2026-87294, bsc#1286490: Enhance Certificate
    Name Checks
    + JDK-8383439, CVE-2026-83395, bsc#1286479: Enhance HTTP Client
    Response Handling
    + JDK-8386783: WebRowSet empty elements read value of previous
    element
    + JDK-8383301, CVE-2026-83387, bsc#1286478: Enhance WebRowSets
    + JDK-8380715, CVE-2026-83374, bsc#1286472: Enhance PKCS5
    padding
    + JDK-8384654, CVE-2026-87367, bsc#1286943: Enhance Template
    Handling
    + JDK-8384736, CVE-2026-91379, bsc#1286498: Enhance JShell
    8387235: JShell tests failing
    + JDK-8382378, CVE-2026-83378, bsc#1286475: Improve C2 loop
    transformations
    + JDK-8383699, CVE-2026-87290, bsc#1286484: Enhance XPath
    Expressions
    + JDK-8383047, CVE-2026-83380, bsc#1286476: Enhance LDAP logins
    + JDK-8384468: Enhance jpackage Packaging
    + JDK-8384021, CVE-2026-101516, bsc#1286395: Enhance
    Certificate Constraint Checking
    + JDK-8387152, CVE-2026-91462, bsc#1286547: Enhance krb5 tokens
    + JDK-8387238, CVE-2026-91464, bsc#1286550: Enhance Kerberos
    validation
    + JDK-8386013: Enhance EventListenerList
    + JDK-8382407: Enhance LDAP Lookups
    + JDK-8390400, CVE-2026-91487, bsc#1286551: Enhance C2
    comparisons
    + JDK-8385209, CVE-2026-91394, bsc#1286507: Enhance HTTP client
    caching
    + JDK-8386535, CVE-2026-91453, bsc#1286545: Improve HTTP headers
    + JDK-8386923, CVE-2026-91461, bsc#1286546: Enhance TLS
    Extensions
    + JDK-8387217, CVE-2026-91463, bsc#1286549: Enhance krb5 client
    + JDK-8386515, CVE-2026-91451, bsc#1286542: Enhance HTTP server
    parsing
    + JDK-8373677: Clear text HttpServer connection could fail fast
    if receiving SSL ClientHello
    + JDK-8384872, CVE-2026-91332, bsc#1286491: Enhance HTTP Client
    + JDK-8383756, CVE-2026-87292, bsc#1286486: Enhance Network
    Clients
    + JDK-8383745, CVE-2026-87291, bsc#1286485: Enhance HTTP Server
    + JDK-8384165, CVE-2026-91333, bsc#1286492: Improve ciphertext
    handling
    + JDK-8383281: Enhance MD5 Digesting
    + JDK-8384664, CVE-2026-91335, bsc#1286494: Enhance Image
    Handling
    + JDK-8384746, CVE-2026-91380, bsc#1286500: Enhance Preferences
    + JDK-8386552, CVE-2026-91418, bsc#1286539: Enhance GIF loading
    + JDK-8385476, CVE-2026-91400, bsc#1286517: Enhance MIDI file
    handling
    + JDK-8384688, CVE-2026-91375, bsc#1286497: Enhance jmod
    handling
    + JDK-8387075: RemoteHostImpl constructor correction (jstatd)
    + JDK-8386525, CVE-2026-91452, bsc#1286544: Enhance HTTP Server
    Handler
    + JDK-8386187, CVE-2026-91415, bsc#1286537: Enhance font
    rendering
    + JDK-8385260, CVE-2026-91398, bsc#1286515: Enhance SOCKS5
    support
    + JDK-8385249, CVE-2026-91397, bsc#1286513: Enhance diagnostic
    sessions
    + JDK-8384930, CVE-2026-91374, bsc#1286496: Enhance jstatd
    + JDK-8384771, CVE-2026-91373, bsc#1286495: Enhance TLS
    handshakes
    + JDK-8384455: Enhance DataFlavor
    + JDK-8384445, CVE-2026-91334, bsc#1286493: Enhance JPEG loading
    + JDK-8384031, CVE-2026-83400, bsc#1286480: Enhance XML
    Processing
    + JDK-8383076, CVE-2026-83381, bsc#1286477: Enhance SASL
    Authentication
    + JDK-8382178, CVE-2026-83376, bsc#1286474: Enhance TLS
    certificate handling
  * Other fixes
    + JDK-8386273: Some javax/sound/sampled tests fail on systems
    with high CPU core number and running with high concurrency
    + JDK-8392072: Follow-on fix for Improve certification checking
    + JDK-8391256: TestZoneTextPrinterParser.java assertion fails
    with expected: <Mountain Standard Time> but was: <Mountain
    Daylight Time>
    + JDK-8388214: (tz) Update Timezone Data to 2026c
    + JDK-8390380: Cherry-pick metazone changes from CLDR to support
    tzdata2026c for JDK update releases
    + JDK-8390388: Cherry-pick tz attributes from newer CLDR data
    for jdk25u and earlier
    + JDK-8372044: Implementation Review Based on ML-KEM Security
    Considerations
    ... changelog too long, skipping 249 lines ...
    + not needed any more

==== jbigkit ====
Version update (2.1 -> 2.2)

- Update to 2.2:
  - Robustness release, upgrade is recommended when processing BIE
    or PBM/PGM data from untrusted sources.
  - The jbig.c decoder now caps the final image layer at 2 GB by
    default via the new sd->maxmem limit (adjustable), mitigating
    denial of service through excessive image dimensions.
  - pbmtojbg and pbmtojbg85 validate PBM/PGM header dimensions and
    check size calculations against integer overflow.
  - Fixed jbg85_dec_finalheight() macro typo, a jbg_enc_options()
    range check, jbgtopbm division by zero, and several converter
    file-handling fixes.
  - struct jbg_dec_state gained maxmem: libjbig consumers must be
    recompiled against the new headers (soname unchanged).
  - Dropped jbigkit-CVE-2022-1210.patch, superseded upstream;
    rebased jbigkit-2.1-shlib.patch to the 2.2 sources, fixing
    parallel-build races in the test programs and test suite.
- Spec cleanup: BuildRequires for gcc and make,
  %ldconfig_scriptlets, https source URL.

==== kactivitymanagerd6 ====
Version update (6.8.0 -> 6.8.2)

- Update to 6.8.2
  * New bugfix release
  * For more details please see:
  * https://kde.org/announcements/plasma/6/6.8.2
- Changes since 6.8.1:
  * Update version for new release 6.8.2
- Update to 6.8.1:
  * New bugfix release
  * For more details see https://kde.org/announcements/plasma/6/6.8.1
- Changes since 6.8.0:
  * Update version for new release 6.8.1

==== kde-cli-tools6 ====
Version update (6.8.0 -> 6.8.2)

- Update to 6.8.2
  * New bugfix release
  * For more details please see:
  * https://kde.org/announcements/plasma/6/6.8.2
- Changes since 6.8.1:
  * Update version for new release 6.8.2
- Update to 6.8.1:
  * New bugfix release
  * For more details see https://kde.org/announcements/plasma/6/6.8.1
- Changes since 6.8.0:
  * Update version for new release 6.8.1

==== kde-gtk-config6 ====
Version update (6.8.0 -> 6.8.2)
Subpackages: kde-gtk-config6-gtk3

- Update to 6.8.2
  * New bugfix release
  * For more details please see:
  * https://kde.org/announcements/plasma/6/6.8.2
- Changes since 6.8.1:
  * Update version for new release 6.8.2
- Update to 6.8.1:
  * New bugfix release
  * For more details see https://kde.org/announcements/plasma/6/6.8.1
- Changes since 6.8.0:
  * Update version for new release 6.8.1

==== kdecoration6 ====
Version update (6.8.0 -> 6.8.2)
Subpackages: libkdecorations3-6 libkdecorations3private2

- Update to 6.8.2
  * New bugfix release
  * For more details please see:
  * https://kde.org/announcements/plasma/6/6.8.2
- Changes since 6.8.1:
  * Update version for new release 6.8.2
- Update to 6.8.1:
  * New bugfix release
  * For more details see https://kde.org/announcements/plasma/6/6.8.1
- Changes since 6.8.0:
  * Update version for new release 6.8.1

==== kdeplasma6-addons ====
Version update (6.8.0 -> 6.8.2)

- Update to 6.8.2
  * New bugfix release
  * For more details please see:
  * https://kde.org/announcements/plasma/6/6.8.2
- Changes since 6.8.1:
  * Update version for new release 6.8.2
  * wallpapers/tiled: Animate animated images again (kde#516541)
  * applets/webbrowser: Apply the fixed zoom factor after each page load (kde#485583)
  * wallpapers/potd: Make the preview match Scaled, Centered and Tiled (kde#505690)
  * applets/webbrowser: Allow pages to read and write to the clipboard (kde#523381)
  * applets/mediaframe: fix adding files/folders
- Update to 6.8.1:
  * New bugfix release
  * For more details see https://kde.org/announcements/plasma/6/6.8.1
- Changes since 6.8.0:
  * kwin/windowswitchers: use non-grabbing popup window type
  * Update version for new release 6.8.1

==== kernel-source ====
Version update (7.2.11 -> 7.3.1)
Subpackages: kernel-64kb kernel-default

- Linux 7.3.1 (bsc#1012628).
- io_uring/poll: don't loop on HUP with multiple references
  (bsc#1012628).
- pid_namespace: prevent TIF_NOTIFY_SIGNAL from interrupting
  the reaper (bsc#1012628).
- coredump: prevent TIF_NOTIFY_SIGNAL from interrupting coredumps
  (bsc#1012628).
- signal: allow taks to temporarily block TIF_NOTIFY_SIGNAL
  (bsc#1012628).
- exit: hang up the tty before closing the files (bsc#1012628).
- fork: release the files of a failed fork after
  sched_cancel_fork() (bsc#1012628).
- ptrace: refuse to change the signal mask of a user worker
  (bsc#1012628).
- io-wq: order the exit bit against worker creation task work
  (bsc#1012628).
- signal: only SIGKILL and the freezers interrupt a coredumping
  task (bsc#1012628).
- signal: don't retarget shared signals in a dying thread group
  (bsc#1012628).
- coredump: hold RCU while releasing parked threads (bsc#1012628).
- ftrace: Initialize modname and offset in print_rec()
  (bsc#1012628).
- asymmetric_keys: reject trust keys without IDs (bsc#1012628).
- keys/trusted_keys: return immediately after TPM unseal failure
  (bsc#1012628).
- KEYS: trusted: Fix blob allocation size in tpm2_key_decode()
  (bsc#1012628).
- KEYS: Fix key_reject_and_link() race with keyring restriction
  (bsc#1012628).
- keys: Protect the read method check against type removal
  (bsc#1012628).
- keys: make keyring indexes independent of kernel addresses
  (bsc#1012628).
- keys: Protect the type name while describing a key
  (bsc#1012628).
- keys: Check the authorization payload in process keyring
  searches (bsc#1012628).
- keys: Avoid the owner account dereference in named keyring
  lookup (bsc#1012628).
- io_uring: end the drain when the drain request completes
  (bsc#1012628).
- io_uring/waitid: prevent cancel reference wrap (bsc#1012628).
- io_uring/net: keep recv buffer select length within MAX_RW_COUNT
  (bsc#1012628).
- io_uring/wait: wake real-time waiters from hard interrupt
  context (bsc#1012628).
- io_uring/poll: avoid retry wakeup loss when dropping ownership
  (bsc#1012628).
- tracing/syscalls: Use copy_from_user for the faultable syscall
  buffer (bsc#1012628).
- tracing/histograms: Verify event_call identity when updating
  synth_event refcount (bsc#1012628).
- tracing: Fix 64-bit and signed histogram fields on 32-bit
  kernels (bsc#1012628).
- tracing: Add the bucket size to expr_field_str() (bsc#1012628).
- tracing: Unregister field variable histograms when the command
  fails (bsc#1012628).
- tracing: Save the event file instead of the compatible histogram
  (bsc#1012628).
- tracing: Reject incomplete event filter expressions
  (bsc#1012628).
- tracing: Hold trace_types_lock when resetting last boot data
  from readers (bsc#1012628).
- tracing: Hold trace_types_lock when updating modules in
  persistent instances (bsc#1012628).
- tools/dma: fix building with O= (bsc#1012628).
- Bluetooth: L2CAP: refuse __l2cap_chan_add if chan already has
  conn (bsc#1012628).
- mm/damon/core: error damos_commit_quota_goal() for zero
  target_value (bsc#1012628).
- genirq/proc: Fix missing CPU header in /proc/interrupts
  (bsc#1012628).
- commit 8815021
- rpm/release-projects: Add SUSE:SLFO:Kernel:1.0
- commit 2b42edb
- rpm/mkspec: Adjust for 32bit arch rename again
  There is a discrepancy between OBS architecture and rpm architecture for
  32bit arm. Specify both variants.
  Fixes: 38dbb311314 ("rpm/mkspec: Adjust for 32bit Arm arch rename")
- commit 09b332e
- Revert "mkspec: Exclude rt flavor from kernel-syms dependencies (bsc#1244337)."
  This reverts commit 7c95ae0ac0bb4a4481565e3a3ead1e221ced817c.
- commit ee3b323
- Revert "rpm/mkspec: Fix missing kernel-syms-rt creation (bsc#1244337)"
  This reverts commit 630f139a764a8ea61dfc0bb46f3675769d8ac1e0.
- commit ebcac98
- Revert "rpm/mkspec: Exclude azure from kernel-syms dependencies"
  This reverts commit c174e9bd96115668914bc3ed97c2df3525bf7930.
- commit 16115a3
- series.conf: move a patch to sorted section
  patches.suse/ALSA-usb-audio-Avoid-applying-boot-quirk-for-Behring.patch
  is upstream now.
- commit 2c911cd
- Refresh
  patches.suse/powerpc-ftrace-Don-t-restore-r13-during-ftrace_regs_caller.patch.
  Update upstream status.
- commit 22d516d
- x86/mm/pat: Use pr_warn() for early W^X warnings (bsc#1284523).
    ... changelog too long, skipping 38 lines ...
- commit 38dbb31

==== kf6-baloo ====
Subpackages: kf6-baloo-file kf6-baloo-imports kf6-baloo-kioslaves kf6-baloo-tools libKF6Baloo6 libKF6Baloo6-lang libKF6BalooEngine6

- Add patch to fix occasional crashes on login:
  * 0001-service-do-not-start-too-early.patch

==== kglobalacceld6 ====
Version update (6.8.0 -> 6.8.2)
Subpackages: libKGlobalAccelD6-0

- Update to 6.8.2
  * New bugfix release
  * For more details please see:
  * https://kde.org/announcements/plasma/6/6.8.2
- Changes since 6.8.1:
  * Update version for new release 6.8.2
- Update to 6.8.1:
  * New bugfix release
  * For more details see https://kde.org/announcements/plasma/6/6.8.1
- Changes since 6.8.0:
  * Update version for new release 6.8.1

==== kinfocenter6 ====
Version update (6.8.0 -> 6.8.2)

- Update to 6.8.2
  * New bugfix release
  * For more details please see:
  * https://kde.org/announcements/plasma/6/6.8.2
- Changes since 6.8.1:
  * Update version for new release 6.8.2
  * kcms/energy: Don't read properties of a null battery
- Update to 6.8.1:
  * New bugfix release
  * For more details see https://kde.org/announcements/plasma/6/6.8.1
- Changes since 6.8.0:
  * Update version for new release 6.8.1
- Add explicit dependency for QtGraphs import

==== kio_audiocd ====

- Drop the obsolete libkcompactdisc dependency

==== kirigami-addons6 ====
Version update (1.14.0 -> 1.16.0)
Subpackages: libKirigamiAddonsComponents6 libKirigamiAddonsStatefulApp6 libKirigamiApp6

- Update to 1.16.0
  https://carlschwan.eu/2026/10/29/kirigami-addons-1.16.0.-the-material-updates/

==== kmenuedit6 ====
Version update (6.8.0 -> 6.8.2)

- Update to 6.8.2
  * New bugfix release
  * For more details please see:
  * https://kde.org/announcements/plasma/6/6.8.2
- Changes since 6.8.1:
  * Update version for new release 6.8.2
- Update to 6.8.1:
  * New bugfix release
  * For more details see https://kde.org/announcements/plasma/6/6.8.1
- Changes since 6.8.0:
  * Update version for new release 6.8.1

==== kmod ====
Version update (34.2 -> 34.3)
Subpackages: libkmod2

- Update to release 34.3
  * depmod gained an -m/--moduledir option.
  * Removed deprecated arguments for depmod:
  - -unresolved-error, --quiet, --root and --map.
  * Removed deprecated arguments for rmmod: -w.
  * Removed deprecated arguments for insmod: -p and -s.
  * Optimized index reading by lazily reading nodes on demand.

==== knighttime6 ====
Version update (6.8.0 -> 6.8.2)
Subpackages: libKNightTime0

- Update to 6.8.2
  * New bugfix release
  * For more details please see:
  * https://kde.org/announcements/plasma/6/6.8.2
- Changes since 6.8.1:
  * Update version for new release 6.8.2
- Update to 6.8.1:
  * New bugfix release
  * For more details see https://kde.org/announcements/plasma/6/6.8.1
- Changes since 6.8.0:
  * Update version for new release 6.8.1

==== kpipewire6 ====
Version update (6.8.0 -> 6.8.2)
Subpackages: kpipewire6-imports libKPipeWire6 libKPipeWireDmaBuf6 libKPipeWireMonitor6 libKPipeWireRecord6

- Update to 6.8.2
  * New bugfix release
  * For more details please see:
  * https://kde.org/announcements/plasma/6/6.8.2
- Changes since 6.8.1:
  * Update version for new release 6.8.2
  * libx264encoder: Tell libx264 the stream's frame rate (kde#526931)
  * PipeWireBaseEncodedStream: Apply a requested size set before starting
- Update to 6.8.1:
  * New bugfix release
  * For more details see https://kde.org/announcements/plasma/6/6.8.1
- Changes since 6.8.0:
  * Update version for new release 6.8.1
  * PipeWireSourceStream: copy the cursor bitmap with its real size

==== krb5 ====
Subpackages: krb5-client

- Package /var/log/krb5 in krb5-server (mode 0700, as created by
  krb5-log.tmpfiles) so the directory the krb5-server logrotate
  config rotates is owned by a package, and move krb5-log.conf
  (the tmpfiles entry creating it) and its %tmpfiles_create call
  from the main package to krb5-server, where both belong;
  client-only installs no longer create the server log directory
- Mark the LDAP schema templates (kerberos.schema, kerberos.ldif)
  %config(noreplace) like the package's other config files
- Annotate the /var/lib/kerberos/krb5 and .../user %ghost state
  directories with their real mode (0755, per krb5.tmpfiles)
- Drop the duplicated kinit/klist entries from %files client
- Drop three dead rpmlintrc filters (files-duplicate for css and
  png files and shlib-policy-missing-suffix); nothing in the
  current file lists matches them
- Prevent denial of Service via crafted forwarded credentials
  * CVE-2026-107778, bsc#1284816
- Prevent denial of Service via malformed PAC in S4U2Proxy
  * CVE-2026-107778, bsc#1284817
- Add 0014-cve-2026-107708.patch and 0015-cve-2026-107778.patch

==== kscreen6 ====
Version update (6.8.0 -> 6.8.2)

- Update to 6.8.2
  * New bugfix release
  * For more details please see:
  * https://kde.org/announcements/plasma/6/6.8.2
- Changes since 6.8.1:
  * Update version for new release 6.8.2
- Update to 6.8.1:
  * New bugfix release
  * For more details see https://kde.org/announcements/plasma/6/6.8.1
- Changes since 6.8.0:
  * Update version for new release 6.8.1
  * kcm: Only compute a badge color for real display numbers
  * kcm: Don't read the panel height before an output is selected

==== kscreenlocker6 ====
Version update (6.8.0 -> 6.8.2)
Subpackages: kscreenlocker6-imports libKScreenLocker6

- Update to 6.8.2
  * New bugfix release
  * For more details please see:
  * https://kde.org/announcements/plasma/6/6.8.2
- Changes since 6.8.1:
  * Update version for new release 6.8.2
- Update to 6.8.1:
  * New bugfix release
  * For more details see https://kde.org/announcements/plasma/6/6.8.1
- Changes since 6.8.0:
  * Handle dropping command line arguments in live upgrades
  * Update version for new release 6.8.1

==== ksshaskpass6 ====
Version update (6.8.0 -> 6.8.2)

- Update to 6.8.2
  * New bugfix release
  * For more details please see:
  * https://kde.org/announcements/plasma/6/6.8.2
- Changes since 6.8.1:
  * Update version for new release 6.8.2
- Update to 6.8.1:
  * New bugfix release
  * For more details see https://kde.org/announcements/plasma/6/6.8.1
- Changes since 6.8.0:
  * Update version for new release 6.8.1

==== ksystemstats6 ====
Version update (6.8.0 -> 6.8.2)

- Update to 6.8.2
  * New bugfix release
  * For more details please see:
  * https://kde.org/announcements/plasma/6/6.8.2
- Changes since 6.8.1:
  * Update version for new release 6.8.2
- Update to 6.8.1:
  * New bugfix release
  * For more details see https://kde.org/announcements/plasma/6/6.8.1
- Changes since 6.8.0:
  * Update version for new release 6.8.1

==== kwayland-integration6 ====
Version update (6.8.0 -> 6.8.2)

- Update to 6.8.2
  * New bugfix release
  * For more details please see:
  * https://kde.org/announcements/plasma/6/6.8.2
- Changes since 6.8.1:
  * Update version for new release 6.8.2
- Update to 6.8.1:
  * New bugfix release
  * For more details see https://kde.org/announcements/plasma/6/6.8.1
- Changes since 6.8.0:
  * Update version for new release 6.8.1

==== kwayland6 ====
Version update (6.8.0 -> 6.8.2)
Subpackages: libKWaylandClient6

- Update to 6.8.2
  * New bugfix release
  * For more details please see:
  * https://kde.org/announcements/plasma/6/6.8.2
- Changes since 6.8.1:
  * Update version for new release 6.8.2
- Update to 6.8.1:
  * New bugfix release
  * For more details see https://kde.org/announcements/plasma/6/6.8.1
- Changes since 6.8.0:
  * Update version for new release 6.8.1

==== kwin6 ====
Version update (6.8.0 -> 6.8.2)
Subpackages: libkwin6

- Add upstream change (kde#527984, boo#1289320)
  * 0001-compositor-handle-possibly-missing-render-device.patch
- Update to 6.8.2
  * New bugfix release
  * For more details please see:
  * https://kde.org/announcements/plasma/6/6.8.2
- Too many changes since 6.8.1, only listing bugfixes:
  * keyboard_layout: Keep an application's layout after its last window closes (kde#476831, kde#452445)
  * backends/drm: move direct scanout device check to the compositor (kde#527544)
  * wayland/pointerconstraints_v1: fix state being overwritten (kde#527675)
  * backends/drm: disable post-blend offloading if color pipelines aren't supported (kde#527628)
  * multigpuswapchain: more correctly check the buffer type (kde#527591)
  * multigpuswapchain: fix synchronization with EGL copy (kde#527591)
  * Lower pip surfaces in the stack (kde#527648)
  * plugins/stickykeys: Latch and lock modifiers on key release (kde#509714)
  * plugins/slidingnotifications: Fix instant animation speed handling (kde#527478)
  * backends/drm: don't allow post-blend offloading with legacy (kde#527421)
  * plugins/startupfeedback: Fix icon sizing (kde#527308)
  * inputmethod: Fix visible in virtual keyboard dbus API (kde#527067)
  * outputconfigurationstore: allow generating a completely new config (kde#527401)
  * qpa: Guard against resizes in EGLPlatformContext::swapBuffers() (kde#527269)
- Update to 6.8.1:
  * New bugfix release
  * For more details see https://kde.org/announcements/plasma/6/6.8.1
- Too many changes to list here
- Drop patches, now upstream:
  * 0001-opengl-gltexture-use-swizzles-to-ignore-non-existent.patch

==== lame ====
Version update (3.100 -> 4.0)

- Update to version 4.0 (libmp3lame soname unchanged, still .so.0):
  * Major version bump: the 9-byte encoder version field in MP3s
    overflowed with 3.100 minor versions; 4.0 resets the scheme.
  * Security fixes: AIFF header parser integer-underflow DoS
    (CVSS 5.5, frontend); Blade DLL beInitStream stack overflow
    (Windows-only, CVSS 8.4).
  * Fix build with recent GCC/Clang (UTF-8 ID3 tag functions);
    export id3tag_set_textinfo/comment_utf8 from shared lib.
  * Add ID3v2.4 support and upstream pkg-config support.
  * mp3rtp gains IPv6 support (incompatible CLI change).
- Use upstream lame.pc; keep libmp3lame.pc alias.
- Use pkgconfig(ncurses); drop obsolete Group tags.
- Add pkgconfig(libmpg123) BuildRequires: 4.0's --enable-decoder
  mandates external mpg123 (configure errors out without it).
- Add lame-4.0-frontend-utf8.patch (backport of upstream post-4.0
  fix): split the mistyped ID3v2 tag handler into typed UTF-16/UTF-8
  variants and add id3tag_set_fieldvalue_utf8(); export hip_set_pinfo
  and hip_finish_pinfo for the frontend; unbreaks the build
  with GCC 14+ defaults.

==== layer-shell-qt6 ====
Version update (6.8.0 -> 6.8.2)
Subpackages: libLayerShellQtInterface6

- Update to 6.8.2
  * New bugfix release
  * For more details please see:
  * https://kde.org/announcements/plasma/6/6.8.2
- Changes since 6.8.1:
  * Update version for new release 6.8.2
- Update to 6.8.1:
  * New bugfix release
  * For more details see https://kde.org/announcements/plasma/6/6.8.1
- Changes since 6.8.0:
  * Update version for new release 6.8.1

==== lcms2 ====
Version update (2.19.1 -> 2.20)

- Update to version 2.20
  * Added a plug-in type for profile header parsing.
  * Fixed premultiplied alpha on planar 16 bit and optimized
    matrix-shaper transforms.
  * Fixed planar half float and Lab double formatters, and planar
    strides in fast_float.
  * Fixed gamut checking with two profiles and a possible crash
    with malformed profiles.
  * Recovered neutrality correction in black point detection.
  * Made cmsCreateLab2Profile white point handling consistent with
    cmsCreateLab4Profile.
  * Fixed UTF8 buffer size calculation.
  * CGATS parser is now more permissive on certain properties.
  * Fixed callback type mismatch in resampled CLUT evaluation.
  * Fixed a crash in PostScript CSA generation.
  * Fixed memory leaks in black preserving intents and .cube
    loading.
  * cmsChangeBuffersFormat now correctly rejects format changes on
    floating point transforms.

==== libHX ====
Version update (5.4 -> 5.5)

- Update to release 5.5
  * io, proc, rand: set O_CLOEXEC on all newly generated file
    descriptors

==== libadwaita ====
Version update (1.9.4 -> 1.10.0)
Subpackages: libadwaita-1-0 typelib-1_0-Adw-1

- Update to version 1.10.0:
  + AdwAnimation: Fix AdwCallbackAnimationTarget annotations
  + AdwActionRow: Ensure :use-markup property is set in
    constructed()
  + AdwStatusPage: Stop using :last-child in styles
  + AdwSidebar/AdwViewSwitcherSidbar: Document how to display
    suffix at the bottom
  + AdwTabBar/AdwTabGrid: Clear a dangling idle callback in dispose
  + Build:
  - Fix release builds requiring sassc
  - Depend on glib 2.89.3
  + Stylesheet: Support .flat and .raised for GtkDropDown
  + Update icons from devkit
  + Updated translations.
- Update to version 1.10.beta.1:
  + Build: Ministream-related fixes
  + AdwAboutDialog:
  - Fix a bug with deselecting text in the legal section
  - Animate showing/hiding the title on the main page
  + AdwActionRow: Don't emit signals in dispose
  + AdwPreferencesRow: Warn when placed
  + AdwSidebarItem: Add :prefix
  + AdwSidebarSection: Add :suffix
  + AdwTabOverview: Make sure we don't round corners in adaptive
    preview
  + AdwWindow/AdwApplicationWindow: Fix false minimum size warnings
    in adaptive preview
  + Update internal icons
  + Docs: Use more detailed placeholder comments in examples
  + Updated translations.
- Update to version 1.10.alpha.1:
  + Include ministream sources into release tarballs.
  + Updated translations.
- Update to version 1.10.alpha:
  + Add translation comments across the project
  + Add AdwCssClassBinding
  + Deprecate AdwEnumListModel; switch everything to GtkEnumList:
  - Require GTK 4.23.1
  - Depend on ministream instead of appstream
  - Make it possible to build on Android
  + Adaptive preview:
  - Try to contain window styles within the preview
  - Collapse the sidebar on small sizes
  - Fix casing in a message
  - Don't make device model names and Phosh names translatable
  + AdwAboutDialog: Add :other-apps-title
  + AdwAboutDialog and AdwAboutWindow
  + AdwApplication: Speed up initial style loading
  + AdwBreakpointBin:
  - Fix initial focus
  - Reduce the number of notify::opacity emissions on children
  + AdwOverlaySplitView: Add a unique style class to the overlay
    sidebar
  + AdwShortcutLabel:
  - Use a more natural modifier ordering
  - Improve key labels on macOS
  - Add :prefix and :suffix
  + AdwSpinnerPaintable:
  - Support icon weight
  - Implement Android settings backend
  - Speed up initial loading
  + AdwSwipeTracker: Ignore mostly orthogonal touchpad scrolls
  + AdwViewSwitcherSidebar:
  - Add :prefix and :suffix
  - Fix a leak
  + Demo: Adjust shortcuts on macOS
  + Examples:
  - Fix a build error
  - Reduce icon weight for large icons
  - Improve popover shadow
  - Fix svg asset rendering with newer GTK
  - Adapt to GtkSpinner changes in newer GTK
  - Fix a copypaste error
  + Update internal icons
  + Various cleanups
  + Updated translations.
- Replace pkgconfig(appstream) with pkgconfig(ministream) following
  upstream changes.

==== libapparmor ====

- add transmission-2246.patch: allow transmission to lock its
  lockfile (boo#1289007)
- Pass the distribution build flags to the plain make builds of the
  parser and the binutils programs, so apparmor_parser, aa-exec,
  aa-load and aa-status are built with fortify and stack-protector
  hardening like the rest of the package
- Drop the obsolete BuildRoot tag from both specs and use the pkgconfig
  spelling of the pkg-config BuildRequires

==== libarchive ====
Version update (3.8.9 -> 3.8.10)

- Update to 3.8.10 (security, bugfix and minor feature release):
  * 7z: add Delta, RISCV, ARMTHUMB and IA64 filters for non-lzma
    archives
  * Support message digests via nettle 4 and mbedtls 3
  * tar: add --mode option for GNU tar compatibility
  * Hardening fixes: iso9660 boot-image block count overflow, two
    reader use-after-free paths, compress flush 1-byte heap overflow,
    bsdunzip use-after-free, rar5 integer overflow, integer
    conversion hardening in lha and iso9660
  * No soname change: libarchive.so.13 unchanged
- Drop obsolete Group: tags; encode upstream libxml2 >= 2.7.3 floor.

==== libconfig ====
Version update (1.8.2 -> 1.8.3)

- Update to release 1.8.3
  * Preserve 32-bit width when writing negative binary integers
  * Preserve explicit 64-bit suffixes when parsing nondecimal
    integers
  * Preserve double precision when auto-converting integer
    assignments
  * Improve handling of file read errors in the lexer

==== libdeflate ====
Version update (1.25 -> 1.26)

- update to 1.26:
  * Added support for compression level -1 as an alias for the
    default compression level (6).
  * libdeflate now requires a C11 compiler.
  * Fixed build failures with clang 18 specifically (clang 19+
    unaffected).
  * Fixed build failure with glibc 2.43 and later.
  * Enabled unaligned access optimizations on all PowerPC
    variants.
  * Improved CRC-32 performance on Arm Neoverse V-Series
    processors by selecting a faster CRC-32 implementation for
    these processors.
  * The CMakeLists.txt now supports the user overriding
    `CMAKE_C_FLAGS_RELEASE`.
  * The CMakeLists.txt no longer runs installation commands when
    it is built as a subproject.

==== libevent ====
Version update (2.1.12 -> 2.1.13)

- libevent.keyring updated, fetched from keyserver
- Updated to 2.1.13 stable
  Security Fixes (evtag, evrpc):
  - CVE-2026-63383: Fix an out-of-bounds read in decode_tag_internal.
    (GHSA-fj29-64w6-73h6 bsc#1276000)
  - CVE-2026-63384: Fix an integer overflow in evtag_unmarshal_header.
    (GHSA-45c6-qx49-89m8 bsc#1276001)
  Security Fixes (evhttp):
  - CVE-2026-63379: Discard HTTP trailers, to prevent header smuggling attacks.
    (GHSA-2gmv-p5m7-98p6 bsc#1275995)
  - CVE-2026-63382: Restrict HTTP header parsing to prevent request smuggling.
    (GHSA-q39v-w2g7-gr8j bsc#1275999)
  - CVE-2026-63385, CVE-2026-63382: Treat CRLF and %00 more strictly in
    HTTP headers, to prevent parser mismatch attacks.
    (See GHSA-q39v-w2g7-gr8j, GHSA-jcwh-pvf2-73p2, bsc#1275999 bsc#1276002)
  - CVE-2026-63388: Fix a heap out-of-bound write that could occur when using
    AF_UNIX sockets and compiling libevent with -DNDEBUG.
    (GHSA-cvq5-vrvr-j338 bsc#1276004)
  Security fixes (evbuffer, bufferevent):
  - CVE-2026-63381: Fixed a dangling pointer in evbuffer_add_reference.
    (GHSA-c2pj-cg4r-88c8 bsc#1275997)
  Security fixes (evdns):
  - CVE-2026-63387: Fix an out-of-bounds write in dnsname_to_labels
    when building a DNS response of 2^16 bytes.
    (GHSA-58rx-7448-jw47 bsc#1276003)
  Security fixes (example code):
  - Avoid using strcpy() in sample/http-server.c.
    (GHSA-5rgj-2c58-7jrc)
  Other fixes:
  - Backport fixes for numerous compiler warnings.
  - Backport fixes for compilation with openssl 3 and later.

==== libgit2 ====

- drop unneeded curl build dependency

==== libglycin ====
Version update (2.1.5 -> 2.2.6)

- Update to version 2.2.6:
  * This release contains the following new component versions
    + libglycin 2.2.6
    + libglycin-gtk4 2.2.6
  * Fixed: meson: Fix build configuration failing if either libglycin or
    libglycin-gtk4 option being enabled.
- Stop passing libglycin=true to meson setup in glycin-loaders.spec.inc
  following upstream changes yet again.
- Update to version 2.2.5:
  * This release contains the following new component versions:
    + Glycin-core 4.0.5
    + Glycin 4.0.5
    + Glycin-builtin 4.0.5
    + Glycin-external 4.0.5
    + Libglycin 2.2.5
    + Libglycin-gtk4 2.2.5
  * Fixed:
    + Require gufo-exif 0.5.5 to avoid reading exif values from incorrect
    positions in some images.
    + Libglycin: Don't panic when trying to lookup an infinite pixel density.
    Instead, don't return any pixel density.
    + Meson/thumbnailer: Ensure that libglycin is built before
    glycin-thumbnailer.
- Pass libglycin=true to meson setup in glycin-loaders.spec.inc following
  upstream changes.
- Update to version 2.2.4:
  * This release contains the following new component versions:
    + Glycin-core 4.0.4
    + Glycin-image-rs 2.2.4
    + Glycin 4.0.4
    + Glycin-builtin 4.0.4
    + Glycin-external 4.0.4
    + Libglycin 2.2.4
    + Libglycin-gtk4 2.2.4
  * Fixed:
    + Require gufo-exif 0.5.4 to avoid a panic in exif lookup for certain
    images.
    + Glycin: Longer magic byte strings in config identifiers now have a higher
    priority. This fixes cursors being sometimes identified as TGAs.
- Update to version 2.2.3:
  * This release contains the following new component versions:
    + Glycin-core 4.0.3
    + Glycin-image-rs 2.2.3
    + Glycin 4.0.3
    + Glycin-builtin 4.0.3
    + Glycin-external 4.0.3
    + Libglycin 2.2.3
    + Libglycin-gtk4 2.2.3
  * Fixed:
    + Require gufo-exif 0.5.3 which fixes parsing issues with non-Canon
    MakerNote entries. This can cause images not to be rotated according to
    the Orientation tag.
    + Image-rs/animation: Drop thread after the Image.done D-Bus method is
    called.
    + Image-rs: Prevent channel with animation frames from filling up, causing
    a effective memory leak.
    + Libglycin: Don't block main thead in `get_mime_types`.
  * Changed: Glycin: Canonicalize paths of "Exec" keys when loading configs.
- Update to version 2.2.2:
  * This release contains the following new component versions:
    + Glycin-core 4.0.2
    + Glycin 4.0.2
    + Glycin-builtin 4.0.2
    + Glycin-external 4.0.2
    + Libglycin 2.2.2
    + Libglycin-gtk4 2.2.2
  * Fixed: Set the unix socket sending the image data to the loader to
    non-blocking. Otherwise, small socket send buffer configurations might lead
    to infinite blocking.
- Update to version 2.2.1:
  + This release contains the following new component versions:
  - glycin-utils 5.0.1
  + Fixed: Don't mmap already write sealed memfds as shared. This
    is only supported since Linux 6.7
    <https://lkml.indiana.edu/2310.1/06395.html>.
- Update to version 2.2.0:
  + This release contains the following new component versions:
  - glycin-common 2.0.0
  - glycin-core 4.0.0
  - glycin-heif 2.2.0
  - glycin-image-rs 2.2.0
  - glycin-jxl 2.2.0
  - glycin-raw 2.2.0
  - glycin-svg 2.2.0
  - glycin-test 2.2.0
  - glycin-thumbnailer 2.2.0
  - glycin-utils 5.0.0
  - glycin 4.0.0
  - glycin-builtin 4.0.0
  - glycin-external 4.0.0
  - libglycin-gtk4-rebind 0.2.0
  - libglycin-gtk4-rebind-sys 0.2.0
  - libglycin-rebind 0.2.0
  - libglycin-rebind-sys 0.2.0
  - libglycin 2.2.0
  - libglycin-gtk4 2.2.0
  + Fixed:
  - glycin/sandbox: Fix compilation on 32 bit architectures
- Update to version 2.2.beta.1:
    ... changelog too long, skipping 165 lines ...
  + Changed: svg: Don't limit the size of elements in the SVG

==== libglycin-gtk4 ====
Version update (2.1.5 -> 2.2.6)

- Update to version 2.2.6:
  * This release contains the following new component versions
    + libglycin 2.2.6
    + libglycin-gtk4 2.2.6
  * Fixed: meson: Fix build configuration failing if either libglycin or
    libglycin-gtk4 option being enabled.
- Stop passing libglycin=true to meson setup in glycin-loaders.spec.inc
  following upstream changes yet again.
- Update to version 2.2.5:
  * This release contains the following new component versions:
    + Glycin-core 4.0.5
    + Glycin 4.0.5
    + Glycin-builtin 4.0.5
    + Glycin-external 4.0.5
    + Libglycin 2.2.5
    + Libglycin-gtk4 2.2.5
  * Fixed:
    + Require gufo-exif 0.5.5 to avoid reading exif values from incorrect
    positions in some images.
    + Libglycin: Don't panic when trying to lookup an infinite pixel density.
    Instead, don't return any pixel density.
    + Meson/thumbnailer: Ensure that libglycin is built before
    glycin-thumbnailer.
- Pass libglycin=true to meson setup in glycin-loaders.spec.inc following
  upstream changes.
- Update to version 2.2.4:
  * This release contains the following new component versions:
    + Glycin-core 4.0.4
    + Glycin-image-rs 2.2.4
    + Glycin 4.0.4
    + Glycin-builtin 4.0.4
    + Glycin-external 4.0.4
    + Libglycin 2.2.4
    + Libglycin-gtk4 2.2.4
  * Fixed:
    + Require gufo-exif 0.5.4 to avoid a panic in exif lookup for certain
    images.
    + Glycin: Longer magic byte strings in config identifiers now have a higher
    priority. This fixes cursors being sometimes identified as TGAs.
- Update to version 2.2.3:
  * This release contains the following new component versions:
    + Glycin-core 4.0.3
    + Glycin-image-rs 2.2.3
    + Glycin 4.0.3
    + Glycin-builtin 4.0.3
    + Glycin-external 4.0.3
    + Libglycin 2.2.3
    + Libglycin-gtk4 2.2.3
  * Fixed:
    + Require gufo-exif 0.5.3 which fixes parsing issues with non-Canon
    MakerNote entries. This can cause images not to be rotated according to
    the Orientation tag.
    + Image-rs/animation: Drop thread after the Image.done D-Bus method is
    called.
    + Image-rs: Prevent channel with animation frames from filling up, causing
    a effective memory leak.
    + Libglycin: Don't block main thead in `get_mime_types`.
  * Changed: Glycin: Canonicalize paths of "Exec" keys when loading configs.
- Update to version 2.2.2:
  * This release contains the following new component versions:
    + Glycin-core 4.0.2
    + Glycin 4.0.2
    + Glycin-builtin 4.0.2
    + Glycin-external 4.0.2
    + Libglycin 2.2.2
    + Libglycin-gtk4 2.2.2
  * Fixed: Set the unix socket sending the image data to the loader to
    non-blocking. Otherwise, small socket send buffer configurations might lead
    to infinite blocking.
- Update to version 2.2.1:
  + This release contains the following new component versions:
  - glycin-utils 5.0.1
  + Fixed: Don't mmap already write sealed memfds as shared. This
    is only supported since Linux 6.7
    <https://lkml.indiana.edu/2310.1/06395.html>.
- Update to version 2.2.0:
  + This release contains the following new component versions:
  - glycin-common 2.0.0
  - glycin-core 4.0.0
  - glycin-heif 2.2.0
  - glycin-image-rs 2.2.0
  - glycin-jxl 2.2.0
  - glycin-raw 2.2.0
  - glycin-svg 2.2.0
  - glycin-test 2.2.0
  - glycin-thumbnailer 2.2.0
  - glycin-utils 5.0.0
  - glycin 4.0.0
  - glycin-builtin 4.0.0
  - glycin-external 4.0.0
  - libglycin-gtk4-rebind 0.2.0
  - libglycin-gtk4-rebind-sys 0.2.0
  - libglycin-rebind 0.2.0
  - libglycin-rebind-sys 0.2.0
  - libglycin 2.2.0
  - libglycin-gtk4 2.2.0
  + Fixed:
  - glycin/sandbox: Fix compilation on 32 bit architectures
- Update to version 2.2.beta.1:
    ... changelog too long, skipping 165 lines ...
  + Changed: svg: Don't limit the size of elements in the SVG

==== libheif ====
Version update (1.23.6 -> 1.23.7)
Subpackages: gdk-pixbuf-loader-libheif libheif-aom libheif-dav1d libheif-ffmpeg libheif-jpeg libheif-openh264 libheif-openjpeg libheif-rav1e libheif-svtenc libheif1

- update to 1.23.7:
  * CVE-2026-XXXXX (GHSA-xwcv-cp39-m2w4) Out-of-bounds read in
    the OpenH264 decoder plugin. An AVC SPS that libheif's coded-
    size check could not parse was skipped and still passed to
    OpenH264, which accepts cropping offsets whose sum wraps
    around and returns plane pointers far outside of its frame
    buffer. An SPS that cannot be parsed is now an error, also in
    subset SPS NAL units. The VVC SPS check had the same pattern
    and fails closed as well. Introduced with the coded-size
    check of v1.23.5. (high)
  * CVE-2026-XXXXX (GHSA-jx54-6rm6-2cgj) The AV1 coded-size check
    of v1.23.5 could be bypassed with libaom through an OBU
    without a size field. libheif stopped scanning at that OBU,
    while libaom continued and decoded a later, larger sequence
    header and frame. The last OBU of a sample is now given an
    explicit size before the data is scanned and decoded, so that
    both see the same framing. (high)
  * CVE-2026-XXXXX (GHSA-fpr5-xpfr-vcq3) The AV1 coded-size check
    of v1.23.5 could be bypassed with libaom.
    `num_ticks_per_picture_minus_1` was read with a UVLC reader
    that stops after 20 leading zero bits, although AV1 allows
    31, and the error was ignored. The sequence header was then
    skipped, or scanned from the middle of the code where it
    could yield a small decoy size, and libaom allocated the
    real, much larger frame. The AV1 UVLC reader now follows the
    AV1 specification, and a sequence header that cannot be
    scanned completely is rejected. (high)
  * CVE-2026-XXXXX (GHSA-35mc-3887-rr37) Heap use-after-free when
    grid tiles are decoded in parallel. Several derived tiles
    (`iovl`, `iden` or `grid`) can share one coded input image.
    Their bit-depth queries read the decoder data of that input
    while another tile thread replaced it during decoding. A
    crafted file could crash the application or corrupt the heap
    with default options. The bit-depth queries now lock the
    decode mutex of the queried item. Only v1.23.6 is affected.
    (high)
  * CVE-2026-XXXXX (GHSA-hpg4-g2gc-pq42) Heap buffer overflow
    when padding an image to a size that is larger in one
    dimension and smaller in the other.
    `heif_image_extend_padding_to_size()` could be reached with
    such a size by re-encoding a sequence whose frames have
    different sizes with the x265 or x264 sequence encoder.
    Padding now refuses a size below the image or any of its
    planes, checks all planes before changing them, and the
    sequence encoders refuse a frame whose size differs from the
    first frame. (high)
  * CVE-2026-XXXXX (GHSA-9rpf-2x22-78m9)
    `heif_context_encode_thumbnail()` returned success without
    setting the output handle when the image already fits into
    the bounding box. Callers that released the handle, among
    them `heif-enc -t` and the C++ wrapper, freed an
    uninitialized or stale pointer (use-after-free, double free).
    The handle is now set to NULL in that case, as the API
    documentation says. (high)
  * CVE-2026-XXXXX (GHSA-48p4-gj45-w9v6) CPU exhaustion through
    derived images that decode a large image again and again and
    use only a few pixels of it, for example a grid of 1x1 tiles
    that are each a `clap` crop of an 8192x8192 overlay. A 2.6 kB
    file took 26 seconds to decode. Each decode now has a pixel
    budget of twice the size of the distinct images it uses (at
    least 2048x2048, at most `max_image_size_pixels`), single-
    tile decodes get their share of it, an exceeded security
    limit in a grid tile is an error also without strict
    decoding, and grid tiles outside of the image are not
    decoded. (high)
  * CVE-2026-XXXXX (GHSA-2g6j-vhr6-6wrj) CPU exhaustion through
    many coded pictures in one image item or sequence sample. The
    decoder decoded all of them, although only one image is
    returned: a 16 kB file with 1000 hidden HEVC pictures of
    4096x4096 took 14 seconds. More than eight coded pictures per
    decode are now refused. HEVC, AVC and VVC count picture
    starts, AV1 counts frame OBUs, and AVC data with embedded
    start codes is refused. (high)
  * CVE-2026-XXXXX (GHSA-7qm8-hj35-269r) CPU exhaustion through
    repeated transformations. An item could carry many
    associations of the same `irot`, `imir` or `clap` property,
    and `iden` chains multiplied them: a 28 kB file took 73
    seconds to decode. An item may now have at most one
    association of each of these properties, as HEIF requires,
    and at most 32 transformations are applied along a decode
    path. (high)
  * CVE-2026-XXXXX (GHSA-hhg3-fxg7-3gxw) CPU exhaustion while
    opening a file whose images have many `colr` associations.
    Reading the file regenerated and compared a colour profile
    property for every association. Reading and encoding now
    store colour profiles separately, so that opening a file does
    not create properties. (high)
  * CVE-2026-XXXXX (GHSA-73j7-gvm9-x8q6) CPU exhaustion in
    sequence decoding through samples that produce no output, for
    example when an edit list repeats a sample that the decoder
    does not display. One call of
    `heif_track_decode_next_image()` could run for minutes, also
    with `ignore_sequence_editlist`. The number of samples that
    are decoded without returning frames is now limited per
    codec, and `ignore_sequence_editlist` stops after the
    original samples. (high)
  * CVE-2026-XXXXX (GHSA-74mj-m37q-h3q9) Quadratic CPU time when
    opening a file with a `moov` box. The `stsc` entry of every
    chunk was looked up by a linear scan, so a file with many
    ... changelog too long, skipping 56 lines ...
    16-bit grayscale images with alpha

==== libimobiledevice ====
Version update (1.4.0+0git.20251010 -> 1.4.0+9git.20260610)

- Update to version 1.4.0+9git.20260610 (9 commits past the 1.4.0
  release, no SONAME change):
  * ostrace: fix a memory leak (upstream issue #1677)
  * afc: improve error handling; afcclient cd fix, start in
    /Documents with --documents, progress and echo fixes
  * endianness.h: default to little endian if __BYTE_ORDER is
    undefined; libsrp6a-sha512: fix environ handling for Apple
  * docs: CSS fix

==== libimobiledevice-glue ====
Version update (1.3.2+git0.20250604 -> 1.3.3+git0.20261005)

- Update to version 1.3.3+git0.20261005:
  * Update NEWS for release
  * Update soversion for release
  * utils: Correct ctype(3) usage
  * socket: Improve portability by replacing OS-specific macros
    with AC_CHECK_HEADERS
  * endianness.h: Default to little endian
  * Add atexit call to (empty) deinit function to prevent
    stripping off initializer code
  * Add FUNDING
  * [github-actions] Update build workflow to use windows-latest
  * socket: Use const void* instead of void* in signature of socket_send()

==== libjpeg-turbo ====
Version update (3.2.0 -> 3.2.1)
Subpackages: libjpeg8 libturbojpeg0

- update to 3.2.1:
  * Fixed a regression that broke Unix builds where
    position-independent code was disabled for static
    libraries. Workaround: set
    CMAKE_POSITION_INDEPENDENT_CODE or use a toolchain that
    enables PIC automatically.
  * Sped up RGB-to-baseline JPEG compression by 10-17% with
    the accurate integer DCT algorithm on RISC-V Vector
    (RVV) hardware, using strided segment load and
    multiply-accumulate intrinsics.
  * Hid symbols of the in-tree zlib and libspng
    implementations and renamed the zlib symbols, so static
    TurboJPEG API users do not expose or call them by
    accident.
  * Fixed an integer overflow and buffer overrun in
    tj3LoadImage12() and tj3LoadImage16() when a 32-bit
    build loads a packed-pixel image with more than 2^31
    components.
  * Fixed a division by zero (CVE-2026-75466) when loading
    a non-grayscale indexed-color PNG image with
    TJPF_UNKNOWN pixel format.
  * Fixed wrong chrominance from tj3DecompressToYUV*() for
    4:2:0, 4:1:0 and 2:4 images with the fast IDCT and 1/2
    scaling.
  * Fixed a buffer overrun and segfault when partially
    decompressing a crafted 4:2:0 image with merged
    upsampling, SIMD disabled and a crop that leaves 1-2
    samples per component plane.
  * Hardened the libjpeg API against 12-bit full-color
    decompression with one-pass quantization and RGB565
    conversion enabled.
  * Fixed jpeg*_skip_scanlines() with non-fancy upsampling:
    wrong scanline count, or skipped scanlines returned
    later.
  * Hardened the TurboJPEG API against an ignored fatal
    error from tj3DecompressHeader() followed by a retry
    with a valid image. This could report wrong dimensions
    and cause a too-small output buffer.
  * Made tj3DecompressHeader() always drop a previously
    extracted ICC profile, so tj3GetICCProfile() and
    tj3TransformBufSize() no longer see stale data.
  * Made tj3TransformBufSize() account for all extra
    markers copied to the destination: comments, JFIF
    thumbnails and Exif data.

==== libkcddb ====

- Drop the Qt 5 flavor

==== libkscreen6 ====
Version update (6.8.0 -> 6.8.2)
Subpackages: libKF6Screen8 libKF6ScreenDpms8 libkscreen6-plugin

- Update to 6.8.2
  * New bugfix release
  * For more details please see:
  * https://kde.org/announcements/plasma/6/6.8.2
- Changes since 6.8.1:
  * Update version for new release 6.8.2
- Update to 6.8.1:
  * New bugfix release
  * For more details see https://kde.org/announcements/plasma/6/6.8.1
- Changes since 6.8.0:
  * Update version for new release 6.8.1

==== libksysguard6 ====
Version update (6.8.0 -> 6.8.2)
Subpackages: ksysguardsystemstats6-data libKSysGuardSystemStats2 libksysguard6-imports libksysguard6-plugins

- Update to 6.8.2
  * New bugfix release
  * For more details please see:
  * https://kde.org/announcements/plasma/6/6.8.2
- Changes since 6.8.1:
  * Update version for new release 6.8.2
  * Only show 2000 data points in Line Chart applet (kde#527627)
- Drop patch:
  * 0001-Drop-org.kde.ksysguard.processlisthelper.applyschedu.patch
- Update to 6.8.1:
  * New bugfix release
  * For more details see https://kde.org/announcements/plasma/6/6.8.1
- Changes since 6.8.0:
  * Update version for new release 6.8.1

==== libmad ====
Version update (0.16.4 -> 0.16.5)

- Update to version 0.16.5:
  * New:
    + Add mad_version_get_string() as an ABI-stable alternative for getting the
    version string.
    + Add -DPAD_VERSION_STRING (disabled by default) to pad the global version
    string for improved ABI compatibility with 0.15.1b.
    + Miscellaneous stuff:
  - Add CONTRIBUTING.md and BUILDING.md for contribution guidelines and how
    to build the library, respectively.
  - Fix typos in README.
  * Changed:
    + Deprecated global version and build type strings. The latter is
    deprecated with no replacement, while mad_version_get_string() should be
    used in place of the former.
    + CMake 3.10+ is now required. This allows for supporting CMake 4.0+
    without warnings.
    + Disabled architecture-specific optimizations for 32-bit ARM for now.
    These optimizations have unfortunately bitrotted and can cause a
    segfault.
    + Reorganize the source tree to be cleaner.
    + Remove nonexistent -DMADD{16}_ASM options from build documentation. These
    options have been long gone and haven't worked since we dropped GCC 4.4
    support.
    + Static and shared library versions of libmad are now built at the same
    time by default. You can also build only a static version with
  - DBUILD_SHARED_LIBS=OFF.
  * Fixed:
    + Fixed anonymous struct for C++ compatibility.
    + Fix some clang-tidy warnings.
    + Fix a Clang warning.
    + minimad: Fix format under 32-bit.
    + Fixed missing MAD_DEPRECATED declarations for MSVC.
    + Fixed x86 CPU detection.
    + Fixed build on ARM v7.
- Drop libmad-x86.patch: Applied upstream.
- Add 9dd96b40c5caf76fd1c6ef9dcc80ba330eb57a79.patch: Really fix build on arm
- Delete the now build static lib.

==== libmaxminddb ====
Version update (1.13.3 -> 1.14.1)

- update to 1.14.1
  * Fixed a -Wsign-compare warning in MMDB_open() that broke builds with
  - Werror on platforms where ssize_t is 32 bits, such as i686.
- version 1.14.0
  * Bounded the resources that MMDB_get_entry_data_list() spends decoding a
    single entry. A crafted database could nest data-section pointers to shared
    targets so that decoding one entry cost exponential time and memory, or point
    many times at one large value so that a caller copying the result materialized
    far more data than the file holds. The decoder now follows the Reader Resource
    Limits section of the MaxMind DB specification. Each call is limited to 65,536
    values and 2 MiB of string and bytes payload, in addition to the existing
    recursive-decoder depth limit of 512. See the MMDB_get_entry_data_list()
    documentation for details.
  - Exceeding a limit returns the new MMDB_DECODER_LIMIT_ERROR status. A
    full-list failure leaves the output set to NULL.
  - MMDB_get_value(), MMDB_vget_value(), and MMDB_aget_value() now return
  - MMDB_DECODER_LIMIT_ERROR instead of MMDB_INVALID_DATA_ERROR when they
    skip a subtree past the depth limit.
  - MMDB_open() returns MMDB_INVALID_METADATA_ERROR when metadata processing
    exceeds a decoder limit.
  - The limits can be raised when building the library with
  - DMAXIMUM_DATA_STRUCTURE_DEPTH, -DMAXIMUM_DATA_STRUCTURE_VALUES, and
  - DMAXIMUM_DATA_STRUCTURE_BYTES.
  * Fixed an out-of-bounds read in MMDB_lookup_sockaddr() when callers passed a
    sockaddr with an unsupported address family. The function now rejects any
    family other than AF_INET and AF_INET6 with
    MMDB_INVALID_NETWORK_ADDRESS_ERROR.
  * Fixed metadata parsing for files that end immediately after the
    \xAB\xCD\xEFMaxMind.com marker. Such files are now rejected as invalid
    metadata instead of allowing a zero-length metadata section to reach the
    decoder.
  * Fixed search-tree validation for records that point into the 16-byte separator
    before the data section. These records are now rejected as corrupt instead of
    being exposed as apparent data entries with underflowed offsets.
  * MMDB_read_node() now returns MMDB_CORRUPT_SEARCH_TREE_ERROR instead of
    MMDB_SUCCESS with MMDB_RECORD_TYPE_INVALID record types when a node's
    child record is invalid.

==== libnfs ====

- Add libnfs-CVE-2026-108985.patch: ZDR: enforce the maxsize bound
  (bsc#1284986, CVE-2026-108985).

==== libnice ====
Version update (0.1.23 -> 0.1.24)
Subpackages: gstreamer-libnice libnice10

- Update version dependencies according to meson.build.
- Update to version 0.1.24:
  + API: nice_agent_attach_recv_ex() to retrieve extra message data
    in recv callback
  + API: nice_message_extra_data_get_tos() to enable access to
    IP_TOS/IPV6_TCLASS IP header field of incoming packets
  + API: stun_usage_bind_run_compat() to allow specifying
    compatibility mode when sending a binding request
  + Nicesrc: Attach GstNetControlMessageMeta containing the TOS
    header field to buffers
  + Ensure NICE_CANDIDATE_MAX_TURN_SERVERS is obeyed
  + Ensure nice_agent_get_local_credentials() returns FALSE on
    error
  + Fix random crashes
  + Fix potential heap buffer overflow in UDP-TURN over TCP
  + Fix compilation on FreeBSD

==== libnotify ====
Version update (0.8.8 -> 0.8.9)
Subpackages: libnotify-tools libnotify4 typelib-1_0-Notify-0_7

- Update to version 0.8.9:
  * This is a maintenance release, mostly with bug fixes around notify-send
    behaviors and portal notifications, together with more tests coverage for
    hints edge cases, and some library cleanups:
    + Notify-send:
  - Start action ID from 1 as docs states
  - Fix the activation token FD validity check
  - Don't write the notification ID and action to stdin
  - Don't cache the hint conversion error
    + Notify: Free the application name and icon on uninit
    + Notification:
  - Do not send the default action as a button in portal notifications
  - Read the icon contents using g_file_load_contents()
  - Use g_clear_handle_id() for the portal timeout
    + Tests/notify-send:
  - Add tests for the default action button
  - Verify behavior on invalid hints
    + Launch-context: Don't omit parameter names in vfunc implementation
    + Bugs fixed:
  - portal: "default" action adds additional button
  - Omitted parameter names in a vfunc implementation

==== libopenmpt ====
Version update (0.8.9 -> 0.8.10)

- Update to version 0.8.10
  * [Sec] Possible heap out-of-bounds write when loading SymMOD
    files containing WAV IMA ADPCM samples (r25623, r25645).
    See also https://github.com/OpenMPT/openmpt/security/advisories/GHSA-fxf7-wc37-p2cx
  * [Sec] Possible heap out-of-bounds read when loading custom
    tunings from MPTM files (r25609, r25615).

==== libostree ====
Version update (2026.4 -> 2026.6)
Subpackages: libostree-1-1

- Update to version 2026.6:
  * sign: Compare OpenSSL sign results against 1, test more spki cases
  * core: Reject duplicate names in dirtree objects
  * static-delta: Parse superblock files as untrusted
  * prepare-root: Allow /run/ostree to exist already
  * fetcher-uri: Keep https scheme when dropping default port
  * rofiles-fuse: Check hardlinks for O_TRUNC opens and removexattr
  * sign-spki: Pass GBytes when looking up revoked keys
  * static-delta: Avoid mapping BSPATCH output on FUSE
- Update to version 2026.5:
  * static-delta: validate bspatch payload offset and length
  * min-free-space: Use min(3%, 1GB) as default
  * docs: drop parameters that are no longer in the signatures
  * ostree-repo: Change argument name in header to match implementation
  * generator: Skip boot.mount if /etc/fstab has a /boot entry by
  * static-delta: validate on-disk checksum names when listing deltas
  * static-delta: bound mode and xattr dict offsets
  * bin/prune: Keep recent unreferenced commits
  * prepare-root: Tolerate an existing /sysroot.tmp in the static path
  * prepare-root: Guard against short digest in load_variant
  * lib: Validate commit tree checksum length on read
  * fetcher-curl: Bound header value copies to buffer length
  * ostree-gpg-verify-result: Strictly match subkeys if suffixed with !
  * otcore: Treat only 1 from EVP_DigestVerify as valid
  * lib: Parse content object header as untrusted
  * man: Document signed-delta and sign-verify behaviour
  * core: Throw an error for short ostree.sizes entries
  * static-delta: Avoid copying bspatch output
  * static-delta: Simplify mapped content allocation
  * Two security-related fixes reported

==== libp11 ====
Version update (0.4.17 -> 0.4.21)

- update to 0.4.21:
  * Added PKCS#11 provider support for `openssl genpkey`
  * Added the PKCS11_generate_key_ext() API
  * Added the PKCS11_CTX_set_pkey_callback() API
  * Removed incorrect `fips=yes` properties from provider
    algorithms
  * Isolated ENGINE EVP_PKEY methods from unrelated OpenSSL keys
  * Fixed ENGINE EVP_PKEY method races and lifetime issues
  * Fixed public-key association for generated key pairs with
    duplicate CKA_ID values
  * Added all-zero shared-secret checks for X25519 and X448
  * Fixed a provider EC public-point NULL dereference with
    affected OpenSSL 3.x versions
  * Fixed building with OpenSSL 1.0.2
  * Improved Git build and RSA-OAEP documentation
  * Added PKCS#11 3.2 interface discovery and updated the bundled
    header to version 3.2
  * Added PKCS#11 provider support for ML-KEM-512, ML-KEM-768 and
    ML-KEM-1024 key generation, encapsulation and decapsulation
  * Added the PKCS11_evp_pkey_decapsulate() API
  * Added provider signature AlgorithmIdentifier support,
    including RSA-PSS parameters and correct default salt length
    handling
  * Fixed RSA-PSS salt length parsing and spurious OpenSSL errors
  * Fixed session-pool races and deadlocks during concurrent key
    generation and cryptographic operations
  * Fixed key-cache and OpenSSL 1.x RSA object use-after-free
    bugs
  * Fixed provider EC parameter lifetime handling and resource
    leaks during EC, RSA, EdDSA and XDH operations and context
    cleanup
  * Added native KEYMGMT, SIGNATURE and ASYM_CIPHER operations to
    the PKCS#11 provider, enabling OpenSSL 4.x support and
    improving RSA interoperability
  * Added support for ML-DSA, SLH-DSA and FALCON key generation,
    signing and verification
  * Added PQC key generation examples and provider tests
  * Added PKCS#11 provider support for ECDH, X25519 and X448 key
    exchange, including X25519 and X448 key generation
  * Improved Ed25519 and Ed448 public-key resolution with
    certificate fallback
  * Fixed use-after-free crashes after enumerating additional
    PKCS#11 keys
  * Fixed a potential out-of-bounds write while parsing PKCS#11
    URI attributes

==== libplasma6 ====
Version update (6.8.0 -> 6.8.2)
Subpackages: libPlasma8 libplasma6-components libplasma6-desktoptheme

- Update to 6.8.2
  * New bugfix release
  * For more details please see:
  * https://kde.org/announcements/plasma/6/6.8.2
- Changes since 6.8.1:
  * Update version for new release 6.8.2
  * PlasmaCore.ToolTipArea: don't lower label opacity when there is no heading present
- Update to 6.8.1:
  * New bugfix release
  * For more details see https://kde.org/announcements/plasma/6/6.8.1
- Changes since 6.8.0:
  * Update version for new release 6.8.1

==== libqaccessibilityclient-qt6 ====
Subpackages: libqaccessibilityclient-qt6-0

- Drop the Qt 5 flavor

==== librsvg ====
Version update (2.62.4 -> 2.63.4)
Subpackages: librsvg-2-2 typelib-1_0-Rsvg-2_0

- Update to version 2.63.4:
  * Handle EXIF orientation in images, and handle the image-orientation
    property. Note that the only values supported for this property are
    'from-image' (the default) and 'none'. Note that this will change the
    rendering of SVG documents which assume the images with EXIF orientation
    data are not auto-oriented correctly. In this case, please add the
    following attribute to the corresponding image elemnts:
    style="image-orientation: none;"
- Update to version 2.63.3:
  * Librsvg-rebind crate version 0.3.0:
  * Let the image-rs crate enforce its default limit of 512 MB for allocated
    memory for each decoded image. The `--unlimited` flag in rsvg-convert (or
    the corresponding flags in the C and Rust APIs) now control whether the
    limits are enforced or not.
  * Fix panic when a feConvolveMatrix declaration has an invalid size.
  * When fuzzing, don't decode raster images from data: URIs to avoid sinking
    fuzz time in the image-rs crate.
- Update version dependencies according to meson.build.
- Update to version 2.63.2 (RUSTSEC-2026-0305 / CVE-2026-96889):
  + librsvg crate version 2.63.2
  + librsvg-rebind crate version 0.3.0
  + Fix use-after-free when there are duplicate XML entities in
  nested Xinclude documents.
- Changes from version 2.63.1:
  + This version is to be considered non-working; the chacha20
    0.10.1 crate was yanked from crates.io.
- Update to version 2.63.0:
  + librsvg crate version 2.63.0
  + librsvg-rebind crate version 0.3.0
  + Limit the depth of files that reference other files, via XML
    XInclude, inter-document references, and CSS includes. The Rust
    API has a new
    ImplementationLimit::MaximumFileNestingDepthExceeded error
    variant to surface this to the loading functions.
  + Fix blurry embeded SVG images by rasterizing them at device
    resolution.
  + Remove loading limits from image-rs.  This means that raster
    images, when embedded in SVG documents, have no limits for
    their size or memory consumption. The idea, for now, is that
    security-sensitive applications that use librsvg should do
    their own sandboxing if they want to impose memory limits.
  + Raise the maximum nesting depth of layers for glibc systems.
    The maximum on glibc is now 500 nested layers; the maximum for
    musl systems remains at 50 layers. This is due to the amount of
    stack space required, since musl has a reduced default stack
    compared to glibc. Please see the comments in that bug if you
    would like to help with the musl situation.
- Disable bug1100_fuzz_layer_nesting_depth test and enable
  svg1_1_text_text_03_b_svg test again.
- Update to version 2.62.91:
  + librsvg crate version 2.63.0-beta.1
  + librsvg-rebind crate version 0.3.0
  + Update test suite for change in how Pango renders
    underline/overline.
  + Update Rust dependencies.
  + Update C dependencies in the CI.
- No longer disable librsvg --test reference.
- Update to version 2.62.90:
  + librsvg crate version 2.63.0-beta.0
  + Limit the depth of files that reference other files, via XML
    XInclude, inter-document references, and CSS includes. The Rust
    API has a new
    ImplementationLimit::MaximumFileNestingDepthExceeded error
    variant to surface this to the loading functions.
  + Fix blurry embeded SVG images by rasterizing them at device
    resolution.
  + Fix build when gobject-introspection is enabled but gdk-pixbuf
    is disabled.
  + Document the crate's feature flags.
  + Update the Rust dependencies.

==== libshumate ====
Version update (1.6.3 -> 1.7.0)
Subpackages: libshumate-1_0-1 typelib-1_0-Shumate-1_0

- Update version dependencies according to meson.build.
- Update to version 1.7.0:
  + No changes since 1.7.0.
- Update to version 1.7.rc:
  + No changes since 1.7.beta.
- Update to version 1.7.beta:
  + Deselect markers before removing from layer
  + Stop using G_GNUC_CONST in _get_type functions
  + gi-docgen: List more dependencies
- Update to version 1.7.alpha:
  + Added new APIs to refresh and get refresh notifications for map
    sources
  + Added missing translation text domains

==== libsndfile ====

- Fix integer overflow vulnerability in mat4_read_header()
  (bsc#1282671, CVE-2026-88372):
  libsndfile-CVE-2026-88372.patch

==== libsolv ====
Version update (0.7.40 -> 0.7.41)
Subpackages: libsolv-tools-base libsolv1 ruby-solv

- improved speed of repo_add_solv, should now be more that 20%
  faster in many cases
- repo_add_solv hardening to catch corrupt solv files earlier
- hardened apkv3 code [bsc#1284786] [bsc#1284995]
  [CVE-2026-104622] [CVE-2026-104624]
- fixed repo_conda xml parsing [bsc#1284786] [CVE-2026-104621]
- support pre-sizing of id hashes (pool_presize_idhashes,
  pool_get_idcounts solv_read_idcounts)
- new POOL_FLAG_NOWHATPROVIDESSHRINK pool flag to disable
  shrinking if speed matters more then memory usage
- bump version to 0.7.41

==== libsoup ====
Version update (3.6.6 -> 3.8.1)
Subpackages: libsoup-3_0-0 typelib-1_0-Soup-3_0

- Update to version 3.8.1:
  * Limit the size of intermediate (redirect and auth) response bodies
  * Http2: Fix stalls when the reader is slower than the session timeout, and
    propagate connection errors to response body streams
  * Zstd: Support multiple concatenated frames, which previously truncated
    responses
  * Cookie-jar: Fix a `SoupConnection` leak when using an HTTP proxy
  * Logger: Fix undefined behavior found by UBSan
  * Build: Require brotli >= 1.1.0 for brotli support
  * Fix building the tests on Windows and update README.msvc
  * Updated translations.
- Add explicit pkgconfig(libbrotlienc) BuildRequires: meson setup checks for it
- Update to version 3.8.0:
  + Harden authentication:
  - Check `nonce` validity in Digest authentication
    (CVE-2026-3099)
  - Do not send cached proxy credentials after a redirect to a
    different origin
  + Harden multipart handling:
  - Fix an out-of-bounds read when less data than the boundary is
    buffered (CVE-2026-66337)
  - Limit the length of part headers
  - Fix a leak of the current part's headers
  + Prevent request smuggling in the server:
  - Close the connection after an early response to `Expect:
    100-continue`
  - Reject `Host` headers containing URI delimiters
  - Require chunk-size to begin with a hex digit
  + Http2:
  - Fix skipping over multiple buffered chunks of a response body
  - Fix a `GCancellable` leak [Michael Catanzaro]
  + Fix the build on platforms without `dlfcn.h`
  + Updated translations.
- Skip test-suite on non-64-bit architectures
  (glgo#GNOME/libsoup#556).
- Update to version 3.7.3:
  + Add `soup_message_set_compression_dictionary_id()` and
    `soup_message_get_compression_dictionary_id()` to send the
    `Dictionary-ID` header alongside `Available-Dictionary`
  + Add `soup_websocket_extension_process_incoming_message_with_limit()`
    so extensions can bound how much they decompress
  + Harden WebSocket handling:
  - Bound decompressed message size during inflation
    (CVE-2026-15709)
  - Reject oversized control frames (CVE-2026-15711)
  - Cap incoming frame payloads, message reassembly, and outgoing
    frames at what the underlying buffer can hold
  - Bound outgoing permessage-deflate buffer growth
  - Cap the number of queued unsolicited pongs
  - Emit `SoupWebsocketConnection::pong` with a `GBytes`, as
    declared
  - Store accepted WebSocket extensions per message rather than
    per handler
  + Harden authentication and caching:
  - Do not send `Proxy-Authorization` through an established
    CONNECT tunnel (CVE-2026-66339)
  - Scope cached proxy credentials to the proxy they came from
    (CVE-2026-12547)
  - Reject caching authenticated responses in shared caches
    (CVE-2026-15713)
  + Tighten HTTP parsing and validation:
  - Reject CRLF injection in the HTTP method (CVE-2026-3633)
  - Fix `Range` parsing overflows and coalescing cost, and
    validate `Content-Range` when parsing it
  - Keep duplicate `Content-Length` headers when they are
    identical
  - Fix an out-of-bounds read in case of an excessively long
    multipart boundary
  - Do not treat base64 data URI content as a NUL-terminated
    string
  + http2:
  - Never send more body bytes than nghttp2 requested
    (CVE-2026-85534)
  - Keep the message alive across `io_run_until()` in
    `run_until_read()`
  - Do not assume that `GOAWAY` opaque data is NUL-terminated
  + server: Report the resource length in 416 responses
  + session: Do not send a message cancelled while being queued
  + cookie: Annotate constants' values
- Drop libsoup-CVE-2026-85534.patch, - Drop
  libsoup-CVE-2026-15711.patch, libsoup-CVE-2026-12547.patch,
  libsoup-CVE-2026-15712.patch, libsoup-CVE-2026-15714.patch,
  libsoup-CVE-2026-66339.patch: fixed upstream.
- Update to version 3.7.2:
  + Add support for compression dictionaries:
  - Support the dcb and dcz encodings
  - Add new `soup_message_set_compression_dictionary_hash()`,
    `SoupMessage::request-compression-dictionary`, and
    `SoupCompressionDictionaryRequest`
  + Remove color codes from http2 debug logs
  + Add missing autoptr defines for `SoupMessageBody`
  + http2:
  - Fix content-sniffer running while message is paused
  - Consume buffered response body before cancel
  - Fix requeuing failed messages when connection is not reusable
  + soup-body-input-stream: Limit buffer read to the received
    content
- Update to version 3.7.1:
  Use canonical signal names.
    ... changelog too long, skipping 42 lines ...
  + libsoup-revert-dep-meson-0.62-shim02-6b34bc58.patch

==== libstorage-ng ====
Version update (4.5.363 -> 4.5.368)
Subpackages: libstorage-ng-lang libstorage-ng-ruby libstorage-ng1

- Translated using Weblate (Russian) (bsc#1149754)
- 4.5.368
- merge gh#openSUSE/libstorage-ng#1102
- Do not call the logger during the garbage collection in the Ruby
  bindings
- Remove unnecessary cast
- Make the logger-gc test independent of the garbage collector timing
- Do not sweep lazily in the logger-gc test
- 4.5.367
- Translated using Weblate (Swedish) (bsc#1149754)
- 4.5.366
- Translated using Weblate (Greek) (bsc#1149754)
- 4.5.365
- Translated using Weblate (Indonesian) (bsc#1149754)
- 4.5.364

==== libtirpc ====
Version update (1.3.7 -> 1.3.8)
Subpackages: libtirpc-netconfig libtirpc3

- Update to version 1.3.8 (bsc#1285882, CVE-2026-85977,
    bsc#1285881, CVE-2026-85231):
  * Security hardening against malicious-data memory exhaustion:
    cap decoded pmap/rpcb XDR list lengths to 1024 nodes
    (CVE-2026-85977) and RPCSEC_GSS wrapped payload decoding
    at 16 MB (CVE-2026-85231, authenticated remote DoS).
  * Fix off-by-one allocation when building the GSS caller name.
  * Export authdes_getucred and rpc_gss_getcred under a versioned
    symbol node (backward compatible, soname stays libtirpc.so.3).
- Spec cleanup: drop obsolete Group tags.

==== libunistring ====
Version update (1.4.2 -> 1.5)

- update to 1.5:
  * The data tables and algorithms have been updated to Unicode
    version 18.0.0

==== libupnp ====
Version update (22.1.8 -> 22.1.10)
Subpackages: libixml22 libupnp22

- Update to release 22.1.10
  * Reject CR and LF in the service type of a SOAP action.
- Update to release 22.1.9
  * Reject an HTTP response whose status code is not three digits.
  * Fix denial of service of the miniserver worker threads.
  * Fix a heap over-read when sending a GENA event.
  * Fix a path traversal in the web server.
  * Fix a corrupted attribute list when
    ixmlElement_setAttributeNode() or
    ixmlElement_setAttributeNodeNS() was called with an attribute
    the element already owned and the lookup did not return that
    same attribute.
  * Send "Content-Range: bytes */<length>" in the 416 response of
    the web server to a Range request that cannot be satisfied.

==== libusb-compat ====

- Update to 0.1.9:
  * Fix memory leaks in USB bus and device cleanup: release device
    references in the exit destructor, free per-device config data,
    and plug leaks in error paths.
  * Modernize autoconf macros and detect the libusb-1.0 SONAME via
    objdump instead of ldd, which is safe for cross-compilation.
  * testlibusb: enlarge the description buffer, silencing
  - Wformat-truncation warnings.
  * Release tarball now ships a pre-generated configure script, so no
    bootstrap step is needed at build time.
- Drop Group tags, add explicit gcc and make BuildRequires, and
  version the libusb-1.0 BuildRequires floor (>= 0.9.1) to match
  upstream's configure check.

==== libusbmuxd ====
Version update (2.1.0 -> 2.1.1)

- update to 2.1.1:
  * Changes:
  * tools: Fix potential issue with select() in case the
    network fd is higher than the usbmux fd
  * Switch to better initializer strategy
  * Fix compilation on MSVC
  * iproxy: Make sure to print correct socket error messages
  * inetcat: Make sure to report correct error messages

==== libvirt ====
Version update (12.8.0 -> 12.9.0)
Subpackages: libvirt-client libvirt-daemon-common libvirt-daemon-config-network libvirt-daemon-driver-network libvirt-daemon-driver-nodedev libvirt-daemon-driver-qemu libvirt-daemon-driver-secret libvirt-daemon-driver-storage libvirt-daemon-driver-storage-core libvirt-daemon-driver-storage-disk libvirt-daemon-driver-storage-iscsi libvirt-daemon-driver-storage-iscsi-direct libvirt-daemon-driver-storage-logical libvirt-daemon-driver-storage-mpath libvirt-daemon-driver-storage-rbd libvirt-daemon-driver-storage-scsi libvirt-daemon-lock libvirt-daemon-log libvirt-daemon-plugin-lockd libvirt-daemon-qemu libvirt-libs

- Update to libvirt 12.9.0
  - Many incremental improvements and bug fixes, see
    https://libvirt.org/news.html#v12-9-0-2026-11-02
- qemu: Emit UNDEFINED event when undefining source after migration
  bsc#1242788
- spec: Unconditionally enable building ESX driver
  bsc#1284983

==== libwacom ====
Version update (2.19.1 -> 2.20.0)
Subpackages: libwacom-data libwacom9

- Update to 2.20.0:
  * New devices: Lenovo Yoga 9 2-in-1 14IPH11, IdeaPad 5
    14AHP9 and ThinkBook 14s Yoga (ISDv4 526b), Huion HS610
    (new USB PID), XP-Pen Deco SE, Gaomon S620, Ugee M808
  * tools: stay quiet when /dev/input is not present
- Bump meson floor to >= 0.58.0 and add glib >= 2.68 floor,
  matching the minimums declared upstream
- Spec cleanup: drop obsolete Group tags, canonical
  spec-cleaner style

==== libzypp ====
Version update (17.38.16 -> 17.38.17)

- Fix hanging eventloop in case setupHandle fails.
  This may happen e.g. due to a failing curlSetupOption call as
  result of a miss configured option value.
- zypp.conf: Add download.min_download_speed_time (60 sec) (fixes
  [#751])
- version 17.38.17 (35)

==== lightdm ====
Subpackages: liblightdm-gobject-1-0 lightdm-bash-completion

- Add lightdm-wayland-session-tty.patch from upstream PR#483
- Fix greeter not starting with SELinux enforcing (gh#canonical/lightdm#480)
  (AI-assisted)

==== linux-glibc-devel ====
Version update (7.2 -> 7.3)

- Update to kernel headers 7.3

==== live555 ====
Version update (2026.10.17 -> 2026.10.29)
Subpackages: libBasicUsageEnvironment2 libUsageEnvironment3 libgroupsock33

- Update to version 2026.10.29:
  * Mostly cosmetic changes, and replaced more calls to "sprintf()" with calls
    to "snprintf()".
- Update to version 2026.10.24:
  * In "RTPInterface::handleRead()", if we're reading from a TCP socket, call
    "getpeername()" to set our "fromAddress", because the "recvfrom()" call
    won't set it.
  * Added a check to "AC3AudioStreamParser" for a buffer overflow that probably
    won't happen, but to be safe...
  * Began replacing some calls to "sprintf()" (that were perfectly safe, but
    caused some compilers to emit warning messages) with calls to "snprintf()".
- Update to version 2026.10.23:
  * The bug fix in version 2026.10.21 was not complete. This should fix it for
    real.
- Bump lmdmaj define to 122 following upstream changes.
- Fix typos in the description
- Update to version 2026.10.22:
  * Fixed a bug that had accidentally been introduced in version 2026.07.23: We
    now correctly parse the "RTP/SAVP" and "RTP/SAVP/TCP" profile strings.
  * When a RTSP server is asked to stream RTP/RTSP-over-TCP, we don't record
    the TCP socket number to use when we're processing the "SETUP" command.
    Instead, we have to wait until we're processing the "PLAY" command, because
    the "PLAY" command might be using a different TCP connection (and thus a
    different socket number).
- Bump lmdmaj define to 121 following upstream changes.
- Update to version 2026.10.21:
  * Fixed a bug that could possibly allow a malicious client to cause a RTSP
    server to crash when streaming from an AC-3 audio file.

==== llvm23 ====
Version update (23.1.3 -> 23.1.4)

- Update to version 23.1.4.
  * This release contains bug-fixes for the LLVM 23.1.0 release.
    This release is API and ABI compatible with 23.1.0.
- Build all targets on ppc64le.
- Build SPIRV target also on ARMv6/7 and s390x.
- Cleanup parts specific to ppc and ppc64, because we don't build
  them anymore.
- Increase memory for compile jobs to avoid OOM.
- Build compiler-rt builtins for wasm32-wasip1 as part of the
  runtimes build (LLVM_BUILTIN_TARGETS) and ship them in clang23,
  so that clang can link wasm32-wasip1 binaries with a WASI sysroot.

==== localsearch ====
Version update (3.11.2 -> 3.12.0)

- Update version dependencies according to meson.build.
- Update to version 3.12.0:
  + Sandbox fixes for musl libc
  + Fix "localsearch index --remove" applying the configuration
  + Memory leak fixes
  + Add "localsearch list" alias to "localsearch search"
  + Updated translations.

==== loupe ====
Version update (50.0 -> 51.1)

- Update to version 51.1:
  * Fixed:
    + Print: Some images with physical dimensions attached could be printed in
    the wrong size and not properly positioned on the page.
    + Print: The PDF that's sent to the printer did report the wrong physical
    dimensions. This could potentially cause issues with some printers.
- Update version dependencies according to meson.build.
- Update to version 51.0:
  + Updated translations.
- Update to version 51.rc:
  + After editing a file and pressing cancel, ask for saving the
    image instead of waiting for closing the global window.
  + After editing a file, unsaved changes were still reported after
    using the "Save as…" feature.
- Update to version 51.beta:
  + Added: Show ICC profile description or generated CICP
    description if applicable.
- Update to version 51.alpha:
  + Added: Show creator, copyright information, camera lens, and
    used software in image metadata.
  + Fixed:
  - Don't accumulate delays during animations.
  - Don't keep showing saving overlay after error.

==== lsscsi ====
Version update (0.32 -> 0.33)

- Update to 0.33 (upstream moved to github.com/doug-gilbert/lsscsi):
  * New --json (-j) and --js-file options for JSON output
  * New helpers: ls_name_value script and ls_name_value_rd tool
    with man pages, plus an lsscsi_json man page
  * New --sysroot option matching lsblk/lsmem/lscpu
  * nvme-generic devices (e.g. /dev/ng0n1) now shown with
  - -generic; single-line NVMe output re-aligned
  * Fix multipath WWID inconsistencies; prefer sysfs wwid
  * Transport output fixes for FC, FCoE, SAS and SBP
  * Add cmake build support alongside autotools
  * Buffer bounds-checking hardening
- Switch Source to the upstream git tag archive and run
  ./autogen.sh at build time

==== lvm2 ====
Version update (2.03.38 -> 2.03.43)
Subpackages: liblvm2cmd2_03

- lvm2 on LUKS: failed to activate VG after unencrypted device appears during boot (bsc#1288220)
  * Add upstream patch
    + bug-1288220_pvscan-preserve-preferred-device-name-when-importing.patch
- Update to version 2.03.43:
  * Wipe stale signatures before formatting a VDO data LV on thin
    storage; allow 4K stripe size smaller than page size.
  * dmeventd fixes: raid repair after partial replacement, snapshot
    extension backoff, snapshot threshold and unmount handling.
  * pvmove in shared VGs with lvmlockd, cluster lock lifecycle for
    the pvmove LV, lock probes for holder availability.
  * lvmpersist hardening: reject non-block devices, validate options,
    require PR tools, clean up keys on interruption.
  * Add lvmconfig --edit to set or remove an lvm.conf setting and
    backup/file-limit handling for config edits.
  * Remove cmirrord and clustered mirror log daemon support; drop the
    legacy vgimportclone.sh script.
  * Increase the default value of global/lvmlockd_lock_retries from
    3 to 6.
  * Respect /run/mdadm/creating-<md_dev_name> in 69-dm-lvm.rules.
  * Many dmeventd, lvmlockd, vgmerge/vgcreate/vgimportclone lock-leak
    and raid/pvmove polling fixes.
- Sync lvm.conf with upstream 2.03.43 defaults (adds
  allocation/vdo_use_kernel_format and backup/config_file_backup_limit
  options).
- Package the new dmvdostats symlink and man page in device-mapper.
- Drop patches adopted upstream or obsolete:
  * cmirrord_remove_date_time_from_compilation.patch (cmirrord
    removed upstream)
  * bug-1214071-blkdeactivate_calls_wrong_mountpoint.patch (upstream
    uses /usr/bin/mountpoint now)
- Rebase bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-rules.patch
  onto the reworked MD section, keeping the new creating-guard.
- Rework bug-1184124-link-tests-as-PIE.patch to pass -pie in the two
  generic test link recipes, and
  bug-1037309_Makefile-skip-compliling-daemons-lvmlockd-directory.patch
  to its configure hunk (the Makefile.in part is upstream now).
- Sonames unchanged (libdevmapper.so.1.03, liblvm2cmd.so.2.03);
  device-mapper package version moves to 2.03.43_1.02.217.
- Spec cleanup: drop Group tags, https sources, pkgconfig deps.

==== lvm2-device-mapper ====
Version update (2.03.38_1.02.212 -> 2.03.43_1.02.217)
Subpackages: device-mapper libdevmapper-event1_03 libdevmapper1_03

- lvm2 on LUKS: failed to activate VG after unencrypted device appears during boot (bsc#1288220)
  * Add upstream patch
    + bug-1288220_pvscan-preserve-preferred-device-name-when-importing.patch
- Update to version 2.03.43:
  * Wipe stale signatures before formatting a VDO data LV on thin
    storage; allow 4K stripe size smaller than page size.
  * dmeventd fixes: raid repair after partial replacement, snapshot
    extension backoff, snapshot threshold and unmount handling.
  * pvmove in shared VGs with lvmlockd, cluster lock lifecycle for
    the pvmove LV, lock probes for holder availability.
  * lvmpersist hardening: reject non-block devices, validate options,
    require PR tools, clean up keys on interruption.
  * Add lvmconfig --edit to set or remove an lvm.conf setting and
    backup/file-limit handling for config edits.
  * Remove cmirrord and clustered mirror log daemon support; drop the
    legacy vgimportclone.sh script.
  * Increase the default value of global/lvmlockd_lock_retries from
    3 to 6.
  * Respect /run/mdadm/creating-<md_dev_name> in 69-dm-lvm.rules.
  * Many dmeventd, lvmlockd, vgmerge/vgcreate/vgimportclone lock-leak
    and raid/pvmove polling fixes.
- Sync lvm.conf with upstream 2.03.43 defaults (adds
  allocation/vdo_use_kernel_format and backup/config_file_backup_limit
  options).
- Package the new dmvdostats symlink and man page in device-mapper.
- Drop patches adopted upstream or obsolete:
  * cmirrord_remove_date_time_from_compilation.patch (cmirrord
    removed upstream)
  * bug-1214071-blkdeactivate_calls_wrong_mountpoint.patch (upstream
    uses /usr/bin/mountpoint now)
- Rebase bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-rules.patch
  onto the reworked MD section, keeping the new creating-guard.
- Rework bug-1184124-link-tests-as-PIE.patch to pass -pie in the two
  generic test link recipes, and
  bug-1037309_Makefile-skip-compliling-daemons-lvmlockd-directory.patch
  to its configure hunk (the Makefile.in part is upstream now).
- Sonames unchanged (libdevmapper.so.1.03, liblvm2cmd.so.2.03);
  device-mapper package version moves to 2.03.43_1.02.217.
- Spec cleanup: drop Group tags, https sources, pkgconfig deps.

==== makedumpfile ====

- support kernel 7.1 -- add:
  * makedumpfile-Fix-wrong-exclusion-of-compound-tail-pages-on-.patch

==== mariadb ====
Version update (12.3.2 -> 13.0.2)
Subpackages: libmariadbd19 mariadb-client mariadb-errormessages

- Add remove-git-dependency.patch
  * Avoid git dependency by using patch instead of git apply
- Add fix-duckdb-sccache-launcher.patch
  * Forward CMAKE_[C|CXX]_COMPILER_ARG1/LAUNCHER into the bundled
    DuckDB ExternalProject_Add() configure step, fixing a build
    failure when sccache is wired in as the compiler
- Update to 13.0.2 (major release, evolution of 12.3):
    https://mariadb.com/docs/release-notes/community-server/13.0/13.0.2
    https://mariadb.com/docs/release-notes/community-server/changelogs/13.0/13.0.2
    https://mariadb.com/docs/release-notes/community-server/13.0/mariadb-13.0-changes-and-improvements
  * Single-table UPDATE ... RETURNING with OLD_VALUE() support,
    atomic CREATE OR REPLACE TABLE, reversed executable comments.
  * New innodb_log_archive for continuous WAL archiving and
    point-in-time recovery; mariadb-backup cannot read that format
    yet. binlog_row_event_max_size default raised to 64k.
  * New QB_NAME() optimizer hint with implicit block names, optimizer
    trace now includes used statistics, PERFORMANCE_SCHEMA digest
    moved to XXH3_128, init_rpl_role visible in SHOW VARIABLES.
  * INFORMATION_SCHEMA SYSTEM_VARIABLES gains deprecation columns;
    STATISTICS/COLUMNS show engine-specific create options. Configurable
    audit plugin log timestamp format, REF CURSOR and RECORD usable in
    package routines.
  * Crash and correctness fixes from 12.3.3 (included): SELECT INTO
    row-type and SYS_REFCURSOR crashes, GIS ST_* crashes, InnoDB
    recovery races, replication event application fixes.
  * Fixes the following security vulnerabilities:
    13.0.2: CVE-2026-107814 (bsc#1285002)
    CVE-2026-107815 (bsc#1285005)
    CVE-2026-107816 (bsc#1285006)
    CVE-2026-107817 (bsc#1285007)
    CVE-2026-107818 (bsc#1285033)
    CVE-2026-107821 (bsc#1284999)
    CVE-2026-107822 (bsc#1284998)
    CVE-2026-107823 (bsc#1284997)
    CVE-2026-102523 (bsc#1286682)
    CVE-2026-97380 (bsc#1286010)
    CVE-2026-92262 (bsc#1286011)
    CVE-2026-86047 (bsc#1285936)
    CVE-2026-85985 (bsc#1285935)
    CVE-2026-85748 (bsc#1285932)
    CVE-2026-85746 (bsc#1285931)
    CVE-2026-85745 (bsc#1285928)
    CVE-2026-61081 (bsc#1286696)
    CVE-2026-60585 (bsc#1286697)
    CVE-2026-60331 (bsc#1286698)
    CVE-2026-60747 (bsc#1286700)
    CVE-2026-47023 (bsc#1286701)
    CVE-2026-60184 (bsc#1286702)
- Drop mariadb-fix-testsuite-openssl3.2.3.patch (fixed upstream).
- Refresh fix-pamdir.patch and 0001-MDEV-38874-Make-tests-pass-
  after-2030.patch for the new sources; drop Group tags, use
  %ldconfig_scriptlets, add git-core BuildRequires for the DuckDB
  engine patch step.
- Skip main.mysql_client_test and main.mysql_client_test_comp: their
  new MDEV-25817 subtest expects host blocking after clean-EOF PROXY
  handshakes, which the server closes normally without counting
  connect errors, so the block never triggers.
- Use pkgconfig() BuildRequires for bzip2, krb5 (GSSAPI),
  libarchive, libedit, libevent, libxml2, lz4, lzo, ncurses, pam,
  pcre2, readline, unixODBC, xz and zlib, and pkgconfig() Requires
  for libmariadb in libmariadbd-devel; the systemd instance
  specifier in the socket sed stays unbraced on purpose.
- CVE-2026-107814 (boo#1285002): move the mysql service account
  home from the datadir to /nonexistent, matching upstream; migrate
  existing users via usermod in %pre.

==== milou6 ====
Version update (6.8.0 -> 6.8.2)

- Update to 6.8.2
  * New bugfix release
  * For more details please see:
  * https://kde.org/announcements/plasma/6/6.8.2
- Changes since 6.8.1:
  * Update version for new release 6.8.2
- Update to 6.8.1:
  * New bugfix release
  * For more details see https://kde.org/announcements/plasma/6/6.8.1
- Changes since 6.8.0:
  * Update version for new release 6.8.1

==== mokutil ====
Version update (0.7.2 -> 0.7.3)

- Update to 0.7.3
  + show help if no args or --help even on unsupported system
  + remove unused int_to_b64()
  + on --test-key, return non-zero if test key is not enrolled
  + introduce --is-sb-enabled parameter
  + return zero in case --test-key is enrolled
  + Remove traditional des and md5 passwords
  + man: fix typo "|- X" -> "| -X"
  + PasswordCrypt: Fix an ABI issue
  + Fix bash completion (bsc#1286920)
- Move the bash completion script to mokutil-bash-completion

==== mutter ====
Version update (50.5 -> 51.1)

- Update to version 51.1:
  * Fix drag&drop between Wayland and Xwayland clients
  * Update window's monitor after configure
  * Use logical normal orientation when resetting panel rotation
  * Preserve MRU order when windows become sticky
  * Allow changing selections with the same serial
  * Fix applying `workspaces-only-on-primary` after monitor changes
  * Allow cursor implementations to fall back to Xcursor
  * Enforce throttling of frame clock updates while power saving
  * Misc. bug fixes and cleanups
- Rebase mutter-disable-cvt-s390x.patch.
- Update version dependencies according to meson.build.
- Update to version 51.0:
  + Fix giving some X11 clients a wrong empty input mask
  + Return correct xdg-shell error for illegal size requests
  + Improve backlight detection
  + Fix dma-buf screencasting with primary GPU FBO path
  + Support custom acceleration profiles
  + Add builtin key controller to handle binding pools
  + Fix background blur in offscreen and clone paints
  + Fix invisible cursor when magnified
  + Fix assigning some X11 clients a wrong initial size
  + Fix partial unmaximization
  + Make WindowConfig maximize flag setters public
  + Fixed crashes
  + Plugged leaks
  + Misc. bug fixes and cleanups
  + Updated translations.
- Update to version 51.rc:
  + Hook up stylus eraser button configuration
  + Fix using hardware cursor for SVG cursors
  + Do not require EDID to generate device color profile
  + Fix auto-rotate on phones without tablet mode switch
  + Decouple timelines from expected presentation times
  + Add background effect policy
  + Prevent modifier release from stopping key repeat
  + Align drag icon coordinates to pixel grid
  + Handle cross GPU buffer scanout
  + Fix multiple monitors being reported as primary
  + Fix desaturated SDR content in HDR mode
  + Add primary GPU rendering path using FBOs
  + Remove clutter_get_default_backend()
  + Fix offscreen effect glitches on resource scale changes
  + Fix hang on external monitor hotplug
  + Throttle timelines that don't produce a frame every cycle
  + Consider key alias for binding pool bindings
  + Allow overriding client initial config
  + Fix direct scanout handling for captures without dma-buf
  + Make binding pool key activation case-insensitive
  + Support Night Light on hardware without GAMMA_LUT
  + Fix listing all supported fallback resolutions
  + Make software cursor overlay visibility per-view
  + Fixed crashes
  + Plugged leaks
  + Misc. bug fixes and cleanups
  + Updated translations.
- Drop pkgconfig(glycin-2): dependency no longer required.
- Update to version 51.beta:
  + Allow to get last input device from backend
  + Send sprite object with grab-op-begin signal
  + Hook up disable-while-typing timeout setting
  + Hide cursor while input capture is active
  + Add ext-background-effect-v1 blur support
  + Fix blurred rendering with non-pixel-aligned monitors
  + Use staging xdg_session_management_v1 protocol
  + Allow for button scrolling on mice
  + Allow external cursor implementations
  + Do not add unsuported fallback monitor modes
  + Improve frame scheduling
  + Add dedicated "input panel" group
  + Fix reapplying shader snippet after resize/scale operations
  + Fill in mastering display metadata for HDR output
  + Add transition-removed signal on ClutterActor
  + Fix invalid redraw clips on rotated monitors
  + Avoid using cairo in public screenshot API
  + Split experimental features into separate settings
  + Use MetaWindowConfig to process window state changes
  + Allow global shortcut inhibitors to inhibit a11y shortcuts
  + Fixed crashes
  + Misc. bug fixes and cleanups
  + Updated translations.
- Update to version 51.alpha:
  + Allow input capture portal to integrate with clipboard
  + Ignore repeated events for double click counting
  + Do not unfullscreen fullscreened window on unmaximize
  + Add format-aware window_actor_paint_to_content() variant
  + Make DND with tablets work across surfaces
  + Ensure preferred_scale event is sent to clients
  + Remove support for legacy NVIDIA drivers
  + De-prioritize focusing desktop windows
  + Minimize stage paints and buffer copies in screencasts
  + Remove CoglProgram/Shader API
  + Fix erroneous stack order changes on workspace switches
  + Allow creating Devkit monitors from the command line
  + Fix triggering OSK for text_input_v3 version 1 clients
  + Fixed crashes
  + Misc. bug fixes and cleanups
  + Updated translations.
- Bump api_major define to 51 following upstream changes.
- Disable mutter-disable-cvt-s390x.patch, needes rebase.
- Stop passing egl_device=true and wayland_eglstream=true to meson
  setup, no longer needed nor recognized.

==== myrlyn ====
Version update (1.0.0 -> 1.1.0)

- Update to version 1.1.0:
  * Updated screenshots
  * Version bump to 1.1.0
  * Fixed OBS home project URLs
  * Updated screenshot
  * No red versions in versions details view
  * Color-coding in versions details view
  * Unified text color handling
  * Unify special fonts handling
  * Moved dark theme detection from YQIconPool to MyrlynApp
  * Use the new icon name in icons.qrc (Closes #156)
  * No crazy all-caps spelling for vendors
  * Fixed missing pkg versions view update for "dup" and "up"
  * Versions details view: Use a grid (table) instead of prose text
  * White, not yellow foreground color in dark theme (Closes #154)
  * Fixed icon name (Closes #152)
  * Updated screenshots
  * Larger pattern icons (22x22 instead of 16x16)
  * Updated screenshots with well-defined list icon size
  * Updated screenshots with well-defined list icon size
  * Force icon size for list items (#145)
  * Pre-release version bump to 1.0.99
  * Icon size fine tuning
  * Updated screenshots
  * Updated screenshots
  * Markdown layout
  * Markdown layout
  * Markdown layout
  * New screenshots
  * Keep the emojis
  * Keep the emojis
  * Obsolete icons
  * Removed old YaST icons
  * Imported new icons by @byDMA
  * Use official API to detect dark theme if available
  * Detect Xfce theme if running on Xfce
  * More debug logging
  * Consistent naming
  * Removed obsolete icons
  * Fix download icons for certain themes (#145)
  * Removed unused (since 20+ years!) icon
  * Use dedicated icons for dark widget themes
  * More contrast for download done icon for dark themes
  * Yellow faces for sad/sick emoji for dark themes
  * Silence Qt SVG renderer
  * Added the new icons to YQIconPool
  * YQIconPool migration from QPixmap to QIcon
  * Load dark theme built-in icons if available
  * Added icons for dark widget themes
  * Updated screenshots with new logo
  * Updated logo on project home page
  * Added new contributors
  * Revamped Myrlyn logo by @Arthurium-On-Linux and @byDMA
  * New Myrlyn logo (Fixes #138)
  * Auto-detect dark or light widget theme
  * Dropped obsolete icons
  * Dropped obsolete icons
  * Fixed icon name in .ui preview
  * More neatly aligned buttons in repo filter view
  * First "Protect All" / "Un-Protect All" buttons in repo filter view
  * Added secondary filters "Installed", "Not Installed"
  * Renamed "Installation Summary" secondary filter to "Status"
  * Typo
  * Make sure the required gettext tools are installed
  * Translations: No msgctx, merge duplicate msgids
  * Don't translate an empty msgid with gettext auto-generated gibberish
  * Add reboot notification if /run/reboot-needed exists
  * Set app icon in window title (Closes #140)
  * Exit if X11 connection lost regardless of Qt log level
  * Prevent endless loop if X server crashed / terminated
  * Highlight package version changes
  * Removed 15.6 OBS targets that may or may not work
  * New home project 'home:/huha:'
  * Reset patterns after commit (Closes #130); thanks to @bjornmp
  * Keep current pattern and scroll position when switching back to patterns view
  * Typos
  * Removed unneeded .png extension for icon in .desktop files (Closes #129)
  * Fixed typo (thanks to @sakves)
  * Skip additional warning for dist-upgraded / pkg-updated packages
  * Safeguard against idiotic behavior (issue #128)
  * Typo
  * Log date extension only when appropriate
  * Reduce log verbosity
  * Handle cut-off zypp history files correctly
  * Replaced outdated project header
  * Use /run/user/0, not /run/user/1000 in myrlyn-sudo
  * Make usage of theme icons configurable
  * Simplified myrlyn-sudo a little bit
  * Use the user theme in myrlyn-sudo (inspired by @cbravo)
  * Clarify official vs. private project status
  * Coding style
  * Fixed screenshot target URLs
  * Added new screenshots to home page
  * Updated screenshots

==== nano ====
Version update (9.2 -> 9.3)

- Update to version 9.3:
  * On the mini bar, an overlong filename gets properly clipped.
  * The keypad operator keys produce their inscribed characters.
  * CVE-2026-6390 (boo#1272394): not affected, fixed upstream
    in 9.0 and the hardening is present in 9.3.

==== nautilus ====
Version update (50.4 -> 51.1)
Subpackages: gnome-shell-search-provider-nautilus libnautilus-extension4

- Update to version 51.1:
  * Bugfixes:
    + Fix reusing tabs when opening locations from shell
    + Fix unwritable file indicator
    + Focus Replace button by default in conflict dialog
    + Disable markup syntax on property extension rows
    + Fix leak in audio/video extension
    + Fix setting custom icons in properties
    + Assure thumbnails in properties are fitted into a square
    + Fix properties window not showing checker background
    + Fix various leaks and errors without reports
    + Don't abort on invalid boolean metadata
    + Respect GTK4 file chooser's folder sorting default settings
    + Fix properties dialog sometimes opening too small
  * Cleanups:
    + Require GTK 4.24
    + Prevent unnecessary relinking on every build caused by Blueprint files
  * Updated translations.
- Update version dependencies according to meson.build.
- Update version dependencies according to meson.build.
- Temp disable test-suite until we figure out the intermitten test
  fail.
- Update to version 51.0.1:
  + Bugfix: Fix metainfo release description syntax.
- Update to version 51.0:
  + Bugfix: Fix a possible crash when changing app defaults after
    closing the app chooser
  + Cleanups: Adjust to renamed sushi devel name
  + Updated translations.
- Update to version 51.rc:
  + Enhancements:
  - Add tests for image, files-view, properties
  - Add shortcut to focus file chooser filename entry
  - Delay clearing of the view for smoother navigation
  - Add rename, trash and folder opening functionality to
    previewer
  - Use type-to-search pattern in app-chooser
  - Mark network address entry invalid on the a11y layer when
    appropriate
  - Announce feedback text to screen readers in filename entries
  + Bugfixes:
  - Fix tab overview behavior with single tab
  - Fix empty list state in app-chooser
  - Only show apps in one section in app-chooser
  - Show parent folder row when properties dialog is detached
  - Fix memory trimming on window closure
  - Correctly fix non-keypad shortcuts in menus
  - Close app when only property windows are left
  - Restore focus and selection if a file gets removed
  + Cleanups:
  - Drop view-related context menu entries
  - Add and use recursive directory iterator helper
  - Attempt using any sushi version
  + Updated translations.
- Enable tests during build again.
- Update to version 51.beta:
  + Enhancements:
  - Use AdwTabOverview in narrow mode
  - Open locations from other apps in new tabs
  - Add an empty document menu entry in case of empty templates
    directory
  - Ignore most duplicate app entries in the app chooser
  - Add gobject-linter CI job
  - Move search focus to higher relevance result
  - Use AdwComboRow for open action preference
  - Hide redundant 'Open Parent Folder' properties row
  - Use dedicated symbolic for Projects bookmark icon
  - Adjust sidebar width limit
  - Don't duplicate loading locations
  + Bugfixes:
  - Show non-keypad shortcuts in menus
  - Handle timed dialogs being destroyed before their timeout
  - Put g_set_date_time behind a guard
  - Fix memory leak in action_create_links_in_place
  - Correctly position related apps in the app chooser
  + Cleanups:
  - Apply gobject-linter fixes
  - Clean up NautilusWindowSlot internals
  + Updated translations.
- Update to version 51.alpha:
  + Enhancements:
  - Show selected items count badge while dragging multiple files
  - Combine '.' and '..' name errors in validators
  - Hide parent folder for mount root children
  - Don't show placeholder trashed info for multiple files or the
    Trash in properties
  - Add a tooltip to properties detach window button
  - Show either an unreadable or read-only emblem
  - Show symbolic link emblem before read-only/unreadable
  - Adjust non-indexed search description in info popover
  - Advertise notification categories for file and mount/unmount
    operations
  - Slightly enhance view reloading performance
  - Add more tests for bookmarks list, icon-info, image widget,
    file creation, and thumbnailing
  + Bugfixes:
  - Show the correct starred status and normal features of
    properties in Recents
  - Don't unselect when right clicking the view's background
    ... changelog too long, skipping 25 lines ...
- Add libgxdp submodule and add as source.

==== ncurses ====
Version update (6.6.20260926 -> 6.6.20261017)
Subpackages: libncurses6 ncurses-utils terminfo terminfo-base terminfo-iterm terminfo-screen

- Make patch FORTIFY_SOURCE_3-fix.patch optional means only for
  glibc < 2.36 and also simply disable FORTIFYing for specific
  variable "string" (boo#1285901)
- Add ncurses patch 20261010
  + modify test/test_mouse.c to demonstrate mouse_get(), mouse_test() and
    mouse_mask().

==== nghttp2 ====
Version update (1.70.0 -> 1.71.0)

- Update to 1.71.0:
  * lib: add length check for CONTINUATION frames
  * lib: disallow HEADERS and PUSH_PROMISE in CONNECT streams
  * lib: fix priority update handling and update window upfront
  * lib: handle too large window size when consuming data
  * lib: fix signed integer overflow in
    nghttp2_session_get_stream_local_window_size and detect size_t
    overflow in nghttp2_nv_array_copy
  * lib: better map hasher and simplified map insertion
  * nghttpx: client TLS certificate validation based on RFC 9525
    (CertLookupTree rewrite) and refactored Router
  * nghttpx: remove server push support
  * nghttpx: fix GSO disabled on QUIC connections and check QUIC
    version
  * Add option to limit the maximum outbound queue size
- The library soname is unchanged at 14

==== nghttp3 ====
Version update (1.18.0 -> 1.19.0)

- Update to 1.19.0:
  * Extend minimum unsent bytes in anticipation of QMux
  * Clamp glitch rate-limiter burst and check priority
    field size, applying buffer limit early
  * Fix map key removal on table resize failure, improve
    map hasher and simplify insertion
  * Fix balloc alignment
  * Document NGHTTP3_ERR_INVALID_ARGUMENT for oversized
    header block submissions
  * Clean up QPACK opcode branching
  * Fix fuzzer ASAN failure
  * Extend test coverage for trailers in CONNECT streams
- The library soname is unchanged at 9

==== ngtcp2 ====
Version update (1.25.0 -> 1.26.0)
Subpackages: libngtcp2-16 libngtcp2_crypto_gnutls8 libngtcp2_crypto_ossl0

- Update to 1.26.0:
  * New API: ngtcp2_conn_tx_strmq_push_if_not and an
    extend_max_data callback
  * Receiving STOP_SENDING no longer closes the stream; a
    STREAM_LIMIT error is returned on STREAMS_BLOCKED
    violations
  * STREAM_DATA_BLOCKED and DATA_BLOCKED are now sent only
    when data is actually blocked
  * CUBIC congestion control fixes: CWND increment, undo
    state reset on confirmed loss, slow-start pacing gain
  * Hardened connection ID handling, path validation and
    client migration, plus 0RTT and token handling fixes
  * 32-bit platform fixes and a fixed heap overrun on
    targets with 4-byte aligned malloc
- Rebase curl-impersonate.patch and
  ngtcp2-boringssl-shared.patch for the new sources
- Spec cleanup: use pkgconfig() interdependencies between the
  - devel subpackages and tag the carried patches

==== nvidia-open-driver-G06-signed ====
Version update (580.178.04_k7.2.11_1 -> 580.196.07_k7.3.1_1)

- update CUDA and non-CUDA variants to 580.196.07 (boo#1286887)
- supersedes linux-7.0.patch
- added CVEs for security release 580.178.04 ((bsc#1270255)

==== nvidia-open-driver-G07-signed ====
Version update (595.104.02_k7.2.11_1 -> 595.112.07_k7.3.1_1)
Subpackages: nvidia-open-driver-G07-signed-kmp-64kb nvidia-open-driver-G07-signed-kmp-default

- update non-CUDA variant to 595.112.07 (boo#1286763)

==== nvidia-open-driver-G07-signed-cuda ====
Version update (615.71.09_k7.2.11_1 -> 615.71.09_k7.3.1_1)
Subpackages: nvidia-open-driver-G07-signed-cuda-kmp-64kb nvidia-open-driver-G07-signed-cuda-kmp-default

- update non-CUDA variant to 595.112.07 (boo#1286763)

==== nvidia-settings ====
Version update (580.159.03 -> 580.196.07)

- update to version 580.196.07 (boo#1286887)
- update to version 580.178.04 (boo#1271603)

==== ocean-sound-theme6 ====
Version update (6.8.0 -> 6.8.2)

- Update to 6.8.2
  * New bugfix release
  * For more details please see:
  * https://kde.org/announcements/plasma/6/6.8.2
- Changes since 6.8.1:
  * Update version for new release 6.8.2
- Update to 6.8.1:
  * New bugfix release
  * For more details see https://kde.org/announcements/plasma/6/6.8.1
- Changes since 6.8.0:
  * Update version for new release 6.8.1

==== openSUSE-release ====
Version update (20261020 -> 20261105)
Subpackages: openSUSE-release-appliance-custom openSUSE-release-dvd

- automatically generated by openSUSE-release-tools/pkglistgen

==== openal-soft ====
Version update (1.24.3~179 -> 1.25.2~0)
Subpackages: libopenal1 openal-soft-data

- Update to version 1.25.2~0:
  * Library codebase moved to C++20
  * Added fourth-order ambisonics support and CAF file support
    to the Wave Writer backend
  * Added capture support and device added/removed events to
    the SDL3 backend; 7.1.4 output autodetection with CoreAudio
  * Implemented 3D processing for the Distortion, Chorus,
    Flanger, Pitch Shifter and Frequency Shifter effects
  * New stereo-encoding option for Tetraphonic Surround Matrix
    Encoding; default Super Stereo width changed to 0.46
  * Fixed the OpenSL and JACK backends, WASAPI and CoreAudio
    capture, the OSS v4 backend build and PipeWire duplicate
    device names
  * Fixed STL hardening assertions in the reverb effect and
    the polyphase resampler, and a crash with older PipeWire
    headers
- Tighten build requirements to the upstream minimums:
  cmake >= 3.13, pkgconfig(libpipewire-0.3) >= 0.3.23
- Drop efx-creative.h from the devel file list: upstream no
  longer installs it (dropped from TARGET_PUBLIC_HEADERS)
- Spec cleanup via spec-cleaner (drop Group tags, pkgconfig-style
  Conflicts)

==== openexr ====
Version update (3.5.2 -> 3.5.3)
Subpackages: libIex-3_5-34 libIlmThread-3_5-34 libOpenEXR-3_5-34 libOpenEXRCore-3_5-34

- Update to version 3.5.3:
  * Add support for Python 3.15
  * Several diagnostic/correctness fixes across the utility tools
    (exrmetrics, exrmultipart, exrcheck) and core decompression
    paths (courtesy of @ssoj13/Alex Khal)
  * Address several long-standing build errors and test failures
    on i686 (32-bit linux) and s390x (big-endian) hosts.
  * Fix build issues on macOS < 10.15
  * Fix build issues on powerpc
  * Fix for absolute paths for libm in OpenEXRTargets.cmake
  * Fix for running on Windows 7 involving CreateFile2

==== orca ====
Version update (50.3 -> 51.1)

- Update to version 51.1:
  * Web:
    + Fix several bugs related to grouping objects on the same visual line.
    + Improve presentation of tables/grids where selection does not follow
    focus.
    + Fix presentation of contenteditables newly-focused via native navigation.
    + Prefer pending focus event when recovering from destruction of the
    current object.
    + Fall back on text for childless ARIA combo boxes with no valuetext value.
    + Fix presentation of headings with explicit names and empty children.
    + Fix Where Am I sometimes triggering mode changes.
    + Fix some substrings being skipped over during forward word navigation.
    + Ignore caret-moved events from ignored, but exposed children of input
    elements.
  * General:
    + Fix multiple bugs related to text-selection.
    + Fix Say All starting from the incorrect location in terminals.
    + Fix presentation of repeated symbols separated by zero-width no-break
    spaces.
    + Clear stale braille selection indicators when the caret moves.
    + Fix a couple of bugs related to profiles in the preferences UI.
    + Add support for the GPaste3 D-Bus interface.
    + Fix bug causing object navigator object click to fail.
    + Fix several "chattiness" issues.
  * Updated translations.
- Update version dependencies according to meson.build.

==== pam_kwallet6 ====
Version update (6.8.0 -> 6.8.2)
Subpackages: pam_kwallet6-common

- Update to 6.8.2
  * New bugfix release
  * For more details please see:
  * https://kde.org/announcements/plasma/6/6.8.2
- Changes since 6.8.1:
  * Update version for new release 6.8.2
- Update to 6.8.1:
  * New bugfix release
  * For more details see https://kde.org/announcements/plasma/6/6.8.1
- Changes since 6.8.0:
  * Update version for new release 6.8.1

==== pam_mount ====
Version update (2.22 -> 2.23)
Subpackages: libcryptmount0

- Update to release 2.23
  * Resolve build failures from new toolchains/modes

==== pangomm ====
Version update (2.56.2 -> 2.58.0)

- Update to version 2.58.0:
  + Add enums FontColor, Width, RenderComponent.
  + FontDescription: Add Add set/get_color().
  + Attributes: Add create_attr_width().
  + FontDescription: Add set/get_width().
  + Layout: Add add_components_to_cairo_context().
  + Renderer: Add set/get_components().
  + Build: Require pango >= 1.58.0.

==== pangomm1_4 ====

- Update URL to new home.

==== parted ====
Subpackages: libparted-fs-resize0 libparted2

- Drop Obsoletes: libparted0 from libparted2. The libparted.so.0
  and libparted.so.2 file sets are disjoint, so the generations
  are co-installable as the shared library packaging policy
  intends; the obsoletes only forced removal of the older
  generation, and also drew the obsolete-not-provided warning.
- baselibs.conf: run /sbin/ldconfig in %post and %postun of the
  generated libparted2 and libparted-fs-resize0 -32bit packages;
  they previously carried no ldconfig scriptlets at all.
- Drop the Group tags and the BuildRoot tag (ignored by rpm).
- Convert BuildRequires: pkg-config to pkgconfig, and drop the
  %doc marker from the info files (spec-cleaner conversions).

==== patterns-base ====
Subpackages: patterns-base-apparmor patterns-base-base patterns-base-basesystem patterns-base-basic_desktop patterns-base-console patterns-base-enhanced_base patterns-base-minimal_base patterns-base-selinux patterns-base-sw_management patterns-base-x11 patterns-base-x11_enhanced

- Regenerate pattern-definition-32bit.txt from the current spec
  (pre_checkin.sh), as a follow-up to SR 1392459: the file had
  not been regenerated for several spec generations, so the
  32-bit pattern definitions no longer matched the patterns:
  drop entries whose packages left the patterns (yast2-apparmor,
  systemd-sysvinit, nscd, dmraid, ifplugd, setserial, providers,
  the system-user-*/system-group-* helpers, terminfo-iterm/
  - screen, dbus-1-glib, dbus-1-x11, tigervnc and the YaST
  control-centre packages), follow the renames (terminfo-base,
  coreutils-systemd, opensuse-welcome-launcher) and the moves
  between patterns (mailx, zypper, udev-configure-printer), and
  add the entries added to the patterns since (lvm2, wtmpdb,
  procps, fwupd, blog-plymouth, supportutils, systemd-coredump,
  cockpit-packages, myrlyn)
- Extend the pre_checkin.sh skip list with kdump,
  kernel_livepatching, immutable_base and hardware: the spec
  creates no 32-bit marker files for them ("These packages
  don't generate a 32bit pattern"), so the generator must not
  emit sections for them either; this also keeps future
  regenerations free of the truncated rich-dependency lines
  the generator produces for those patterns
- x11_enhanced pattern: on openSUSE, drop the hard Requires on
  pattern() = x11. x11_enhanced is session plumbing, not a
  server, and the default openSUSE session is Wayland (X
  applications run via Xwayland); the x11 pattern stays the
  opt-in X session bundle and itself Recommends x11_enhanced,
  so selecting X still pulls the enhanced plumbing in. The
  non-openSUSE (SLE / SL Micro) branch keeps the hard
  requirement unchanged
- Modernise the core patterns:
  * base: drop the Suggests on openssl-1_1: the package was
    dropped from Factory, and the comment above it still claimed
    1.1 was the default openssl, two major versions out of date
  * console: drop the Suggests on cnetworkmanager: the
    Python-2-era NetworkManager CLI no longer exists in Factory
  * console: suggest plocate instead of mlocate: mlocate was
    dropped from Factory and plocate is its designated successor
    (it Provides and Obsoletes mlocate); no pattern named
    plocate before
  * enhanced_base: drop the Suggests on kerneloops: the package
    is gone from Factory and the crash submission service it
    reported to is defunct
  * x11_enhanced: drop the Suggests on
    xorg-x11-driver-video-radeonhd and
    xorg-x11-driver-video-unichrome: both drivers were removed
    from Factory years ago
  * enhanced_base: recommend iw and wireless-regdb instead of
    wireless-tools: wireless-tools is the stalled 30.pre9
    pre-release driving the deprecated Wireless Extensions API
    and iw is its nl80211 successor; wireless-regdb was not
    pulled in by any installing pattern before, so default
    installs ran on the kernel's built-in world regulatory
    domain
  * enhanced_base: use the current package names
    update-bootloader and kmod instead of the compat aliases
    perl-Bootloader and kmod-compat: the alias packages no
    longer exist and only resolve via the Provides of their
    successors, so the lines would silently rot if those compat
    Provides were ever dropped
  * enhanced_base: drop the Recommends on klogd on openSUSE:
    journald captures the kernel messages, and the pattern
    already goes for the journal on Tumbleweed (boo#1143144)
  * enhanced_base: drop the Recommends on deltarpm: Tumbleweed
    repositories publish no deltainfo, so the repository
    infrastructure deltarpm serves no longer exists there
  * enhanced_base: drop the Recommends on net-snmp: a full SNMP
    stack does not belong in every default install
  * enhanced_base: drop the Recommends on mpt-status: it is the
    status tool for the LSI 1030, a 2002-era SCSI RAID chip
  * enhanced_base: drop the Recommends on gpart: the 1999-era
    lost-partition guessing tool
  * enhanced_base: drop the Recommends on zisofs-tools: tools
    for the zisofs compressed-ISO extension
  * enhanced_base: drop the Recommends on procmail: the
    sendmail-era local delivery agent, upstream dormant since
    2001
  * pattern-definition-32bit.txt: mirror the enhanced_base
    changes for the enhanced_base-32bit pattern
  * enhanced_base: correct the comment above the openSUSE-only
    block: it claimed the block lists packages missing from
    SLE-15, but the block is guarded by is_opensuse, so SLE of
    any version does not get these packages from this pattern
- Stop pulling YaST into default Tumbleweed installations:
  * enhanced_base: drop the Recommends on pattern() = yast2_basis
  * x11_enhanced: drop the Recommends on pattern() = x11_yast,
    pattern() = yast2_desktop, yast2-control-center-gnome and
    yast2-network
  * apparmor: drop the Recommends on yast2-apparmor
  Drop YaST from the pattern recommendations. The YaST patterns
  and packages stay in the repository for anyone who has them or
  wants them; new installations simply come without YaST.
  Completes code-o-o#leap/features/173 for Tumbleweed defaults.

==== patterns-desktop ====
Subpackages: patterns-desktop-books patterns-desktop-imaging patterns-desktop-mobile patterns-desktop-multimedia

- books: drop the Recommends on opensuse-manuals_en and
  opensuse-startup_en-pdf and the Suggests on opensuse-manuals_de,
  opensuse-manuals_hu, opensuse-manuals_ru, opensuse-startup_de-pdf
  and opensuse-startup_ru-pdf. The opensuse-manuals source no longer
  builds any binary into the Tumbleweed repo, so the lines were
  silently inert.
- books: drop the Suggests on gcc46-info (the GCC 4.6 info pages
  are long gone; gcc-info remains), kiwi-doc, nfs-doc, php-doc,
  python-doc, python-doc-pdf, python3-doc-pdf, texlive-doc and
  yast2-devel-doc. None of these names resolves to a binary, a
  Provides or an Obsoletes in the current repository; the kiwi
  documentation moved online and the texlive-doc meta package was
  removed (per-collection *-doc packages remain).
- books: rename apache2-doc to apache2-manual and selinux-doc to
  selinux-policy-doc. The documentation ships under the new names;
  the old ones survive only as compat Provides/Obsoletes.
- imaging: drop the Recommends on gimp-help and the Suggests on
  gimp-ufraw and ufraw. GIMP 3 no longer ships a help subpackage or
  the ufraw plugin, and ufraw itself is unmaintained upstream with
  its pattern role gone with the plugin.
- mobile: drop the Suggests on irda (IrDA support was removed from
  the distribution) and rename smbios-utils-python to
  python3-smbios-utils, the current package name.
- multimedia: drop the Suggests on vdr and xawtv; both packages
  were dropped from the distribution.
- technical_writing: drop the Recommends on docbook-xml-website
  and susedoc (both dropped from the distribution) and the Suggests
  on texlive-doc; rename mxml to libmxml1 and saxon to saxon10,
  the current package names; drop sablot, an XSLT processor dormant
  upstream for two decades whose role is covered by saxon10 and
  libxslt; remove the duplicated texlive-omega and texlive-xetex
  Suggests.
- Stop pulling YaST into default Tumbleweed installations: drop
  the Recommends on yast2-sound from the multimedia pattern.
  Drop YaST from the pattern recommendations. The YaST patterns
  and packages stay in the repository for anyone who has them or
  wants them; new installations simply come without YaST.

==== patterns-games ====

- games pattern: drop the requirement on the x11 pattern
  entirely. X11 desktop patterns already require the x11
  pattern themselves, and a games install must not pull an
  X stack onto Wayland-only systems

==== patterns-kde ====
Subpackages: patterns-kde-kde patterns-kde-kde_edutainment patterns-kde-kde_games patterns-kde-kde_ide patterns-kde-kde_imaging patterns-kde-kde_internet patterns-kde-kde_multimedia patterns-kde-kde_office patterns-kde-kde_pim patterns-kde-kde_plasma patterns-kde-kde_utilities patterns-kde-kde_utilities_opt patterns-kde-kde_yast

- Drop the Tumbleweed-only Recommends on yast2-control-center-qt and
  pattern() = kde_yast from the kde pattern.
  [edited by fabian@ritter-vogt.de]

==== patterns-media ====
Subpackages: patterns-media-rest_cd_core patterns-media-rest_dvd

- Drop the dhcp server pattern from the DVD.

==== patterns-server ====
Subpackages: patterns-server-directory_server patterns-server-file_server patterns-server-kvm_server patterns-server-lamp_server patterns-server-mail_server patterns-server-printing

- Regenerate pattern-definition-32bit.txt with the package's own
  pre_checkin.sh (follow-up to SR 1392454, which hand-mirrored the
  file and missed the postfix/dovecot additions): mail_server now
  recommends postfix and dovecot; drop stale entries (dhcp-tools,
  nss_ldap/pam_ldap, mailman, apache2-mod_php7) and pick up current
  ones (sssd/sssd-ldap, apache2-mod_php8). Extend pre_checkin.sh's
  skip list with hwcrypto and oracle_server, which have no 32bit
  pattern marker, so regeneration stays idempotent.
- dhcp_dns_server: build the DHCP half on Kea on openSUSE too, as
  the SLE branch of this pattern already does; ISC dhcp is
  end-of-life since December 2022 and 4.4.3.P1 was its final
  release. Drop bind-chrootenv, which the bind package no longer
  ships.
- gateway_server: drop quagga, ipsec-tools and rarpd, none of which
  exists in openSUSE Factory anymore; recommend frr, the FRRouting
  successor of quagga that the SLE branch of this pattern already
  names, on openSUSE as well. Also drop calamaris and
  wondershaper, and arptables: the patterns' firewall is
  firewalld, recommended by patterns-base, and its backend is
  nftables, so the legacy ARP packet filtering tool is
  superseded on both counts.
- mail_server: drop cyrus-imapd, whose source package was removed
  from Factory, and inn, the NNTP news server left over from the
  mail-and-news era. Recommend postfix and dovecot, so the
  pattern has a mail centre again: postfix is the distribution's
  default MTA (boo#1136078) and dovecot is the remaining full
  IMAP server in Factory.
- lamp_server: drop apache2-mod_python (mod_python is Python 2 era
  and the package was removed from Factory) and
  apache2-example-pages (no longer built); recommend
  libapr1-0/libapr-util1-0 and apache2-manual under their current
  names instead of libapr1/libapr-util1 and apache2-doc, which no
  longer exist as packages.
- directory_server: drop yast2-ldap-server, which no longer exists
  in Factory.
- printing: drop cups-filters-foomatic-rip and
  cups-filters-ghostscript; both were folded into cups-filters,
  which this pattern already recommends. Recommend
  hplip-driver-hpcups instead of the retired hplip-hpijs name.
- Drop all remaining yast2-* recommendations, as patterns do not
  carry YaST modules: yast2-ftp-server, yast2-nfs-server,
  yast2-samba-server and yast2-tftp-server in file_server;
  yast2-control-center, yast2-ncurses, yast2-ncurses-pkg and
  yast2-vm in kvm_tools and xen_tools; and the yast2-*-32bit
  mirrors in pattern-definition-32bit.txt.
- file_server: drop the nfsidmap recommendation entirely rather
  than renaming it to libnfsidmap1: the idmapping library is
  pulled in by the NFS client packages themselves and has no
  place named in a pattern.
- kvm_tools, xen_tools: recommend xauth under its current name
  instead of xorg-x11-xauth.
- Mirror the changed entries in pattern-definition-32bit.txt,
  including the inn-32bit removal in mail_server.
- gateway_server: recommend wireshark unconditionally. The SLE
  branch of this pattern also requires it, while the openSUSE
  branch named it nowhere and nothing in the file explains the
  difference; the recommended strength matches the pattern's
  other analysis tooling.

==== patterns-xfce ====
Subpackages: patterns-xfce-xfce patterns-xfce-xfce_basis patterns-xfce-xfce_extra patterns-xfce-xfce_laptop

- Stop pulling YaST into default Tumbleweed installations: drop
  the Recommends on yast2-control-center-qt from the xfce_basis
  pattern.
  Drop YaST from the pattern recommendations. The YaST patterns
  and packages stay in the repository for anyone who has them or
  wants them; new installations simply come without YaST.

==== pciutils ====
Version update (3.14.0 -> 3.15.0)
Subpackages: libpci3

- Update to version 3.15.0:
  * New capabilities are decoded: MMIO Register Block Locator,
    Flit Error Injection, Flit Logging.
  * Decoding of PCIe capabilities updated to Gen7.
  * lspci and setpci warn when the "-s" or "-d" option is given
    multiple times.
  * Improved display of interrupts in "lspci -vv": routing of
    interrupt pins is shown only if the pins are not disabled,
    routing of MSI(X) interrupts is shown when available.
  * Dump back-end can read the dump from stdin with "-" as file name.
  * libpci adds pci_filter_has_slot and pci_filter_has_id
    (backward compatible, sover stays 3).
  * FreeBSD supports 64-bit addresses; minor Windows back-end
    improvements.
  * Updated pci.ids.
- Spec cleanup: drop obsolete Group tags.
- Rebase pciutils-ocloexec.patch for the reworked dump and sysfs
  back-ends (stdin dump support).

==== pcsc-lite ====
Version update (2.3.3 -> 2.5.3)
Subpackages: libpcsclite1

- Add merge-sysuser.patch: (boo#1287634)
  This merges our pcsc-lite.sysusers into the upstream sysuser file
  and also ensures that the pcscd user is also in the scard group
  as an additional group.
- version 2.5.3
  - pcscd.service: preserve card sessions across polkit restarts
  - correctly decode all ATRs (fix the fix suggested by AI)
  - Fix authorization for uid > 65536
- version 2.5.2
  - hotplug_libudev: rescan "serial" readers in HPReCheckSerialReaders
  - fix minor issues found by AI tool
- version 2.5.1
  - Fix a bug (introduced in 2.5.0) with multi-slots readers
  - Add support of Haiku Operating System
- version 2.5.0
  - Do not limit to 16 readers only
  - Remove support of autotools
  - Fix a crash when rescanning serial configs
  - Fix a memory leak in Polkit
  - tokenparser: avoid a crash with corrupted Info.plist files
  - Some other minor improvements
- version 2.4.1
  - Add backward version support on the client side
  - Add backward version support on the server side
  - hotplug libudev: rescan the USB bus with "pcscd --hotplug"
  - fix a value in pcscd.service systemd file
  - meson: install systemd files even if libsystemd is not used
  - Some other minor improvements
- version 2.4.0
  - Run pcscd under a pcscd user instead of root when using systemd
  - Set PIDFile in systemd service file
  - Protect contextMapList modifications using a mutex
  - meson:
  . Fix libpcsclite.pc file
  . respect builtin meson default_library option
  . build and install spy lib & tool only when needed
  - UnitaryTests/*.py: fix pylint warnings
  - Improve Doxygen documentation

==== perl-Clone ====
Version update (0.500.0 -> 0.510.0)

- updated to 0.510.0 (0.51)
  see /usr/share/doc/packages/perl-Clone/Changes
  0.51 2026-10-01 atoomic
  - fix: clone deep hash and mixed array/hash structures past MAX_DEPTH
    without C stack growth (GH #121, GH #146)
  - fix: support cloning Perl 5.38+ class instances (SVt_PVOBJ)
  - fix: count nesting depth, not call count, in rdepth
  - fix: honour depth==0 when rdepth exceeds MAX_DEPTH on wide structures
  - fix: preserve shared RV identity in rv_clone_iterative
  - fix: guard rv_clone_iterative against scalar-ref cycles past MAX_DEPTH
  - fix: share non-cloneable leaves in rv_clone_iterative
  - fix: preserve blessings in iterative array chain walking (GH #121)
  - fix: deep-copy leaf scalars past MAX_DEPTH instead of aliasing
  - fix: release cloned mg_obj refcount after sv_magic (memory leak)
  - fix: remove leaked Newxz buffer in magic mg_ptr cloning
  - fix: use SAVEFREESV for exception-safe hseen/weakrefs cleanup
  - fix: avoid shell in ps invocation for MacPorts / sandboxed macOS (GH #122)
  - refactor: extract magic cloning to clone_magic() helper
  - refactor: fix TRACEME debug infrastructure for 64-bit and MSVC
  - chore: update ppport.h from 3.68 to 3.73
  - test: add coverage for clone($ref, $depth), edge cases, class objects
  - docs: fix duplicate Synopsis header and update LIMITATIONS section
  - ci: add macOS, refresh Linux distro matrix, fix Windows build step

==== perl-Cpanel-JSON-XS ====
Version update (4.520.0 -> 4.800.0)

- updated to 4.800.0 (4.80)
  see /usr/share/doc/packages/perl-Cpanel-JSON-XS/Changes
  4.80 2026-09-?? (rurban)
  - Security fixes, reported by Stig Palmquist (CPANSec):
  * CVE-2026-110672 decode: free the hash key on "Duplicate keys not
  allowed" and on a missing ':' (leak). bsc#1286166
  * CVE-2026-110673 decode: charge allow_tags "(" nesting against
  max_depth (stack overflow). bsc#1286167
  * CVE-2026-110674 decode: look bare keys up as UTF-8, so the
  duplicate check no longer misses or crashes on non-ASCII keys. bsc#1286168
  * CVE-2026-110675 decode: validate bare hash keys as UTF-8 like
  quoted keys (malformed keys). bsc#1286169
  * CVE-2026-110676 encode: compact allow_bignum Math::BigFloat
  values with huge exponents (30MB from 12 bytes). bsc#1286170
  * CVE-2026-110677 decode: fix the dupkeys_as_arrayref reference
  counts (leaked every array). bsc#1286173
  * CVE-2026-110678 incr_parse: apply max_size to the buffered text
  in every context. bsc#1286174
  * CVE-2026-110680 encode: bound the canonical key snapshot for
  growing tied or shared hashes (overflow). bsc#1286175
  * CVE-2026-110681 new: clone the callbacks and buffer SVs on
  ithread clone instead of sharing the parent's pointers. bsc#1286176
  * CVE-2026-110682 incr_parse: reject a top-level number, true,
  false or null unless allow_nonref was set explicitly, as
  chunking changes their value. Strings, arrays and objects are
  unchanged. bsc#1286177
  * CVE-2026-110684 encode: release the temporary references when
  stringifying overloaded objects (leak). bsc#1286179
  * CVE-2026-110685 decode_tag: free the tag and its arguments when
  THAW dies (leak). bsc#1286180
  * CVE-2026-110686 decode: keep the filter callbacks alive while
  they run (use-after-free when a filter removes itself). bsc#1286181
  * CVE-2026-110687 canonical: sort byte-string keys as Latin-1. bsc#1286182
  * CVE-2026-110688 incr_parse: validate UTF-8 only up to the end of
  the decoded text (quadratic CPU). bsc#1286183
  - Add version markers to all module files. (PR #260 demerphq)
  - Use utf8n_to_uvchr on Perl 5.32 and later to avoid the deprecated
  utf8n_to_uvuni API. (PR #260 demerphq)
  - Add schema-based validation for decoded JSON (GH #238):
  Cpanel::JSON::XS::Type now provides check_type($data, $schema[,
  $found_type]), which validates an already-decoded perl structure
  against a type spec built from the existing encoder building
  blocks (JSON_TYPE_* / json_type_arrayof / json_type_hashof /
  json_type_anyof), plus the new json_type_optional() for hash keys
  that may be absent, and short scalar type name sugar ('Str',
  'Int', 'Float', 'Bool', 'Null', 'Any', and nullable 'Str?' etc.)
  so a schema reads as "just a hash of keys and types", as
  requested. Unlike the encoder's hash type spec, a plain hashref
  schema is closed: unknown keys and missing required keys are
  reported. New $json->decode_and_validate($json_text, $schema)
  method decodes and croaks with all mismatches if validation
  fails, using decode()'s own type introspection as ground truth to
  avoid perl's usual dual-var/stringified-number ambiguity.
  - json_type_optional() and the nullable '?' type-name suffixes
  ('Str?', 'Int?', 'Float?', 'Bool?') give schemas an explicit way
  to declare a key/value as optional instead of demanding a
  complete type specification for every key. The encoder now also
  understands json_type_optional() directly (it unwraps to the
  wrapped type, since encode() only ever sees keys that are
  actually present): the exact same type spec built for
  check_type()/decode_and_validate() can now be handed to encode()
  as-is, instead of croaking with "no type was specified for hash
  key '...'" for every optional key. Encoding stays strict by
  default otherwise: a hash key with no entry at all in the type
  spec still croaks (GH #242).
    eg/bench_large.pl:
    old encode: 20.5–22.9/s   decode: 16.2–16.5/s for 4.53
    new encode: 21.1–22.5/s   decode: 15.7–16.3/s for 4.80
  4.53 2026-09-28 (rurban)
  - Fix C90 violations with arm neon (GH #258 rjbs)
  - Added a native arm64 test runner.

==== perl-DB_File ====
Version update (1.860 -> 1.861)

- updated to 1.861
  see /usr/share/doc/packages/perl-DB_File/Changes
  1.861 13 October 2026
  * Update to version 1.861
    Tue Oct 13 10:04:57 2026 +0100
    68d942587c4f2d40cfc94aa0d3626ba101fb3e40
  * update email address
    Fri Oct 9 17:40:19 2026 +0100
    8aad0cf864bde5f9c3b67a3cb6917dc722749389
  * Bump actions/checkout from 6 to 7
    Fri Jul 3 12:49:06 2026 +0100
    34f18f049f0f84f8cc13b36a06514fe37fd220ef
  * Bump actions/cache from 5 to 6
    Fri Jul 3 12:48:35 2026 +0100
    c740b91701fa40845463ad2476e2b346303b570d

==== perl-MIME-tools ====
Version update (5.518.0 -> 5.522.0)

- updated to 5.522.0 (5.522)
  see /usr/share/doc/packages/perl-MIME-tools/ChangeLog
  5.522	  2026-10-27  Dianne Skoll <dianne@skoll.ca>
  * VERSION 5.522 RELEASED
  * Many security issues were addressed (see the following ten CVEs)
  Issues were brought to my attention, and patches supplied, by the
  CPANSec security group.
  * parse_params: flag a parameter list that could not be parsed
  Detect additional ambiguous parse situations when parameter
  names contain illegal characters.  Fixes:
  CVE-2026-116264 invalid parameter hides boundary/filename. bsc#1288723
  * parse_params: check the boundary after RFC 2231 reassembly
  Another ambiguous-parse case was missed (trailing space after
  boundary was not detected for RFC-2231-encoded boundaries.)  Fixes:
  CVE-2026-116265 RFC 2231 boundary skips ambiguity checks. bsc#1288722
  * parse_params: Stricter checking for encoded boundaries; earlier
  versions would miss some cases.  Fixes:
  CVE-2026-116266 boundary changed by decoding not flagged. bsc#1288721
  * Cap the indentation levels in the Results: structure.  Otherwise,
  specially-crafted messages could consume large amounts of memory.
  Fixes: CVE-2026-116267 indent stored per message per level bsc#1288720
  * parse_params: stop a comment match at the next parenthesis.
  Otherwise, specially-crafted messages could cause the regex
  back-tracker to consume large amounts of CPU time.  Note that
  MIME::Parser does not correctly parse ((nested comments)) and
  has never done so.  Fixes:
  CVE-2026-116268 unclosed "(" comments backtrack CPU exhaustion. bsc#1288719
  * parse_params: re-encode filename* values without charset tricks
  Specially-crafted messages could trick recommended_filename()
  into returning an empty string instead of a plausible filename.
  Fixes: CVE-2026-116269 RFC 2231 language tag empties filename. bsc#1288718
  * decode_mimewords: do not copy the input into each error.  Otherwise,
  specially-crafted messages could consume large amounts of memory.
  Fixes: CVE-2026-116270 each bad "=?" copies the input into $@. bsc#1288717
  * FileUnder: do not reuse an existing generated directory.  Otherwise,
  attackers might be able to use symbolic links to get files created
  in unexpected locations.  Fixes:
  CVE-2026-116271 FileUnder reuses a pre-created directory. bsc#1288716
  * parse_params: flag comments other readers do not skip
  Specially-crafted messages could create ambiguous messages without
  setting the ambiguous_parse flag.  Fixes:
  CVE-2026-116272  comment hides a duplicate boundary. bsc#1288715
  * Call whine() rather than error() if max_parts or max_depth is
  exceeded during a parse.  This lets us return undef rather than
  throwing an exception if ignore_errors() is set to 0.
  * Change to defaults: max_parts is now set to 1000 and max_depth
  to 64 rather than being unlimited.  This should not affect most
  real-world uses of MIME::tools, but you may need to increase
  these values or set them to -1 (unlimited) if you run into trouble.
  * **** NOTE INCOMPATIBILITY *****
  Fixes: CVE-2026-116273 max_parts and max_depth unlimited. bsc#1288714
  * Do not signal an ambiguous parse if we have filename="" or
  name=""
  * Update author names in META.yml
  * Add git repo to META.yml
  5.520	  2026-10-21  Dianne Skoll <dianne@skoll.ca>
  * VERSION 5.520 RELEASED
  * MIME::Parser used O(N^2) CPU time and memory parsing a MIME
  message nested N levels deep.  A smallish specially-crafted
  message could DOS the computer by making it consume enormous
  amounts of memory and CPU time.  The parser was modified to use
  O(N) time and memory in this case.  Additionally, a new
  MIME::Parser::max_depth() function was added to limit the nesting
  depth before declaring a parse failure.  Problem was reported to
  me by Zhaoyang Li and Xiang Li from AOSP Lab at Nankai University.
  * MIME::Parser would ignore multiple blank lines in a message
    preamble when parsing it; this could break DKIM.  Problem pointed
  out and fix suggested by Tim Henderson.
  * If a MIME boundary includes trailing whitespace, we mark the
  parse as ambiguous.  Problem noted and patch submitted by
  Christian Herdtweck
  5.519	  2026-09-22  Dianne Skoll <dianne@skoll.ca>
  * VERSION 5.519 RELEASED
  * Some (buggy) software creates base64-encoded parts as a
  concatenation of multiple base64-encoded streams, and some client
  software decodes each stream separately and concatenates the
  results.  Duplicate this behavior in MIME::tools to prevent it
  from being used as a mechanism to sneak dangerous content past a
  security scanner.  Patch courtesy of Giorgio Premi
  <giosh94mhz@gmail.com>.

==== perl-URI ====
Version update (5.370.0 -> 5.400.0)

- updated to 5.400.0 (5.40)
  see /usr/share/doc/packages/perl-URI/Changes
  5.40      2026-10-19 19:56:29Z
  - URI->new no longer dies on malformed geo: URIs; the URI::geo accessors
    croak instead (GH#201)
  - Fix rel() returning an absolute-path or network-path reference
    ("/x", "//host/...") when a path has empty segments, so rel()->abs()
    round-trips again (GH#205)
  5.39      2026-10-19 16:38:21Z
  - Reject over-long IDNA labels before punycode encoding or decoding, so
    a long non-ASCII host no longer takes seconds to fail (GH#207) (Olaf
    Alders)
  5.38      2026-10-19 03:58:47Z
  - Preserve leading and trailing whitespace in file:// URI paths built from
    mac file names; URI::file::Mac supplies its own escaping and so was not
    covered by the GH#95 fix (GH#95) (@youdie006)
  - Treat a percent-escaped ';' in an smb:// userinfo as part of the
    username instead of the authdomain delimiter, matching
    URI::_emailauth, and escape '%', ';' and ':' on write so the value
    round-trips and neither delimiter can be forged (GH#199) (@youdie006)
  - Exclude the trailing colon from host() when a URI has an empty port
    (GH#200) (Jozef Kutej)

==== permissions ====
Subpackages: permctl permissions-config

- Ship chkstat.8 man page as a symlink to permctl.8; the chkstat
  compatibility symlink had no manual page of its own
- Wrap the permissions-config description within the line length
  limit
- Remove Group tags and use pkgconfig() BuildRequires for the
  libraries the build probes: libacl, libcap and tclap (spec-cleaner)
- Keep the pkgconfig() BuildRequires in the main block and delimit
  the test suite requirements with # SECTION markers, so the two
  groups stay separate when spec-cleaner sorts the BuildRequires

==== phodav ====
Version update (3.0 -> 3.2)

- Update to version 3.2:
  * Spice-webdavd: close the local client connection when the host drops it,
    instead of leaving the webdav client waiting for the end of the response or
    reusing a dropped connection, which led to dropped frames and hangs
  * Spice-webdavd: announce the local mDNS service on loopback only, and run as
    an unprivileged user in the systemd unit
  * Libphodav: add debug tracing for the request lifecycle, the streamed
    response pulls and the spice mux frames, silent unless G_MESSAGES_DEBUG is
    set
  * Windows testing fixes: read the virtual-dir server port from a file to
    avoid the carriage return of the text-mode standard handles, and run the
    Wine tests with their output to regular files, which a stray "explorer.exe
    /desktop" process cannot keep open
  * Updated translations.
- Changes from version 3.1:
  * CVE-2026-114417: reject the encoded slashes in the COPY/MOVE
    Destination header, which allowed writing outside of the shared directory
  * CVE-2026-114418: don't handle PUT when the request was already rejected:
    with digest authentication configured, an unauthenticated client could
    create or overwrite any file of the share
  * CVE-2026-114419: chezdav: check the digest password, any password was
    accepted for a user listed in the htdigest file
  * refuse the oversized request bodies with 413, including the chunked ones,
    and don't run the method handler of an already rejected request
  * fix crash and hangs on invalid If headers
  * fix a crash on PROPFIND/PROPPATCH requests without any property
- Update version dependencies according to meson.build.
- Drop harden_spice-webdavd.service.patch: fixed upstream.
- Convert to _service for easier management.
- Replace gtk-doc BuildRequires for scdoc and pkgconfig(gi-docgen): follow
  upstreams port away from gtk-doc
- Add pkgconfig(neon), pkgconfig(gobject-introspection-1.0): new dependencies
- Split out lang files from the shared library package: fixing policy violation
- Provide phodav-3.0 by the libphodav-3_0-0 to have the new lang package
  installable

==== php8 ====
Version update (8.5.11 -> 8.5.12)
Subpackages: php8-ctype php8-dom php8-iconv php8-openssl php8-pdo php8-sqlite php8-tokenizer php8-xmlreader php8-xmlwriter

- version update to 8.5.12
    Core:
    Fixed GHSA-w8hw-w9fx-j79w, GHSA-6wmf-4rv5-p3rp (Avoid state corruption via bailout). (CVE-2026-109618, CVE-2026-109619) [bsc#1286027]
    Fixed bug GH-23644 (Optimizer leaves a constant-vs-constant comparison unfolded, crashing the VM in zval_undefined_cv).
    Fixed OSS-Fuzz 532353396 (assertion failure with static type).
    Fix GH-23662 (Avoid NAN warning in print_r()).
    Fix GH-21999: GC inconsistency with lazy object, var_dump(), and object comparison.
    Fixed OSS-Fuzz #536440507 (Immutable class incorrect assertion).
    Fixed AVX being reported as supported when the OS has not enabled AVX state.
    Fixed GH-23980 (ZEND_ASSERT violation @ ZEND_INCLUDE_OR_EVAL).
    Fixed use-after-free when a dl()-loaded extension declares a frameless function and a later request calls it.
    Fixed System V shared memory emulation for Windows attaching segments past the end of their mapping.
    Fixed exception thrown by destructor during GC in a Fiber not being rethrown into the frame that triggered the GC.
    BCMath:
    Fixed BcMath\Number results that truncate to zero keeping a negative sign and comparing less than zero.
    BZ2:
    Fixed double close of the descriptor and use-after-free of the inner stream when bzopen() is given a stream resource.
    CLI:
    Fix GH-22567 (Windows ZTS CLI SAPI should refresh its TSRMLS cache during request activation).
    Fixed bug GH-23764 (Built-in server leaks a file descriptor on every HEAD request for a static file).
    Fixed crash in the built-in server when a client is reset before being accepted.
    Fixed the built-in server truncating an error page and leaking its unsent part after a partial socket write.
    DOM:
    Fixed use-after-free when re-constructing a DOMXPath whose php:function registrations are freed while still reachable from the cycle collector.
    Fixed Dom\HTMLDocument::getElementById() not finding ids of SVG and MathML elements.
    Fixed Dom\HTMLDocument giving attributes the namespace of their element when a fragment is parsed with an xlink, xml or xmlns context element.
    Fixed bug GH-23887 (Dom\HTMLCollection::namedItem() assertion failure, hang, or missed first element).
    Fixed DOMXPath and Dom\XPath losing the context node and in-scope namespaces of an evaluation after a php:function() callback evaluated another expression on the same object.
    FFI:
    Fixed crashes with FFI callbacks created from __call() trampolines and array callables whose object is released.
    FTP:
    Fixed bug GH-23619 (cryptic error on servers that don't support TLS session resumption on data connection).
    GD:
    Fixed undefined behavior with GD2 images with `INT_MAX`-sized chunks.
    Fixed undefined behavior with GIFs with problematic LZW compression data.
    Intl:
    Fixed cloning IntlDateFormatter and MessageFormatter losing PHP-side state such as dateType, timeType, calendar and the message pattern.
    Fixed a crash when converting with a cloned UConverter that uses toUCallback/fromUCallback.
    Fixed Collator attribute and strength methods not rejecting an unconstructed Collator.
    Fixed crash in intl_error_set_custom_msg() without an active call frame.
    Fixed grapheme_strstr() and grapheme_stristr() returning incorrect substrings when supplementary characters precede the match.
    Fixed grapheme_strstr() and grapheme_strpos() missing canonically equivalent matches, and grapheme searches reporting ICU errors for empty haystacks.
    Fixed grapheme_strrpos() and grapheme_strripos() skipping overlapping matches when using a negative offset.
    Fixed IntlDateFormatter::parse(), localtime() and parseToCalendar() treating the offset as UTF-16 code units instead of bytes.
    Lexbor:
    Merge patches lexbor/lexbor@8a14bc0 and lexbor/lexbor@f67ce4b, fixing a heap buffer overflow in :lexbor-contains() parsing and buffer overflows in malformed decode replay.
    Merge patches lexbor/lexbor@859f100, lexbor/lexbor@a36e09a, lexbor/lexbor@b0f7412, lexbor/lexbor@1b215a8, lexbor/lexbor@385afff, lexbor/lexbor@e6c068f, lexbor/lexbor@327a8b6,
    lexbor/lexbor@917742f and lexbor/lexbor@e89c258, fixing dropped usernames containing an at sign, uninitialized memory in IDNA buffer growth, the encoding of a space before a
    query or fragment in an opaque path, a query or fragment lost after a dot segment in a path, replacement file drive paths, the output encoding used for percent-encoding, the
    URLSearchParams tail pointer and fragment serialization without a query.
    MBString:
    Fixed bug GH-23106 (mb_strpos() reads past the end of a haystack ending in a truncated UTF-8 sequence).
    Fixed mbstring functions emitting surrogates in UTF-8 output and flagging it as valid UTF-8.
    MySQLi:
    Fix GH-22854: Fixed failed assertion when accessing mysqli property after failed reconnection.
    MySQLnd:
    Fixed field_count not resetting on OK packet.
    Fixed memory leak when closing a prepared statement after its connection was killed.
    Opcache:
    Fixed OSS-Fuzz #546798343 (Heap-buffer-overflow in optimizer with FCCs and inlining).
    Fixed bug GH-23693 (Tracing JIT produces wrong results for a guard on a loop-invariant addition).
    Fixed OSS-Fuzz #5674034779193344 (Read of uninitialized memory in is_cacheable_stream_path()).
    Fix zend_analyze_calls() call_stack buffer overrun.
    Fixed bug GH-23628 (Tracing JIT reads undefined property slots of lazy proxy objects instead of forwarding to the real instance).
    Fixed bug GH-23679 (Tracing JIT writes a parent private property into a child's shadowing public property).
    Fix multiple incorrect DCE due to unsound escape analysis.
    Fixed bug GH-24063 (OPcache optimizer folds `$cond ? -0.0 : 0.0` into a single `-0.0` constant).
    Fixed crash when a file cache is reused with a different set of extensions declaring frameless functions.
    Fixed bug GH-23991 (JIT generates invalid IR for multiple recursive calls).
    Fix SCCP evaluation of isset()/empty() on dimension of non-escaping object.
    Fixed bug GH-20890 (Segfault in zval_undefined_cv with non-simple property hook with minimal tracing JIT).
    OpenSSL:
    Fixed stream_socket_enable_crypto() leaving the socket non-blocking after a handshake timeout.
    Fixed feof() on a TLS stream staying false after a close_notify on Windows.
    PCNTL:
    Fixed pcntl_signal_dispatch() dropping the queued signals when it runs while an exception is pending.
    Fixed pcntl_signal_dispatch() dropping the signals queued behind a handler that throws.
    Fixed bug GH-23986 (/proc/self paths resolve to the parent process after pcntl_fork()).
    PDO:
    Fixed PDOStatement::getColumnMeta() reading out of bounds for an invalid column index.
    Fixed PDOStatement::bindColumn() registering a binding for a column name that is not in the result set.
    Fixed PDOStatement::execute() leaving the previous result available after a failed execution.
    Fixed a use-after-free when bindValue()/execute()/closeCursor() is called from a bound parameter's __toString() during execute().
    Fixed bug GH-23962 (Destroying a persistent PDO instance rolls back a transaction still in use by another instance).
    Fixed PDO::setAttribute() installing a PDO::ATTR_STATEMENT_CLASS class whose constructor arguments it rejects.
    Fixed PDO::ATTR_STATEMENT_CLASS constructor_args type errors reporting "array given" regardless of the value passed.
    Fixed PDOStatement::bindParam() and bindColumn() leaking the driver options value.
    Fixed PDOStatement not reporting its bound parameters and columns to the cycle collector.
    Fixed PDOStatement::setFetchMode() not applying changes atomically.
    PDO_DBLIB:
    Fixed bug GH-23741 (segfault after a failed query inside a PDO transaction). Errors raised by beginTransaction(), commit(), rollBack() and lastInsertId() are now reported instead of being dropped.
    PDO_Firebird:
    Fixed bug GH-23758 (PDO_Firebird returns null for non-null empty BLOBs).
    PGSQL:
    Fixed pg_lo_write() rejecting data containing null bytes.
    Removed pg_service(), unavailable with any released libpq.
    Readline:
    Fixed a heap over-read in the interactive shell prompt when cli.prompt is set to an empty string.
    Reflection:
    ... changelog too long, skipping 25 lines ...
  * php-build-reproducible-phar.patch (refreshed)

==== pipewire ====
Version update (1.6.9 -> 1.6.11)
Subpackages: gstreamer-plugin-pipewire libpipewire-0_3-0 pipewire-alsa pipewire-jack pipewire-libjack-0_3 pipewire-modules-0_3 pipewire-pulseaudio pipewire-spa-plugins-0_2 pipewire-spa-tools pipewire-tools

- Update to version 1.6.11:
  * This is a bugfix release that is API and ABI compatible with
    the previous 1.6.x releases.
  * Highlights
  - Backported a lot of bluetooth fixes.
  - Fix an issue with draining in the ALSA plugin that could
    cause lockups in applications.
  - Some smaller bugfixes and improvements.
  * PipeWire
  - Use extra buffer in reliable mode.
  * Modules
  - Fail client device export when device can't be started.
    Together with Wireplumber changes this avoids non-functioning
    devices in case of errors.
  - Fix potential crash in adapter. (#5549 (closed))
  * SPA
  - Clean up some SPA_POD_Long arguments to make things work on
    32bits.
  * Bluetooth
  - Backport some security fixes.
  - Handle some allocation errors better.
  - Fix handling of multiple concurrent profile registrations.
  - Fix BIS latency range checks.
  - Improve ofono compatibility.
  - Handle async device and node removal.
  - Avoid using stale transport or device pointers by using a
    unique serial instead.
  * ALSA plugin
  - Avoid going into XRUN when draining. (#5544 (closed))
- Update to version 1.6.10:
  * This is a bugfix release that is API and ABI compatible with
    the previous 1.6.x releases.
  * Highlights
  - Fix some potential crashes in the JACK layer.
  - Fix a regression in the PSD rear delay upmixing code.
  - Avoid pops and clicks when playing unsigned formats.
  - More small fixes and backports.
  * PipeWire
  - Initialize the error location in all cases when parsing
    properties.
  - Don't try to unlink ports without a node. (#5540 (closed))
  * Modules
  - Fix a potential crash in the X11 module because error
    handlers can be called twice.
  * SPA
  - Fix a regression in the PSD rear delay upmixing code. A delay
    of 0 was not working and would result in a big delay instead.
    (#5490 (closed))
  - Use per audio format clear function to avoid pops when
    draining on unsigned formats. (#5531 (closed))
  * Pulse-server
  - Avoid queueing an unlimited amount of REQUEST commands for
    paused clients in some cases. (#5541 (closed))
  * Bluetooth
  - Remove some old deprecated functions.
  - cancel RegisterApplication calls when adapter goes away.
    (#5096 (closed))
  * JACK
  - Add locking around the port array and mixer list.
    (#5499 (closed))
  - Avoid possible infinite loop.
  - Free port and buffers before disconnect. (#5455)
  * GStreamer
  - Set the plane strides and offsets correctly.
  - Avoid setting invalid max resolution values.
  * ALSA Plugin
  - Handle the XRUN case better. (#5524 (closed))
  * Tools
  - Support more output formats by letting sndfile choose the
    byte order.

==== plasma5support6 ====
Version update (6.8.0 -> 6.8.2)
Subpackages: libPlasma5Support6

- Update to 6.8.2
  * New bugfix release
  * For more details please see:
  * https://kde.org/announcements/plasma/6/6.8.2
- Changes since 6.8.1:
  * Update version for new release 6.8.2
- Update to 6.8.1:
  * New bugfix release
  * For more details see https://kde.org/announcements/plasma/6/6.8.1
- Changes since 6.8.0:
  * Update version for new release 6.8.1

==== plasma6-activities ====
Version update (6.8.0 -> 6.8.2)
Subpackages: libPlasmaActivities7 plasma6-activities-imports

- Update to 6.8.2
  * New bugfix release
  * For more details please see:
  * https://kde.org/announcements/plasma/6/6.8.2
- Changes since 6.8.1:
  * Update version for new release 6.8.2
- Update to 6.8.1:
  * New bugfix release
  * For more details see https://kde.org/announcements/plasma/6/6.8.1
- Changes since 6.8.0:
  * Update version for new release 6.8.1

==== plasma6-activities-stats ====
Version update (6.8.0 -> 6.8.2)
Subpackages: libPlasmaActivitiesStats1

- Update to 6.8.2
  * New bugfix release
  * For more details please see:
  * https://kde.org/announcements/plasma/6/6.8.2
- Changes since 6.8.1:
  * Update version for new release 6.8.2
- Update to 6.8.1:
  * New bugfix release
  * For more details see https://kde.org/announcements/plasma/6/6.8.1
- Changes since 6.8.0:
  * Update version for new release 6.8.1

==== plasma6-browser-integration ====
Version update (6.8.0 -> 6.8.2)

- Update to 6.8.2
  * New bugfix release
  * For more details please see:
  * https://kde.org/announcements/plasma/6/6.8.2
- Changes since 6.8.1:
  * Update version for new release 6.8.2
- Update to 6.8.1:
  * New bugfix release
  * For more details see https://kde.org/announcements/plasma/6/6.8.1
- Changes since 6.8.0:
  * Update version for new release 6.8.1

==== plasma6-desktop ====
Version update (6.8.0 -> 6.8.2)
Subpackages: plasma6-desktop-emojier plasma6-kimpanel-ibus

- Update to 6.8.2
  * New bugfix release
  * For more details please see:
  * https://kde.org/announcements/plasma/6/6.8.2
- Changes since 6.8.1:
  * Update version for new release 6.8.2
  * Update version for new release 6.8.2
  * applets/kickoff: Tie sidebar item spacing to the compact list style (kde#524003)
  * applets/taskmanager: wrap labels anywhere (kde#526972)
  * dwellclicker: fix after click keep open when pinned
  * applets/kicker: use the containment's screen for the popup size limit (kde#527385)
  * folder: make row/column arrangement settings match actual behavior (kde#512993)
  * activitymanager: Crop activity wallpapers instead of stretching them (kde#478784)
  * applets/pager: Keep desktop labels and window icons bound to the model (kde#522322)
  * Do not use wallpaper context variable binding as it changes value incorrectly (kde#527569)
  * applets/kickoff: directly scroll list in ListOfGridsView (kde#526911)
  * applets/taskmanager: fix highlight effect signal order issue (kde#527229)
  * Shell package: correct size and position for the activity switcher (kde#527158)
  * runners/keys: Use KGlobalAccel QKeySequence (de)serialization code
  * Fix disappearing desktop icons
- Update to 6.8.1:
  * New bugfix release
  * For more details see https://kde.org/announcements/plasma/6/6.8.1
- Changes since 6.8.0:
  * Update version for new release 6.8.1
  * applets/kicker: set drag mimedata url only if we have one
  * applets/kicker: inherit LayoutMirroring (kde#525994)
  * applets/kicker: add ItemListView inner right margin if scrollable
  * containments_desktop: don't always forward Shift+key to krunner
  * kcms/mouse: Move QML property lines for better readability
  * kcms/mouse: Fix indentation of scroll-button behavior options
  * kcms/touchpad: Indent checkboxes with indicator width and spacing
  * Update version for new release 6.8.1
  * kcms/landingpage: Fix showing default kcms when there are no most used kcms (kde#522711)
  * Fix action names

==== plasma6-disks ====
Version update (6.8.0 -> 6.8.2)

- Update to 6.8.2
  * New bugfix release
  * For more details please see:
  * https://kde.org/announcements/plasma/6/6.8.2
- Changes since 6.8.1:
  * Update version for new release 6.8.2
- Update to 6.8.1:
  * New bugfix release
  * For more details see https://kde.org/announcements/plasma/6/6.8.1
- Changes since 6.8.0:
  * Update version for new release 6.8.1

==== plasma6-integration ====
Version update (6.8.0 -> 6.8.2)
Subpackages: plasma6-integration-plugin plasma6-integration-plugin-qt5

- Update to 6.8.2
  * New bugfix release
  * For more details please see:
  * https://kde.org/announcements/plasma/6/6.8.2
- Changes since 6.8.1:
  * Update version for new release 6.8.2
- Update to 6.8.1:
  * New bugfix release
  * For more details see https://kde.org/announcements/plasma/6/6.8.1
- Changes since 6.8.0:
  * Update version for new release 6.8.1

==== plasma6-nm ====
Version update (6.8.0 -> 6.8.2)
Subpackages: plasma6-nm-openconnect plasma6-nm-openvpn plasma6-nm-pptp plasma6-nm-vpnc

- Update to 6.8.2
  * New bugfix release
  * For more details please see:
  * https://kde.org/announcements/plasma/6/6.8.2
- Changes since 6.8.1:
  * Update version for new release 6.8.2
- Update to 6.8.1:
  * New bugfix release
  * For more details see https://kde.org/announcements/plasma/6/6.8.1
- Changes since 6.8.0:
  * Update version for new release 6.8.1

==== plasma6-openSUSE ====
Subpackages: plasma6-branding-openSUSE plasma6-sddm-theme-openSUSE plasma6-theme-openSUSE

- Update to 6.8.2
- Update to 6.8.1

==== plasma6-pa ====
Version update (6.8.0 -> 6.8.2)

- Update to 6.8.2
  * New bugfix release
  * For more details please see:
  * https://kde.org/announcements/plasma/6/6.8.2
- Changes since 6.8.1:
  * Update version for new release 6.8.2
  * Play feedback when increasing/decreasing volume (kde#527775)
  * volumefeedback: Play the sound from the configured sound theme (kde#525954)
- Update to 6.8.1:
  * New bugfix release
  * For more details see https://kde.org/announcements/plasma/6/6.8.1
- Changes since 6.8.0:
  * Update version for new release 6.8.1
  * Fix HTML escaping and ampersands in tooltips

==== plasma6-print-manager ====
Version update (6.8.0 -> 6.8.2)

- Update to 6.8.2
  * New bugfix release
  * For more details please see:
  * https://kde.org/announcements/plasma/6/6.8.2
- Changes since 6.8.1:
  * Update version for new release 6.8.2
- Update to 6.8.1:
  * New bugfix release
  * For more details see https://kde.org/announcements/plasma/6/6.8.1
- Changes since 6.8.0:
  * Update version for new release 6.8.1
  * kded: Track marker level notifications per printer

==== plasma6-systemmonitor ====
Version update (6.8.0 -> 6.8.2)

- Update to 6.8.2
  * New bugfix release
  * For more details please see:
  * https://kde.org/announcements/plasma/6/6.8.2
- Changes since 6.8.1:
  * Update version for new release 6.8.2
  * Ensure SplitView maximumWidth > minimumWidth
- Update to 6.8.1:
  * New bugfix release
  * For more details see https://kde.org/announcements/plasma/6/6.8.1
- Changes since 6.8.0:
  * Update version for new release 6.8.1
  * ColumnConfigurationDialog: Add Window color (kde#527190)
  * Update version for new release 6.8.1
  * Revert "table: Change ColumnConfigDialog search filter to filter on text edit"

==== plasma6-thunderbolt ====
Version update (6.8.0 -> 6.8.2)

- Update to 6.8.2
  * New bugfix release
  * For more details please see:
  * https://kde.org/announcements/plasma/6/6.8.2
- No code change since 6.8.1
- Update to 6.8.1:
  * New bugfix release
  * For more details see https://kde.org/announcements/plasma/6/6.8.1
- No code changes since 6.8.0

==== plasma6-workspace ====
Version update (6.8.0 -> 6.8.2)
Subpackages: plasma6-session plasma6-workspace-libs sddm-qt6-branding-openSUSE

- Update to 6.8.2
  * New bugfix release
  * For more details please see:
  * https://kde.org/announcements/plasma/6/6.8.2
- Changes since 6.8.1:
  * Update version for new release 6.8.2
  * kcms/style: use consistent slider value
  * applets/digital-clock: Keep the system font's OpenType features for the time (kde#524257)
  * libnotificationmanager: Accept single-quoted attributes in notification markup (kde#506733)
  * applets/kicker: port old favoriteId format to new one (kde#527651)
  * components/timezoneselector: fix margins
  * components/calendar: Don't navigate to years before year 1 (kde#525980)
  * shell: Set entered edit mode to false on startup (kde#527738)
  * libtaskmanager: Re-filter launchers when a window changes screen (kde#527507)
  * wallpapers/color: Set the accent color from the configured color (kde#513851)
  * libkmpris: Don't auto-repeat the global play/pause shortcut (kde#521448)
  * Applets Layout Manager: don't take preferred size into account when restoring (kde#490687)
  * libtaskmanager: Let the compositor name desktops created from the pager (kde#501808)
  * libkmpris: Keep non-ASCII characters in the title and album fallbacks (kde#503405)
  * applets/activitybar: fix tab focus and arrow nav (kde#527235)
  * Image wallpaper: Make all image packages correctly load (kde#527150)
  * appmenu: auto focus search field (kde#525569)
  * launcher tasks model: Guard lookup to serviceMenuById
  * libtaskmanager: put tasks in place of their launchers (kde#527189)
- Update to 6.8.1:
  * New bugfix release
  * For more details see https://kde.org/announcements/plasma/6/6.8.1
- Changes since 6.8.0:
  * Colors: unexportTopLevel on editor close (kde#527382)
  * klipper: request activation when showing popup (kde#527326)
  * shellcorona: Set default containment
  * Update version for new release 6.8.1
  * devicenotifications: Ignore virtual screens
  * Scripting: save and restore correctly floating panel config (kde#526843)
  * wallpapers/image: Handle when type cannot be determined
  * freespacenotifier: Set XDG activation token on launch job and config
  * freespacenotifier: Fix configure action

==== polkit-kde-agent-6 ====
Version update (6.8.0 -> 6.8.2)

- Update to 6.8.2
  * New bugfix release
  * For more details please see:
  * https://kde.org/announcements/plasma/6/6.8.2
- Changes since 6.8.1:
  * Update version for new release 6.8.2
- Update to 6.8.1:
  * New bugfix release
  * For more details see https://kde.org/announcements/plasma/6/6.8.1
- Changes since 6.8.0:
  * Update version for new release 6.8.1

==== postfix ====

- config.postfix:
  * Fix timezone
  * /usr/sbin/postconf: fatal: -e, -X, or -# accepts no multi-line input
  * master.cf generation
- update patches
  * postfix-main.cf.patch
  * postfix-master.cf.patch
- rebase patch
  * postfix-vda-v14-3.0.3.patch
- remove /usr/local/include from compilation options

==== powerdevil6 ====
Version update (6.8.0 -> 6.8.2)

- Update to 6.8.2
  * New bugfix release
  * For more details please see:
  * https://kde.org/announcements/plasma/6/6.8.2
- Changes since 6.8.1:
  * Update version for new release 6.8.2
  * applets/batterymonitor: set switch state on first open (kde#527560)
  * backlightbrightness: Also log error code when executejob fails
- Update to 6.8.1:
  * New bugfix release
  * For more details see https://kde.org/announcements/plasma/6/6.8.1
- Changes since 6.8.0:
  * Brightness: Proper sizing of scrollview contents (kde#527261)
  * Update version for new release 6.8.1
  * Show the brightness OSD when a brightness key is pressed at min/max (kde#505558)

==== publicsuffix ====
Version update (20260921 -> 20261022)

- Update to version 20261022:
  * Add *.ztna-dingtalk.com to the PRIVATE section (#3196)
  * Remove `oya.to` (domain expired & drop-caught) (#3432)
  * Remove GCom Internet entries: aliases121.com (#3435)
  * Remove gitapp.si form the list (#3421)
  * util: gTLD data autopull updates (#3414, #3338, #3331)
  * AWS Submissions to the Public Suffix List - Q3 2026 (#3044)
  * Remove knightpoint.systems and perspecta.cloud (#3070)
  * Add NAVER Cloud (Ncloud Storage) domains to the PRIVATE
    section (#3340)
  * Replace explicit replit.dev entries with wildcard rules (#3251)
  * AWS Submissions to the Public Suffix List Q2 2026 (#2771)
  * Add retool.app (Retool) to PRIVATE section (#3283)
  * Add glideos.app (Glide) (#3200)
  * Add site prefixes to Combell domains (#3282)
  * Add iqhs.pl (IQHost) to PRIVATE section (#3264)

==== python-Brotli ====
Version update (1.2.0 -> 1.2.1)

- update to 1.2.1 (bsc#1287779, CVE-2026-111497):
  * Brotli decoder out-of-bounds write permits remote code execution

==== python-Pillow ====
Version update (12.3.0 -> 13.0.0)

- Update to 13.0.0:
  * Addresses CVE-2026-112390 (bsc#1286256), CVE-2026-112391 (bsc#1286273),
    CVE-2026-112392 (bsc#1286287), CVE-2026-112393 (bsc#1286325),
    CVE-2026-112394 (bsc#1286311), CVE-2026-112395 (bsc#1286312),
    CVE-2026-112396 (bsc#1286313), CVE-2026-112397 (bsc#1286314),
    CVE-2026-112398 (bsc#1286406), CVE-2026-112399 (bsc#1286368),
    CVE-2026-112400 (bsc#1286370), CVE-2026-112401 (bsc#1286372),
    CVE-2026-112402 (bsc#1286381), CVE-2026-112403 (bsc#1286405),
    CVE-2026-112404 (bsc#1286388), CVE-2026-112405 (bsc#1286404),
    CVE-2026-112406 (bsc#1286403), CVE-2026-112891 (bsc#1286402),
    CVE-2026-112892 (bsc#1286401), CVE-2026-112893 (bsc#1286392),
    CVE-2026-112894 (bsc#1286408), CVE-2026-112895 (bsc#1286411),
    CVE-2026-112896 (bsc#1286400), CVE-2026-112897 (bsc#1286398),
    CVE-2026-112898 (bsc#1286399), CVE-2026-112899 (bsc#1286489),
    CVE-2026-112900 (bsc#1286397), CVE-2026-112901 (bsc#1286396),
    CVE-2026-112902 (bsc#1286804), CVE-2026-114501 (bsc#1286803),
    CVE-2026-96636 (bsc#1286802), CVE-2026-96637 (bsc#1286801),
    CVE-2026-96638 (bsc#1286800), CVE-2026-96639 (bsc#1286799),
    CVE-2026-96640 (bsc#1286798), CVE-2026-96641 (bsc#1286797),
    CVE-2026-96642 (bsc#1286796), CVE-2026-96643 (bsc#1286795),
    CVE-2026-96778 (bsc#1286793)
  * Remove undocumented GifImagePlugin._save_netpbm
  * Remove ExifTags.IFD.Makernote
  * Drop support for Python 3.10
  * Validate TIFF tag values against libtiff's own field definition before
    TIFFSetField
  * Take libtiff scanline geometry tags from the image, not tiffinfo/exif
  * Bound retained TIFF tag data by stream size
  * Fix heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO
  * Use bit plane row size for P;2L and P;4L rawmodes
  * Allow floating point constants in ImageMath operations
  * Add support for ImageOps invert, posterize and solarize of P images
  * Respect explicit BASIC layout in font_variant()
  * Improve support for TGA images in P mode with an RGBA palette
  * Use reducing_gap when resizing RGBA and LA images
  * Use pen widths when drawing ImageDraw2 shape outlines
  * Reject TIFFs whose unpacker row is wider than libtiff's decoded row
  * Write all channels when saving a one pixel wide RGB image as PCX
  * Allow ImageOps to create zero dimension images
  * Do not write IFD1 as a tag when converting EXIF to bytes
  * Check WebP canvas size before creating decoder
  * Apply "bits" to saving L mode PNG images
  * Clear TIFF strip and tile buffer beyond previously decoded data
  * Read from tall PSD tiles safely
  * Only load new palette in putpalette() if it contains raw data
  * Only combine PNG frames if the combined duration is still writable
  * Support greyscale TIFFs with ExtraSamples 0 or 1
  * Avoid repeated concatenation of GIF comments
  * Require TIFF ColorMap length according to BitsPerSample
  * Assign next PDF object ID in constant time
  * Reject JPEG streams whose scanlines are wider or have more components
  * Raise an error when calling quantize() with an empty palette
  * Set PdfParser default max_nesting limit to 900
  * Prevent infinite loop when rewriting PDF pages
  * Check COM marker length when encoding JPEG
  * Delay creating APNG disposal frame until necessary
  * Fix combining GIF frames when an earlier duration is missing
  * Limit WMF dimensions when loading to 0-65535
  * Read XBM header line by line, instead of through regex
  * Fix PSD layer tiles reading from the wrong file offset
  * Avoid unused object ids when saving PDF
  * Raise an error if PDF page loop exists
  * Fixed passing zero dimension images into fromarrow()
  * Do not treat RGB as a rawmode for an RGB palette
  * Use while loop in read_prev_trailer() to avoid RecursionError
  * Allow zero-length members in tar files
  * Correctly manage glyph when rendering font
  * Return early when applying ImageMorph MorphOp to an empty image
  * Do not decode more MSP or BMP data than necessary
  * Raise error when creating ImagePalette with unsupported mode
  * Apply hoist optimizations to Geometry.c's transforms
  * Allow for IFDRational with negative numerator and zero denominator
  * Add escape argument to PSDraw text method
  * Use lazy imports on Python 3.15 to improve startup speed
  * Add GPSHPositioningError to GPS IFD tag data
  * Do not open YCbCr colorspace images as RGB without libtiff
  * Fix loading XPM images with transparency
  * Open BMP image with black palette in mode 1
  * Remove palette if no longer relevant after TIFF seek
  * Add mixed-line-ending to prek and convert to LF
  * Fix adding a new color when image palette has missing background or
    transparency index
  * Correct background color when using P mode images with ImageOps.pad()
  * Fix 16-bit ImageFilter accuracy
  * Fix RLE4 absolute mode decoding for odd pixel counts

==== python-Twisted ====
Version update (26.4.0 -> 26.10.0)
Subpackages: python313-Twisted python313-Twisted-tls

- Update to 26.10.0 (CVE-2026-83813, bsc#1287833,
  CVE-2026-115778, bsc#1287678, CVE-2026-115775, bsc#1287675,
  CVE-2026-115877, bsc#1287848, CVE-2026-115774, bsc#1287671,
  CVE-2026-115776, bsc#1287676)
  * It is now possible to set the SO_REUSEPORT and SO_REUSEADDR TCP
    socket flags from user code.
  * Python 3.14 is now supported.
  * twisted.internet.defer.Deferred.__iter__, used when awaiting a
    Deferred, is now about 2-3% faster.
  * twisted.internet.tcp.Connection no longer supports returning a
    non-None value from a protocol's dataReceived method
  * Implementations of twisted.internet.interfaces.IProcessProtocol
    are now required to provide a processExited method
  * twisted.internet.tcp.Port.startListening() now closes the socket
    when raising CannotListenError
  * twisted.logger.LoggingFile.fileno now raises io.UnsupportedOperation
    instead of returning -1. This fixes an interoperability issue with
    multiprocessing.
  * twistd now exits with a non-zero status given an unknown subcommand.
  * twisted.protocols.ftp.FTPClient now uses ip address of the original
    ftp server to open passive data connections by default, instead of
    trusting PASV responses.
  * _makeGetterFactory method in twisted.web.client has been removed.
  * twisted.trial.runner.samefile is deprecated and replaced by
    os.path.samefile.
- Drop merged pycryptography-use-csr.patch and CVE-2026-106454.patch
- Add upstream py315.patch to fix tests with python 3.15

==== python-argcomplete ====
Version update (3.6.3 -> 3.7.2)

- Update to 3.7.2:
  * Require Python 3.10+
  * Fix zsh global completion with zsh 5.9.0.1; expand ~ in
    _FilteredFilesCompleter
  * Escape glob and brace metacharacters in quote_completions;
    quote compgen prefix in FilesCompleter
  * Remove deprecated easy_install script detection
- Drop python-argcomplete-check-easy-install-script and its
  libalternatives registrations, removed upstream
- Remove the /usr/bin/env python3 shebang from the non-executable
  argcomplete/scripts modules

==== python-argparse-manpage ====
Version update (4.7 -> 4.8)

- Update to 4.8:
  * escape sequences are no longer propagated into the generated man pages
  * fixed a traceback when an action has no help text (action.help == None)
  * double-quoted values are newly supported in the manpages spec parsing
- Drop patch support-python-315.patch, merged upstream.

==== python-certifi ====
Version update (2026.7.22 -> 2026.10.23)

- update to 2026.10.23 (bsc#1286261, bsc#1287723):
  * drop eMudhra Inc root CA
- Update to 2026.10.19:
  Remove the compromised eMudhra CA certificates.

==== python-gobject ====
Version update (3.56.3 -> 3.58.1)
Subpackages: python313-gobject python313-gobject-Gdk python313-gobject-cairo

- Drop glib_version, gi_version, pycairo_version and libffi_version defines:
  set minimum versions on every (Build)Requires, geckopit handles this for us
  now.
- Update to version 3.58.1:
  * (backport) Fix GStreamer crash with python-debug
- Update version dependencies according to meson.build.
- Update to version 3.58.0:
  + Stable release.
- Update to version 3.57.1:
  + Add extra checks around construction of object destroy notifier
  + `GLib.Pid` should be a number with a special `close` method
  + Use `PathLike` objects for `Gtk.Template`
  + Fast marshalling of `bytearray` to `GBytes`
  + Prevent crashes where `GValue` is `NULL`
- Update to version 3.57.0:
  + doc: Update tutorial and examples
  + Fix potential buffer overflow errors where the C API exposes
  + gio: Support creating `GFile` child with slash operator,
    similar to `pathlib.Path`
  + Refactor memory management for marshaller cache
  + Add missing msg argument to asyncio cancel()
  + Fix deprecation warning for register_object
  + Find libraries automatically on Windows
  + Fix crash when `user_data` is defined before callback
  + Avoid extraneous deprecation warnings
  + Support generic annotations on `Async`
  + fix: Simplify string prefix handling
  + doc: Use gobject-linter for linting GObject code

==== python-msgpack ====
Version update (1.2.3 -> 1.2.4)

- Uppdate to 1.2.4: (GHSA-j586-36cw-2gc2)
  - fallback: pass object_pairs_hook a list of pairs by @youdie006
    in #744
  - fallback: leave the object unread when a header type does not
    match by @Shaisolaris in #748
  - Bump the all-dependencies group with 3 updates by
    @dependabot[bot] in #749
  - fallback: return bytes from Unpacker.read_bytes by @Cherith1222
    in #747
  - Run tracemalloc tests sequentially by @methane in #758

==== python-pip ====
Version update (26.2.1 -> 26.2.2)

- update to 26.2.2:
  * Upgrade certifi to 2026.10.19

==== python-pycares ====
Version update (5.0.1 -> 5.2.1)

- update to 5.2.1:
  * Bump c-ares to version 1.34.9
- update to 5.1.0:
  * Update Python 3.14 version
  * cleanup code extract_record_data with new _extract* system
  * Fix decoding of CAA records
  * enable uploading pycares wheels to the release page
  * reinstate a couple of skipped tests
  * Fix handle leak in c-ares submission methods
  * Defer ares_destroy to __del__ to fix close()/submit use-
    after-free
  * Fix handle leaks if callback raises exception
  * Make all Channel methods thread-safe
  * Drop support for Python 3.9
  * Fix Channel.timeout() returning 0.0 when no queries are
    pending
  * Fix double-free of dnsrec in Channel.search()
  * Fix local IPv6 and device binding
  * build(deps): bump pypa/cibuildwheel from 3.4.1 to 4.2.0

==== python-pycparser ====
Version update (3.0 -> 3.12)

- update to 3.12:
  * Emit one type definition for declarators that share it
  * raise ParseError for _Atomic applied to array or function
    type
  * Fix code generation for the _Pragma operator
  * Parse GNU statement expressions as primary expressions
  * Fix shared type declarations in switch cases
  * raise ParseError for typedef in a parameter declaration
  * Scope for loop init declarations to the loop
  * Enhanced C11 support
  * Drop an unneeded direct build depndency on wheel
  * fix: handle integer suffix in #line directive without
    crashing
  * Update default branch to main
  * fix: raise ParseError instead of AssertionError on unmatched
    '}'
  * Add support for Python 3.15
  * Fix empty compound literal (type){} raising ParseError
  * Fix compound literal statements in C generator
  * Keep the contents of adjacent u8 string literals

==== python-pypdf ====
Version update (6.19.0 -> 6.21.2)

- Update to 6.21.2
  * SEC: Avoid repeated full file loads
  * SEC: Limit size of standard xref table
  * Decode UniGB-UTF16 CMaps as UTF-16BE
  6.21.1 (CVE-2026-113786, bsc#1286632)
  * SEC: Only open /DCTDecode image data with the Pillow JPEG plugin
  6.21.0 (CVE-2026-113789, bsc#1286633, CVE-2026-113790, bsc#1286634, CVE-2026-113791, bsc#1286635)
  * SEC: Improve performance and limit field work
  * SEC: Limit stream parsing work
  * Allow custom fit modes for named destinations
  * Treat NUL as whitespace in ArrayObject
  6.20.1 (CVE-2026-113792, bsc#1286636, CVE-2026-113793, bsc#1286637)
  * SEC: Prevent cyclic tree handling
  6.20.0 (CVE-2026-113795, bsc#1286639, CVE-2026-113794, bsc#1286638)
  * SEC: Limit work per stream (filter count, accumulated decoding work)
  * Add support for BrotliDecode filter
  * Performance improvements
  * Declare official support for Python 3.15

==== python-tornado6 ====
Version update (6.5.10 -> 6.6)

- Update to 6.6.0 (CVE-2026-115927, bsc#1289050,
    CVE-2026-116577, bsc#1289064,
    CVE-2026-116578, bsc#1289058):
  [#] General changes
  - Python 3.15 is now supported. Python 3.9 and 3.10 are no longer
    supported; 3.11 is the minimum supported version.
  - Free-threaded python interpreters are now supported; prebuilt
    wheels are available for 3.14t and 3.15t.
  - Windows on ARM is now supported and prebuilt wheels are available.
  - Prebuilt wheels are now available for ``riscv64``, ``ppc64le``,
    and ``s390x`` architectures on Linux. These architectures are
    experimental and have limited support and testing.
  - PyPy 8.0 is now supported (for both Python 3.11 and 3.12).
  - Error messages have been improved in many places.
  - Improved handling of `asyncio.CancelledError` in various parts of
    the framework.
  [#] Feature highlights
  - New feature ``cross_origin_protection`` provides a new mechanism
    for protecting against XSRF and other cross-origin attacks. This
    feature is easier to use than ``xsrf_cookies`` and is expected to
    become the default in Tornado 6.7.
  [#] Deprecation notices
  - The ``host`` argument to the `.HTTPServerRequest` constructor is
    deprecated (since Tornado 6.5.2); use ``headers["Host"]`` instead.
    It will be removed in Tornado 6.7.
  - The ``start_line`` argument to the ``HTTPServerRequest``
    constructor will become required in Tornado 6.7. The ``method``,
    ``uri``, and ``version`` arguments are deprecated and will be
    removed at the same time. All remaining arguments will become
    keyword-only. A `DeprecationWarning` is now emitted when
    ``start_line`` is not provided or when the ``host``, ``method``,
    or ``uri`` arguments are used.
  - ``tornado.auth.OpenIdMixin`` is deprecated and will be removed in
    Tornado 6.7 (this is a change in the timeline; it was previously
    scheduled for removal in Tornado 7.0).
  - ``tornado.util.TimeoutError``, ``tornado.gen.TimeoutError``, and
    ``tornado.ioloop.TimeoutError`` are deprecated. They are aliases
    for the builtin `TimeoutError`, which should be used instead.  (No
    warning is emitted when these aliases are used.)
  - Calling `.GzipDecompressor.decompress` without a ``max_length``
    argument (or with ``max_length=0``) is deprecated and emits a
    `DeprecationWarning`. In Tornado 7.0, ``max_length`` will be
    required.
  - The ``xsrf_cookies`` application setting is expected to be
    deprecated in Tornado 6.7 (with warnings) in favor of
    ``cross_origin_protection``. It will not be removed before Tornado
    7.0.
  [#] Type annotation changes
  - `tornado.gen.multi` now has overload annotations to indicate that
    its return type depends on its inputs (list vs dict).
  - `.HTTPServerRequest.method` and ``uri`` attributes are now typed
    as ``str`` instead of ``str | None``.
  [#] tornado.curl_httpclient
  - The minimum supported version of libcurl is now 7.81 (which is the
    version shipped by Ubuntu 22.04 LTS).
  - Passing a coroutine as the ``streaming_callback`` argument now
    fails with a `TypeError`.  (Coroutine streaming callbacks are only
    supported by ``simple_httpclient``.)
  [#] tornado.gen
  - `asyncio.CancelledError` is now handled correctly in coroutines,
    `.multi`, and `.chain_future`.
  - `.WaitIterator` now supports multiple copies of the same `.Future`
    object.
  - `.with_timeout` has a new ``message`` argument, which sets the
    message of the `TimeoutError`.  It may be a string or a callable
    that returns a string (which is only called if the timeout
    expires).
  [#] tornado.http1connection
  - Invalid ``Host`` headers are now logged at the INFO level instead
    of as an uncaught exception.
  - Line folding in HTTP headers is no longer supported. This was
    deprecated in Tornado 6.5 but is being removed sooner than
    originally scheduled to avoid DoS risk.
  - Reading a request or response body now yields to the event loop
    periodically, so a peer that sends a body faster than it can be
    processed (especially with many tiny chunks in chunked encoding)
    can no longer block the event loop for the duration of the body.
  - Small chunks of a body using chunked encoding are now coalesced
    before being passed to ``data_received``, so the pieces seen by
    the application no longer correspond to the HTTP chunk boundaries.
  - A chunk in a chunked body that is not followed by ``\r\n`` is now
    reported as an `.HTTPInputError` instead of raising
    ``AssertionError`` (or being silently accepted when Python is run
    with ``-O``).
  - Gzipped bodies containing multiple members are now decompressed
    correctly. Trailing garbage at the end of a body or in between
    members is now an error instead of being silently ignored, as is a
    body that is truncated partway through a member. This applies both
    to responses received by ``simple_httpclient`` and to requests
    received by a server with ``decompress_request=True``.
  [#] tornado.httputil
  - If ``start_line`` is not passed to `.HTTPServerRequest`, missing
    ``method`` and ``uri`` arguments now default to ``GET`` and ``/``
    (with a `DeprecationWarning`) instead of leaving these attributes
    as ``None``.
  - ``HTTPHeaders.__delitem__`` no longer raises `KeyError` at
    inappropriate times.
  [#] tornado.iostream
  - Fixed a socket leak when a timeout occurs during a TLS handshake,
    ... changelog too long, skipping 118 lines ...
- Drop upstreamed patch run-multi-process-in-fresh-process.patch

==== python313 ====
Subpackages: python313-curses python313-dbm python313-tk

- Require libexpat1 >= 2.8.5 for python313-base and raise
  the Expat build requirement accordingly. pyexpat uses
  XML_SetHashSalt16Bytes when built with Expat >= 2.8, but the
  automatic SONAME dependency permits older libraries, breaking
  imports and venv/ensurepip (bsc#1285433).

==== python313-core ====
Subpackages: libpython3_13-1_0 python313-base python313-devel

- Require libexpat1 >= 2.8.5 for python313-base and raise
  the Expat build requirement accordingly. pyexpat uses
  XML_SetHashSalt16Bytes when built with Expat >= 2.8, but the
  automatic SONAME dependency permits older libraries, breaking
  imports and venv/ensurepip (bsc#1285433).

==== qpdf ====
Version update (12.4.1 -> 12.4.2)

- Update to version 12.4.2:
  * Enhancements
  - Improve validation of object ids and generation numbers when
    reading special objects (such as xref or hint streams) and
    during reconstruction of damaged files.
  - In –show-linearization, including a listing of all the object numbers
    that qpdf would assign to each part. Implementation of linearization
    is inconsistent across tools, so unless qpdf linearized the file,
    the computed part assignments are not likely to match what’s actually in the file.
  - Radically decrease memory usage and improve performance when linearizing certain types of files.
  * Bug fixes
  - Fix some very old, latent linearization bugs.
    These will change linearization output for some files.
  - Previous versions of qpdf incorrectly determined whether an object was shared.
    The correct behavior based on the specification and for correct performance
    is that an object is shared if it is accessed by more than one page.
    qpdf was treating it as shared if it was reachable from more than
    one starting point including non-page objects. This would cause objects
    that were referenced by both page and non-page objects to be placed in part 9,
    at the end of the file, rather than in the appropriate part based on which
    pages accessed the object. In practice, it is rare for objects to be accessed
    by both page and non-page objects, so this won’t affect the output of most files.
  - In some cases, the Pages tree was treated as a shared object and placed earlier
    in the file than necessary. This was harmless, but incorrect, and it was fixed
    as a side effect of the performance improvements.
  - If items in the Outlines dictionary are referenced by pages, the outlines hint table will be absent,
    and the outlines will appear in the groups of page objects, regardless of the document’s page mode.
  - Reject trailing characters in bounded numeric command-line option values instead of silently accepting their numeric prefixes.
    This is technically a breaking change, but if you were relying on qpdf’s behavior of accepting malformed arguments, it’s better to fix that.
  - Report a file whose only line is a PDF header as damaged instead of failing with a system error.
    Reading a line whose end-of-line run reaches the end of the file left the input source one byte
    before the start of that line, which at offset 0 is a seek to -1.
  * Build changes
  - Create binary release for additional platforms:
  - Windows arm64
  - Linux aarch64 (arm64) AppImage
  - Linux aarch64 (arm64) stand-alone binaries
  - macOS stand-alone binaries (Apple silicon and Intel). These are not signed with an Apple Developer ID
    or notarized, so you will have to remove Apple’s quarantine attribute as described in the
    top-level README.md in the source distribution.
  - Add cmake flags STATIC_JPEG and STATIC_OPENSSL which link jpeg and openssl statically.
    This is to make it easier to create binary distributions without dependencies on libraries
    that are less likely to be present on the system. On some platforms, the static libraries
    will have to be built with position-independent code, so this may not work seamlessly in all environment.
    It is used to create the macOS binaries included in qpdf releases.
  - Add cmake flag STATIC_EXTRA_LIBS to pass additional static libraries when linking qpdf.
    This is useful if you are trying to link statically with libraries that are not automatically detected as dependencies.

==== qqc2-breeze-style6 ====
Version update (6.8.0 -> 6.8.2)

- Update to 6.8.2
  * New bugfix release
  * For more details please see:
  * https://kde.org/announcements/plasma/6/6.8.2
- Changes since 6.8.1:
  * Update version for new release 6.8.2
  * MobileTextActionsToolBar: Fix popup not closing after an action is activated
  * MobileTextActionToolbar: Fix TextArea not showing contextual actions (kde#526591)
- Update to 6.8.1:
  * New bugfix release
  * For more details see https://kde.org/announcements/plasma/6/6.8.1
- Changes since 6.8.0:
  * Update version for new release 6.8.1
  * ToolButton: Fix flat mode not inheriting background color scheme (kde#526786)

==== qt6-base ====
Subpackages: libQt6Concurrent6 libQt6Core6 libQt6DBus6 libQt6Gui6 libQt6Network6 libQt6OpenGL6 libQt6OpenGLWidgets6 libQt6PrintSupport6 libQt6Sql6 libQt6Test6 libQt6WaylandClient6 libQt6Widgets6 libQt6WlShellIntegration6 libQt6Xml6 qt6-network-tls qt6-networkinformation-connman qt6-networkinformation-glib qt6-networkinformation-nm qt6-platformtheme-gtk3 qt6-printsupport-cups qt6-sql-sqlite qt6-wayland

- Update qt6-waylandclient-private-devel dependencies
- Add upstream fix:
  * CVE-2026-105924-qtbase-6.12.diff (CVE-2026-105924)

==== qt6-declarative ====
Subpackages: libQt6LabsAnimation6 libQt6LabsFolderListModel6 libQt6LabsPlatform6 libQt6LabsQmlModels6 libQt6LabsSettings6 libQt6LabsSharedImage6 libQt6LabsStyleKit6 libQt6LabsSynchronizer6 libQt6LabsWavefrontMesh6 libQt6Qml6 libQt6QmlCore6 libQt6QmlDesignSupport6 libQt6QmlLocalStorage6 libQt6QmlMeta6 libQt6QmlModels6 libQt6QmlNetwork6 libQt6QmlWorkerScript6 libQt6QmlXmlListModel6 libQt6Quick6 libQt6QuickControls2-6 libQt6QuickControls2Impl6 libQt6QuickDialogs2-6 libQt6QuickDialogs2QuickImpl6 libQt6QuickDialogs2Utils6 libQt6QuickEffects6 libQt6QuickLayouts6 libQt6QuickParticles6 libQt6QuickShapes6 libQt6QuickTemplates2-6 libQt6QuickTest6 libQt6QuickVectorImage6 libQt6QuickWidgets6 qt6-declarative-imports

- Add upstream change (boo#1287613, QTBUG-150769)
  * 0001-QQuickItemView-don-t-leave-dangling-entries-in-unreq.patch
- Add upstream change (kde#527720)
  * 0001-Fix-teardown-hang-with-QuickPixmapReader.patch

==== qt6-qt5compat ====
Subpackages: libQt6Core5Compat6 qt6-qt5compat-imports

- Add upstream changes (CVE-2026-100140, boo#1289130)
  * CVE-2026-100140-qt5compat-6.12-0001.diff
  * CVE-2026-100140-qt5compat-6.12-0002.diff
  * CVE-2026-100140-qt5compat-6.12-0003.diff
  * CVE-2026-100140-qt5compat-6.12-0004.diff

==== quadrapassel ====
Version update (50.2 -> 51.1)

- Update to version 51.1:
  * Made the game statistics in the compact mode into cards
  * Made miscellaneous style changes
  * Added a focus ring to the game cards
  * Documented the Return key shortcut for starting a game
  * Updated libgnome-games-support
  * Updated translations.
- Update to version 51.0:
  + Changed preferred audio backend to pipewire
  + Updated libgnome-games-support
  + Updated translations.
- Update to version 51.rc.1:
  + metainfo: add missing end tag.
- Update to version 51.rc:
  + Removed the man page
  + Modernized the 'Game Over' view
  + Removed the pango, pangocairo, posix, and rsvg dependencies
  + Replaced the cairo drawn blocks with css styling
  + Removed the tango and tango flat styles
  + Changed the game stats to use cards
  + Replaced the 'Appearance' dialog with an 'Appearance' page in
    the preferences
  + Updated translations.
- Update to version 51.alpha:
  + Fixed a bug where blocks would not stop moving if the game lost
    focus.
  + Fixed a bug where game keys wouldn't work once if they were
    pressed before to starting a game.
  + Added a -1 difficulty, where the level never increases.
  + Updated translations.

==== rav1e ====

- Add rav1e-Make-object-order-deterministic.patch: Make object
  order deterministic (bsc#1289073, gh#medek/nasm-rs#47)

==== rdma-core ====
Version update (63.0 -> 65.0)
Subpackages: libefa1 libhns1 libibverbs libibverbs1 libionic1 libmana1 libmlx4-1 libmlx5-1 librdmacm1

- Remove librdmacm dependency on rdma-core to avoid systemd being pulled
  in by valkey (bsc#1265295)
- Add kernel-boot-Remove-Wants-network-pre.target-from-ini.patch
  to fix network-pre.target being resolved during initrd (bsc#1276748)
- Update to rdma-core v65.0
  - https://github.com/linux-rdma/rdma-core/releases/tag/v65.0
- Update to rdma-core v63.1
  - https://github.com/linux-rdma/rdma-core/releases/tag/v63.1

==== rsync ====
Version update (3.5.1 -> 3.5.2)

- Update to 3.5.2
  - Security fixes:
  - Bounded strong-checksum work when a malicious receiver
    supplies weak checksums that collide with consecutive
    rolling windows (CVE-2026-119741, bsc#1289289).
  - Bug fixes:
  - Fixed interrupted `--append` and `--inplace` transfers
    writing the final 256 KiB buffer twice. An interrupted
    destination now remains a clean prefix which the next
    transfer can resume or repair.
  - Fixed uploads through `rrsync` when the destination file
    already exists.
  - Fixed poor matching performance on large sparse and
    repeated-block files when duplicate checksum chains
    exhausted the search limit.
  - Prevented the `--inplace` matcher from advancing its
    aligned basis index beyond the available checksum entries.
    This avoids signed overflow on large source files when the
    peer supplies a small block count.
  - Recovered from failed hard-link creation without aborting
    or hanging the generator.
  - Prevented an out-of-bounds write while invalidating a
    sender checksum after a file read error when the
    negotiated checksum length is zero.
  - Fixed a daemon receiver stack overflow when queued
    deletion output reached `--max-alloc`.
  - Fixed a `--files-from` pull from a subdirectory of a daemon
    module, which read each listed file from the module root
    instead.
  - Fixed password files whose first line is empty.
  - Escaped terminal control characters in filenames and
    diagnostics written to standard output, standard error and
    log files.
  - Restored daemon startup from accepted named Unix sockets on
    standard input.
  - Fixed forward-DNS hostname entries in daemon `hosts allow`
    and `hosts deny` lists for IPv6 peers.
  - Preserved Unix symlink permissions on systems which require
    `fchmodat()` to change the mode of a symlink rather than its
    target.
  - Enhancements:
  - Added `--nice` to adjust CPU and I/O scheduling priorities
    for local and remote rsync processes.
  - Added `--delay-symlinks` to defer creating new and changed
    symlinks until other transferred files are in place. It
    implies `--no-inc-recursive` and requires protocol 29 or
    newer.
- Add rsync-direct-interpreters.patch: use direct interpreter
  paths, #!/bin/bash for rsync-ssl and #!/usr/bin/perl for
  rsyncstats, instead of /usr/bin/env lookups. The scripts
  then declare a proper interpreter dependency rather than
  relying on PATH resolution at runtime.
- Do not ship rsyncstats twice: the support documentation
  is copied without it, the script is installed once in
  /usr/bin.
- Drop the unused rsyncd.rc source and the empty init.d and
  xinetd.d directory creation; the daemon runs through the
  systemd units.
- Drop the grep and sed post requirements, no scriptlet of
  this package calls either tool.
- Spec cleanup per the packaging guidelines: drop the
  obsolete Group tag and write the library build
  requirements in pkgconfig form.

==== rsyslog ====

- fix postgresql dependency for devel package (bsc#1286162)

==== ruby4.0 ====
Version update (4.0.7 -> 4.0.9)
Subpackages: libruby4_0-4_0

- Set the alternative names inside the loop in %post and %preun.
  They were set before it, while $bin was still empty, so without
  libalternatives /usr/bin/.ruby4.0 was registered instead of the
  versioned alternatives (bundle.ruby4.0, rake.ruby4.0, ...), and
  their symlinks dangled.
- Update to 4.0.9 (boo#1287171 CVE-2026-89078, CVE-2026-93577,
  CVE-2026-97229, CVE-2026-110264)
  https://www.ruby-lang.org/en/news/2026/10/23/regexp-fixes-for-gitlab-cves/
  - Reject overflowed repeat/null-check IDs in huge regexps by
    makenowjust
- Update to 4.0.8
  - Bug #22311: Build crashes on macOS 26 with the macOS 27 SDK
    because pipe2() and dup3() are unavailable - Ruby - Ruby Issue
    Tracking System
  - Bug #22174: Set operations (&, ^, collect!, flatten, classify,
    divide) do not preserve compare_by_identity - Ruby - Ruby Issue
    Tracking System
  - Bug #22383: Fix inverted STR_SHARED check in
    rb_str_tmp_frozen_release - Ruby - Ruby Issue Tracking System
  - Bug #22387: str_shared_replace incorrectly recalculates termlen
  - Ruby - Ruby Issue Tracking System
  - Bug #22327: RubyVM::ZJIT.reset_stats! aborts the process (Rust
    panic) when ZJIT is not enabled - Ruby - Ruby Issue Tracking
    System
  - Bug #22381: MatchData assigned to $~ is incorrectly reused -
    Ruby - Ruby Issue Tracking System
  - Bug #22321: Assertion Failed:
    rb_vm_search_method_slowpath:RB_TYPE_2_P(klass, RUBY_T_CLASS,
    RUBY_T_ICLASS): klass: T_MODULE - Ruby - Ruby Issue Tracking
    System
  - Bug #22315: heap-use-after-free in String unpack with a block
    that mutates the receiver - Ruby - Ruby Issue Tracking System
  - Bug #22318: heap uaf triggered in array.flatten - Ruby - Ruby
    Issue Tracking System
  - Bug #22319: heap buffer overflow triggered by array's zip
    function - Ruby - Ruby Issue Tracking System
  - Bug #22322: AddressSanitizer: use-after-poison in
    econv_description /ruby-src/build/../transcode.c - Ruby - Ruby
    Issue Tracking System
  - Bug #22334: Assertion Failed: VM_ENV_FLAGS:FIXNUM_P(flags) -
    Ruby - Ruby Issue Tracking System
  - Bug #22336: IO:Buffer Heap uaf - Ruby - Ruby Issue Tracking
    System
  - Bug #22330: heap uaf from string.encode() - Ruby - Ruby Issue
    Tracking System
  - Bug #22340: Win32: File.stat succeeds on symbolic-link loops on
    Windows - Ruby - Ruby Issue Tracking System
  - Bug #22335: Stack corruption with >31 keyword args and refined
    Integer#== - Ruby - Ruby Issue Tracking System
  - Bug #22339: Ruby::Box: crash / hang at VM shutdown with
    RUBY_FREE_AT_EXIT=1 - Ruby - Ruby Issue Tracking System
  - Bug #22342: IO#gets can ignore the limit argument in some edge
    cases - Ruby - Ruby Issue Tracking System
  - Bug #22391: Fix propagation of errno in rb_io_maybe_wait. -
    Ruby - Ruby Issue Tracking System
  - Bug #22384: Regexp compile error in the 2nd+ branch of a
    top-level alternation leaks the parse tree (regression from
    [#13332], Ruby 4.0) - Ruby - Ruby Issue Tracking System
  - Bug #22388: Use-after-free when an Enumerable retains its each
    block - Ruby - Ruby Issue Tracking System
  - Bug #22284: Passing an object with to_int to curry as its arity
    causes problems with LLP64. - Ruby - Ruby Issue Tracking System
  - Bug #22416: Respect timezone abbreviation encodings in
    Time#strftime - Ruby - Ruby Issue Tracking System
  - Bug #22426: ZJIT: keyword arguments swapped when passed out of
    declared order to a method with a block (please backport
    d81a11d4e6 to 4.0) - Ruby - Ruby Issue Tracking System
  - Bug #22406: Process.fork can leave the child unable to resolve
    hostnames: getaddrinfo helper threads take glibc's resolver
    lock after releasing the fork lock - Ruby - Ruby Issue Tracking
    System
  - Bug #22445: On macOS, a child of Kernel#fork can abort with
    "[BUG] pthread_rwlock_destroy: Resource busy (EBUSY)" - Ruby -
    Ruby Issue Tracking System
  - Bug #22415: Thread.handle_interrupt needs to preserve errinfo -
    Ruby - Ruby Issue Tracking System
  - Bug #22434: "No live threads left. Deadlock?" when running
    system() or spawn in Ractors - Ruby - Ruby Issue Tracking
    System
  - Backport the regexp compiler program size overflow fixes to
    ruby_4_0 by hsbt · Pull Request #19025

==== salt ====
Subpackages: python313-salt salt-master salt-minion

- Stabilize testsuite
- Added:
  * stabilize-testsuite-791.patch
- Ignore network status when comparing docker networks
- Fix Git state comment formatting
- Fix surogateescape encoding typo in openscap module
- Prevent schedule loss during master connection loss (bsc#1280583)
- Added:
  * fix-docker-tests-785.patch
  * repair-git-state-comment-formatting-788.patch
  * fix-surogateescape-typo-in-openscap-module-790.patch
  * prevent-schedule-loss-when-minion-loses-master-conne.patch

==== samba ====
Version update (4.25.0+git.473.e78e78fbf4 -> 4.25.1+git.476.bfc358351cb)
Subpackages: libldb2 python3-ldb samba-ad-dc-libs samba-client samba-client-libs samba-dcerpc samba-gpupdate samba-ldb-ldap samba-libs samba-libs-python3 samba-python3 samba-winbind samba-winbind-libs

- Update to 4.25.1
  * CVE-2026-109411: Access control bypass via vfs_ceph_rgw
    case-insensitive open; (bso#16276); (bsc#1286540);
  * CTDB: Cannot find device "<iface>@<link>": need to extract real
    interface names; (bso#16274).
  * generate_unique_u64() may not protect against veto_value;
    (bso#16200).
  * Rename with ReplaceIfExists to a target differing only in case
    creates a duplicate instead of replacing; (bso#16261).
  * Samba 4.25.0 fails to build on macOS; (bso#16263).
  * Python smbconf transaction_start() lacks a talloc stack frame
    with CTDB; (bso#16258).
  * Linux i686 build fails on dynamic_lookup; (bso#16265).
  * vfs_acl_xattr crashes on zero-sized flistxattr queries;
    (bso#16287).
  * Dynamic interface support in smbd is racy; (bso#16235).
  * CTDB database operations can be run against incorrect nodes;
    (bso#16254).
  * A node can be banned because it tries to run recovery after
    losing the cluster lock; (bso#16273).
  * All backend log should honor global log level "log level = ";
    (bso#15857).
  * fruit:time machine max size can only be set to an integer and
    is ignored if user sets a float; (bso#15324).

==== screen ====
Version update (4.9.1 -> 5.0.2)

- Update to 5.0.2 (major 5.x release):
  * Rewritten authentication mechanism; new auth, status,
    truecolor and multiinput commands; new %T, %O and %*
    escapes. Removed time, debug, password, maxwin and
    nethack commands.
  * Behavior notes: single socket dir /run/screens (the old
    screens/uscreens split is gone); bare -L only enables
    logging, use -Logfile to set the logfile name;
    screenrc files using
    removed commands need updating; terminfo entries still
    honored.
  * CVE-2025-46805: no signals sent with root privileges.
  * CVE-2025-46804: no file existence test information leaks.
  * CVE-2025-46803: safe PTY default mode of 0620.
  * CVE-2025-23395: reintroduce lf_secreopen for logfile.
  * 5.0.2 also fixes a SendCmdMessage buffer overflow and a
    detaching TOCTOU race with empty terminfo.
- Drop libtinfo.diff (upstream rewrote termcap detection),
  sendfdcont.diff, multicont.diff, nottychmod.diff (all
  superseded by the 5.0 authentication rewrite).
- Refresh screen.keyring from upstream (new upstream signing key).
- Run the upstream unit tests in %%check (the detach
  integration test needs a live pty, unavailable in the
  buildroot).

==== sdbootutil ====
Version update (1+git20261007.53bc127 -> 1+git20261026.4e266f0)
Subpackages: sdbootutil-bash-completion sdbootutil-dracut-measure-pcr sdbootutil-snapper

- Update to version 1+git20261026.4e266f0:
  * Add --version parameter
  * Do not propagate umount to the host
  * Do not add duplicate cmdline.d entries

==== sddm-kcm6 ====
Version update (6.8.0 -> 6.8.2)

- Update to 6.8.2
  * New bugfix release
  * For more details please see:
  * https://kde.org/announcements/plasma/6/6.8.2
- Changes since 6.8.1:
  * Update version for new release 6.8.2
- Update to 6.8.1:
  * New bugfix release
  * For more details see https://kde.org/announcements/plasma/6/6.8.1
- Changes since 6.8.0:
  * Update version for new release 6.8.1

==== selinux-policy ====
Version update (20261019 -> 20261030)
Subpackages: selinux-policy-targeted

- Update to version 20261030:
  * Allow rebootmgr to initialize reboot and soft-reboot (bsc#1287746)
  * Allow httpd map its private runtime files
  * Allow qatlib get attributes of a hugetlbfs filesystem
  * Allow rhsmcertd list insights-client config dirs
  * Allow svirt_tcg_t to use the passt user-mode networking backend
  * Allow sshd_session_t to forward connections to a container runtime socket
  * Allow systemd-oomd the kill capability in the user namespace
  * Allow systemd-oomd signull all domains
  * Revert "Allow systemd-oomd signull systemd-resolved"
  * Update the nvme block devices regex in file context specification
  * Allow keepalived getpgid of its unconfined scripts
  * Allow init mounton system dbus pid socket files
  * Allow systemd-oomd signull systemd-resolved
  * Allow login_userdomain watch localization files for changes
  * Allow login_userdomain mounton gnome generic data home dirs
  * Revert Allow sdbootutil_t write access to /var/lib/sdbootutil (bsc#1281087)
  * Label /run/gnome-remote-desktop with gnome_remote_desktop_var_run_t
  * Allow systemd_nsresourced_t setuid/setgid inside a userns (bsc#1285095)
  * Allow access to systemd-nsresourced runtime socket (bsc#1284651)
  * Allow smbd watch public directories used for file transfer services
  * Allow sshd-session read systemd-nsresourced runtime socket file
  * Allow chrome_sandbox_t map its private tmpfs files
  * Allow sysadm_t to create iSCSI netlink sockets
  * Allow ktlshd connect to pcscd over a unix stream socket
  * Add iptables_dontaudit_read_var_run_dirs() interface
  * Allow polkit-auth read systemd-nsresourced runtime socket file
  * Allow systemd-nsresourced the sys_admin capability
  * Label /var/cache/boomaga with cupsd_rw_etc_t
  * Allow dirsrv to read filesystem sysctls
  * Allow cupsd create bluetooth sockets
  * Allow gnome-remote-desktop handle kerberos replay cache files
  * Allow multiple domains read systemd-nsresourced runtime socket file
  * Update mount_nnp_domtrans() with nosuid_transition
  * Label /run/systemd/coredump socket with systemd_coredump_var_run_t
- Syncing with upstream rawhide selinux-policy up to:
  * 8a22f4474f77c7cb32cd6d18e3da75eaef8696de

==== sensors ====
Subpackages: libsensors4

- Stop using globs in filelist, removes rpmlint warning.
- Own zsh-completion dirs, explicitly list files.

==== shotwell ====
Version update (33.0 -> 33.1)

- Update to version 33.1:
  * Fix a potential issue with continous rescanning of meta-data
  * Fix text entry disappearing in Saved Search dialog
  * Fix hierarchy path creation when moving a tag
  * Fix jumping back to overview when deleting a picture
  * Ignore folders containing .nomedia during monitoring
  * Prefer dc::title over IPTC caption when resolving the title
  * Allow EXIF dates in 1900
  * Fix Help viewer launch from inside flatpak
  * Fix descending sort order in event view
  * Fix various slowness with zooming and panning
  * Center on mouse cursor when scroll-wheel zooming
  * Fix HiDPI issues with panning
  * Updated translations.
- Switch to source service for tarball.

==== simdutf ====
Version update (9.3.0 -> 9.3.3)

- Update to version 9.3.3:
  * Check the tail of the ASCII validators in place
  * Check the tail of the UTF-8 validators in place
  * base64: avoid overflow in base64_length_from_binary_with_lines
  * arm64: fix base64 default_or_url tables accepting '['
- Update to version 9.3.2:
  * icelake: unroll the base64 encoding loop
- Changes from version 9.3.1:
  + icelake: use plain loads in the base64 encoding loop

==== snapshot ====
Version update (50.0 -> 51.0)

- Update to version 51.0:
  + Update gettext-rs to 0.8.0
- Update to version 51.beta:
  + Inhibit idle while the viewfinder is active
  + Remove glycin build dependencies from meson.build
  + Update rust crates
  + Updated translations.
- Drop liblcms2-devel and libseccomp-devel BuildRequires: No longer
  needed.
- Update to version 51.alpha:
  + Minor improvements
  + Updated translations.

==== snowball ====
Version update (3.0.1 -> 3.1.1)

- Update to version 3.1.1:
  + Numerous bug fixes and improvements, see full details in
    /usr/share/doc/packages/snowball/NEWS.
- Rebase patches:
  + build-options.diff
  + python-dist.diff
  + shared-library.diff

==== socat ====

- Add socat-chain-ssl-l-race.patch

==== spacenavd ====
Version update (1.3.1 -> 1.4)

- Add new USB ids
- Version 1.4
  * Add universal keyboard emulation support through uinput (no X11 dependency)
  * UNIX domain socket path is now configurable
  * allow the user to override default pid-file
  * add USB id for spacemouse pro wireless BT
  * add support for multi-key button presses
  * initial support for button hold mappings
  * various other minor bug fixes
- Remove harden_spacenavd.service.patch, contained service file is already
  hardened
- Remove spacenavd-fix-pidfile.patch, not needed anymore

==== spectacle ====
Version update (6.8.0 -> 6.8.2)

- Update to 6.8.2
  * New bugfix release
  * For more details please see:
  * https://kde.org/announcements/plasma/6/6.8.2
- Changes since 6.8.1:
  * Update version for new release 6.8.2
  * Delete temporary OCR text file once job is done
- Update to 6.8.1:
  * New bugfix release
  * For more details see https://kde.org/announcements/plasma/6/6.8.1
- Changes since 6.8.0:
  * Update version for new release 6.8.1
  * Gui: Don't shadow Item.focusPolicy in the button containers
  * Fix transient popup CLI mapping for -u/-t
  * SpectacleCore: update current saved image URL so Save overwrites file after Save As (kde#526111)
  * Update version for new release 6.8.1
  * ExportManager: fall back to default location if last save directory is missing (kde#526909)

==== speex ====

- Fix out-of-bounds write in speex_bits_read_whole_bytes()
  (CVE-2026-116741, bsc#1288101):
  speex-CVE-2026-116741.patch
- Refresh speex-no-build-date.patch to be applied with -p1

==== spice ====

- bsc#1285876 - VUL-0: CVE-2026-105958: spice: heap corruption due
  to insufficient bounds validation of client-supplied offsets in
  multiple migration data handlers
  000-smartcard-fix-NULL-dereference-of-scc-in-on_message_from_device.patch
  001-CVE-2026-105958-migration-dont-abort-on-invalid-migration-data.patch
  002-CVE-2026-105958-reds-fix-wrong-struct-size-in-agent-migration-data-restore.patch
  003-CVE-2026-105958-display-validate-surface_id-bounds-in-migration-restore.patch
  004-CVE-2026-105958-display-validate-surfaces_at_client_ptr-in-display-migration-data.patch
  005-CVE-2026-105958-reds-validate-agent-migration-data-fields-before-use.patch
  006-CVE-2026-105958-char-device-validate-write_data_ptr-bounds-in-migration-restore.patch
  007-CVE-2026-105958-smartcard-validate-migration-read-bounds-and-buffer-sizing.patch
  008-CVE-2026-105958-smartcard-remove-spice_assert-on-attacker-controlled-read_size.patch
  009-CVE-2026-105958-smartcard-dont-allocate-based-on-attacker-controlled-message-length.patch
- bsc#1285875 - VUL-0: CVE-2026-105959: spice: heap buffer
  overflow due to incorrect truncation of `size_t` allocation in
  the GLZ encoder dictionary restore path
  010-CVE-2026-105959-glz-fix-integer-truncation-in-encoder-malloc-callback.patch
  011-CVE-2026-105959-glz-validate-max_encoders-from-migration-data.patch

==== sqlite3 ====
Version update (3.53.2 -> 3.54.1)
Subpackages: libsqlite3-0 sqlite3-tcl

- Update to version 3.54.1:
  * https://sqlite.org/releaselog/3_54_1.html
  * Fix a possible heap-buffer overflow on 32-bit builds (64-bit
    builds are not affected).
  * Fix other problems in 3.54.0 reported by users.
- Update to version 3.54.0:
  * https://sqlite.org/releaselog/3_54_0.html
  * CLI enhancements: prompt strings may contain escape sequences
    that expand to show state information, and the initial prompt
    is taken from the SQLITE_PS1 and SQLITE_PS2 environment
    variables if set. The default prompt honors NO_COLOR.
  * CLI: columnar output modes now show the column name header by
    default even if the query returns no rows.
  * CLI: the new ".diskused" dot-command (based on the new
    diskused() extension) replaces the separate sqlite3_analyzer
    utility, which is now deprecated upstream.
  * CLI: the .mode command gained the --rowcount, --titles,
  - -ifmt and --fpfmt options.
  * CLI: ending an SQL command with a line containing just "go" or
    "/" is discontinued unless compiled with
  - DSQLITE_SHELL_LEGACY_COMMAND_TERMINATOR.
  * Query planner improvements, including better optimization of
    "expr OR TRUE" / "expr OR FALSE", skipping needless updates of
    expression indexes, ignoring DISTINCT on the right-hand side
    of IN, and faster UNION queries with a LIMIT of exactly 1.
  * ALTER TABLE now raises an error on any attempt to add, drop,
    or rename columns named "ROWID", "_ROWID_" or "OID".
  * New %J and %j conversions to render JSON string literals in
    the built-in printf() and the format() SQL function.
  * New C-language interfaces: sqlite3_result_str() and
    sqlite3_incomplete().
  * Date/time functions: added the "weekday -N" form of the
    weekday modifier and the "end of" modifier.
  * The authorizer callback is now invoked for SQL functions found
    in the DEFAULT clauses of CREATE TABLE statements.
  * Added SQLITE_LIMIT_SCHEMA and SQLITE_LIMIT_TRIGGER_STEPS to
    the sqlite3_limit() interface.
  * Use O_TMPFILE when generating temporary files on systems that
    support it.
  * About 4% faster as measured by counting CPU cycles in the
    speedtest1 benchmark.
- Raise RLIMIT_DATA in %check so that the ASAN based tests can
  reserve their shadow memory region.

==== squashfs ====
Version update (4.6.1 -> 4.7.5)

- Update to 4.7.5:
  * Mksquashfs now reads files in parallel (-small-readers,
  - block-readers, -single-reader options), much faster on SSDs
    and network filesystems; "fragment block stall" eliminated,
    improving performance by 20% or more
  * Rewritten help system using the full terminal width with pager
    support and -help-all/-help-section/-help-option selectors
  * New reproducible-image options: -repro, -repro-time, plus
  - mkfs-time/-inode-time/-root-time inode variants
  * Mksquashfs/Sqfstar can stream the filesystem to stdout
    (-stream) and fix it up afterwards (-fix); sparse file
    reading greatly sped up via SEEK_DATA
  * New Align action, -force-file-mode/-force-dir-mode,
  - numeric-owner, -mem/-mem-percent for unsquashfs and more
  * Bug fixes: possible filesystem corruption with sparse files,
    broken -max-depth, pseudo-file definition issues, -offset
    regression, tar-file cache leak in sqfstar
  * Many more fixes and improvements; see upstream's release notes
    for the full list
- Rebase squashfs-64k.patch (pad to 64K for ppc64 alignment) to
  4.7.5, covering the new streamed-filesystem superblock padding
  and the rewritten help texts; squashfs-thread-limit refreshed
  for the reworked initialise_threads().
- Adjust packaged docs to the new upstream layout (README.md,
  CHANGES.md).

==== sso-mib ====
Version update (0.10.1 -> 0.11.0)

- Import version 0.11.0
  New sso-mib-sasl-xoauth2 SASL plugin added via the new
  libsso-mib-sasl-xoauth2 package.

==== strace ====
Version update (7.2 -> 7.3)

- Update to strace 7.3
  * Implemented decoding of fchroot syscall.
  * Implemented decoding of SO_RIGHTS_NOTRUNC socket option.
  * Implemented decoding of IFA_MC_USERS and IFA_PROTO netlink attributes.
  * Implemented decoding of macvlan IFLA_INFO_DATA netlink attributes.
  * Implemented decoding of NHA_DST_PORT, NHA_GROUP_STATS,
    NHA_HW_STATS_ENABLE, NHA_HW_STATS_USED, and NHA_OP_FLAGS netlink
    nexthop attributes.
  * Implemented decoding of RTA_DEL_REASON route attribute.
  * Implemented decoding of TUN/TAP ioctls.
  * Implemented decoding of UFFDIO_MOVE, UFFDIO_RWPROTECT, and
    UFFDIO_SET_MODE userfaultfd ioctls.
  * Implemented decoding of bpf_link_info for BPF_OBJ_GET_INFO_BY_FD.
  * Implemented decoding of landlock_restrict_self flags.
  * Implemented decoding of ZCRX_CTRL_ADD_AREA io_uring zcrx ctrl operation.
  * Implemented decoding of VIDIOC_{UN,}SUBSCRIBE_EVENT ioctl commands.
  * Enhanced -e namespace=new option to decode setns(2) namespace transitions
    when nstype is 0.
  * Implemented decoding of auxiliary clock IDs.
  * Updated lists of ATA_*, KVM_*, NL80211_*, V4L2_*, and *_MAGIC constants.
  * Updated lists of ioctl commands from Linux 7.3.
  * Fixed the argument names printed by -N/--arg-names for getresgid,
    setfsgid, setgid, setregid, and setresgid syscalls.
  * Limited nested NLMSG_ERROR netlink decoding to prevent stack exhaustion.
  * Fixed out-of-bounds read in STHYI kernel response buffer tail decoding
    when the declared header length exceeds the available buffer size.
  * Fixed decoding of AF_BRIDGE RTM_GETNEIGH requests, including requests
    with multiple attributes.
  * Fixed several procfs lookups that used the wrong PID when strace's
    PID namespace differs from the mounted /proc, affecting -e namespace=new
    annotations for setns(2) and unshare(2), -Y/--decode-pids=comm process
    names, and "already traced" attach diagnostics.
  * Fixed -e namespace=new to report the correct namespace ID for setns(2)
    and unshare(2) transitions to PID and time namespaces, which affect
    future children rather than the caller.  An unavailable PID namespace
    ID after unshare(2) is omitted.
  * Fixed dynamic clock id decoding.

==== sushi ====
Version update (50.0 -> 51.2)

- Update to version 51.2:
  * Minor graphical app icon fixes
  * Update vulnerable NPM packages
  * Update and modernize flatpak manifest
  * Add desktop file
  * Set application name
  * Updated translations.
- Update to version 51.1:
  + Fix toolbar overlay from blocking content
  + Fix release note tags
  + Add metainfo validation
  + Updated translations.
- Update to version 51.0:
  + Handle corrupted pdf documents
  + Handle strings as errors from plugins
  + Use ".Devel" suffix for the nightly version
  + Add app icon
  + Fix papers dependency version
  + Updated translations.
- Update to version 51.rc:
  + Enhancements:
  - Add Rename (`F2`) and Trash (`Del`) shortcuts
  - Add `O` as a shortcut to open a file
  - Open folders in currently previewed nautilus window
  - Add play/pause (`P`) shortcut for audio and video
  - Use dark background for videos
  - Add foundry config
  - Resize window on changed scale factor
  + Bug Fixes:
  - Fix playing animated images using glycin
  - Fix re-attaching dialog to nautilus after previously closing
    the window
  - Ignore errors from stopped/cancelled renderers
  - Fix HTML renderer without WebKit availability
  - Fix attaching open-with portal dialogs
  - Fix and rework user resizing detection
  - Avoid resizes on opening of window
  - Fix width/height ratio of image renderer
  - Don't scale up small images
  - Prefer Glycin over Papers to handle loading TIFF files
  - Fix long filenames making the window too wide
  + Plugins:
  - Add example with UI file and shortcuts
  - Add action group setup helper
  - Add relative path resolving helper
  - Rename markReady/markInitialized API functions
  - Add explicit markFailed error API
  - Remove ResizePolicy.CUSTOM, use ResizePolicy.SCALED instead
  + Backend Changes:
  - Create RendererWrapper that handles overlays and GTK window
    size geometry
  - Use SignalGroup for renderer signals
  - Add cyclic heap dumping development mechanism
  - Rework content type matching, remove legacy generated type
    list
  - Report (some) video stream errors
  - Separate out LibreOffice conversion logic from pdf renderer
  - Only initialize PapersDocument on demand
  - Add an abstraction over GLib sources and connections
  - Fix various signal-related leaks
  - Port text UI to blueprint
  - Make private renderer fields inaccessible to renderers
  - Use correct wrap mode in text renderer
  - Improve error handling
  - Improve reactivity for large text files
  + Updated translations.
- Update to version 51.beta:
  + UI changes:
  - Show a loading spinner when loading a file takes longer
  - Ensure legibility of icons in statuspage
  - Clamp MediaControls to limit width
  - Wrap lines in text viewer
  - Handle single- and double-click in video viewer
  - Add double-click to fullscreen support to image viewer
  - Enable context menu in HTML viewer
  - Prompt user before loading remote resources in HTML viewer
  - Improve loading states
  - Tweak toolbar and headerbar
  - Fix title for tagless files
  - Always use integrated artwork
  - Hide headerbar in fullscreen
  - Use icon for file open button
  - Preserve aspect ratio when showing images
  + Known regressions: Only the first frame of animated GIFs is
    shown
  + Backend changes:
  - Add more mime types to the LibreOffice viewer
  - Add ESLint
  - Replace use of deprecated GJS APIs with their suggested
    replacements
  - Use Blueprint
  - Handle XHTML mime type
  - Cancel pending operations when file is switched
  - Plug memory leaks
  - Overhaul plugin API and introduce a system-wide plugin path
  - Document plugin API
  - Promisify async calls
  - Rework hovering
  - Improve handling of renderer sizing
    ... changelog too long, skipping 35 lines ...
- Use meson BuildSystem and macros, autogenerate BuildRequires.

==== systemsettings6 ====
Version update (6.8.0 -> 6.8.2)

- Update to 6.8.2
  * New bugfix release
  * For more details please see:
  * https://kde.org/announcements/plasma/6/6.8.2
- Changes since 6.8.1:
  * Update version for new release 6.8.2
- Update to 6.8.1:
  * New bugfix release
  * For more details see https://kde.org/announcements/plasma/6/6.8.1
- Changes since 6.8.0:
  * Update version for new release 6.8.1

==== taglib ====
Version update (2.3 -> 2.3.2)
Subpackages: libtag2 libtag_c2

- Add fix-32bit-overflow.patch
  * Fix 32-bit overflows and i586 test suite
- Update to version 2.3.2 (soname unchanged, libtag.so.2):
  * 2.3.1: Matroska crash and element-length fixes, MP4 cnID
    64-bit/chapter fixes, QT stsc allocation guard, XM save fix.
  * 2.3.2: MP3 unsync/iTunes ID3 fixes, MP4 covr tolerance and
    new codecs, Ogg muxed Vorbis comments, ASF property
    improvements, RF64/BW64 support, Matroska scan/attachment
    fixes, crafted-input hardening (DoS/resource exhaustion).
  * Build: use Requires.private for zlib.
- Modernize spec (pkgconfig zlib, drop Group tags).

==== tecla-keyboard-layout-viewer ====
Version update (50.0 -> 51.0)

- Update to version 51.0:
  + Updated translations.
- Update to version 51.beta:
  + Updated translations.

==== tesseract-ocr ====
Version update (5.5.3 -> 5.5.4)
Subpackages: libtesseract5 tesseract-ocr-common

- Update to version 5.5.4:
  * Hardening release: crafted-traineddata guards, Coverity
    fixes, leak and robustness fixes, training-tool fixes
  * Drop upstreamed patches contained in 5.5.4 (fixes
    credited 2026-09-23):
    tesseract-CVE-2026-88047.patch,
    tesseract-CVE-2026-88048.patch,
    tesseract-CVE-2026-88049.patch,
    tesseract-CVE-2026-88050.patch,
    tesseract-CVE-2026-88051.patch,
    tesseract-CVE-2026-88052.patch,
    tesseract-CVE-2026-88053.patch,
    tesseract-CVE-2026-88054.patch
  * Raise pkgconfig(lept) floor to >= 1.80 per upstream
  * Fix double-free/UAF in AppendLinePolygon for RTL PAGE XML output
    CVE-2026-119338 bsc#1289080
  * lstm: reject old-format WeightMatrix instead of aborting
    CVE-2026-119339 bsc#1289082
  * Reject malformed dimensions in GENERIC_2D_ARRAY deserialization
    CVE-2026-119340 bsc#1289087
  * Neutralise file-sourced pointers in ReadAdaptedClass before use
    CVE-2026-119341 bsc#1289088

==== tevent ====
Subpackages: libtevent0 python3-tevent

- Convert the package to _multibuild flavors: the man pages are
  now built from the "man" flavor of tevent.spec instead of
  a generated tevent-man.spec, so pre_checkin.sh, tevent-man.spec
  and tevent-man.changes are gone. No need to maintain duplicate
  files.
- Merge the duplicated %if blocks in the spec file and give the
  man flavor its own summary and description.
- Remove use of obsolete %py3* macros, use only the maintained
  ones from `python-rpm-macros` package.
- Drop obsolete spec constructs (BuildRoot, %defattr, PreReq,
  legacy suse_version conditionals).
- Build and install pycache files
- fix deps
  * cmocka (>=1.1.8)

==== tftp ====
Version update (5.3 -> 5.4)

- update to 5.4:
  * Much stricter validation of path names in non-chroot mode
  * remap: labels/jump targets, file existence probe, new "gg"
    modifier
  * cleaner handling of restricted user namespaces on Linux
  * new --enable-werror configure option
  * fix several security-relevant path validation bugs (tftpd/path.c)
  * fix buffer overflows in the tftp client (unbounded strcpy in
    request building, OOB write on multi-file put, unbounded write in
    the interactive command-line argument array)
  * fix an out-of-bounds read while scanning request fields in tftpd
  * fix the --map-steps option rejecting valid numeric arguments
  * fix the \x remap macro returning the wrong substitution length
  * fix synchnet() passing the wrong nfds argument to select()
  * add IPv6 support on MacOS X
- fix CVE-2026-85234 (bsc#1280621): out-of-bounds read in
  genmatchstring() when a remap rule with the inverse (~) modifier and
  an abort (a) action formats a custom error message. Fixed upstream
  in 5.4 (commit 4b493532f5ce)
- drop tftp-hpa-0.48-macros-crash.patch: fixed upstream in 5.4
- drop tftp-hpa-0.49-fortify-strcpy-crash.patch: fixed upstream in 5.4
- drop tftp-config_h.patch: config.h ships with the source tree
- adapt tftp-hpa-0.43_include_sys_params.patch,
  tftp-hpa-0.46_colon_check.patch, tftp-hpa-0.48-tzfix.patch and
  tftp-hpa-0.48-macros-v6mapped.patch to 5.4
- add tftp-hpa-5.4-stdbool.patch: include <stdbool.h> in tftpd/path.h
  so that bool/true/false are defined under -std=gnu11
- add tftp-hpa-5.4-macro-dirs.patch: declare AC_CONFIG_MACRO_DIRS in
  configure.ac so that autoreconf -fiv finds the project m4 macros in
  autoconf/m4 (5.4 ships no pre-generated aclocal.m4)

==== tigervnc ====
Subpackages: libXvnc1 tigervnc-selinux xorg-x11-Xvnc xorg-x11-Xvnc-module

- Remove the xinetd migration block from the xorg-x11-Xvnc %post.
  It enabled xvnc.socket with a direct systemctl call when an
  enabled /etc/xinetd.d/vnc was found (bnc#1085974); the migration
  is one-shot by design, has shipped since 2018, and enablement is
  preset-driven via %service_add_post. The block was also the only
  consumer of Requires(post): /bin/awk, which goes with it
- Ship the SELinux policy module with 0644 permissions (it is data,
  not an executable) and annotate the SELinux store %ghost with
  its mode
- Drop the unused mozilla-nss BuildRequires: the Java client is no
  longer signed and nothing in the build invokes the NSS tools
- Drop the obsolete Group tags and a dead commented-out macro line

==== tinysparql ====
Version update (3.11.1 -> 3.12.0)
Subpackages: libtracker-sparql-3_0-0 typelib-1_0-Tracker-3_0

- Update version dependencies according to meson.build.
- Update to version 3.12.0:
  + No changes, version update only.
- Update to version 3.12.rc:
  + Fix potential memory leaks in JSON-LD serializer
  + Fix possible memory leaks in SPARQL parser
- Update to version 3.12.alpha:
  + Performance improvements to ICU full-text search tokenizer
  + Fix potential leaks with malformed ontology definitions
  + Test suite changes to cater for SQLite >= 3.53.1

==== totem ====
Subpackages: totem-plugins totem-video-thumbnailer

- Update version dependencies according to meson.build.
- Own %{_datadir}/GConf and %{_datadir}/GConf/gsettings: legacy
  migration directories.

==== tpm2-0-tss ====
Version update (4.1.3 -> 4.2.1)
Subpackages: libtss2-esys0 libtss2-fapi-common libtss2-fapi1 libtss2-mu0 libtss2-rc0 libtss2-sys1 libtss2-tcti-device0 libtss2-tctildr0

- New subpackage libtss2-tcti-null0
- New subpackage libtss2-tcti-spi-ltt2go0 (add libusb-1.0 dependency)
- Update to 4.2.1
  + TEST: use SHA-256 in EVP signing integration test
  + TCTI: validate the response header length
  + TCTI: add missing size checks for response buffers
  + FAPI: fix quoting of empty event logs
  + FAPI: check the number of branches for policy lists
  + FAPI: validate key size before extracting the public key
  + FAPI: add a missing bounds check on PCR_Select deserialization
  + FAPI: check buffer size in RSASSA and RSAPSS signature conversion
  + FAPI: reject eventlog entries with an empty template value
  + FAPI: bound eventlog entry name reads by the template size
  + FAPI: verify the eventlog digest window fits the template buffer
  + FAPI: fix file leak on read error
  + FAPI: fix tests failing with physical TPMs
  + ESYS: fix compilation without SM4 support
  + ESYS: fix OpenSSL 3.X engine context handling for internal crypto
  + FAPI: fix buffer overflow in ifapi_set_auth_primary
  + SYS: harden the response size checks
  + SYS: validate the length of no-session responses
  + SYS: validate the length of encrypted parameter responses
  + SYS: validate the length of response authorization parameters
  + SYS: use response size instead of buffer size during unmarshalling
  + MU: bound subtype unmarshalling to the TPM2B size field
  + IO: retry poll calls on EINTR and EAGAIN
  + CI: allow CI runs from different repositories
  + CI: preserve existing LD_LIBRARY_PATH
  + CI: update container images
- Update to 4.2.0
  + Fixed
  * Fix: In some calloc calls the parameters number of elements and
    size were swapped.
  * configure.ac: Fix test of == to = to be POSIX compliant
  * FAPI: Add check whether auth values exist for hierarchies.
  * Fixed headers given iwyu output
  * Remove use of which in favor of command -v
  * TCTI: Fix leak if Tss2_TctiLdr_Initialize fails.
  * FAPI: Fix usage of imported external PEM keys for
    PolicyAuthorize.
  * test: skip tcti-spidev on 32bit architectures with 64bit time_t
  * TCTI: fix incomplete teardown in tcti-mssim.
  * FAPI: Fix Fapi_GetPlatformCertificates without certificates.
  * test: Fix incomplete teardown in error cased.
  * configure: install tmpfiles.d and sysusers.d in libdir
  * FAPI: Fixed leak in Fapi_Sign
  * FAPI: Fix Fapi_GetPlatformCertificates without certificates does
    not return TSS2_FAPI_RC_NO_CERT.
  * FAPI: Fix instantiation of policyduplication select when object
    name or public data is used.
  * FAPI: Fix nv object authorization for policy authorize nv.
  * TCTI: Fixed possible “Resource temporarily unavailable” (EAGAIN)
    errors
  * TESTS: Fixed use of PCR16
  * TCTI: Separate namespaces for internal struct
  * ESYS: Fix variable usage in logging message
  * Fix CodeQL complaints
  * ESYS: Fix usage of handles in Esys_AC_Send
  * FAPI: Fix segmentation fault in policy callbacks.
  * FAPI: Add proper OOM handling for profile realloc.
  * FAPI: add missing NULL check after malloc in encode_ek_public.
  * FAPI: memset zero is called in the async functions for the
    command state to ensure the correct cleanup in error cases.
  * tests: Switch to latest cmocka layout
  * FAPI: Fix get_booleal_from_json
  * ESYS: Fix handling of TPM_RH_NULL handles with sessions
  + Added
  * Add clang-format to CI
  * Add clang-tidy to CI
  * Add a .clang-tidy file and applied changes to all source code
  * Add udev rules to create tcm device
  * FAPI: Support storing EK Certificate chains in NVRAM.
  * FAPI: KDF scheme KDF2 added.
  * tcti: add interface config option for spi-ftdi.
  * Complete license information (including non-code) with REUSE
  * Add REUSE tool to CI
  * FAPI: Add new profiles for high range EKs
  * FAPI: Create FAPI NV objects for existing NV indexes
  * Enable ARM64 build on Windows
  * FAPI: Allow usage of restricted keys in Fapi_Sign .
  * FAPI: Nuvoton certificates added.
  * MU: add TPM2_ST_ATTEST_NV_DIGEST attestation type support
  * OpenSSL 4.0 compatible macro usage

==== tpm2.0-tools ====
Version update (5.7 -> 5.8)

- Spec cleanup:
  + Drop unneeded BuildRequires: tpm2.0-abrmd-devel, libuuid-devel,
    gcc-c++ and libtool
  + Simplify the test bcond and run the test suite sequentially
  + Remove the dead pandoc block, fix URL and keyring comment
- Update to 5.8:
  + CVE-2026-75504, CVE-2026-73991, CVE-2026-75503
  + Fixed
  * tpm2_makecredential: fix wrong tcg ek templates
  * tpm2_checkquote: Fix memory leaks, malloced buffer not always
    freed
  * tpm2_checkquote: Fix missing error checking
  * tpm2_getekcertificate: Fix curl_easy_setopt type warnings
  * tpm2_makecredential: Fix usage of name parameter.
  * tpm2_quote/checkquote: Fix usage of little endian serialization.
  * tpm2_eventlog: parse vendor_db as EFI_SIGNATURE_DATA
  * tpm2_eventlog: Fix parsing on big-endian systems
  * tpm2_clockrateadjust: Fix segfault.
  * tpm2_policy: Do not overflow list of policy digests
  * tpm2_eventlog: Fix pretty print for efivar 39
  * tpm2_encode: Fix setting emptyAuth in generated pem file.
  * tpm2_eventlog_yaml.c Fix output of BlobDescription.
  * tpm2_getrandom: Fix --force parameter
  * tpm2_getekcertificate: fix impl to prioritize low range
    certificate
  * Options: Add option to allow usage of password session.
  * tpm2_createpolicy: flush session for trial policy.
  * tpm2_evictcontrol.c: Fix segfault for output of handle
    ESYS_TR_NONE
  * pcr commands: Fix session leaks
  * tools, test: Fix several missing NULL checks after malloc
  * tpm2_util: fix buffer overflow in string validation checks.
  * tpm2_getekcertificate: ensure curl buffer grows to required
    size.
  * tpm2_getekcertificate: fix heap buffer overflow.
  + Added
  * tpm2_quote/checkquote: Add new serialization format is added (-F
    marshaled).
  * tpm2_loadexternal: Add option rsa_exponent_zero
  * tpm2_createek: Add high range templates for rsa20248 and eccp256
  * tpm2_certify: Add parameter qualifying-data.
  * pcr commands: session support added.
  * tpm2_getekcertificate: add option --x509-trunc
  * tpm2_getekcertificate: Provide option -u for certs in NV ram.
  * tpm2_gettestresult: Fix handling of test result.
  * tpm2_checkquote: Fix usage of more than 7 PCRs
  * tpm2_send: Validate command_size before computing data_size.
  * tpm2_send: Avoid unintended stdio closing a file
  * tpm2_util: Allow file names with whitspace characters.
  * tools: fix out-of-bounds write with too many aux sessions.
  * tss2_sign: Add new parameter from which the digest is computed.
  * OpenSSL use 4.0 compatible macros

==== transmission ====
Version update (4.1.3 -> 4.1.4)
Subpackages: transmission-common transmission-gtk

- Update to version 4.1.4:
  * All Platforms:
    + Fixed a potential RCE vulnerability in the macOS client. It requires
    local write access to the user's preferences, so it is not remotely
    exploitable. (GHSA-v7mp-fpv3-jf5r)
    + Fixed a Transmission 4.1.0 regression that could cause torrents with
    zero-byte files to be handled incorrectly, sometimes losing downloaded
    progress
    + Hardened the torrent-add RPC method against malformed requests.
    + Unified launch and delegation between the Qt and GTK clients: If either
    is already running and then you or a browser's mime-type handler tries to
    start the other to add a new torrent, that new torrent will get handed
    off to the pre-existing session.
    + Fixed a build failure that happened when building Transmission with
  - Wnull-dereference -Werror in gcc 12.15.
    + Fixed a rare bug could leave Transmission hung but running on shutdown.
    + Fixed a rare bug that could prevent downloading webseeds from finishing.
    + Fixed a bug where setting TR_CURL_PROXY_SSL_NO_VERIFY broke origin
    server SSL verification.
    + Fixed per-torrent session speed-limit overrides so they apply to both
    downloads and uploads.
  * Qt Client: Improved UI code to use less CPU. (#9161)
  * GTK Client:
    + The torrent list now re-sorts and re-applies its filter when the
    torrent's top folder's name changes, eg after a rename or after a magnet
    link's metadata arrives.
    + Opening a torrent's folder now opens the correct folder when a
    single-file torrent uses a directory structure.
    + Fixed a bug that prevented transmission-gtk's app icon from being found
    on some desktops.
  * Web Client: Fixed a display bug that sometimes listed torrent names as
    'Unknown'.
  * transmission-remote:
    + Fixed a 4.0.0 bug that broke transmission-remote --list-groups.
- Migrate package to _service for easier management.

==== u-boot-rpiarm64 ====
Version update (2026.07 -> 2026.10)
Subpackages: u-boot-rpiarm64-doc

- Update to 2026.10:
  * Full changelog available at:
    https://github.com/u-boot/u-boot/compare/v2026.07...v2026.10
- Switch download URL to github since denx ftp server is down

==== unbound ====
Version update (1.26.1 -> 1.26.2)
Subpackages: libunbound8 unbound-anchor

- Update to 1.26.2:
  * Fix CVE-2026-97206, DoQ path-migration can lead to use-after-free
    on multi-threaded deployments.
    [bsc#1286139]
  * Fix CVE-2026-50106, Possible insecure NXDOMAIN for non-existing
    records under a configured island trust anchor underneath an
    insecure parent.
    [bsc#1286140]
  * Fix CVE-2026-96405, Aggregate DNS name chained pointer
    decompression work leads to degradation of service.
    [bsc#1286141]
  * Fix CVE-2026-109125, Possible cache poisoning vulnerability via
    a cache side-channel exposed by 'unwanted-reply-threshold'.
    [bsc#1286142]
  * Fix CVE-2026-35501, Bypass of a configured island trust anchor
    underneath an insecure parent from an attacker-controlled NSEC
    record.
    [bsc#1286143]

==== union6 ====
Version update (6.8.0 -> 6.8.2)

- Update to 6.8.2
  * New bugfix release
  * For more details please see:
  * https://kde.org/announcements/plasma/6/6.8.2
- Changes since 6.8.1:
  * Update version for new release 6.8.2
  * AbstractElement: Set elementQuery at construction
  * IndicatorElement: Set indicator values at construction
  * TabElement: set hSpace and vSpace at construction
  * AbstractElement: Check if we already have this element and update it
  * output/widgets: scale the widget animation duration with the animation speed (kde#527527)
  * output/quick: Explicitly set the Style instance for TextArea's background (kde#527455)
  * input/css/breeze: Only round delegate backgrounds in list when highlighted (kde#527087)
  * output/quick: Also consider parent for inside-{list,table} hints
  * input/css/breeze: Use large spacing for menubar item horizontal padding (kde#527213)
  * output/widgets: Don't dereference potential nullptr value (kde#527459)
- Update to 6.8.1:
  * New bugfix release
  * For more details see https://kde.org/announcements/plasma/6/6.8.1
- Changes since 6.8.0:
  * TreeViewElement: draw the branch arrow at the size of the indicator
  * UnionStyle: underline accelerators of selectable labels only with Alt
  * Update version for new release 6.8.1
  * CheckBox/RadioButtonElement: Don't draw as a push button without a widget (kde#526764)
  * Elements: Add validity checks
  * :cherries: tools/styletool: Support Tar archived styles in install/inspect/update commands
  * tools/styletool: Add support for extracting files from a Tar archive
  * tools/styletool: Add support for reading existing archives to TarArchive
  * :cherries: tools/styletool: Refactor Tar to TarArchive and make it a proper class
  * ScrollAreaCornerElement: Fix validity check
  * UnionStyle: Remove unused QSplitterHandle check
  * CMakeLists: Remove Breeze QStyle dependency
  * delegate: Add focusframe
  * FocusElement: Fix validity check
  * AbstractElement: Add changed hint on _kde_highlight_neutral

==== usb_modeswitch ====
Version update (2.6.1 -> 2.6.2)
Subpackages: usb_modeswitch-data

- Update to version 2.6.2:
  * Fixed C code bug breaking build with gcc 15
- Drop usb_modeswitch-c23.patch: fixed upstream
- Spec cleanup: drop obsolete Group tags

==== usbutils ====
Version update (019 -> 020)

- Update to version 020:
  * lsusb: Add support for FWStatus Capability decoding.
  * desc-dump: fix operator precedence bug in bit-to-byte
    conversion.
  * usbmisc: fix NULL dereference on getcwd() failure in
    get_absolute_path().
  * usbmisc: check malloc() return in get_dev_string_ascii().
  * usbmisc: check malloc() return in usb_string_to_native().
  * usbmisc: fix unbounded recursion and strncpy issues in
    readlink_recursive().
  * names: replace sprintf() with snprintf() for modalias
    formatting.
  * lsusb-t: replace sprintf() with snprintf() in lanes_to_str().
  * desc-dump: fix NULL pointer dereference for unknown audio
    terminal types.
  * desc-dump: fix integer underflow in get_array_entry_count().
  * names: fix missing null termination in
    get_vendor_product_with_fallback().
  * sysfs: fix buffer handling in read_sysfs_prop().
  * sysfs: check initial snprintf() return value in
    get_sysfs_name().
  * lsusb: fix out-of-bounds array access in dump_encryption_type()
  * lsusb: fix out-of-bounds reads in video EXTENSION_UNIT
    descriptor parsing.
  * lsusb: fix unaligned memory access in dump_printer_device().
  * lsusb: fix out-of-bounds read in video HEADER descriptor
    parsing.
  * lsusb: fix out-of-bounds read in HID report descriptor parsing.
  * lsusb: replace sprintf() with snprintf() in get_guid().
  * lsusb: fix out-of-bounds read in MIDI streaming endpoint
    descriptor.
  * lsusb: fix out-of-bounds read in STILL_IMAGE_FRAME descriptor
    parsing.
  * lsusb-t: fix buffer handling in read_sysfs_file_string().
  * lsusb: fix wrong variable in FORMAT_TYPE_II descriptor length
    calculation.
  * lsusb: fix out-of-bounds reads in video INPUT_HEADER and
    OUTPUT_HEADER.
  * lsusb: fix out-of-bounds reads in video PROCESSING_UNIT
    descriptor.
  * lsusb: fix out-of-bounds reads in video terminal and selector
    descriptors.
  * lsusb: fix undefined behavior in convert_le_u32() signed shift.
  * lsusb: fix OOB reads in UAC1 audio FORMAT_TYPE descriptor
    parsing.
  * lsusb: fix out-of-bounds read in SuperSpeedPlus capability
    descriptor.
  * lsusb: fix OOB reads in audio FORMAT_SPECIFIC descriptor parsing
  * lsusb: fix out-of-bounds reads in IPP printer descriptor parsing
  * lsusb: add missing length checks in dump_wire_adapter and
    dump_rc_interface.
  * lsusb: add missing length checks in dump_security and
    dump_encryption_type.
  * lsusb: fix OOB read in dump_dfu_interface on short descriptors.
  * lsusb: add missing length check in dump_association().
  * lsusb: fix out-of-bounds reads in dump_hid_device() on short
    descriptors.
  * lsusb: fix OOB reads in UAC2 FORMAT_TYPE descriptor parsing.
  * lsusb: fix OOB reads in MIDI HEADER and MIDI_IN_JACK descriptor
    parsing.
  * lsusb: fix OOB read in dump_videocontrol_interrupt_endpoint().
  * lsusb: fix OOB reads in video streaming format descriptors.
  * lsusb: fix OOB reads in video FRAME descriptor parsing.
  * lsusb: fix remaining OOB read in MIDI_OUT_JACK initial fields.
  * lsusb: fix remaining OOB reads in video descriptor
    warn-and-continue paths.
  * lsusb: fix OOB reads in video INPUT_HEADER and OUTPUT_HEADER
    data loops.
  * lsusb: fix OOB read in STILL_IMAGE_FRAME compression pattern
    loop.
  * lsusb: fix OOB read in FORMAT_MPEG2TS descriptor on short
    descriptors.
  * lsusb: zero hub descriptor buffer to prevent reading
    uninitialized data.
  * lsusb: fix OOB read in FORMAT_STREAM_BASED descriptor parsing.
  * lsusb: fix unsigned integer underflow in dump_bytes calls for
    short descriptors.
  * lsusb: fix wrong byte printed for CCID bClassEnvelope.
  * lsusb: bounds-check MIDI ELEMENT bNrInputPins/bElCapsSize
    against bLength.
  * lsusb: bounds-check UVC INPUT_TERMINAL bControlSize against
    bLength.
  * lsusb.py: strip control characters from device-supplied sysfs
    strings.
  * usbreset: refuse ambiguous selectors that match more than one
    device.
  * usbmisc, usb-devices: strip control characters from
    device-supplied strings.
  * lsusb: don't loop forever in find_otg() on a zero-bLength
    sub-descriptor.
  * desc-defs: fix off-by-one in UAC1 wFormatTag string lookup.
  * lsusb: bounds-check the BOS device-capability walk.
  * usbhid-dump: skip interfaces with bInterfaceNumber 0xff.
  * usb-devices: use printf instead of echo for device-supplied
    strings.
  * usb-devices: fix default case in class_decode().
  * lsusb: strip control characters from the WebUSB landing-page
    URL.
  * lsusb: bound the report-fetch loop in dump_hid_device() too.
    ... changelog too long, skipping 30 lines ...
    dump.

==== userspace-rcu ====
Version update (0.15.6 -> 0.15.7)

- update to 0.15.7:
  * call-rcu worker: set CPU affinity on first non-empty dequeue
  * Fix: leaky wfcq tests
  * Fix: test_build.c: Test output mismatch
  * Fix: workqueue leaks mutexes on FreeBSD
  * Fix: call-rcu leaks mutexes on FreeBSD
  * call_rcu: pin per-CPU worker at thread startup
  * urcu-pointer: Add rcu_dereference_sym2() taking the pointer
    address
  * urcu-pointer: Fix missing memory ordering in
    rcu_dereference_sym()

==== util-linux ====
Subpackages: libblkid1 libfdisk1 libmount1 libsmartcols1 libuuid1

- Wrap the lastlog2 and liblastlog2-2 package descriptions within
  the line length limit
- Ship /var/lib/lastlog in the lastlog2 package; the directory is
  created by the tmpfiles entry but was missing from the file list
- Drop the no-op %tmpfiles_create calls from the lastlog2 and
  uuidd scriptlets; both packages ship their tmpfiles.d entries,
  which the systemd file trigger processes at install time
- Use the find -regextype name posix-extended instead of its
  posix-egrep alias in %install
- List the header directories excluded from the systemd package
  explicitly instead of globbing the shared include directory

==== util-linux-systemd ====
Subpackages: lastlog2 liblastlog2-2

- Wrap the lastlog2 and liblastlog2-2 package descriptions within
  the line length limit
- Ship /var/lib/lastlog in the lastlog2 package; the directory is
  created by the tmpfiles entry but was missing from the file list
- Drop the no-op %tmpfiles_create calls from the lastlog2 and
  uuidd scriptlets; both packages ship their tmpfiles.d entries,
  which the systemd file trigger processes at install time
- Use the find -regextype name posix-extended instead of its
  posix-egrep alias in %install
- List the header directories excluded from the systemd package
  explicitly instead of globbing the shared include directory

==== vlc ====
Subpackages: libvlc5 libvlccore9 vlc-codec-gstreamer vlc-noX vlc-plugins-desktop vlc-qt

- Update version dependencies according to configure.ac.
- Migrate to xz compression and manual service run
- Use legacy '#' instead of '%dnl' to comment: VLC is still being built for
  CODE15 branches outside of OBS, where %dnl is not supported.

==== webkitgtk3 ====
Version update (2.54.1 -> 2.54.2)
Subpackages: libjavascriptcoregtk-4_1-0 libwebkit2gtk-4_1-0 webkit2gtk-4_1-injected-bundles

- Update to version 2.54.2:
  * Fix performance when compositing layers with backdrop filters.
  * Fix prewarmed web process leak when they are rejected due to sandboxing.
  * Release suspended pages and idle processes on memory pressure.
  * Bind /dev/dxg in the bubblewrap sandbox.
  * Notify input method about cursor area or surrounding text after a re-focus.
  * Clear input method composition underlines before adding new ones.
  * Do not enable input method for read-only text fields.
  * Update the input method state when readonly changes on the focused element.
  * Add User-Agent quirk for OrangeTV.
  * Fix several crashes and rendering issues.
- Lower memory constraint down to 25G which is enough and allow
  build for armv9

==== webkitgtk4 ====
Version update (2.54.1 -> 2.54.2)
Subpackages: libjavascriptcoregtk-6_0-1 libwebkitgtk-6_0-4 typelib-1_0-JavaScriptCore-6_0 typelib-1_0-WebKit-6_0 webkitgtk-6_0-injected-bundles

- Update to version 2.54.2:
  * Fix performance when compositing layers with backdrop filters.
  * Fix prewarmed web process leak when they are rejected due to sandboxing.
  * Release suspended pages and idle processes on memory pressure.
  * Bind /dev/dxg in the bubblewrap sandbox.
  * Notify input method about cursor area or surrounding text after a re-focus.
  * Clear input method composition underlines before adding new ones.
  * Do not enable input method for read-only text fields.
  * Update the input method state when readonly changes on the focused element.
  * Add User-Agent quirk for OrangeTV.
  * Fix several crashes and rendering issues.
- Lower memory constraint down to 25G which is enough and allow
  build for armv9

==== wireplumber ====
Version update (0.5.18 -> 0.5.19)
Subpackages: libwireplumber-0_5-0 wireplumber-bash-completion

- Update to version 0.5.19:
  * Additions & Enhancements:
  - Added wpctl get-profile and wpctl get-route to show the
    available and active profiles and routes of a device,
    including their priorities and the direction of each route
    (#989 (closed); !933 (merged))
  - Added the node.slow-resume node property, together with the
    session.fast-capture-start and session.fast-playback-start
    client properties, which let clients keep slow-resume nodes
    idle instead of suspended while they are connected
    (!921 (merged))
  - Added the monitor.camera.seat-monitoring feature, which makes
    the V4L2 and libcamera monitors enumerate cameras only while
    the logind session is active, so that cameras are no longer
    skipped when WirePlumber starts before the session gets
    access to them. This is enabled by default (#1049 (closed);
    !939 (merged))
  - Added the bluetooth.autoswitch-switch-timeout and
    bluetooth.autoswitch-restore-timeout settings, and raised the
    default restore timeout to 4 seconds, so that applications
    reopening the microphone shortly after closing it keep the
    headset profile (#1050 (closed); !938 (merged))
  - Improved Bluetooth A2DP duplex profiles support: the source
    loopback is now also created for these profiles, making their
    microphone usable, and autoswitch-bluetooth-profile no longer
    switches away from them (#1051 (closed); !940 (merged))
  - Added the device.recover-on-error ALSA device property:
    closing and re-opening a device after a node error only helps
    some devices, so this recovery now only happens if the
    property is set (#1046 (closed); !929 (merged))
  * Fixes:
  - Fixed the priority of UCM HiFi* nodes to match that of
    analog-* nodes, so that they no longer lose the default sink
    election to HDMI (!924 (merged))
  - Fixed restricted and flatpak clients being wrongly given
    write and link permissions (#1044 (closed); !928 (merged))
  - Fixed autoswitch-bluetooth-profile leaving headsets stuck in
    the headset profile after connecting devices that advertise
    the A2DP profile later (#1048 (closed); !931 (merged))
  - Fixed all new streams getting corked after a card profile
    switch, until WirePlumber was restarted (#1030 (closed);
    !919 (merged))
  - Fixed new streams that enable a smart filter being linked
    before the filters were relinked, which made them capture
    unfiltered audio for a short time (!922 (merged))
  - Fixed an abort on shutdown with PipeWire 1.4 when V4L2
    devices are present, by tearing down WpSpaDevice on the
    thread of its owning client context, and did the same for
    destroying WpImplNode (!934 (merged), !935 (merged))
  - Fixed monitor.bluez.rules not being applied to the Bluetooth
    source loopback nodes (#1043 (closed); !927 (merged))
  - Fixed wpctl list not listing some objects, such as video
    devices, by requesting the minimal object features
    (!930 (merged))
  - Fixed object activation hanging forever if exporting an
    object to PipeWire fails, by returning an error instead
    (#1019; !937 (merged))

==== xdg-desktop-portal-gnome ====
Version update (50.0 -> 51.0)

- Update version dependencies according to meson.build.
- Update to version 51.0:
  + Update CI to use the gnomeos-basic-ci component
- Update to version 51.rc:
  + Various fixed to the Global Shortcuts portal
  + Stop using G_GNUC_CONST in _get_type functions
  + Fix input-only Remote Desktop sessions
  + Updated translations.
- Update to version 51.alpha:
  + Add support for session persistence in the Input Capture portal
  + Use newer GLib APIs to simplify code
  + Various small code cleanups
  + Updated translations.
- Update libgxdp vendored tarball

==== xdg-desktop-portal-kde6 ====
Version update (6.8.0 -> 6.8.2)

- Update to 6.8.2
  * New bugfix release
  * For more details please see:
  * https://kde.org/announcements/plasma/6/6.8.2
- Changes since 6.8.1:
  * Update version for new release 6.8.2
- Update to 6.8.1:
  * New bugfix release
  * For more details see https://kde.org/announcements/plasma/6/6.8.1
- Changes since 6.8.0:
  * Update version for new release 6.8.1
  * Use correct padding for window contents
  * PipeWireDelegate: Fix broken ComboBox height

==== xf86-input-wacom ====
Version update (0.40.0 -> 1.2.0)

- remove older tarball from sources

==== xfsdump ====
Version update (3.2.0 -> 3.3.0)

- Update to 3.3.0:
  * xfsrestore: only process subtrees that are selected, fixing
    an assertion failure in cumulative restores where the initial
    restore used the subtree (-s) option
  * Fix permissions on files installed by libtoolize (build fix)
- Refresh keyring: add new upstream maintainer key (Andrey
  Albershteyn); upstream signing key rotated from Carlos Maiolino
- Spec cleanup (spec-cleaner): drop Group tag, use pkgconfig()
  BuildRequires, %license for COPYING
- Fix BuildRequires: restore autoconf (regenerating configure
  needs it), keep only the pkgconfig() providers the sources
  use (libattr, ncurses), add gcc/make

==== xfsprogs ====
Version update (6.19.0 -> 7.2.0)
Subpackages: libhandle1

- update to 7.2.0
  - xfs_quota, xfs_spaceman, libfrog: hoist xfsquotactl into libfrog
    with quotactl_fd and mount-fd support, so xfs_quota can open the
    filesystem mountpoint directly for quota operations and
    xfs_spaceman's makecfg can reuse the same code path
  - mkfs, xfs_admin, xfs_spaceman, xfs_db: allow specifying and
    printing mkfs default options via a configuration file; mkfs also
    upgrades autofsck earlier automatically
  - xfs: fix an off-by-one in rtrefcount btree root level validation, a
    reflink-flag clearing issue with INO1_WRITTEN during exchange-range,
    a memory leak in xfs_dqinode_metadir_create(), a 32-bit pointer
    arithmetic bug, an exchmaps reservation limit check, and growfs
    delta computation not returning the updated block count
  - xfs: report case sensitivity via fileattr_get
  - xfs_copy: always align I/O to at least the page size, and log the
    errno on write failures
  - man: document that XFS_IOC_FS[G|S]ETXATTR can't be used on special
    files
- update to 7.1.1
  - fiemap: add a nosync option
  - xfs_scrub: fix spacemap scan for the data volume
  - mdrestore: fix extent length overflow in the v2 restore path
  - xfs_healer: install targets one at a time (build fix)
- update to 7.1.0
  - xfs: zero directory data block padding and header regions on write
    verification and at init, avoiding exposure of stale data
  - xfs_scrub: dozens of correctness and crash fixes across rtgroups,
    zoned and realtime filesystem handling, spacemap scans, media
    verification and work estimation; notably an integer overflow, a
    crash when reporting clean health, and several memory/scan-item
    leaks
  - mkfs: fix PQUOTA/GQNOENFORCE conflict, hardlink detection, symlink
    length checks, a PATH_MAX check and protofile handling in directory
    import; fix filesystem/log size units
  - libfrog: fix a buffer overflow in getparents' path_to_string
  - xfs_healer, xfs_healer_start: fix a getmntent race in weakhandle,
    statmount buffer sizing, listmount checks on --check, and
    monitor-fd aliasing; allow AF_UNIX socket access for xfs_healer
    instances
  - xfs_db: dump zoned filesystem superblock fields
  - xfs_scrub_all, xfs_scrub_media_fail: reduce security lockdowns that
    broke postfix mail notifications, and fix broken command-line
    array construction
- update to 7.0.1
  - xfs_healer, libfrog: fix build/runtime on targets missing the
    HAVE_LISTMOUNT flag or statmount kernel support (missing flags and
    fallback stubs) -- a portability fix for the health-monitoring code
    introduced in 7.0.0
- update to 7.0.0
  - xfs_healer: new self-healing background daemon that monitors mounted
    filesystems for health events (metadata corruption, I/O errors,
    shutdowns) and automatically triggers spot or full repairs, picking
    repair mode from the autofsck fsproperty; adds a per-mount
    xfs_healer_start service to start it automatically
  - xfs_io: add listmount, statmount and a media verify command; monitor
    filesystem health events
  - xfs_scrub: use the new media-verify ioctl for phase 6 media scanning,
    extend it to cover the log region, raise media verification IO
    limits, and report truncated devices as media errors
  - mkfs: enable online repair by default when all backrefs are enabled
  - xfs_repair: don't fail on INCOMPLETE attrs in leaf blocks
  - xfs_scrub_all: fix a deadlock when lsblk produces a lot of output
  - xfs_scrub: drop the bogus warning about mixed bidirectional
    codepoints in names, warn about unicode variation selectors instead
  - xfs_quota: display default limits for users with zero usage

==== xkeyboard-config ====

- added xkeyboard-config-rpmlintrc as Source to Specfile
- Drop the %ghost entries for /var and /var/lib; both directories
  are owned by the filesystem package. The /var/lib/xkb
  directories themselves stay as ghosts and keep being created
  by tmpfiles (jsc#PED-14831).
- Drop the trailing slash from the /var/lib/xkb tmpfiles entry
  so the path matches the packaged file list.
- Run fdupes over /usr/share/xkeyboard-config-2 and the locale
  tree: the base and evdev rules files and the xkeyboard-config
  and xkeyboard-config-2 message catalogues are byte-identical
  pairs, now linked instead of duplicated (about 4 MB of
  duplicated payload).
- Collect the xkeyboard-config-2 message catalogues with
  %find_lang as well, so they carry %lang attributes like the
  xkeyboard-config ones.
- Drop unused BuildRequires: intltool and perl(XML::Parser);
  nothing in the build uses either.
- Add an rpmlintrc for the %post keymap-cache cleanup findings;
  the cleanup itself stays (bnc#662014).
- Drop the Group tag, fix a spelling error in the description
  and add the missing patch tags.

==== xorg-x11-libX11-ccache ====

- added xorg-x11-libX11-ccache.rpmlintrc as source to Specfile
- Replace the one-letter Summary ("X") with the package's actual
  description text
- Drop the deprecated Group: tag
- Convert the xkeyboard-config BuildRequires to pkgconfig form
  (resolves to the same package) and use %{_fontsdir}; spec-cleaner
  canonical pass
- Suppress the dir-or-file-outside-snapshot error in the package
  rpmlintrc: this package is not compatible with transactional
  (frozen) update systems - it ships pre-generated libX11 compose
  caches in /var/cache/libx11/compose, a directory compiled into
  libX11 that cannot be relocated from this package, and the
  content-hashed cache must persist across snapshots/rollbacks
  rather than roll back with the system; the finding is not
  actionable from this package

==== xorg-x11-server ====
Version update (21.1.24 -> 21.1.25)
Subpackages: xorg-x11-server-Xvfb xorg-x11-server-extra

- Update to version 21.1.25
  * Security Update
- supersedes the following patches:
  * 0001-xkb-NULL-text-pointer-after-free-in-_CheckSetDoodad-.patch
  * 0002-xkb-allocate-names-keys-to-MAP_LENGTH-in-XkbAllocNam.patch
  * 0003-xkb-widen-size_syms-num_syms-size_acts-num_acts-to-u.patch
  * 0004-xkb-fix-CheckKeySyms-overwriting-request-range-symsP.patch
  * 0005-randr-fix-size-and-offset-in-RRChangeProviderPropert.patch
  * 0006-Xi-validate-modifier-values-in-ProcXIPassiveUngrabDe.patch
  * 0007-glx-validate-dataBytes-against-cmdlen-in-RenderLarge.patch
  * 0008-present-unlink-notifies-from-window-list-in-present_.patch
  * 0009-dix-remove-passive-grabs-referencing-a-device-on-rem.patch
  * 0010-Xi-add-bounds-check-for-barrier-events-in-input_cons.patch
  * 0011-Xi-clean-up-gesture-sprite-traces-in-WindowGone.patch

==== xscreensaver ====
Version update (6.16 -> 6.17)
Subpackages: xscreensaver-data xscreensaver-lang

- Update to 6.17:
  * added missing localization strings; X11 localizations
    are installed again; macOS, iOS and Android now localized
  * macOS: workarounds for legacyScreenSaver 100% CPU bugs;
    macOS 14.6+ and iOS 17.6+ now required
- Refresh xscreensaver-mansuffix.patch for upstream's added
  localedir line (no content change)

==== xterm ====
Version update (411 -> 412)
Subpackages: xterm-bin xterm-resize

- update to 412:
  * improve fix for regex-selection of a wrapped line
  * correct limits for a partial screen clear operation
  * amend DECRQM 1046 response to return set when
    titeInhibit is set
  * update wcwidth tables to Unicode 18.0.0
  * update config.guess and config.sub
- Spec cleanup: drop obsolete Group tags, use macros for
  fonts dir and man extension, use pkgconfig(ncursesw)
  for the wide-curses dependency

==== xwayland ====
Version update (24.1.13 -> 24.1.14)

- Update to version 24.1.14
  * security release
- supersedes the following patches
  * 0001-xkb-NULL-text-pointer-after-free-in-_CheckSetDoodad-.patch
  * 0002-xkb-allocate-names-keys-to-MAP_LENGTH-in-XkbAllocNam.patch
  * 0003-xkb-widen-size_syms-num_syms-size_acts-num_acts-to-u.patch
  * 0004-xkb-fix-CheckKeySyms-overwriting-request-range-symsP.patch
  * 0005-randr-fix-size-and-offset-in-RRChangeProviderPropert.patch
  * 0006-Xi-validate-modifier-values-in-ProcXIPassiveUngrabDe.patch
  * 0007-glx-validate-dataBytes-against-cmdlen-in-RenderLarge.patch
  * 0008-present-unlink-notifies-from-window-list-in-present_.patch
  * 0009-dix-remove-passive-grabs-referencing-a-device-on-rem.patch
  * 0010-Xi-add-bounds-check-for-barrier-events-in-input_cons.patch
  * 0011-Xi-clean-up-gesture-sprite-traces-in-WindowGone.patch
  * 0012-glamor-size-tmp_bits-buffer-for-source-coordinate-ra.patch

==== yast2-trans ====
Version update (84.87.20261004.92ae53d41b -> 84.87.20261027.d68bd6c358)
Subpackages: yast2-trans-af yast2-trans-ar yast2-trans-bg yast2-trans-bn yast2-trans-bs yast2-trans-ca yast2-trans-cs yast2-trans-cy yast2-trans-da yast2-trans-de yast2-trans-el yast2-trans-en_GB yast2-trans-es yast2-trans-et yast2-trans-fa yast2-trans-fi yast2-trans-fr yast2-trans-gl yast2-trans-gu yast2-trans-hi yast2-trans-hr yast2-trans-hu yast2-trans-id yast2-trans-it yast2-trans-ja yast2-trans-jv yast2-trans-ka yast2-trans-km yast2-trans-ko yast2-trans-lo yast2-trans-lt yast2-trans-mk yast2-trans-mr yast2-trans-nb yast2-trans-nl yast2-trans-pa yast2-trans-pl yast2-trans-pt yast2-trans-pt_BR yast2-trans-ro yast2-trans-ru yast2-trans-si yast2-trans-sk yast2-trans-sl yast2-trans-sr yast2-trans-sv yast2-trans-ta yast2-trans-th yast2-trans-tr yast2-trans-uk yast2-trans-vi yast2-trans-wa yast2-trans-xh yast2-trans-zh_CN yast2-trans-zh_TW yast2-trans-zu

- Update to version 84.87.20261027.d68bd6c358:
  * Translated using Weblate (Greek)
  * Translated using Weblate (Greek)
- Update to version 84.87.20261025.1609796e9d:
  * Translated using Weblate (Greek)
  * Translated using Weblate (Indonesian)
  * Translated using Weblate (Indonesian)
  * Translated using Weblate (German)
  * Translated using Weblate (Swedish)
  * Translated using Weblate (Swedish)
  * Translated using Weblate (Swedish)
  * Translated using Weblate (Swedish)
  * Translated using Weblate (Swedish)
  * Translated using Weblate (Swedish)
  * Translated using Weblate (Swedish)
  * Translated using Weblate (Swedish)
  * Translated using Weblate (Swedish)
  * Translated using Weblate (Swedish)
  * Translated using Weblate (Swedish)
  * Translated using Weblate (Swedish)
  * Translated using Weblate (Swedish)
  * Translated using Weblate (Swedish)
  * Translated using Weblate (German)
  * Translated using Weblate (German)

==== yelp ====
Version update (49.2 -> 49.2+12)
Subpackages: libyelp-1-0

- Update to version 49.2+12:
  * main: Plug GApplication leak
  * search-entry: Plug char leak
  * settings: Plug gchar leaks
  * yelp: Plug value leak and initialize correctly
  * app: Free option context
  * Chain-up constructed methods
  * Updated translations.
- Switch to meson BuildSystem.

==== zvbi ====
Version update (0.2.45 -> 0.2.46)

- update to 0.2.46:
  * Apply security updates.
- fixes
  CVE-2026-110654 [bsc#1285571]

==== zypper ====
Version update (1.14.101 -> 1.14.102)
Subpackages: zypper-log zypper-needs-restarting

- list-patches: Show issue numbers that were not found
  (bsc#1275036, fixes #655)
- Use RunCommand to execute the pager.
- security: replace shell-based pager execution with execvp.
- patch: Allow to select optional patches by category
  (bsc#1283249)
  Explicitly selecting optional patches by --category must imply
  - -with-optional. Otherwise the without-optional default would
  sort out the requested patches.
- version 1.14.102