Packages changed: MicroOS-release (20260802 -> 20260806) SDL3 (3.4.12 -> 3.4.14) breeze6 cockpit-tukit (0.1.7~git0.61e54f1 -> 0.1.8~git0.0c769f8) crypto-policies fuse-overlayfs (1.16 -> 1.17) google-noto-fonts (20260701 -> 20260801) grub2 gstreamer (1.28.5 -> 1.28.6) gstreamer-plugins-bad (1.28.5 -> 1.28.6) gstreamer-plugins-base (1.28.5 -> 1.28.6) hwdata (0.409 -> 0.410) kernel-source (7.1.5 -> 7.1.6) libXfont2 libgpg-error libpsl (0.23.0 -> 0.23.1) libraw (0.22.1 -> 0.22.2) libssh2_org mpg123 (1.33.6 -> 1.33.7) ngtcp2 (1.24.0 -> 1.25.0) open-isns (0.103+2.296d533bd52a -> 0.103+4.60de8b5) plasma6-integration plasma6-workspace polkit-default-privs (1550+20260623.563df94 -> 1550+20260803.90784eb) python-charset-normalizer (3.4.7 -> 3.4.9) python-cryptography (49.0.0 -> 50.0.0) python-pyzmq qtkeychain-qt6 (0.16.0 -> 0.17.0) selinux-policy (20260727 -> 20260804) shadow (4.19.4 -> 4.20.0) u-boot-rpiarm64 (2026.01 -> 2026.07) vulkan-loader (1.4.350 -> 1.4.357) vulkan-tools (1.4.350 -> 1.4.357) === Details === ==== MicroOS-release ==== Version update (20260802 -> 20260806) Subpackages: MicroOS-release-appliance MicroOS-release-dvd - automatically generated by openSUSE-release-tools/pkglistgen ==== SDL3 ==== Version update (3.4.12 -> 3.4.14) - Update to release 3.4.14 * GPU buffers and textures can have multiple read usages * Fixed X11 crash if the IME service was shutdown in the background * Fixed hang when hiding an X11 window on some window managers * Fixed Xbox controllers not being detected if SDL is built with GameInput support ==== breeze6 ==== Subpackages: breeze6-cursors breeze6-decoration breeze6-style breeze6-wallpapers - Move Qt 5 style into a separate optional package ==== cockpit-tukit ==== Version update (0.1.7~git0.61e54f1 -> 0.1.8~git0.0c769f8) - Update to 0.1.8~git0.0c769f8: * Dependency updates * Translation updates ==== crypto-policies ==== - Disable umac-128* in DEFAULT, FUTURE and BSI openssh policies (bsc#1259515) * Add patch: crypto-policies-Disable-umac-128-in-DEFAULT-FUTURE-and-BSI-openssh-policies.patch ==== fuse-overlayfs ==== Version update (1.16 -> 1.17) - Update to v1.17 (bsc#1273100, CVE-2026-52791) * main: clear SUID/SGID bits on truncate (CVE-2026-52791). * main: make sure st_ino needs is unique for all inodes on a device. * man: uniformly apply bold attributes. ==== google-noto-fonts ==== Version update (20260701 -> 20260801) Subpackages: google-noto-sans-fonts google-noto-sans-symbols-fonts google-noto-sans-symbols2-fonts - Update to 20260801: * Sans Batak: fix the lack of anchoring on the "A" letter (#14) ==== grub2 ==== Subpackages: grub2-arm64-efi grub2-common grub2-snapper-plugin - Fix crash in booting kernel on some AMD systems (bsc#1271980) * 0001-linux-allocate-EFI-kernel-buffer-as-GRUB_EFI_LOADER_.patch ==== gstreamer ==== Version update (1.28.5 -> 1.28.6) Subpackages: libgstreamer-1_0-0 - Update to version 1.28.6: + Highlighted bugfixes in 1.28.6 - Various security fixes and playback fixes - playbin3, playbin: fix stalls after re-enabling previously disabled subtitles - Fix regression in core if a pad is re-linked while changed sticky events are being pushed - dtls/webrtc: fix some issues with OpenSSL 4.0.0 - RTP retransmission bitrate estimation fixes - Fix RTP depayloading of SMPTE ST291 frames with multiple ANC packets - Add H.266 muxing support to the Rust (f)mp4 muxers - Better handling of input buffers without timestamps in Rust (f)mp4 muxers - webrtcsink H.264 level/profile negotiation fixes and support for nvv4l2h265enc encoder - SMPTE ST2038 ancillary metadata and closed caption combiner improvements - Fix SEI insertion into H.265/HEVC streams with alpha - Windows D3D11 WinRT screen capture element fixes - Improved coded buffer size handling for VA encoders - Textaccumulate: various tweaks how the element outputs text, plus better handling of French punctuation - hlssink3: improved handling of input buffers without timestamps - Fix build against FFmpeg 9.0 - cerbero: fix Windows packages binary size increase regression; upgrade libsrt recipe to 1.5.6 - Various bug fixes, build fixes, memory leak fixes, and other stability and reliability improvements + gstreamer: - baseparse: Don't reset infer_ts/pts_interpolate subclass configuration in reset() and related fixes - cpuid: fix AArch64 NEON detection to check HWCAP_ASIMD, not HWCAP_NEON - pad: fix livelock when pushing changed sticky events when the pad is re-linked - valve: Don't send a reconfigure even when setting the drop property to the same value - meson: Make the g-ir-scanner init section consistent across modules - meson: use dependency('dl') instead of cc.find_library('dl') ==== gstreamer-plugins-bad ==== Version update (1.28.5 -> 1.28.6) Subpackages: libgstphotography-1_0-0 libgstplay-1_0-0 - Update to version 1.28.6: + adpcmdec: Fix IMA ADPCM input size check to match with the actual code + baseparse: Don't reset infer_ts/pts_interpolate subclass configuration in reset() and related fixes + d3d11winrtcapture: Fix incorrect capture height + dtls: make BIO read signal retry instead of EOF when no data + dtls: New DTLS test failure with OpenSSL 4.0.0 + dvdspu: Fix too strict off-by-one bounds check in a couple of places + h263parse: diracparse: Sync baseparse configuration with other compressed video parsers + h265parser: Fix out-of-bounds writes in RPS parsing + h265seiinserter: Fix HEVC with alpha stream handling + h266parser: fix SEI parsing error handler + meson: Make the g-ir-scanner init section consistent across modules + mpegpsdemux: Use byte readers for parsing data and make sure enough data is available + openjpegdec: Various issues related to striped mode and image origins, plus memory leaks + pnmdec: Don't assert if creating the output state fails and don't flush more data than is available + tfliteinference: fix leaks + tsdemux: Don't assert if stream pad was not yet created + vabaseenc: clamp driver-reported coded size to the coded buffer size + vtdec: Don't register the hw-only variant on simulators + vulkantrash: avoid reinitializing trash objects multiple times + waylandsink: Omit reporting drop frame on preroll + webrtcbin: fix possible floating leak for post-aux + wlvideobufferpool: Fix memory leak in gst_wl_video_buffer_pool_alloc_buffer + docs: Fix build when mse library is disabled + Remove incorrect G_GNUC_CONST annotation for _get_type() functions and some other functions ==== gstreamer-plugins-base ==== Version update (1.28.5 -> 1.28.6) Subpackages: libgstallocators-1_0-0 libgstapp-1_0-0 libgstaudio-1_0-0 libgstgl-1_0-0 libgstpbutils-1_0-0 libgstriff-1_0-0 libgsttag-1_0-0 libgstvideo-1_0-0 - Update to version 1.28.6: + gl/eagl: Fix GstGLUIView leak from duplicate __bridge_retained + playsink: don't wait for text pad block during reconfiguration + typefind: Actually register various forgotten typefinders + meson: Make the g-ir-scanner init section consistent across modules + Remove incorrect G_GNUC_CONST annotation for _get_type() functions and some other functions ==== hwdata ==== Version update (0.409 -> 0.410) - Update to version 0.410: * Update pci and vendor ids ==== kernel-source ==== Version update (7.1.5 -> 7.1.6) Subpackages: kernel-64kb kernel-default - Linux 7.1.6 (bsc#1012628). - platform/x86/intel-uncore-freq: Fix current_freq_khz after CPU hotplug (bsc#1012628). - sched_ext: Skip ops.set_weight() for disabled tasks (bsc#1012628). - drm/virtio: fix deadlock in display_info_cb by removing hotplug from dequeue worker (bsc#1012628). - seqlock: Allow UBSAN_ALIGNMENT to fail optimizing (bsc#1012628). - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (bsc#1012628). - KVM: x86: Only reset TSC Deadline Timer in apic_timer_expired on KVM_RUN (bsc#1012628). - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (bsc#1012628). - KVM: x86/mmu: Fix use-after-free on vendor module reload (bsc#1012628). - gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings (bsc#1012628). - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (bsc#1012628). - xprtrdma: Clear receive-side ownership pointers on release (bsc#1012628). - arm64: tegra: Remove fallback compatible for GPCDMA (bsc#1012628). - Docs/admin-guide/cgroup-v2: fix memory.stat doc details (bsc#1012628). - sched_ext: Annotate ksyncs with __rcu in alloc/free_kick_syncs() (bsc#1012628). - arm64: tegra: Fix CPU compatible string to cortex-a78ae on Tegra234 (bsc#1012628). - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (bsc#1012628). - xfrm: fix stale skb->prev after async crypto steals a GSO segment (bsc#1012628). - firmware: arm_ffa: Respect firmware advertised RX/TX buffer size limits (bsc#1012628). - IB/mad: Drop unmatched RMPP responses before reassembly (bsc#1012628). - mtd: virt_concat: fix use-after-free in mtd_virt_concat_destroy_joins() (bsc#1012628). - mtd: virt_concat: fix use-after-free in mtd_virt_concat_destroy() (bsc#1012628). - mtd: mtdswap: remove debugfs stats file on teardown (bsc#1012628). - mtd: nand: mtk-ecc: stop on ECC idle timeouts (bsc#1012628). - btrfs: reject free space cache with more entries than pages (bsc#1012628). - btrfs: fix root leak if its reloc root is unexpected in merge_reloc_roots() (bsc#1012628). - btrfs: fallback to transaction csum tree on a commit root csum miss (bsc#1012628). - firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get() (bsc#1012628). - sched_ext: Don't warn on core-sched forced idle in put_prev_task_scx() (bsc#1012628). - reset: spacemit: k3: fix USB2 ahb reset (bsc#1012628). - xfrm: fix sk_dst_cache double-free in xfrm_user_policy() (bsc#1012628). - xfrm: reject optional IPTFS templates in outbound policies (bsc#1012628). - RDMA/cma: Fix hardware address comparison length in netevent callback (bsc#1012628). - RDMA/irdma: Prevent rereg_mr for non-mem regions (bsc#1012628). - RDMA/irdma: Remove redundant legacy_mode checks (bsc#1012628). - RDMA/irdma: Prevent user-triggered null deref on QP create (bsc#1012628). - RDMA/erdma: initialize ret for empty receive WR lists (bsc#1012628). - RDMA/mana_ib: initialize err for empty send WR lists (bsc#1012628). - RDMA/core: Fix memory leak in __ib_create_cq() on invalid cqe (bsc#1012628). - RDMA/hns: Fix potential integer overflow in mhop hem cleanup (bsc#1012628). - RDMA/siw: publish QP after initialization (bsc#1012628). - mtd: fix double free and WARN_ON in add_mtd_device() error paths (bsc#1012628). - selftests/alsa: Fix memory leak in find_controls error path (bsc#1012628). - RDMA/irdma: Prevent overflows in memory contiguity checks (bsc#1012628). - xfrm: clear mode callbacks after failed mode setup (bsc#1012628). - xfrm: iptfs: propagate SKBFL_SHARED_FRAG in iptfs_skb_add_frags() (bsc#1012628). - xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst() (bsc#1012628). - xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert (bsc#1012628). - wifi: mac80211: allocate backup ieee80211_nan_sched_cfg off stack (bsc#1012628). - ALSA: usb-audio: Fix imbalance per-channel volume of sticky mixers (bsc#1012628). - wifi: cfg80211: cancel sched scan results work on unregister (bsc#1012628). - wifi: ipw2100: fix potential memory leak in ipw2100_pci_init_one() (bsc#1012628). - wifi: cfg80211: Fix an error handling path in cfg80211_wext_siwscan() (bsc#1012628). - wifi: mac80211_hwsim: clamp virtio RX length before skb_put ... changelog too long, skipping 1266 lines ... - commit 05b8588 ==== libXfont2 ==== - bsc1272660_CVE-2026-59679_0001-fserve-validate-num_chars-against-encoding-array-siz.patch * libXfont2 fs_read_glyphs() heap OOB read/write via encoding array index mismatch (CVE-2026-59679, bsc#1272660) - bsc1272661_CVE-2026-44950-0002-fserve-bounds-check-cumulative-glyph-data-writes-in-.patch * libXfont2 fs_read_glyphs() heap buffer overflow via cumulative glyph data overflow (CVE-2026-44950, bsc#1272661) ==== libgpg-error ==== - Add upstream patch to fix build on 32-bit arm: * libgpg-error-fix-armv7.patch ==== libpsl ==== Version update (0.23.0 -> 0.23.1) - Update to version 0.23.1: * Fix reproducible builds, a regression introduced in 0.23.0 * psl-make-dafsa embeds only the basename of the input file * Allow explicitly disabling fuzzing at configure time ==== libraw ==== Version update (0.22.1 -> 0.22.2) - update to 0.22.2: * Fixed 6yr old typos in USE_6BY9RPI 8- and 16- bit decoders * trimSpaces: Improved handling of zero-length strings and strings consisting only of spaces * Misc fixups * Fix links to license files in contributing document * removeExcessiveSpaces: handle zero-length strings the right way * contributing rules updated * Zero read buffers before fread * FP DNG loader: check for tile index; convertFloatToInt: avoid possible integer overflow * open_bayer(): reject images with raw size/visible size less than 22 (as in open_file/identify); vng_interpolate: do not interpolate images less than 8x8 * PPM16 thumb: check against LIBRAW_MAX_THUMBNAIL_MB * open_bayer(): additional input data checks * Olympus/14bit: refuse incorrect wbits metadata * X3F decoder: initialise raw storage if LIBRAW_CALLOC_RAWSTORE defined * crx decoder: check plane size agains imgdata.rawparams.max_raw_memory_mb * Crx decoder: avoid possible int32 overflow on allocation size calculations * check for ifd->bps values in FP DNG decoder * fixed stack memory/previous image metadata exposure (reported by DMSAN) * LibRaw_memmgr: allow malloc to fail on local pointer array small allocation. It will definitely fall later on large-buffer allocation * rotated fuji: stricter image size limits; raw2image(ex): avoid possible 32-bit overflow on alloc size calculations * width/height and iwidth/height values documented * width/height and iwidth/height values documented * wavelet denoise: ensure allocation size not exceed 4GB * unpack_thumb: check JPEG thumbnail size before performing allocation; Remove all allocation test results because LibRaw::calloc/malloc will raise exception if allocation fails * removed row_stride signed/unsigned mix; check row_stride value against buffer size * fixed possible next struct item override in x3f_parse * parse_phase_one: prevent buffer overrun if incorrect flat field data provided * Limit parse_mos recursion depth; parse_qt: raise exception, do not hide too depth nesting error * parse_qt: avoid too deep recursion ==== libssh2_org ==== - Security fixes: * CVE-2026-58050: Attacker controlled attribute count from a publickey-subsystem response is used without bounds checking and can cause to a heap buffer overflow in a connecting libssh2 client (bsc#1269568) * CVE-2026-58051: Public key list is increased and does not zero-initialized new entries, which can cause an uninitialized pointer to be freed when a malformed response is sent by an SSH server (bsc#1269567) * Add patches - libssh2-CVE-2026-58050.patch - libssh2-CVE-2026-58051.patch - Security fixes: * CVE-2026-66032: Arbitrary code execution via double-free in SFTP session (bsc#1272737) * CVE-2026-66033: Denial of Service via integer underflow in AES-GCM cipher negotiation (bsc#1272736) * CVE-2026-66034: Information disclosure and potential arbitrary code execution via heap out-of-bounds read (bsc#1272735) * CVE-2026-66035: Arbitrary code execution via heap buffer overflow during SSH negotiation (bsc#1272734) * Add patches: - libssh2-CVE-2026-66032.patch - libssh2-CVE-2026-66033.patch - libssh2-CVE-2026-66034.patch - libssh2-CVE-2026-66035.patch ==== mpg123 ==== Version update (1.33.6 -> 1.33.7) - Update to version 1.33.7 mpg123: * Fix information disclosure of uninitialied memory for - -auth-file without line endings. * Fix out-of-bounds read/write when combining --continue - -random --listentry where n is larger than the playlist size. * Fix a harmless valgrind memory leak report by not nulling playlist name. * Fix a mostly harmless OOB read of 1 byte when printing USLT lyrics. * Fix leaking file descriptor on read error from --equalizer file. * Hardening of loading HTTP(S) via curl or wget against funky URLs by including the -- separator. No actual vulnerability, tough, just extra care. out123: * Fix heap overrun on --endian conversion with differing input and output channel counts. * Fix parsing of filter specs with whitespace before commas, which resulted in out-of-bounds writes before. libmpg123, mpg123: Harden memory realloc calls against multiplication overflow of size_t in arguments. Specifically, this addresses part of bug 389 with possible application abuse of mpg123_set_index64(). libmpg123: * Fix possible use of uninitialized values in layer III dequantization. III_dequantize_sample() for consistent output also for strange input. The new code seems to be slightly faster after some rearrangements. * Fix a double free when deleting a handle after failed mpg123_decoder() call (possibly among others). * More strong wording in API that ID3 text convenience links are short-lived, but safeguard against ignorant use by nulling them early. * Prevent double free in mpg123_set_index() 32 bit wrapper being called with index size 0. * Harden against an application wielding a foot gun by handing in an undersized decoding buffer betwee seek and read (return error before trying to decode and discard frames in that case). * Do properly terminate ID3v2 texts coming in UTF16 encoding when they overwrite previous frames, like with other encodings. The symptom was a shorter second frame resulting in a combined text with the earlier longer frame. * Check and properly handle null source buffer and zero size in mpg123_store_utf8() instead of reading past (before) buffers. * Ensure clients get ID3v1 data with (unmotivated) mpg123_id3_raw() only if the parser decided that it is there, not possibly the last 128 bytes of a seekable stream without ID3v1 tag. * Prevent impossible NtoM resampling with too low target rate (like 1 Hz) which would trgger endless looping. libout123: * Fix deadlock in buffer mode when combined with (stereo) 24 bit output. Now also mpg123 --buffer 4096 -e s24 shall actuallly work. Sorry. * Abort early on zero/negative rate and channel count in out123_start(). * Fix divide by zero in WAV writing by catching channel counts that go zero in the 16 bit WAV header field. libsyn123: * Explictly reject mismatched format for appending filters with syn123_setup_filter(), preventing memory errors from that API-violating use. * Harden the dirty resampling interpolator against extreme rates (around 1e18 Hz) by fixing a sample offset check to not do the exact overflowing addition that it is supposed to guard against. The fine resampler was… fine. * Error out on trying to create a filter of order 0 instead of dividing by zero later. ==== ngtcp2 ==== Version update (1.24.0 -> 1.25.0) Subpackages: libngtcp2-16 libngtcp2_crypto_gnutls8 libngtcp2_crypto_ossl0 - Update to 1.25.0: * Fix build error with gcc-16 * Add ngtcp2_stream_close2 callback * Verify the end offset of STREAM frame before updating flow control * Rework connection flow window accounting after sending STOP_SENDING * Stop buffering data after shutting downstream read * Expand NGTCP2_MAX_INITIAL_CRYPTO_OFFSET to 64K so that large post-quantum key shares are no longer rejected * Handle a client migrating back to the original path * crypto/quictls: Rework the global initialization * ksl: Align keys in 8 bytes boundary * bbr: Update longterm variable computation * Optimize rob and acktr - Drop the now-dead libnghttp3 dependency: --with-libnghttp3 and its BuildRequires only affect the examples, which - -enable-lib-only does not build - Declare the version floors configure actually checks: pkgconfig(gnutls) >= 3.7.3 and pkgconfig(openssl) >= 1.1.1 - Clean up the spec file with spec-cleaner (drop obsolete Group tags) ==== open-isns ==== Version update (0.103+2.296d533bd52a -> 0.103+4.60de8b5) - Update to version 0.103+4.60de8b5: * Fix issue in error path causing double-free. Fixes issue CVE-2026-55995 bsc#1268685 ==== plasma6-integration ==== - Put Qt 5 integration into a separate optional package ==== plasma6-workspace ==== Subpackages: plasma6-session plasma6-workspace-libs - sddm.conf: Set plasmawayland.desktop as default session - No longer recommend plasma6-session-x11 ==== polkit-default-privs ==== Version update (1550+20260623.563df94 -> 1550+20260803.90784eb) - Update to version 1550+20260803.90784eb: * profiles: renamed calamares (bsc#1273196) * build(deps): bump actions/checkout from 6.0.2 to 7.0.1 ==== python-charset-normalizer ==== Version update (3.4.7 -> 3.4.9) - update to 3.4.9: * Regression in our fallback path leading to a decode error. * We've yanked 3.4.8 as a result of that bug. * Wall import time due to cascade codec imports for our multibyte first sort of iana supported codecs * Unnecessary json import at runtime * Inverse capitalization not seen by noise detector * No longer holding a global cache for our noise / coherence measurements. Relax RSS memory usage. * Micro-optimizations in our noise / coherence measurements. * No longer using regex search by default for our preemptive charset mark algorithm. * Raised upperbound of setuptools to v83. * Raised upperbound of mypy(c) to v2.1. ==== python-cryptography ==== Version update (49.0.0 -> 50.0.0) - update to 50.0.0 (bsc#1273551, CVE-2026-69247): * SECURITY ISSUE: :func:`~cryptography.hazmat.primitives.serial ization.pkcs7.pkcs7_decrypt_der` and its PEM and S/MIME variants no longer expose distinguishable errors or timing when unwrapping a RecipientInfo's encryptedKey, which could act as a Bleichenbacher oracle for callers that decrypt untrusted messages. A random key is now substituted on failure, as described in RFC 3218. Credit to @X1AOxiang for reporting the issue * Deprecated Diffie-Hellman key exchange over finite fields (FFDH). Everything FFDH is deprecated, including the types in cryptography.hazmat.primitives.asymmetric.dh and loading FFDH keys or parameters with the key loading APIs. Users should migrate to a more modern key exchange algorithm. * Added xof() class methods to :class:`~cryptography.hazmat.primitives.hashes.SHAKE128` and :class:`~cryptography.hazmat.primitives.hashes.SHAKE256` for constructing algorithm instances configured for use with :class:`~cryptography.hazmat.primitives.hashes.XOFHash`. * The :mod:`X.509 verification ` APIs are now considered stable and are subject to our API stability policy. * Added the :doc:`/cobblestone` recipe, an implementation of the Cobblestone-128 and Cobblestone-256 instantiations of the C2SP chunked-encryption specification for streaming authenticated encryption of large messages. * Parsing a Signed Certificate Timestamp list now rejects encodings that carry trailing bytes after the list or after an individual SCT, instead of silently ignoring them. * Added support for using :class:`~cryptography.x509.Name` as a field type in the :doc:`/hazmat/asn1/index` module. * Loading a public key or an EC private key now rejects DER where the subjectPublicKey (or EC publicKey) BIT STRING declares a non-zero number of unused bits, instead of silently ignoring it. * Parsing a CRL entry's InvalidityDate extension now rejects a GeneralizedTime that carries fractional seconds or another non-DER form, matching the strict encoding already required for every other X.509 time field. * :func:`~cryptography.x509.ocsp.load_der_ocsp_request` and :func:`~cryptography.x509.ocsp.load_der_ocsp_response` now reject a request or response whose version field is not v1, the only version defined by RFC 6960, matching the version validation already performed when loading certificates, CSRs and CRLs. * :class:`~cryptography.hazmat.primitives.hashes.XOFHash` is now supported when building against AWS-LC. * HMAC (and therefore PBKDF2-HMAC) with SHA-3 hashes is now supported when building against AWS-LC. * Diffie-Hellman (:doc:`/hazmat/primitives/asymmetric/dh`) is now supported when building against AWS-LC. * :func:`~cryptography.hazmat.primitives.serialization.load_der _public_key` and :func:`~cryptography.hazmat.primitives.seria lization.load_pem_public_key` now reject Diffie-Hellman public keys whose modulus is smaller than 512 bits, matching the minimum already enforced when loading DH private keys and when constructing :class:`~cryptography.hazmat.primitives.asy mmetric.dh.DHParameterNumbers`. * Added :class:`~cryptography.hazmat.primitives.asymmetric.mlds a.MLDSAMuHasher` for incrementally computing the ML-DSA mu (message representative) used by the external-mu signing and verification APIs. * The builtin :class:`~cryptography.hazmat.primitives.hashes.HashAlgorithm` classes and the classes in :mod:`~cryptography.hazmat.primitives.asymmetric.padding` can now be compared with ==. * :class:`~cryptography.x509.CertificateBuilder` now supports creating unsigned certificates (RFC 9925) with the create_unsigned method. * The :mod:`X.509 verification ` APIs now permit ML-DSA-44, ML-DSA-65, and ML-DSA-87 (RFC 9881) public keys and signatures by default. ==== python-pyzmq ==== - Pin scikit-build-core's CMake build directory for reproducible builds. Otherwise it uses a random tempdir whose path leaks into the debug info that the linker hashes into the GNU build-id note of the later-stripped _zmq*.so, making the build non-reproducible even though the actual code is identical. ==== qtkeychain-qt6 ==== Version update (0.16.0 -> 0.17.0) - Update to 0.17.0 * Windows: Do not ignore "service" when storing data. Note: This is a breaking change. * Android: Support payloads > 256kb * Add wasm backend * CMake: Assume Qt 6 by default; pass -DBUILD_WITH_QT5=ON to use Qt 5 ==== selinux-policy ==== Version update (20260727 -> 20260804) Subpackages: selinux-policy-targeted - Update to version 20260804: * Use NetworkManager_t instead of networkmanager_t * Changes adapting to bind packages with suffixes * Dontaudit unconfined_t map its private directories * Support cronie create crontab backups * Allow nfsidmapd read virt lib files * Allow sysadm_t run and read/write networkmanager bpf programs * Allow dhcpc_hook_t connect to init_t over a unix stream socket * Allow unconfined_t mounton its lnk_files * Allow wireguard read cgroup files * Label /usr/local/share/man with man_t * Allow pcscd get attributes of a pty filesystem * Allow geoclue read cgroup files * Allow init_t nnp domain transition to postgresql_t * Move bootupd systemd interface to 2 optional blocks * Allow net_admin to the nfsd_t domain * Allow kernel write to unconfined and sysadm users' keys * Allow staff user ioctl cockpit-session stream sockets * Allow the staff user mount on tmpfs directories * Allow staff user the dac_override capability in the user namespace * Allow aide get attributes of all filesystems * Make insights_client_t accessible from the system cronjob * Support systemtap on a UEFI+SecureBoot system * Allow systemd-coredump signull spc container * Allow dhcpcd hook scripts read generic files in /proc - Syncing with upstream rawhide selinux-policy up to: * 5c9bff8fbdaeb41b724b68937c706dc5e42a490a ==== shadow ==== Version update (4.19.4 -> 4.20.0) Subpackages: login_defs shadow-pw-mgmt - Update to 4.20.0: * Removals: The following programs and features were deprecated in 4.19 or earlier, and have been removed in 4.20. + expiry(1) (deprecated in 4.19). See #1481 and #1432. + login.defs(5): ENCRYPT_METHOD: DES (deprecated in 4.19). See #1456. + login.defs(5): ENCRYPT_METHOD: MD5 (deprecated in 4.19). See #1457. + login.defs(5): MD5_CRPYT_ENAB (deprecated since the dinosaurs were around). See #1455. + shadow(5): .sp_min (deprecated in 4.19). See #1482. This also includes the following removals: - chage(1): -m,--mindays (also the interactive version) - passwd(1): -n,--mindays - login.defs(5): PASS_MIN_DAYS This feature is considered a vulnerability, and was removed without replacement. Programs will now fail when any of those flags or variable are specified. This is intentional, and should help identify any scripts that rely on these. + groupmems(8) (deprecated in 4.19). See #1343 and #1601. Use usermod(8) instead. + logoutd(8) (deprecated in 4.19). See #999 and #1344. * Defaults: The following default values were changed. + login.defs(5): Remove defaults for password expiration (PASS_MAX_DAYS, PASS_WARN_AGE). See #1428. + login.defs(5): ENCRYPT_METHOD: Default to SHA512 (previously, it was DES). See #1278 and #1454. Users should still explicitly specify it, since other programs that read login.defs(5) may still default to DES. * Features: The following features that were optional in 4.19 are now unconditionally supported in 4.20. + SHA256, SHA512 See #1278 and #1452. * Regressions: Some regressions have been introduced (as side effects of bug fixes) and they're here to stay. Users must adapt. + `su - ` as root brings inappropriate ioctl for device #1704 + `usermod --unlock` on an account without valid password will exit with status 20 instead of print a warning #1706 * Dependencies: + We've removed an unused dependency (libattr). See #1473. * Deprecations: No new deprecations since 4.19. However, we maintain the deprecations from then. - Refresh patches: * shadow-login_defs-comments.patch Line offsets and dropping MD5_CRYPT_ENAB. * shadow-login_defs-suse.patch Drop PASS_MAX_DAYS/PASS_MIN_DAYS/PASS_WARN_AGE. We set them to 0 earlier to disable them because PAM handles it. So we have the same effect still. Drop PASS_MAX_LEN since DES support got removed. Drop MD5_CRYPT_ENAB. PASS_CHANGE_TRIES got dropped upstream. * shadow-login_defs-unused-by-pam.patch Drop PASS_MAX_DAYS, PASS_MIN_DAYS, PASS_WARN_AGE, PASS_MAX_LEN, and PASS_MIN_LEN. * shadow-util-linux.patch - Add PASS_ALWAYS_WARN, PASS_CHANGE_TRIES, PASS_MAX_DAYS, PASS_MIN_LEN, PASS_WARN_AGE, OBSCURE_CHECKS_ENAB to false positives in shadow-login_defs-check.sh - Add shadow-4.20-stdint.patch to fix an include ==== u-boot-rpiarm64 ==== Version update (2026.01 -> 2026.07) Subpackages: u-boot-rpiarm64-doc - Update to 2026.07: * Full changelog available at: https://source.denx.de/u-boot/u-boot/-/compare/v2026.04...v2026.07 - Use tools-only config instead of sandbox for u-boot-tools - Handle openSUSE:Factory:LegacyARM and remove old Leap:15.2 - Update to 2026.04: * Full changelog available at: https://source.denx.de/u-boot/u-boot/-/compare/v2026.01...v2026.04 - Patch queue updated from https://github.com/openSUSE/u-boot.git tumbleweed-2026.04 * Patches dropped: 0014-Enable-EFI-and-ISO-partitions-suppo.patch 0015-cmd-boot-add-brom-cmd-to-reboot-to-.patch 0016-Kconfig-add-btrfs-to-standard-boot.patch * Patches added: 0014-cmd-boot-add-brom-cmd-to-reboot-to-.patch 0015-Kconfig-add-btrfs-to-standard-boot.patch ==== vulkan-loader ==== Version update (1.4.350 -> 1.4.357) - Update to tag SDK-1.4.357.0 * Log driverUUID instead of deviceUUID for missing device config * Some fixes to missing bounds checks, overflows, out-of-bounds reads ==== vulkan-tools ==== Version update (1.4.350 -> 1.4.357) - Update to tag SDK-1.4.357.0 * vulkaninfo: Add VK_KHR_display support and related fixes