Packages changed: boost-base bubblewrap (0.11.2 -> 0.12.0) chrony ffmpeg-8 gstreamer-plugins-bad gtk3 (3.24.52 -> 3.24.52+git59.b30343717d) hwdata (0.410 -> 0.411) libbpf libheif (1.23.2 -> 1.23.4) libxml2 (2.15.3 -> 2.15.4) libzypp (17.38.14 -> 17.38.15) python-maturin (1.14.1 -> 1.15.0) qemu (11.1.0 -> 11.1.1) sg3_utils (1.48+35.c49e7c08 -> 1.48+36.936c7ae) steam-devices (20251018+git.4d7e6c1 -> 20260625+git.22ec85e) wireplumber (0.5.15 -> 0.5.17) zypper (1.14.98 -> 1.14.101) === Details === ==== boost-base ==== Subpackages: boost-license1_91_0 libboost_filesystem1_91_0 libboost_thread1_91_0 - Also install the CMake package config for the header-only Boost.System during the base build: since CMake 4 removed the FindBoost module, find_package(Boost COMPONENTS system) falls through to BoostConfig.cmake, which requires a per-component boost_system-config.cmake that the top-level b2 install no longer generates now that the compatibility stub library is gone. Package it in libboost_headers-devel. ==== bubblewrap ==== Version update (0.11.2 -> 0.12.0) - update to 0.12.0: * The flag --not-a-security-boundary was added. If this is enabled then failure of some sandbox setup steps (like remounting a submount) are not fatal. * The license has been updated from LGPL 2.0 (or later) to LGPL 2.1 (or later). * This version removes the support for building a setuid bubblewrap. Changes in this version made it difficult to support and basically all modern linux distributions now support unprivileged user namespaces to some extent. * The assume_kernel build option was added, if specified no backwards compatiblity for kernels older than this is built in (and will result in hard failures at runtime). Currently specifying 5.6.0 or later will disable the fallback implementation of openat2(RESOLVE_IN_ROOT). * Bubblewrap now correctly resolves absolute symlinks during the sandbox setup by using openat2 with RESOLVE_IN_ROOT (or a fallback implementation). This fixes a security issue (GHSA-pxhw-h44j-8pfx) where file or directories created during sandbox setup could follow parent symlinks out of the sandbox. ==== chrony ==== Subpackages: chrony-pool-openSUSE - Create /var/lib/chrony via tmpfiles ==== ffmpeg-8 ==== Subpackages: libavcodec62 libavfilter11 libavformat62 libavutil60 libswresample6 libswscale9 - Enable decoders in ffmpeg-8-mini that need no extra build dependencies. This makes it possible for some packages to run testsuites with e.g. WAV files. ==== gstreamer-plugins-bad ==== Subpackages: libgstphotography-1_0-0 libgstplay-1_0-0 - Disable msdk plugin, currently broken, and in practice abandoned upstream. It is also ranked as 0, so to even attempt to use it, users have to manually enable it via the command line. ==== gtk3 ==== Version update (3.24.52 -> 3.24.52+git59.b30343717d) Subpackages: gtk3-data gtk3-schema gtk3-tools libgtk-3-0 typelib-1_0-Gtk-3_0 - Update to version 3.24.52+git59.b30343717d: + filechooser: Avoid converting CSS font size twice + a11y: Do not emit false focus changes for a notebook tab on page changes + Window: Free empty string set to gtk-menu-bar-accel + wayland: Align decoration layout fallback with GtkSettings + filechooserwidget: stop the location and load timeouts in dispose - Update to version 3.24.52+git48.b9cc75f19f: + menu: Avoid scrolling too far + gtkapplication: Fix gtk_application_dbus_register return value + gtk/window: NULL check settings before disconnecting handler + gtkwindow: Clear active state on disappearing pointer + gdk/wayland: Remove unused field in _GdkWaylandSelection + gdk/wayland: Make primary selection and clipboard updates less racy + gdk/wayland: Clear dnd targets + gdk/wayland: Set clipboard targets atomically + Focus does not return to the main window when closing File Chooser + gdk/wayland: Add support for wl_fixes.ack_global_remove + x11: Fix wrong display when getting xatom - Drop gtk3-fix-xi2-xatom.patch:fixed upstream. ==== hwdata ==== Version update (0.410 -> 0.411) - Update to version 0.411: * Update pci and vendor ids ==== libbpf ==== - Use make macros with -C ==== libheif ==== Version update (1.23.2 -> 1.23.4) - Update to version 1.23.4: * CVE-2026-XXXXX: The max_items security limit was not enforced for the child boxes of iinf, so a file could declare an unbounded number of items. * CVE-2026-XXXXX: Unbounded recursion in the reference-cycle check crashed the parser on a long chain of derived items, without bound when the item-count limit is disabled. * CVE-2026-XXXXX: Permanent decoder deadlock through a lock-order inversion in parallel grid tile decoding (enabled by default). * CVE-2026-XXXXX: Heap out-of-bounds read in the encoder pluginsi for images whose luma and chroma bit depths differ. * CVE-2026-XXXXX: Unreclaimable memory leak in heif_track_get_next_raw_sequence_sample(). * CVE-2026-XXXXX: Heap out-of-bounds read in the WebCodecs decoder plugin - includes fixes from 1.23.3: * CVE-2026-XXXXX: Heap buffer overflow (write) in the uncompressed (unci) mixed-interleave decoder when the two chroma components declare different bit depths. * CVE-2026-XXXXX: Permanent decoder deadlock through a reference cycle between an image and its alpha auxiliary image. * CVE-2026-XXXXX: Heap out-of-bounds read in the YCbCr 4:2:0 to 16-bit interleaved RGB conversion when the chroma planes have a lower bit depth than luma * CVE-2026-XXXXX: Heap buffer overflow in the SVT-AV1 encoder plugin when encoding a high-bit-depth alpha channel, and a double free on its send-picture error path. * CVE-2026-84451: Incomplete fix: the tile range check of the unci decoder (without icef) could still overflow, allowing an out-of-bounds read * CVE-2026-XXXXX: Heap out-of-bounds read when converting odd- height 4:2:0 frames of an uncompressed (uncv) image sequence to RGB. * CVE-2026-XXXXX: Out-of-bounds read in the RGB to YCbCr identity- matrix color conversion when the R, G, and B planes have different bit depths * CVE-2026-84450: A clap property combined with an oversized ispe reached an assert() in the Fraction arithmetic and aborted the process (incomplete fix). An error is returned instead. * Fix Several smaller findings * Fix Undefined behavior (negative shift) in the HDR bit-depth up-conversion for target bit depths above 16. Such conversions are now rejected. * A number of bug fixes ==== libxml2 ==== Version update (2.15.3 -> 2.15.4) Subpackages: libxml2-16 libxml2-tools - Update to version 2.15.4: + Security: - xmlregexp: Prevent out-of-bounds read in NXT macro - fix: add missing overflow checks in dict.c, uri.c, and valid.c - xmlregexp: Calc string length after null checking - xpointer: Check overflow in xmlXPtrEvalXPtrPart - xmlIO: Check for int overflow before calling writecallback - fix(xinclude): propagate parseFlags in xmlXIncludeProcess and xmlXIncludeProcessTree + Improvements: - Improve bound checks for xmlcatalog and xmllint arguments (out-of-bound) - Fix memory leak in static Windows library (memory-leak) - xmlreader: Copy DTD in xmlTextReaderDumpCopy - parser: Fix double free in xmlIOParseDTD (double-free) - parser: fix division-by-zero when maxAmpl is set to 0 - parser: Fix memory leak in xmlCtxtSetSaxHandler (memory-leak) - catalog: Make sure to reset catalog resolve cache - xmlAddChild: unlink node before free for text nodes (memory-leak) - Normalize entity values in attr in xmlNodeGetContent - Handle whitespace for date/time/duration types - catalog: Fix NULL deref for nextCatalog without 'catalog' attribute (null-deref) - Drop libxml2-CVE-2026-11979.patch: Fixed upstream. ==== libzypp ==== Version update (17.38.14 -> 17.38.15) - Prevent libgpgme from launching gpg-agents; we don't need them. - defaultLoadSystem: Hand out the ZYpp::Ptr as return value. - Log all solver problem rules (bsc#1277790) The log contains the most relevant problem rule, but sometimes it helps to know all rules associated with this problem. zypper shows them on demand as 'detail'. The log now remembers them as well. - Replace popen cat/zcat with solv_xfopen for testcase loaders (fixes #749) - repoGpgCheck: Strictly follow the repo_gpgcheck setting (bsc#1274625) There's been a legacy exception for unsigned repositories which were explicitly accepted in the past. After switching the repo_gpgcheck from off to on, they were allowed to stay unsigned until a first signed version was retrieved. From there on the handling was strict. Now the handling is strict as soon as the repo_gpgcheck turned on. The next set of metadata retrieved must be signed. - Iniparser: each new file starts in the unnamed section (bsc#1272534) - Fix hasCredentials() to require both username AND password to be non-empty (bsc#1273242) This avoids an unnecessary 2nd 401 response sending just the username in case the username but no password is known. Now it immediately fetches the credentials from disk if no password is known. - GPG Key hints in repoindex.xml require at least a long id to allow auto-import (bsc#1271730) The short Id (32bit/8byte) is not considered to be a safe identifier for a gpg key. A long id (64bit/16byte) or even better the full fingerprint is needed to identify the key. - zypp: Improve Testcase Loading for MCP Tools. - spec: Remove useless %bcond visibility_hidden (is always ON in cmake) - version 17.38.15 (35) ==== python-maturin ==== Version update (1.14.1 -> 1.15.0) - Update to 1.15.0 * set UV_PYTHON when running maturin develop with uv gh#PyO3/maturin#3236 * Set UID and GID headers in pax gh#PyO3/maturin#3241 * Replace unguarded panics with explicit errors on fallible input gh#PyO3/maturin#3242 * Harden PEP 517 build-wheel and fix unreachable OIDC 404 fallback gh#PyO3/maturin#3244 * docs: add pdfcrate and quebec to examples gh#PyO3/maturin#3245 * Fix abi3t PyModExport entrypoint check gh#PyO3/maturin#3246 * fix maturin build --pgo -i with uv install gh#PyO3/maturin#3237 * Don’t specify generate-import-lib for PyO3 0.29 gh#PyO3/maturin#3258 * refactor build so that pgo is part of normal pathway gh#PyO3/maturin#3257 * fix: verify bindings detection with cargo tree in workspaces gh#PyO3/maturin#3264 * fix: harden cargo tree verification of bindings detection gh#PyO3/maturin#3266 * feat: support --pgo for maturin develop gh#PyO3/maturin#3270 * feat: support MATURIN_PGO env var to activate --pgo gh#PyO3/maturin#3271 * feat: type the bindings input with a single-source-of-truth enum gh#PyO3/maturin#3273 * Don't force export of the PyInit_{module_name} in UniFfi mode gh#PyO3/maturin#3275 * fix(generate-stubs): write stubs into the module's package directory gh#PyO3/maturin#3282 * Fix group not cwd gh#PyO3/maturin#3284 * docs: document missing [tool.maturin] config fields gh#PyO3/maturin#3287 * docs: fix cross compiling heading level gh#PyO3/maturin#3290 ==== qemu ==== Version update (11.1.0 -> 11.1.1) - Bugfixes (bsc#1277435, bsc#1263864): * file-posix: Tolerate unaligned hole at middle (bsc#1277435) * target/ppc/kvm: Use host compatibility mode for nested guests (bsc#1263864) * target/ppc/kvm: Add support for querying host compatibility mode (bsc#1263864) * linux-headers: Update to include KVM_CAP_PPC_COMPAT_CAPS (bsc#1263864) - Improve riscv64 handling: * [openSUSE][RPM] build all firmware on riscv64 and fix user tests * [openSUSE][RPM] spec: stub out all iotests when running under user emulation (e.g., for riscv64) - Fix broken build on aarch64: * [openSUSE][RPM] spec: disable GCS linker validation on aarch64 - Update to latest stable release (11.1.1) Full backport list here: https://lore.kernel.org/qemu-devel/20260827155607.639070-1-mjt@tls.msk.ru/ A selection of them is reported here below: target/riscv/tcg: sret in virtual user mode raises virtual instruction exception target/riscv: Allow UXL to be 3 in mstatus on rv128 target/riscv: Restore register dump zero padding tests/qtest: remove trace output from k230 watchdog test target/riscv: enforce even register constraints for Zdinx fcvt pairs target/riscv: reject FMV.X.W/FMV.W.X under Zfinx target/riscv: honor zicbo* envcfg gating in linux-user mode disas/riscv: Fix typo in th.lbib format disas/riscv: Fix isa decoding of rev8 disas/riscv: Fix rv32 encoding of zext.h target/riscv: allow menvcfg/henvcfg LPE and SSE bits on RV32 hw/riscv/riscv-iommu: preserve requested perm in spa_fetch() hw/riscv/riscv-iommu: fix U-bit check to apply only to leaf S/VS-stage PTEs disas/riscv: Decode unsigned vector immediates as unsigned disas/riscv: Use signed type for vector immediates disas/riscv: Fix 6-bit immediate extraction disas/riscv: Fix th.srri decoding tests/qtest: Add seed CSR zero extension test target/riscv: Fix seed CSR sign extension target/riscv: do not count ECALL in minstret target/riscv: Fix memory leak in riscv_trigger_unrealize() target/riscv: use SXL instead of MXL for read_sstatus target/riscv: Fix PC sync in trans_sspopchk for CFI exception handling whpx: i386: inject back db whpx: i386: work around Hyper-V FP state oddities whpx: i386: synchronise PAT too whpx: i386: enable fast hypercall output hw/i386: fw_cfg: do not set VMX feature control on WHPX whpx: i386: fix xsaves enablement in legacy probing path hw/watchdog: Add lower bound check for watchdogNumber tests/tcg/aarch64: Add regression test for whilewr/whilerw target/arm: Fix SVE2 WHILEWR/WHILERW zero diff boundary case tcg: Export tcg_gen_ussub_i{32,64,tl} hw/intc/arm_gicv3: Have GIC kconfig select GICv3 for HVF and WHPX hw/intc: Fix arm kvm gicv3 selection tcg: Defer tb_flush when initial thread region alloc fails tcg: Return success from tcg_region_alloc tcg: Return success from tcg_region_alloc__locked target/loongarch: check FPE before reading fcc in bceqz/bcnez meson: make linker warnings non-fatal on Linux serial: clear transmit retry callback on unrealize ... ==== sg3_utils ==== Version update (1.48+35.c49e7c08 -> 1.48+36.936c7ae) Subpackages: libsgutils2-1_48-2 - Update to version 1.48+36.936c7ae: * sg_inq: avoid including 0-bytes in SCSI name strings (bsc#1277106) ==== steam-devices ==== Version update (20251018+git.4d7e6c1 -> 20260625+git.22ec85e) - Update to version 20260625+git.22ec85e: * Fix Valve hidraw devices with no associated input node * steam-input.rules: Only enable wakeup if the attribute exists * Add other Switch 2 controllers over USB * Limit Valve bluetooth devices to VID-only, expose evdevs too * Update 60-steam-input.rules * allow wakeup from Valve devices - Update udev-joystick-blacklist to 20250414 - Changed to noarch ==== wireplumber ==== Version update (0.5.15 -> 0.5.17) Subpackages: libwireplumber-0_5-0 - Update to version 0.5.17: * Highlights: - This release fixes a significant regression introduced in version 0.5.16. Users are strongly encouraged to upgrade to this release and avoid using 0.5.16. * Fixes: - Fixed factory-created device, node and link objects to stop sharing ownership with their registry global, fixing a regression from the WpClientContext introduced in 0.5.16 that broke proper object destruction in the monitor scripts. - Improved default-nodes to also rank on the object.serial of a node's device and on the node's own object.serial, so that route priorities are only compared between nodes of the same card, and the election no longer changes for no apparent reason when all other keys are equal. - Fixed m-lua-scripting to include the offending Lua type name in POD build errors - Update to version 0.5.16: * Additions & Enhancements: - Added WpClientContext, a second PipeWire connection running on its own thread that hosts WirePlumber's in-process media objects (loopback and filter-chain modules, LocalNode(), SpaDevice()), so that slow Lua event hooks on the main thread no longer stall their control path; the export core is retired in favor of this new client context - Added new WpDynamicRules class for matching rules with conditions, and updated filter-graph.lua to use it, allowing filter-graphs to be loaded and unloaded dynamically depending on whether other objects exist or not - Added wp_impl_module_unload() and LocalModule:unload(), giving scripts control to unload implemented modules at any time - Added a volume-set action to module-mpris to allow adjusting the volume of a remote MPRIS2 player from Lua - Added --yes flag to wpctl reset to skip the confirmation prompt - Added device.form-factor ALSA node property for use in ALSA rules, and made HDMI node descriptions include the name of the connected display when available - Refactored the Bluetooth monitor to use event hooks for handling devices and nodes, matching the design already used by the v4l2 and libcamera monitors - Overhauled the documentation: filled in every stub and missing Lua API and C API page, added a getting started guide, new wireplumber(1) and wpexec(1) man pages, and removed stale pages describing features renamed or removed in the 0.4 to 0.5 transition * Fixes: - Fixed monitors to always activate all device and node features, and made monitors wait for successful device activation before storing the devices and nodes as a managed objects - Fixed find-preferred-profile to skip a configured preferred profile that is not available, instead of leaving no profile selected - Fixed permission-manager to not include destroyed globals when rebuilding the permissions array on objects-changed, fixing some pipewire warnings in the log - Fixed a memory leak in WpSpaDevice by only collecting params from our own requests - Fixed filter-graph to correctly apply graphs defined for the same node across multiple configuration files - Fixed several nil-related crashes and correctness issues in Lua scripts - Improved apply-access to directly attach an already-active permission manager to the client instead of wastefully re-running activation on it - Improved state-stream change detection to avoid spurious state writes from volume rounding and from unset or empty properties - Fixed default-nodes to ignore smart filters when selecting the best default node - Removed the node.filter.forward-format setting and its script, which only worked with 0.4 and never really worked with 0.5 ==== zypper ==== Version update (1.14.98 -> 1.14.101) Subpackages: zypper-needs-restarting - Show solver problem details per default in not-interactive mode (bsc#1277790) This way they see all details when capturing zypper's output because the (d)etail button can't be pressed in not-interactive mode. - version 1.14.101 - Add --servicesd-dir global option to relocate /etc/zypp/services.d (bsc#1257249) - version 1.14.100 - info: check for missing positional args before systemSetup (bsc#1274091) - Remove deprecated installRecommends option from zypper.conf. The system wide default for all libzypp based applications is defined in zypp.conf(5). It is not recommended to define this in zypper exclusively. - BuildRequires: libzypp-devel >= 17.38.0. Code uses some of the new libzypp log and string tools. - version 1.14.99