<?xml version="1.0" encoding="UTF-8"?>
<otherdata xmlns="http://linux.duke.edu/metadata/other" packages="10">
<package pkgid="bdaad93a328b46885eb405034b268927120dc919ebc7465ca6ae22e9c2816f87" name="venv-salt-minion" arch="s390x">
  <version epoch="0" ver="3006.0" rel="231002.58.1"/>
  <changelog author="pablo.suarezhernandez@suse.com" date="1708516800">- Discover Ansible playbook files as "*.yml" or "*.yaml" files (bsc#1211888)
- Added:
  * discover-both-.yml-and-.yaml-playbooks-bsc-1211888.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1708948800">- Fix problematic tests and allow smooth tests executions on containers
- Added:
  * fix-problematic-tests-and-allow-smooth-tests-executi.patch</changelog>
  <changelog author="marek.czernek@suse.com" date="1709726400">- Make importing seco.range thread safe (bsc#1211649)
- Added:
  * make-importing-seco.range-thread-safe-bsc-1211649.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1710417600">- Fix detected issues in Salt tests when running on VMs
- Added:
  * fix-tests-failures-and-errors-when-detected-on-vm-ex.patch</changelog>
  <changelog author="yeray.gutierrez@suse.com" date="1710504000">- Ignore non-ascii chars in oscap output (bsc#1219001)
- Added:
  * decode-oscap-byte-stream-to-string-bsc-1219001.patch</changelog>
  <changelog author="marek.czernek@suse.com" date="1711022400">- Make Salt compatible with Python 3.11
- Added:
  * fix-salt-warnings-and-testuite-for-python-3.11-635.patch</changelog>
  <changelog author="marek.czernek@suse.com" date="1711454400">- Convert oscap output to UTF-8
- Added:
  * switch-oscap-encoding-to-utf-8-639.patch</changelog>
  <changelog author="alexander.graul@suse.com" date="1712318400">- Include salt-test in venv-salt-minion-testsuite
- Modified:
  * include-deb
  * include-rpm
  * exclude-deb
  * exclude-rpm</changelog>
  <changelog author="marek.czernek@suse.com" date="1712318401">- Update Python version from 3.10 to 3.11
- Fix updating the venv-salt-minion pkg with itself
- Enable build for SLE 11
- Added:
  * venv-salt-minion.initd</changelog>
  <changelog author="vzhestkov@suse.com" date="1714996800">- Include libffi and libyaml to the bundle for all of the clients
  to avoid extra dependencies from the client OS.</changelog>
  <changelog author="vzhestkov@suse.com" date="1715774400">- Speed up salt.matcher.confirm_top by using __context__
- Do not call the async wrapper calls with the separate thread
- Prevent OOM with high amount of batch async calls (bsc#1216063)
- Add missing contextvars dependency in salt.version
- Skip tests for unsupported algorithm on old OpenSSL version
- Remove redundant `_file_find` call to the master
- Prevent possible exception in tornado.concurrent.Future._set_done
- Make reactor engine less blocking the EventPublisher
- Make salt-master self recoverable on killing EventPublisher
- Improve broken events catching and reporting
- Make logging calls lighter
- Remove unused import causing delays on starting salt-master
- Added:
  * speed-up-salt.matcher.confirm_top-by-using-__context.patch
  * do-not-call-the-async-wrapper-calls-with-the-separat.patch
  * prevent-oom-with-high-amount-of-batch-async-calls-bs.patch
  * add-missing-contextvars-dependency-in-salt.version.patch
  * skip-tests-for-unsupported-algorithm-on-old-openssl-.patch
  * remove-redundant-_file_find-call-to-the-master.patch
  * prevent-possible-exception-in-tornado.concurrent.fut.patch
  * make-reactor-engine-less-blocking-the-eventpublisher.patch
  * make-salt-master-self-recoverable-on-killing-eventpu.patch
  * improve-broken-events-catching-and-reporting.patch
  * make-logging-calls-lighter.patch
  * remove-unused-import-causing-delays-on-starting-salt.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1716811200">- Several fixes for tests to avoid errors and failures in some OSes
- Added:
  * several-fixes-for-tests-to-avoid-errors-and-failures.patch</changelog>
  <changelog author="marek.czernek@suse.com" date="1717675200">- Add a timer to delete old env post update for venv-minion
- Added:
  * provide-systemd-timer-unit.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1718193600">- Skip certain tests if necessary for some OSes and set flaky ones
- Added:
  * skip-certain-tests-if-necessary-and-mark-some-flaky-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1718712000">- Fix "status.diskusage" function and exclude some tests for Salt Bundle
- Added:
  * fix-status.diskusage-and-exclude-some-tests-to-run-w.patch</changelog>
  <changelog author="fliu@suse.com" date="1720008000">- Fix performance of user.list_groups with many remote groups
- Added:
  * fix-user.list_groups-omits-remote-groups.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1720440000">- Make auth.pam more robust with Salt Bundle and fix tests
- Added:
  * some-more-small-tests-fixes-enhancements-661.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1720526400">- test_vultrpy: adjust test expectation to prevent failure after Debian 10 EOL
- Added:
  * test_vultrpy-adjust-test-expectation-to-prevent-fail.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1721822400">- Fix rich rule comparison in firewalld module (bsc#1222684)
- Added:
  * firewalld-normalize-new-rich-rules-before-comparing-.patch</changelog>
  <changelog author="marek.czernek@suse.com" date="1723032000">- Fix few failing tests to work with both Salt and Salt bundle
- Skip testing unsupported OpenSSL crypto algorithms
- Added:
  * make-tests-compatible-with-venv-bundle.patch
  * skip-more-tests-related-to-old-openssl-algorithms.patch</changelog>
</package>
<package pkgid="4b9e450a634edb54da9623e1d78b74278cb9defddbdb0fa91d6cf1d9565354e4" name="venv-salt-minion" arch="src">
  <version epoch="0" ver="3006.0" rel="231002.58.1"/>
  <changelog author="pablo.suarezhernandez@suse.com" date="1708516800">- Discover Ansible playbook files as "*.yml" or "*.yaml" files (bsc#1211888)
- Added:
  * discover-both-.yml-and-.yaml-playbooks-bsc-1211888.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1708948800">- Fix problematic tests and allow smooth tests executions on containers
- Added:
  * fix-problematic-tests-and-allow-smooth-tests-executi.patch</changelog>
  <changelog author="marek.czernek@suse.com" date="1709726400">- Make importing seco.range thread safe (bsc#1211649)
- Added:
  * make-importing-seco.range-thread-safe-bsc-1211649.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1710417600">- Fix detected issues in Salt tests when running on VMs
- Added:
  * fix-tests-failures-and-errors-when-detected-on-vm-ex.patch</changelog>
  <changelog author="yeray.gutierrez@suse.com" date="1710504000">- Ignore non-ascii chars in oscap output (bsc#1219001)
- Added:
  * decode-oscap-byte-stream-to-string-bsc-1219001.patch</changelog>
  <changelog author="marek.czernek@suse.com" date="1711022400">- Make Salt compatible with Python 3.11
- Added:
  * fix-salt-warnings-and-testuite-for-python-3.11-635.patch</changelog>
  <changelog author="marek.czernek@suse.com" date="1711454400">- Convert oscap output to UTF-8
- Added:
  * switch-oscap-encoding-to-utf-8-639.patch</changelog>
  <changelog author="alexander.graul@suse.com" date="1712318400">- Include salt-test in venv-salt-minion-testsuite
- Modified:
  * include-deb
  * include-rpm
  * exclude-deb
  * exclude-rpm</changelog>
  <changelog author="marek.czernek@suse.com" date="1712318401">- Update Python version from 3.10 to 3.11
- Fix updating the venv-salt-minion pkg with itself
- Enable build for SLE 11
- Added:
  * venv-salt-minion.initd</changelog>
  <changelog author="vzhestkov@suse.com" date="1714996800">- Include libffi and libyaml to the bundle for all of the clients
  to avoid extra dependencies from the client OS.</changelog>
  <changelog author="vzhestkov@suse.com" date="1715774400">- Speed up salt.matcher.confirm_top by using __context__
- Do not call the async wrapper calls with the separate thread
- Prevent OOM with high amount of batch async calls (bsc#1216063)
- Add missing contextvars dependency in salt.version
- Skip tests for unsupported algorithm on old OpenSSL version
- Remove redundant `_file_find` call to the master
- Prevent possible exception in tornado.concurrent.Future._set_done
- Make reactor engine less blocking the EventPublisher
- Make salt-master self recoverable on killing EventPublisher
- Improve broken events catching and reporting
- Make logging calls lighter
- Remove unused import causing delays on starting salt-master
- Added:
  * speed-up-salt.matcher.confirm_top-by-using-__context.patch
  * do-not-call-the-async-wrapper-calls-with-the-separat.patch
  * prevent-oom-with-high-amount-of-batch-async-calls-bs.patch
  * add-missing-contextvars-dependency-in-salt.version.patch
  * skip-tests-for-unsupported-algorithm-on-old-openssl-.patch
  * remove-redundant-_file_find-call-to-the-master.patch
  * prevent-possible-exception-in-tornado.concurrent.fut.patch
  * make-reactor-engine-less-blocking-the-eventpublisher.patch
  * make-salt-master-self-recoverable-on-killing-eventpu.patch
  * improve-broken-events-catching-and-reporting.patch
  * make-logging-calls-lighter.patch
  * remove-unused-import-causing-delays-on-starting-salt.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1716811200">- Several fixes for tests to avoid errors and failures in some OSes
- Added:
  * several-fixes-for-tests-to-avoid-errors-and-failures.patch</changelog>
  <changelog author="marek.czernek@suse.com" date="1717675200">- Add a timer to delete old env post update for venv-minion
- Added:
  * provide-systemd-timer-unit.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1718193600">- Skip certain tests if necessary for some OSes and set flaky ones
- Added:
  * skip-certain-tests-if-necessary-and-mark-some-flaky-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1718712000">- Fix "status.diskusage" function and exclude some tests for Salt Bundle
- Added:
  * fix-status.diskusage-and-exclude-some-tests-to-run-w.patch</changelog>
  <changelog author="fliu@suse.com" date="1720008000">- Fix performance of user.list_groups with many remote groups
- Added:
  * fix-user.list_groups-omits-remote-groups.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1720440000">- Make auth.pam more robust with Salt Bundle and fix tests
- Added:
  * some-more-small-tests-fixes-enhancements-661.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1720526400">- test_vultrpy: adjust test expectation to prevent failure after Debian 10 EOL
- Added:
  * test_vultrpy-adjust-test-expectation-to-prevent-fail.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1721822400">- Fix rich rule comparison in firewalld module (bsc#1222684)
- Added:
  * firewalld-normalize-new-rich-rules-before-comparing-.patch</changelog>
  <changelog author="marek.czernek@suse.com" date="1723032000">- Fix few failing tests to work with both Salt and Salt bundle
- Skip testing unsupported OpenSSL crypto algorithms
- Added:
  * make-tests-compatible-with-venv-bundle.patch
  * skip-more-tests-related-to-old-openssl-algorithms.patch</changelog>
</package>
<package pkgid="0b15168c544dc6d178f9f71d73f42f4892e497f7dbc033a0b8f5f71add5e106f" name="venv-salt-minion" arch="aarch64">
  <version epoch="0" ver="3006.0" rel="260715.140.1"/>
  <changelog author="vzhestkov@suse.com" date="1773403200">- Add x86_64_v2 as a possible rpm package architecture
- Make users with backslash working for salt-ssh (bsc#1254629)
- Fix ansible.playbooks extra-vars quoting (bsc#1257831)
- Fix virtualenv call in test helper to use proper python version
- Added:
  * add-x86_64_v2-as-a-possible-rpm-package-architecture.patch
  * make-users-with-backslash-working-for-salt-ssh-bsc-1.patch
  * fix-ansible.playbooks-extra-vars-quoting-bsc-1257831.patch
  * fix-virtualenv-call-in-test-helper-to-use-proper-pyt.patch</changelog>
  <changelog author="vzhestkov@suse.com" date="1773748800">- Backport security patch for Salt vendored tornado (bsc#1259554):
  * CVE-2026-31958: Add limits on multipart form data parsing
- Added:
  * backport-of-the-cve-2026-31958-fix-bsc-1259554.patch</changelog>
  <changelog author="marek.czernek@suse.com" date="1776168000">- Fix testsuite failures
- Added:
  * fix-test-failures-754.patch</changelog>
  <changelog author="marek.czernek@suse.com" date="1777291200">- BDSA-2025-60810: Harden Tornado from invalid HTTP reason phrases
- Read full URI from ldap pillar config (bsc#1254900)
- Added:
  * bdsa-2025-60810-harden-against-invalid-http-reason-p.patch
  * read-full-uri-from-ldap-pillar-config-753.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1778155200">- Specify .SO ver explicitly in BuildRequire for libsodium</changelog>
  <changelog author="vzhestkov@suse.com" date="1778760000">- Use non vendored tornado with Python 3.11 (bsc#1257583, bsc#1259700)
- Added:
  * use-non-vendored-tornado-with-python-3.11.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1779451200">- Add 'show_changes' arg to 'file.append/file.prepend" states
- Added:
  * add-show_changes-to-file.append-and-file.prepend-sta.patch</changelog>
  <changelog author="yeray.gutierrez@suse.com" date="1780488000">- Calculate UUID grain for Xen PV guests (bsc#1255418)
- Added:
  * calculate-uuid-grain-for-xen-pv-guests-759.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1780920000">- Fix deprecation warnings when running on Python 3.13
- Added:
  * fix-deprecation-warnings-when-running-on-python-3.13.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1781092800">- Fix ImportError during reentrant SIGTERM shutdown
- Fix broken "pkg.info_installed" after migration to salt.utils.timeutil
- Added:
  * fix-importerror-during-reentrant-sigterm-shutdown.patch
  * fix-broken-pkg.info_installed-after-moving-to-salt.u.patch</changelog>
  <changelog author="vzhestkov@suse.com" date="1782216000">- Fix the tests failing after switching to non-vendored tornado
- Fix the default group in tests for new users in SLE 15.6
- Use AsyncHTTPClient in salt.utils.http (bsc#1268325)
- Fix file fetching with cp module on non-vendored tornado
- Decode binary pillars for salt-ssh to avoid exceptions (bsc#1263822)
- Added:
  * fix-the-tests-failing-after-switching-to-non-vendore.patch
  * fix-the-default-group-in-tests-for-new-users-in-sle-.patch
  * use-asynchttpclient-in-salt.utils.http-bsc-1268325.patch
  * fix-file-fetching-with-non-vendored-tornado.patch
  * decode-binary-pillars-for-salt-ssh-to-avoid-exceptio.patch</changelog>
  <changelog author="vzhestkov@suse.com" date="1782820800">- Bundled python module OpenSSL was updated with CVE fix:
  * CVE-2026-40475: improper input handling of null bytes
    can lead to silent data truncation and security-state
    inconsistency (bsc#1262803)</changelog>
  <changelog author="vzhestkov@suse.com" date="1783080000">- Bundled python module tornado was updated with CVE fixes:
  * CVE-2026-49853: authorization header forwarded across
    cross-origin redirects in SimpleAsyncHTTPClient (bsc#1268395)
  * CVE-2026-49854: out-of-bounds memory access via C extension
    (bsc#1268396)
  * CVE-2026-49855: AsyncHTTPClient accumulates decompressed chunks
    without size limit (gzip bomb) (bsc#1268397)</changelog>
  <changelog author="marek.czernek@suse.com" date="1784116800">- Stabilize testsuite tests and fix AllEventsHandler
- Switch apache2ctl to apachectl for SUSE OSes (bsc#1252286)
- Support attrlist in ldap.managed (bsc#1257151)
- Added:
  * stabilize-testsuite-tests-and-fix-alleventshandler-7.patch
  * switch-apache2ctl-to-apachectl-for-suse-oses-bsc-125.patch
  * support-attrlist-in-ldap.managed-746.patch</changelog>
  <changelog author="vzhestkov@suse.com" date="1785240000">- Bundled python module jinja2 was updated to 3.1.6 with CVE fixes:
  * CVE-2024-22195: Fix compiler error when checking if required
    blocks in parent templates are xmlattr filter does not allow
    keys with spaces. (bsc#1218722)
- Bundled python module idna was updated with CVE fix:
  * CVE-2026-45409: Specially crafted inputs to idna.encode()
    can bypass earlier security fix (bsc#1265413)
- Bundled python module urllib3 was updated with CVE fix:
  * CVE-2026-44431: sensitive information disclosure due to
    sensitive headers being forwarded across origins in proxied
    low-level redirects (bsc#1265267)
- Bundled python module lxml was updated to 6.1.1 with CVE fixes:
  * CVE-2026-49825: The known link attributes in
    ``lxml.html.defs.link_attrs`` were missing ``xlink:href``,
    which can be used for URL bypass attacks in embedded
    SVG/MathML/etc. content. (bsc#1270285, CVE-2026-49825)
    https://github.com/fedora-python/lxml_html_clean/security/
    advisories/GHSA-4jhm-jv67-739f
  * CVE-2026-41066: This release fixes a possible external entity
    injection (XXE) vulnerability in ``iterparse()`` and
    the ``ETCompatXMLParser``. (bsc#1263254, CVE-2026-41066)
- Bundled python was updated with CVE fixes:
  * CVE-2026-3446: Preventing ignoring excess Base64 data
    after the first padded quad in non-strict (default) mode.
    (bsc#1261970, CVE-2026-3446, gh#python/cpython#145264).
  * CVE-2026-3479: pkgutil.get_data() has the same security model
    as open(). The documented limitations ensure compatibility with
    non-filesystem loaders; Python doesn't check that.
    (bsc#1259989, CVE-2026-3479, gh#python/cpython#146121).
- Bundled python module pyopenssl contains CVE fixes:
  * CVE-2026-27459: large cookie value can lead to a buffer overflow
    (bsc#1271428, CVE-2026-27459)
- Remove unused paramiko python module from the bundle.
- Cleanup commented packages in include-rpm and include-deb
- Modified:
  * include-deb
  * include-rpm</changelog>
  <changelog author="marek.czernek@suse.com" date="1785326400">- Fix unit tests that fail due to async Tornado usage
- Added:
  * stabilize-testsuite-773.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1785412800">- Prevent broken Salt Bundle on Ubuntu due regression in "tar" package
  from Ubuntu repositories (bsc#1271613)</changelog>
  <changelog author="vzhestkov@suse.com" date="1786017600">- Bundled python was updated with CVE fixes:
  * CVE-2026-13346: Arbitrary file installation via malicious package
    indexes. Remove ensurepip with bundled .whl files. (bsc#1273094)
  * CVE-2026-0864: Normalize all line endings (CR, CRLF, and LF) in
    configparser (bsc#1269066, gh#python/cpython#143927)
  * CVE-2026-1502: reject CR/LF in HTTP tunnel request headers
    (bsc#1261969, gh#python/cpython#146211)
  * CVE-2026-3276: Fix O(n^2) canonical ordering in
    unicodedata.normalize() (bsc#1267581, gh#python/cpython#149079)
  * CVE-2026-4360: Pass filter_function to TarFile._extract_one()
    during .extract() (bsc#1269959, gh#python/cpython#151987)
  * CVE-2026-4786: fix webbrowser %action substitution bypass of
    dash-prefix check (bsc#1262319, gh#python/cpython#148169)
  * CVE-2026-6019: protect against HTML injection by
    Base64-encoding cookie values embedded in JS
    (bsc#1262654, gh#python/cpython#90309)
  * CVE-2026-6100: prevent dangling pointer, which can end in the
    use-after-free error (bsc#1262098, gh#python/cpython#148395)
  * CVE-2026-7210: Use XML_SetHashSalt16Bytes in
    pyexpat/_elementtree when possible
    (bsc#1264962, gh#python/cpython#149018).
  * CVE-2026-7774: tarfile.data_filter: validate written link
    target (bsc#1267821, gh#149486)
  * CVE-2026-8328: Make ftplib not trust the PASV response
    (bsc#1265268)
  * CVE-2026-11940: fix the symlink escape via tarfile
    hardlink-extraction fallback (bsc#1268977)
  * CVE-2026-11972: Make tarfile._Stream.seek break at EOF
    (bsc#1269788, gh#python/cpython#151981)
  * CVE-2026-15308: Fix quadratic complexity in incremental parsing
    in HTMLParser (bsc#1271192, gh#python/cpython#153030)
- Bundled python module pip was updated to 25.0.1 with CVE fixes:
  * CVE-2026-13346: Arbitrary file installation via malicious package
    indexes (bsc#1273094)
  * CVE-2026-8643: Path traversal via malicious entry point name in pip
    wheel installation allows arbitrary file overwrite(bsc#1266669)
  * CVE-2026-6357: pip self-update functionality can import newly
    installed modules after wheel installation (bsc#1263442)
  * CVE-2026-3219: pip doesn't reject concatenated ZIP (bsc#1262429)
  * CVE-2026-1703: files may be extracted outside the installation
    directory when installing and extracting maliciously crafted
    wheel archives (bsc#1257599, gh#pypa/pip#13777)</changelog>
  <changelog author="marek.czernek@suse.com" date="1786449600">- Fix test failures with pytest&gt;=8
- Added:
  * migrate-rest_tornado-saltnado-tests-to-pytest-774.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1787832000">- Honor proxy settings in gitfs, git_pillar and winrepo (bsc#1261147)
- Added:
  * honor-proxy-settings-in-gitfs-git_pillar-and-winrepo.patch</changelog>
</package>
<package pkgid="f23d783221621bc3fdf70a1b21c5071bfeced8f063379e95a5a481164b027c3b" name="venv-salt-minion" arch="ppc64le">
  <version epoch="0" ver="3006.0" rel="260715.140.1"/>
  <changelog author="vzhestkov@suse.com" date="1773403200">- Add x86_64_v2 as a possible rpm package architecture
- Make users with backslash working for salt-ssh (bsc#1254629)
- Fix ansible.playbooks extra-vars quoting (bsc#1257831)
- Fix virtualenv call in test helper to use proper python version
- Added:
  * add-x86_64_v2-as-a-possible-rpm-package-architecture.patch
  * make-users-with-backslash-working-for-salt-ssh-bsc-1.patch
  * fix-ansible.playbooks-extra-vars-quoting-bsc-1257831.patch
  * fix-virtualenv-call-in-test-helper-to-use-proper-pyt.patch</changelog>
  <changelog author="vzhestkov@suse.com" date="1773748800">- Backport security patch for Salt vendored tornado (bsc#1259554):
  * CVE-2026-31958: Add limits on multipart form data parsing
- Added:
  * backport-of-the-cve-2026-31958-fix-bsc-1259554.patch</changelog>
  <changelog author="marek.czernek@suse.com" date="1776168000">- Fix testsuite failures
- Added:
  * fix-test-failures-754.patch</changelog>
  <changelog author="marek.czernek@suse.com" date="1777291200">- BDSA-2025-60810: Harden Tornado from invalid HTTP reason phrases
- Read full URI from ldap pillar config (bsc#1254900)
- Added:
  * bdsa-2025-60810-harden-against-invalid-http-reason-p.patch
  * read-full-uri-from-ldap-pillar-config-753.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1778155200">- Specify .SO ver explicitly in BuildRequire for libsodium</changelog>
  <changelog author="vzhestkov@suse.com" date="1778760000">- Use non vendored tornado with Python 3.11 (bsc#1257583, bsc#1259700)
- Added:
  * use-non-vendored-tornado-with-python-3.11.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1779451200">- Add 'show_changes' arg to 'file.append/file.prepend" states
- Added:
  * add-show_changes-to-file.append-and-file.prepend-sta.patch</changelog>
  <changelog author="yeray.gutierrez@suse.com" date="1780488000">- Calculate UUID grain for Xen PV guests (bsc#1255418)
- Added:
  * calculate-uuid-grain-for-xen-pv-guests-759.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1780920000">- Fix deprecation warnings when running on Python 3.13
- Added:
  * fix-deprecation-warnings-when-running-on-python-3.13.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1781092800">- Fix ImportError during reentrant SIGTERM shutdown
- Fix broken "pkg.info_installed" after migration to salt.utils.timeutil
- Added:
  * fix-importerror-during-reentrant-sigterm-shutdown.patch
  * fix-broken-pkg.info_installed-after-moving-to-salt.u.patch</changelog>
  <changelog author="vzhestkov@suse.com" date="1782216000">- Fix the tests failing after switching to non-vendored tornado
- Fix the default group in tests for new users in SLE 15.6
- Use AsyncHTTPClient in salt.utils.http (bsc#1268325)
- Fix file fetching with cp module on non-vendored tornado
- Decode binary pillars for salt-ssh to avoid exceptions (bsc#1263822)
- Added:
  * fix-the-tests-failing-after-switching-to-non-vendore.patch
  * fix-the-default-group-in-tests-for-new-users-in-sle-.patch
  * use-asynchttpclient-in-salt.utils.http-bsc-1268325.patch
  * fix-file-fetching-with-non-vendored-tornado.patch
  * decode-binary-pillars-for-salt-ssh-to-avoid-exceptio.patch</changelog>
  <changelog author="vzhestkov@suse.com" date="1782820800">- Bundled python module OpenSSL was updated with CVE fix:
  * CVE-2026-40475: improper input handling of null bytes
    can lead to silent data truncation and security-state
    inconsistency (bsc#1262803)</changelog>
  <changelog author="vzhestkov@suse.com" date="1783080000">- Bundled python module tornado was updated with CVE fixes:
  * CVE-2026-49853: authorization header forwarded across
    cross-origin redirects in SimpleAsyncHTTPClient (bsc#1268395)
  * CVE-2026-49854: out-of-bounds memory access via C extension
    (bsc#1268396)
  * CVE-2026-49855: AsyncHTTPClient accumulates decompressed chunks
    without size limit (gzip bomb) (bsc#1268397)</changelog>
  <changelog author="marek.czernek@suse.com" date="1784116800">- Stabilize testsuite tests and fix AllEventsHandler
- Switch apache2ctl to apachectl for SUSE OSes (bsc#1252286)
- Support attrlist in ldap.managed (bsc#1257151)
- Added:
  * stabilize-testsuite-tests-and-fix-alleventshandler-7.patch
  * switch-apache2ctl-to-apachectl-for-suse-oses-bsc-125.patch
  * support-attrlist-in-ldap.managed-746.patch</changelog>
  <changelog author="vzhestkov@suse.com" date="1785240000">- Bundled python module jinja2 was updated to 3.1.6 with CVE fixes:
  * CVE-2024-22195: Fix compiler error when checking if required
    blocks in parent templates are xmlattr filter does not allow
    keys with spaces. (bsc#1218722)
- Bundled python module idna was updated with CVE fix:
  * CVE-2026-45409: Specially crafted inputs to idna.encode()
    can bypass earlier security fix (bsc#1265413)
- Bundled python module urllib3 was updated with CVE fix:
  * CVE-2026-44431: sensitive information disclosure due to
    sensitive headers being forwarded across origins in proxied
    low-level redirects (bsc#1265267)
- Bundled python module lxml was updated to 6.1.1 with CVE fixes:
  * CVE-2026-49825: The known link attributes in
    ``lxml.html.defs.link_attrs`` were missing ``xlink:href``,
    which can be used for URL bypass attacks in embedded
    SVG/MathML/etc. content. (bsc#1270285, CVE-2026-49825)
    https://github.com/fedora-python/lxml_html_clean/security/
    advisories/GHSA-4jhm-jv67-739f
  * CVE-2026-41066: This release fixes a possible external entity
    injection (XXE) vulnerability in ``iterparse()`` and
    the ``ETCompatXMLParser``. (bsc#1263254, CVE-2026-41066)
- Bundled python was updated with CVE fixes:
  * CVE-2026-3446: Preventing ignoring excess Base64 data
    after the first padded quad in non-strict (default) mode.
    (bsc#1261970, CVE-2026-3446, gh#python/cpython#145264).
  * CVE-2026-3479: pkgutil.get_data() has the same security model
    as open(). The documented limitations ensure compatibility with
    non-filesystem loaders; Python doesn't check that.
    (bsc#1259989, CVE-2026-3479, gh#python/cpython#146121).
- Bundled python module pyopenssl contains CVE fixes:
  * CVE-2026-27459: large cookie value can lead to a buffer overflow
    (bsc#1271428, CVE-2026-27459)
- Remove unused paramiko python module from the bundle.
- Cleanup commented packages in include-rpm and include-deb
- Modified:
  * include-deb
  * include-rpm</changelog>
  <changelog author="marek.czernek@suse.com" date="1785326400">- Fix unit tests that fail due to async Tornado usage
- Added:
  * stabilize-testsuite-773.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1785412800">- Prevent broken Salt Bundle on Ubuntu due regression in "tar" package
  from Ubuntu repositories (bsc#1271613)</changelog>
  <changelog author="vzhestkov@suse.com" date="1786017600">- Bundled python was updated with CVE fixes:
  * CVE-2026-13346: Arbitrary file installation via malicious package
    indexes. Remove ensurepip with bundled .whl files. (bsc#1273094)
  * CVE-2026-0864: Normalize all line endings (CR, CRLF, and LF) in
    configparser (bsc#1269066, gh#python/cpython#143927)
  * CVE-2026-1502: reject CR/LF in HTTP tunnel request headers
    (bsc#1261969, gh#python/cpython#146211)
  * CVE-2026-3276: Fix O(n^2) canonical ordering in
    unicodedata.normalize() (bsc#1267581, gh#python/cpython#149079)
  * CVE-2026-4360: Pass filter_function to TarFile._extract_one()
    during .extract() (bsc#1269959, gh#python/cpython#151987)
  * CVE-2026-4786: fix webbrowser %action substitution bypass of
    dash-prefix check (bsc#1262319, gh#python/cpython#148169)
  * CVE-2026-6019: protect against HTML injection by
    Base64-encoding cookie values embedded in JS
    (bsc#1262654, gh#python/cpython#90309)
  * CVE-2026-6100: prevent dangling pointer, which can end in the
    use-after-free error (bsc#1262098, gh#python/cpython#148395)
  * CVE-2026-7210: Use XML_SetHashSalt16Bytes in
    pyexpat/_elementtree when possible
    (bsc#1264962, gh#python/cpython#149018).
  * CVE-2026-7774: tarfile.data_filter: validate written link
    target (bsc#1267821, gh#149486)
  * CVE-2026-8328: Make ftplib not trust the PASV response
    (bsc#1265268)
  * CVE-2026-11940: fix the symlink escape via tarfile
    hardlink-extraction fallback (bsc#1268977)
  * CVE-2026-11972: Make tarfile._Stream.seek break at EOF
    (bsc#1269788, gh#python/cpython#151981)
  * CVE-2026-15308: Fix quadratic complexity in incremental parsing
    in HTMLParser (bsc#1271192, gh#python/cpython#153030)
- Bundled python module pip was updated to 25.0.1 with CVE fixes:
  * CVE-2026-13346: Arbitrary file installation via malicious package
    indexes (bsc#1273094)
  * CVE-2026-8643: Path traversal via malicious entry point name in pip
    wheel installation allows arbitrary file overwrite(bsc#1266669)
  * CVE-2026-6357: pip self-update functionality can import newly
    installed modules after wheel installation (bsc#1263442)
  * CVE-2026-3219: pip doesn't reject concatenated ZIP (bsc#1262429)
  * CVE-2026-1703: files may be extracted outside the installation
    directory when installing and extracting maliciously crafted
    wheel archives (bsc#1257599, gh#pypa/pip#13777)</changelog>
  <changelog author="marek.czernek@suse.com" date="1786449600">- Fix test failures with pytest&gt;=8
- Added:
  * migrate-rest_tornado-saltnado-tests-to-pytest-774.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1787832000">- Honor proxy settings in gitfs, git_pillar and winrepo (bsc#1261147)
- Added:
  * honor-proxy-settings-in-gitfs-git_pillar-and-winrepo.patch</changelog>
</package>
<package pkgid="eb333cc85f117577a333dfc3abe908b70b2d63af23f0f3a0b83ef835bad704cc" name="venv-salt-minion" arch="src">
  <version epoch="0" ver="3006.0" rel="260715.140.1"/>
  <changelog author="vzhestkov@suse.com" date="1773403200">- Add x86_64_v2 as a possible rpm package architecture
- Make users with backslash working for salt-ssh (bsc#1254629)
- Fix ansible.playbooks extra-vars quoting (bsc#1257831)
- Fix virtualenv call in test helper to use proper python version
- Added:
  * add-x86_64_v2-as-a-possible-rpm-package-architecture.patch
  * make-users-with-backslash-working-for-salt-ssh-bsc-1.patch
  * fix-ansible.playbooks-extra-vars-quoting-bsc-1257831.patch
  * fix-virtualenv-call-in-test-helper-to-use-proper-pyt.patch</changelog>
  <changelog author="vzhestkov@suse.com" date="1773748800">- Backport security patch for Salt vendored tornado (bsc#1259554):
  * CVE-2026-31958: Add limits on multipart form data parsing
- Added:
  * backport-of-the-cve-2026-31958-fix-bsc-1259554.patch</changelog>
  <changelog author="marek.czernek@suse.com" date="1776168000">- Fix testsuite failures
- Added:
  * fix-test-failures-754.patch</changelog>
  <changelog author="marek.czernek@suse.com" date="1777291200">- BDSA-2025-60810: Harden Tornado from invalid HTTP reason phrases
- Read full URI from ldap pillar config (bsc#1254900)
- Added:
  * bdsa-2025-60810-harden-against-invalid-http-reason-p.patch
  * read-full-uri-from-ldap-pillar-config-753.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1778155200">- Specify .SO ver explicitly in BuildRequire for libsodium</changelog>
  <changelog author="vzhestkov@suse.com" date="1778760000">- Use non vendored tornado with Python 3.11 (bsc#1257583, bsc#1259700)
- Added:
  * use-non-vendored-tornado-with-python-3.11.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1779451200">- Add 'show_changes' arg to 'file.append/file.prepend" states
- Added:
  * add-show_changes-to-file.append-and-file.prepend-sta.patch</changelog>
  <changelog author="yeray.gutierrez@suse.com" date="1780488000">- Calculate UUID grain for Xen PV guests (bsc#1255418)
- Added:
  * calculate-uuid-grain-for-xen-pv-guests-759.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1780920000">- Fix deprecation warnings when running on Python 3.13
- Added:
  * fix-deprecation-warnings-when-running-on-python-3.13.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1781092800">- Fix ImportError during reentrant SIGTERM shutdown
- Fix broken "pkg.info_installed" after migration to salt.utils.timeutil
- Added:
  * fix-importerror-during-reentrant-sigterm-shutdown.patch
  * fix-broken-pkg.info_installed-after-moving-to-salt.u.patch</changelog>
  <changelog author="vzhestkov@suse.com" date="1782216000">- Fix the tests failing after switching to non-vendored tornado
- Fix the default group in tests for new users in SLE 15.6
- Use AsyncHTTPClient in salt.utils.http (bsc#1268325)
- Fix file fetching with cp module on non-vendored tornado
- Decode binary pillars for salt-ssh to avoid exceptions (bsc#1263822)
- Added:
  * fix-the-tests-failing-after-switching-to-non-vendore.patch
  * fix-the-default-group-in-tests-for-new-users-in-sle-.patch
  * use-asynchttpclient-in-salt.utils.http-bsc-1268325.patch
  * fix-file-fetching-with-non-vendored-tornado.patch
  * decode-binary-pillars-for-salt-ssh-to-avoid-exceptio.patch</changelog>
  <changelog author="vzhestkov@suse.com" date="1782820800">- Bundled python module OpenSSL was updated with CVE fix:
  * CVE-2026-40475: improper input handling of null bytes
    can lead to silent data truncation and security-state
    inconsistency (bsc#1262803)</changelog>
  <changelog author="vzhestkov@suse.com" date="1783080000">- Bundled python module tornado was updated with CVE fixes:
  * CVE-2026-49853: authorization header forwarded across
    cross-origin redirects in SimpleAsyncHTTPClient (bsc#1268395)
  * CVE-2026-49854: out-of-bounds memory access via C extension
    (bsc#1268396)
  * CVE-2026-49855: AsyncHTTPClient accumulates decompressed chunks
    without size limit (gzip bomb) (bsc#1268397)</changelog>
  <changelog author="marek.czernek@suse.com" date="1784116800">- Stabilize testsuite tests and fix AllEventsHandler
- Switch apache2ctl to apachectl for SUSE OSes (bsc#1252286)
- Support attrlist in ldap.managed (bsc#1257151)
- Added:
  * stabilize-testsuite-tests-and-fix-alleventshandler-7.patch
  * switch-apache2ctl-to-apachectl-for-suse-oses-bsc-125.patch
  * support-attrlist-in-ldap.managed-746.patch</changelog>
  <changelog author="vzhestkov@suse.com" date="1785240000">- Bundled python module jinja2 was updated to 3.1.6 with CVE fixes:
  * CVE-2024-22195: Fix compiler error when checking if required
    blocks in parent templates are xmlattr filter does not allow
    keys with spaces. (bsc#1218722)
- Bundled python module idna was updated with CVE fix:
  * CVE-2026-45409: Specially crafted inputs to idna.encode()
    can bypass earlier security fix (bsc#1265413)
- Bundled python module urllib3 was updated with CVE fix:
  * CVE-2026-44431: sensitive information disclosure due to
    sensitive headers being forwarded across origins in proxied
    low-level redirects (bsc#1265267)
- Bundled python module lxml was updated to 6.1.1 with CVE fixes:
  * CVE-2026-49825: The known link attributes in
    ``lxml.html.defs.link_attrs`` were missing ``xlink:href``,
    which can be used for URL bypass attacks in embedded
    SVG/MathML/etc. content. (bsc#1270285, CVE-2026-49825)
    https://github.com/fedora-python/lxml_html_clean/security/
    advisories/GHSA-4jhm-jv67-739f
  * CVE-2026-41066: This release fixes a possible external entity
    injection (XXE) vulnerability in ``iterparse()`` and
    the ``ETCompatXMLParser``. (bsc#1263254, CVE-2026-41066)
- Bundled python was updated with CVE fixes:
  * CVE-2026-3446: Preventing ignoring excess Base64 data
    after the first padded quad in non-strict (default) mode.
    (bsc#1261970, CVE-2026-3446, gh#python/cpython#145264).
  * CVE-2026-3479: pkgutil.get_data() has the same security model
    as open(). The documented limitations ensure compatibility with
    non-filesystem loaders; Python doesn't check that.
    (bsc#1259989, CVE-2026-3479, gh#python/cpython#146121).
- Bundled python module pyopenssl contains CVE fixes:
  * CVE-2026-27459: large cookie value can lead to a buffer overflow
    (bsc#1271428, CVE-2026-27459)
- Remove unused paramiko python module from the bundle.
- Cleanup commented packages in include-rpm and include-deb
- Modified:
  * include-deb
  * include-rpm</changelog>
  <changelog author="marek.czernek@suse.com" date="1785326400">- Fix unit tests that fail due to async Tornado usage
- Added:
  * stabilize-testsuite-773.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1785412800">- Prevent broken Salt Bundle on Ubuntu due regression in "tar" package
  from Ubuntu repositories (bsc#1271613)</changelog>
  <changelog author="vzhestkov@suse.com" date="1786017600">- Bundled python was updated with CVE fixes:
  * CVE-2026-13346: Arbitrary file installation via malicious package
    indexes. Remove ensurepip with bundled .whl files. (bsc#1273094)
  * CVE-2026-0864: Normalize all line endings (CR, CRLF, and LF) in
    configparser (bsc#1269066, gh#python/cpython#143927)
  * CVE-2026-1502: reject CR/LF in HTTP tunnel request headers
    (bsc#1261969, gh#python/cpython#146211)
  * CVE-2026-3276: Fix O(n^2) canonical ordering in
    unicodedata.normalize() (bsc#1267581, gh#python/cpython#149079)
  * CVE-2026-4360: Pass filter_function to TarFile._extract_one()
    during .extract() (bsc#1269959, gh#python/cpython#151987)
  * CVE-2026-4786: fix webbrowser %action substitution bypass of
    dash-prefix check (bsc#1262319, gh#python/cpython#148169)
  * CVE-2026-6019: protect against HTML injection by
    Base64-encoding cookie values embedded in JS
    (bsc#1262654, gh#python/cpython#90309)
  * CVE-2026-6100: prevent dangling pointer, which can end in the
    use-after-free error (bsc#1262098, gh#python/cpython#148395)
  * CVE-2026-7210: Use XML_SetHashSalt16Bytes in
    pyexpat/_elementtree when possible
    (bsc#1264962, gh#python/cpython#149018).
  * CVE-2026-7774: tarfile.data_filter: validate written link
    target (bsc#1267821, gh#149486)
  * CVE-2026-8328: Make ftplib not trust the PASV response
    (bsc#1265268)
  * CVE-2026-11940: fix the symlink escape via tarfile
    hardlink-extraction fallback (bsc#1268977)
  * CVE-2026-11972: Make tarfile._Stream.seek break at EOF
    (bsc#1269788, gh#python/cpython#151981)
  * CVE-2026-15308: Fix quadratic complexity in incremental parsing
    in HTMLParser (bsc#1271192, gh#python/cpython#153030)
- Bundled python module pip was updated to 25.0.1 with CVE fixes:
  * CVE-2026-13346: Arbitrary file installation via malicious package
    indexes (bsc#1273094)
  * CVE-2026-8643: Path traversal via malicious entry point name in pip
    wheel installation allows arbitrary file overwrite(bsc#1266669)
  * CVE-2026-6357: pip self-update functionality can import newly
    installed modules after wheel installation (bsc#1263442)
  * CVE-2026-3219: pip doesn't reject concatenated ZIP (bsc#1262429)
  * CVE-2026-1703: files may be extracted outside the installation
    directory when installing and extracting maliciously crafted
    wheel archives (bsc#1257599, gh#pypa/pip#13777)</changelog>
  <changelog author="marek.czernek@suse.com" date="1786449600">- Fix test failures with pytest&gt;=8
- Added:
  * migrate-rest_tornado-saltnado-tests-to-pytest-774.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1787832000">- Honor proxy settings in gitfs, git_pillar and winrepo (bsc#1261147)
- Added:
  * honor-proxy-settings-in-gitfs-git_pillar-and-winrepo.patch</changelog>
</package>
<package pkgid="f1e4e837c11cd39ca661ab8f2fbed045c62f72e40547cf17997a2f780e5f6b11" name="venv-salt-minion" arch="x86_64">
  <version epoch="0" ver="3006.0" rel="260715.140.1"/>
  <changelog author="vzhestkov@suse.com" date="1773403200">- Add x86_64_v2 as a possible rpm package architecture
- Make users with backslash working for salt-ssh (bsc#1254629)
- Fix ansible.playbooks extra-vars quoting (bsc#1257831)
- Fix virtualenv call in test helper to use proper python version
- Added:
  * add-x86_64_v2-as-a-possible-rpm-package-architecture.patch
  * make-users-with-backslash-working-for-salt-ssh-bsc-1.patch
  * fix-ansible.playbooks-extra-vars-quoting-bsc-1257831.patch
  * fix-virtualenv-call-in-test-helper-to-use-proper-pyt.patch</changelog>
  <changelog author="vzhestkov@suse.com" date="1773748800">- Backport security patch for Salt vendored tornado (bsc#1259554):
  * CVE-2026-31958: Add limits on multipart form data parsing
- Added:
  * backport-of-the-cve-2026-31958-fix-bsc-1259554.patch</changelog>
  <changelog author="marek.czernek@suse.com" date="1776168000">- Fix testsuite failures
- Added:
  * fix-test-failures-754.patch</changelog>
  <changelog author="marek.czernek@suse.com" date="1777291200">- BDSA-2025-60810: Harden Tornado from invalid HTTP reason phrases
- Read full URI from ldap pillar config (bsc#1254900)
- Added:
  * bdsa-2025-60810-harden-against-invalid-http-reason-p.patch
  * read-full-uri-from-ldap-pillar-config-753.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1778155200">- Specify .SO ver explicitly in BuildRequire for libsodium</changelog>
  <changelog author="vzhestkov@suse.com" date="1778760000">- Use non vendored tornado with Python 3.11 (bsc#1257583, bsc#1259700)
- Added:
  * use-non-vendored-tornado-with-python-3.11.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1779451200">- Add 'show_changes' arg to 'file.append/file.prepend" states
- Added:
  * add-show_changes-to-file.append-and-file.prepend-sta.patch</changelog>
  <changelog author="yeray.gutierrez@suse.com" date="1780488000">- Calculate UUID grain for Xen PV guests (bsc#1255418)
- Added:
  * calculate-uuid-grain-for-xen-pv-guests-759.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1780920000">- Fix deprecation warnings when running on Python 3.13
- Added:
  * fix-deprecation-warnings-when-running-on-python-3.13.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1781092800">- Fix ImportError during reentrant SIGTERM shutdown
- Fix broken "pkg.info_installed" after migration to salt.utils.timeutil
- Added:
  * fix-importerror-during-reentrant-sigterm-shutdown.patch
  * fix-broken-pkg.info_installed-after-moving-to-salt.u.patch</changelog>
  <changelog author="vzhestkov@suse.com" date="1782216000">- Fix the tests failing after switching to non-vendored tornado
- Fix the default group in tests for new users in SLE 15.6
- Use AsyncHTTPClient in salt.utils.http (bsc#1268325)
- Fix file fetching with cp module on non-vendored tornado
- Decode binary pillars for salt-ssh to avoid exceptions (bsc#1263822)
- Added:
  * fix-the-tests-failing-after-switching-to-non-vendore.patch
  * fix-the-default-group-in-tests-for-new-users-in-sle-.patch
  * use-asynchttpclient-in-salt.utils.http-bsc-1268325.patch
  * fix-file-fetching-with-non-vendored-tornado.patch
  * decode-binary-pillars-for-salt-ssh-to-avoid-exceptio.patch</changelog>
  <changelog author="vzhestkov@suse.com" date="1782820800">- Bundled python module OpenSSL was updated with CVE fix:
  * CVE-2026-40475: improper input handling of null bytes
    can lead to silent data truncation and security-state
    inconsistency (bsc#1262803)</changelog>
  <changelog author="vzhestkov@suse.com" date="1783080000">- Bundled python module tornado was updated with CVE fixes:
  * CVE-2026-49853: authorization header forwarded across
    cross-origin redirects in SimpleAsyncHTTPClient (bsc#1268395)
  * CVE-2026-49854: out-of-bounds memory access via C extension
    (bsc#1268396)
  * CVE-2026-49855: AsyncHTTPClient accumulates decompressed chunks
    without size limit (gzip bomb) (bsc#1268397)</changelog>
  <changelog author="marek.czernek@suse.com" date="1784116800">- Stabilize testsuite tests and fix AllEventsHandler
- Switch apache2ctl to apachectl for SUSE OSes (bsc#1252286)
- Support attrlist in ldap.managed (bsc#1257151)
- Added:
  * stabilize-testsuite-tests-and-fix-alleventshandler-7.patch
  * switch-apache2ctl-to-apachectl-for-suse-oses-bsc-125.patch
  * support-attrlist-in-ldap.managed-746.patch</changelog>
  <changelog author="vzhestkov@suse.com" date="1785240000">- Bundled python module jinja2 was updated to 3.1.6 with CVE fixes:
  * CVE-2024-22195: Fix compiler error when checking if required
    blocks in parent templates are xmlattr filter does not allow
    keys with spaces. (bsc#1218722)
- Bundled python module idna was updated with CVE fix:
  * CVE-2026-45409: Specially crafted inputs to idna.encode()
    can bypass earlier security fix (bsc#1265413)
- Bundled python module urllib3 was updated with CVE fix:
  * CVE-2026-44431: sensitive information disclosure due to
    sensitive headers being forwarded across origins in proxied
    low-level redirects (bsc#1265267)
- Bundled python module lxml was updated to 6.1.1 with CVE fixes:
  * CVE-2026-49825: The known link attributes in
    ``lxml.html.defs.link_attrs`` were missing ``xlink:href``,
    which can be used for URL bypass attacks in embedded
    SVG/MathML/etc. content. (bsc#1270285, CVE-2026-49825)
    https://github.com/fedora-python/lxml_html_clean/security/
    advisories/GHSA-4jhm-jv67-739f
  * CVE-2026-41066: This release fixes a possible external entity
    injection (XXE) vulnerability in ``iterparse()`` and
    the ``ETCompatXMLParser``. (bsc#1263254, CVE-2026-41066)
- Bundled python was updated with CVE fixes:
  * CVE-2026-3446: Preventing ignoring excess Base64 data
    after the first padded quad in non-strict (default) mode.
    (bsc#1261970, CVE-2026-3446, gh#python/cpython#145264).
  * CVE-2026-3479: pkgutil.get_data() has the same security model
    as open(). The documented limitations ensure compatibility with
    non-filesystem loaders; Python doesn't check that.
    (bsc#1259989, CVE-2026-3479, gh#python/cpython#146121).
- Bundled python module pyopenssl contains CVE fixes:
  * CVE-2026-27459: large cookie value can lead to a buffer overflow
    (bsc#1271428, CVE-2026-27459)
- Remove unused paramiko python module from the bundle.
- Cleanup commented packages in include-rpm and include-deb
- Modified:
  * include-deb
  * include-rpm</changelog>
  <changelog author="marek.czernek@suse.com" date="1785326400">- Fix unit tests that fail due to async Tornado usage
- Added:
  * stabilize-testsuite-773.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1785412800">- Prevent broken Salt Bundle on Ubuntu due regression in "tar" package
  from Ubuntu repositories (bsc#1271613)</changelog>
  <changelog author="vzhestkov@suse.com" date="1786017600">- Bundled python was updated with CVE fixes:
  * CVE-2026-13346: Arbitrary file installation via malicious package
    indexes. Remove ensurepip with bundled .whl files. (bsc#1273094)
  * CVE-2026-0864: Normalize all line endings (CR, CRLF, and LF) in
    configparser (bsc#1269066, gh#python/cpython#143927)
  * CVE-2026-1502: reject CR/LF in HTTP tunnel request headers
    (bsc#1261969, gh#python/cpython#146211)
  * CVE-2026-3276: Fix O(n^2) canonical ordering in
    unicodedata.normalize() (bsc#1267581, gh#python/cpython#149079)
  * CVE-2026-4360: Pass filter_function to TarFile._extract_one()
    during .extract() (bsc#1269959, gh#python/cpython#151987)
  * CVE-2026-4786: fix webbrowser %action substitution bypass of
    dash-prefix check (bsc#1262319, gh#python/cpython#148169)
  * CVE-2026-6019: protect against HTML injection by
    Base64-encoding cookie values embedded in JS
    (bsc#1262654, gh#python/cpython#90309)
  * CVE-2026-6100: prevent dangling pointer, which can end in the
    use-after-free error (bsc#1262098, gh#python/cpython#148395)
  * CVE-2026-7210: Use XML_SetHashSalt16Bytes in
    pyexpat/_elementtree when possible
    (bsc#1264962, gh#python/cpython#149018).
  * CVE-2026-7774: tarfile.data_filter: validate written link
    target (bsc#1267821, gh#149486)
  * CVE-2026-8328: Make ftplib not trust the PASV response
    (bsc#1265268)
  * CVE-2026-11940: fix the symlink escape via tarfile
    hardlink-extraction fallback (bsc#1268977)
  * CVE-2026-11972: Make tarfile._Stream.seek break at EOF
    (bsc#1269788, gh#python/cpython#151981)
  * CVE-2026-15308: Fix quadratic complexity in incremental parsing
    in HTMLParser (bsc#1271192, gh#python/cpython#153030)
- Bundled python module pip was updated to 25.0.1 with CVE fixes:
  * CVE-2026-13346: Arbitrary file installation via malicious package
    indexes (bsc#1273094)
  * CVE-2026-8643: Path traversal via malicious entry point name in pip
    wheel installation allows arbitrary file overwrite(bsc#1266669)
  * CVE-2026-6357: pip self-update functionality can import newly
    installed modules after wheel installation (bsc#1263442)
  * CVE-2026-3219: pip doesn't reject concatenated ZIP (bsc#1262429)
  * CVE-2026-1703: files may be extracted outside the installation
    directory when installing and extracting maliciously crafted
    wheel archives (bsc#1257599, gh#pypa/pip#13777)</changelog>
  <changelog author="marek.czernek@suse.com" date="1786449600">- Fix test failures with pytest&gt;=8
- Added:
  * migrate-rest_tornado-saltnado-tests-to-pytest-774.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1787832000">- Honor proxy settings in gitfs, git_pillar and winrepo (bsc#1261147)
- Added:
  * honor-proxy-settings-in-gitfs-git_pillar-and-winrepo.patch</changelog>
</package>
<package pkgid="6ea7e2f5697a1992c00af2128f59f5a0c98dc05775f5c789311927a704cc0daf" name="venv-salt-minion-testsuite" arch="s390x">
  <version epoch="0" ver="3006.0" rel="231002.58.1"/>
  <changelog author="pablo.suarezhernandez@suse.com" date="1708516800">- Discover Ansible playbook files as "*.yml" or "*.yaml" files (bsc#1211888)
- Added:
  * discover-both-.yml-and-.yaml-playbooks-bsc-1211888.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1708948800">- Fix problematic tests and allow smooth tests executions on containers
- Added:
  * fix-problematic-tests-and-allow-smooth-tests-executi.patch</changelog>
  <changelog author="marek.czernek@suse.com" date="1709726400">- Make importing seco.range thread safe (bsc#1211649)
- Added:
  * make-importing-seco.range-thread-safe-bsc-1211649.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1710417600">- Fix detected issues in Salt tests when running on VMs
- Added:
  * fix-tests-failures-and-errors-when-detected-on-vm-ex.patch</changelog>
  <changelog author="yeray.gutierrez@suse.com" date="1710504000">- Ignore non-ascii chars in oscap output (bsc#1219001)
- Added:
  * decode-oscap-byte-stream-to-string-bsc-1219001.patch</changelog>
  <changelog author="marek.czernek@suse.com" date="1711022400">- Make Salt compatible with Python 3.11
- Added:
  * fix-salt-warnings-and-testuite-for-python-3.11-635.patch</changelog>
  <changelog author="marek.czernek@suse.com" date="1711454400">- Convert oscap output to UTF-8
- Added:
  * switch-oscap-encoding-to-utf-8-639.patch</changelog>
  <changelog author="alexander.graul@suse.com" date="1712318400">- Include salt-test in venv-salt-minion-testsuite
- Modified:
  * include-deb
  * include-rpm
  * exclude-deb
  * exclude-rpm</changelog>
  <changelog author="marek.czernek@suse.com" date="1712318401">- Update Python version from 3.10 to 3.11
- Fix updating the venv-salt-minion pkg with itself
- Enable build for SLE 11
- Added:
  * venv-salt-minion.initd</changelog>
  <changelog author="vzhestkov@suse.com" date="1714996800">- Include libffi and libyaml to the bundle for all of the clients
  to avoid extra dependencies from the client OS.</changelog>
  <changelog author="vzhestkov@suse.com" date="1715774400">- Speed up salt.matcher.confirm_top by using __context__
- Do not call the async wrapper calls with the separate thread
- Prevent OOM with high amount of batch async calls (bsc#1216063)
- Add missing contextvars dependency in salt.version
- Skip tests for unsupported algorithm on old OpenSSL version
- Remove redundant `_file_find` call to the master
- Prevent possible exception in tornado.concurrent.Future._set_done
- Make reactor engine less blocking the EventPublisher
- Make salt-master self recoverable on killing EventPublisher
- Improve broken events catching and reporting
- Make logging calls lighter
- Remove unused import causing delays on starting salt-master
- Added:
  * speed-up-salt.matcher.confirm_top-by-using-__context.patch
  * do-not-call-the-async-wrapper-calls-with-the-separat.patch
  * prevent-oom-with-high-amount-of-batch-async-calls-bs.patch
  * add-missing-contextvars-dependency-in-salt.version.patch
  * skip-tests-for-unsupported-algorithm-on-old-openssl-.patch
  * remove-redundant-_file_find-call-to-the-master.patch
  * prevent-possible-exception-in-tornado.concurrent.fut.patch
  * make-reactor-engine-less-blocking-the-eventpublisher.patch
  * make-salt-master-self-recoverable-on-killing-eventpu.patch
  * improve-broken-events-catching-and-reporting.patch
  * make-logging-calls-lighter.patch
  * remove-unused-import-causing-delays-on-starting-salt.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1716811200">- Several fixes for tests to avoid errors and failures in some OSes
- Added:
  * several-fixes-for-tests-to-avoid-errors-and-failures.patch</changelog>
  <changelog author="marek.czernek@suse.com" date="1717675200">- Add a timer to delete old env post update for venv-minion
- Added:
  * provide-systemd-timer-unit.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1718193600">- Skip certain tests if necessary for some OSes and set flaky ones
- Added:
  * skip-certain-tests-if-necessary-and-mark-some-flaky-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1718712000">- Fix "status.diskusage" function and exclude some tests for Salt Bundle
- Added:
  * fix-status.diskusage-and-exclude-some-tests-to-run-w.patch</changelog>
  <changelog author="fliu@suse.com" date="1720008000">- Fix performance of user.list_groups with many remote groups
- Added:
  * fix-user.list_groups-omits-remote-groups.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1720440000">- Make auth.pam more robust with Salt Bundle and fix tests
- Added:
  * some-more-small-tests-fixes-enhancements-661.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1720526400">- test_vultrpy: adjust test expectation to prevent failure after Debian 10 EOL
- Added:
  * test_vultrpy-adjust-test-expectation-to-prevent-fail.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1721822400">- Fix rich rule comparison in firewalld module (bsc#1222684)
- Added:
  * firewalld-normalize-new-rich-rules-before-comparing-.patch</changelog>
  <changelog author="marek.czernek@suse.com" date="1723032000">- Fix few failing tests to work with both Salt and Salt bundle
- Skip testing unsupported OpenSSL crypto algorithms
- Added:
  * make-tests-compatible-with-venv-bundle.patch
  * skip-more-tests-related-to-old-openssl-algorithms.patch</changelog>
</package>
<package pkgid="db9972cfe50fb0bbfc990ae94a2468393eed15eec1c7a0b02db81347edeb3520" name="venv-salt-minion-testsuite" arch="aarch64">
  <version epoch="0" ver="3006.0" rel="260715.140.1"/>
  <changelog author="vzhestkov@suse.com" date="1773403200">- Add x86_64_v2 as a possible rpm package architecture
- Make users with backslash working for salt-ssh (bsc#1254629)
- Fix ansible.playbooks extra-vars quoting (bsc#1257831)
- Fix virtualenv call in test helper to use proper python version
- Added:
  * add-x86_64_v2-as-a-possible-rpm-package-architecture.patch
  * make-users-with-backslash-working-for-salt-ssh-bsc-1.patch
  * fix-ansible.playbooks-extra-vars-quoting-bsc-1257831.patch
  * fix-virtualenv-call-in-test-helper-to-use-proper-pyt.patch</changelog>
  <changelog author="vzhestkov@suse.com" date="1773748800">- Backport security patch for Salt vendored tornado (bsc#1259554):
  * CVE-2026-31958: Add limits on multipart form data parsing
- Added:
  * backport-of-the-cve-2026-31958-fix-bsc-1259554.patch</changelog>
  <changelog author="marek.czernek@suse.com" date="1776168000">- Fix testsuite failures
- Added:
  * fix-test-failures-754.patch</changelog>
  <changelog author="marek.czernek@suse.com" date="1777291200">- BDSA-2025-60810: Harden Tornado from invalid HTTP reason phrases
- Read full URI from ldap pillar config (bsc#1254900)
- Added:
  * bdsa-2025-60810-harden-against-invalid-http-reason-p.patch
  * read-full-uri-from-ldap-pillar-config-753.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1778155200">- Specify .SO ver explicitly in BuildRequire for libsodium</changelog>
  <changelog author="vzhestkov@suse.com" date="1778760000">- Use non vendored tornado with Python 3.11 (bsc#1257583, bsc#1259700)
- Added:
  * use-non-vendored-tornado-with-python-3.11.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1779451200">- Add 'show_changes' arg to 'file.append/file.prepend" states
- Added:
  * add-show_changes-to-file.append-and-file.prepend-sta.patch</changelog>
  <changelog author="yeray.gutierrez@suse.com" date="1780488000">- Calculate UUID grain for Xen PV guests (bsc#1255418)
- Added:
  * calculate-uuid-grain-for-xen-pv-guests-759.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1780920000">- Fix deprecation warnings when running on Python 3.13
- Added:
  * fix-deprecation-warnings-when-running-on-python-3.13.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1781092800">- Fix ImportError during reentrant SIGTERM shutdown
- Fix broken "pkg.info_installed" after migration to salt.utils.timeutil
- Added:
  * fix-importerror-during-reentrant-sigterm-shutdown.patch
  * fix-broken-pkg.info_installed-after-moving-to-salt.u.patch</changelog>
  <changelog author="vzhestkov@suse.com" date="1782216000">- Fix the tests failing after switching to non-vendored tornado
- Fix the default group in tests for new users in SLE 15.6
- Use AsyncHTTPClient in salt.utils.http (bsc#1268325)
- Fix file fetching with cp module on non-vendored tornado
- Decode binary pillars for salt-ssh to avoid exceptions (bsc#1263822)
- Added:
  * fix-the-tests-failing-after-switching-to-non-vendore.patch
  * fix-the-default-group-in-tests-for-new-users-in-sle-.patch
  * use-asynchttpclient-in-salt.utils.http-bsc-1268325.patch
  * fix-file-fetching-with-non-vendored-tornado.patch
  * decode-binary-pillars-for-salt-ssh-to-avoid-exceptio.patch</changelog>
  <changelog author="vzhestkov@suse.com" date="1782820800">- Bundled python module OpenSSL was updated with CVE fix:
  * CVE-2026-40475: improper input handling of null bytes
    can lead to silent data truncation and security-state
    inconsistency (bsc#1262803)</changelog>
  <changelog author="vzhestkov@suse.com" date="1783080000">- Bundled python module tornado was updated with CVE fixes:
  * CVE-2026-49853: authorization header forwarded across
    cross-origin redirects in SimpleAsyncHTTPClient (bsc#1268395)
  * CVE-2026-49854: out-of-bounds memory access via C extension
    (bsc#1268396)
  * CVE-2026-49855: AsyncHTTPClient accumulates decompressed chunks
    without size limit (gzip bomb) (bsc#1268397)</changelog>
  <changelog author="marek.czernek@suse.com" date="1784116800">- Stabilize testsuite tests and fix AllEventsHandler
- Switch apache2ctl to apachectl for SUSE OSes (bsc#1252286)
- Support attrlist in ldap.managed (bsc#1257151)
- Added:
  * stabilize-testsuite-tests-and-fix-alleventshandler-7.patch
  * switch-apache2ctl-to-apachectl-for-suse-oses-bsc-125.patch
  * support-attrlist-in-ldap.managed-746.patch</changelog>
  <changelog author="vzhestkov@suse.com" date="1785240000">- Bundled python module jinja2 was updated to 3.1.6 with CVE fixes:
  * CVE-2024-22195: Fix compiler error when checking if required
    blocks in parent templates are xmlattr filter does not allow
    keys with spaces. (bsc#1218722)
- Bundled python module idna was updated with CVE fix:
  * CVE-2026-45409: Specially crafted inputs to idna.encode()
    can bypass earlier security fix (bsc#1265413)
- Bundled python module urllib3 was updated with CVE fix:
  * CVE-2026-44431: sensitive information disclosure due to
    sensitive headers being forwarded across origins in proxied
    low-level redirects (bsc#1265267)
- Bundled python module lxml was updated to 6.1.1 with CVE fixes:
  * CVE-2026-49825: The known link attributes in
    ``lxml.html.defs.link_attrs`` were missing ``xlink:href``,
    which can be used for URL bypass attacks in embedded
    SVG/MathML/etc. content. (bsc#1270285, CVE-2026-49825)
    https://github.com/fedora-python/lxml_html_clean/security/
    advisories/GHSA-4jhm-jv67-739f
  * CVE-2026-41066: This release fixes a possible external entity
    injection (XXE) vulnerability in ``iterparse()`` and
    the ``ETCompatXMLParser``. (bsc#1263254, CVE-2026-41066)
- Bundled python was updated with CVE fixes:
  * CVE-2026-3446: Preventing ignoring excess Base64 data
    after the first padded quad in non-strict (default) mode.
    (bsc#1261970, CVE-2026-3446, gh#python/cpython#145264).
  * CVE-2026-3479: pkgutil.get_data() has the same security model
    as open(). The documented limitations ensure compatibility with
    non-filesystem loaders; Python doesn't check that.
    (bsc#1259989, CVE-2026-3479, gh#python/cpython#146121).
- Bundled python module pyopenssl contains CVE fixes:
  * CVE-2026-27459: large cookie value can lead to a buffer overflow
    (bsc#1271428, CVE-2026-27459)
- Remove unused paramiko python module from the bundle.
- Cleanup commented packages in include-rpm and include-deb
- Modified:
  * include-deb
  * include-rpm</changelog>
  <changelog author="marek.czernek@suse.com" date="1785326400">- Fix unit tests that fail due to async Tornado usage
- Added:
  * stabilize-testsuite-773.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1785412800">- Prevent broken Salt Bundle on Ubuntu due regression in "tar" package
  from Ubuntu repositories (bsc#1271613)</changelog>
  <changelog author="vzhestkov@suse.com" date="1786017600">- Bundled python was updated with CVE fixes:
  * CVE-2026-13346: Arbitrary file installation via malicious package
    indexes. Remove ensurepip with bundled .whl files. (bsc#1273094)
  * CVE-2026-0864: Normalize all line endings (CR, CRLF, and LF) in
    configparser (bsc#1269066, gh#python/cpython#143927)
  * CVE-2026-1502: reject CR/LF in HTTP tunnel request headers
    (bsc#1261969, gh#python/cpython#146211)
  * CVE-2026-3276: Fix O(n^2) canonical ordering in
    unicodedata.normalize() (bsc#1267581, gh#python/cpython#149079)
  * CVE-2026-4360: Pass filter_function to TarFile._extract_one()
    during .extract() (bsc#1269959, gh#python/cpython#151987)
  * CVE-2026-4786: fix webbrowser %action substitution bypass of
    dash-prefix check (bsc#1262319, gh#python/cpython#148169)
  * CVE-2026-6019: protect against HTML injection by
    Base64-encoding cookie values embedded in JS
    (bsc#1262654, gh#python/cpython#90309)
  * CVE-2026-6100: prevent dangling pointer, which can end in the
    use-after-free error (bsc#1262098, gh#python/cpython#148395)
  * CVE-2026-7210: Use XML_SetHashSalt16Bytes in
    pyexpat/_elementtree when possible
    (bsc#1264962, gh#python/cpython#149018).
  * CVE-2026-7774: tarfile.data_filter: validate written link
    target (bsc#1267821, gh#149486)
  * CVE-2026-8328: Make ftplib not trust the PASV response
    (bsc#1265268)
  * CVE-2026-11940: fix the symlink escape via tarfile
    hardlink-extraction fallback (bsc#1268977)
  * CVE-2026-11972: Make tarfile._Stream.seek break at EOF
    (bsc#1269788, gh#python/cpython#151981)
  * CVE-2026-15308: Fix quadratic complexity in incremental parsing
    in HTMLParser (bsc#1271192, gh#python/cpython#153030)
- Bundled python module pip was updated to 25.0.1 with CVE fixes:
  * CVE-2026-13346: Arbitrary file installation via malicious package
    indexes (bsc#1273094)
  * CVE-2026-8643: Path traversal via malicious entry point name in pip
    wheel installation allows arbitrary file overwrite(bsc#1266669)
  * CVE-2026-6357: pip self-update functionality can import newly
    installed modules after wheel installation (bsc#1263442)
  * CVE-2026-3219: pip doesn't reject concatenated ZIP (bsc#1262429)
  * CVE-2026-1703: files may be extracted outside the installation
    directory when installing and extracting maliciously crafted
    wheel archives (bsc#1257599, gh#pypa/pip#13777)</changelog>
  <changelog author="marek.czernek@suse.com" date="1786449600">- Fix test failures with pytest&gt;=8
- Added:
  * migrate-rest_tornado-saltnado-tests-to-pytest-774.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1787832000">- Honor proxy settings in gitfs, git_pillar and winrepo (bsc#1261147)
- Added:
  * honor-proxy-settings-in-gitfs-git_pillar-and-winrepo.patch</changelog>
</package>
<package pkgid="11b7a2364288fc643c74967c00c77ffd253c02a3e8f39e981cef1e171ffb1242" name="venv-salt-minion-testsuite" arch="ppc64le">
  <version epoch="0" ver="3006.0" rel="260715.140.1"/>
  <changelog author="vzhestkov@suse.com" date="1773403200">- Add x86_64_v2 as a possible rpm package architecture
- Make users with backslash working for salt-ssh (bsc#1254629)
- Fix ansible.playbooks extra-vars quoting (bsc#1257831)
- Fix virtualenv call in test helper to use proper python version
- Added:
  * add-x86_64_v2-as-a-possible-rpm-package-architecture.patch
  * make-users-with-backslash-working-for-salt-ssh-bsc-1.patch
  * fix-ansible.playbooks-extra-vars-quoting-bsc-1257831.patch
  * fix-virtualenv-call-in-test-helper-to-use-proper-pyt.patch</changelog>
  <changelog author="vzhestkov@suse.com" date="1773748800">- Backport security patch for Salt vendored tornado (bsc#1259554):
  * CVE-2026-31958: Add limits on multipart form data parsing
- Added:
  * backport-of-the-cve-2026-31958-fix-bsc-1259554.patch</changelog>
  <changelog author="marek.czernek@suse.com" date="1776168000">- Fix testsuite failures
- Added:
  * fix-test-failures-754.patch</changelog>
  <changelog author="marek.czernek@suse.com" date="1777291200">- BDSA-2025-60810: Harden Tornado from invalid HTTP reason phrases
- Read full URI from ldap pillar config (bsc#1254900)
- Added:
  * bdsa-2025-60810-harden-against-invalid-http-reason-p.patch
  * read-full-uri-from-ldap-pillar-config-753.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1778155200">- Specify .SO ver explicitly in BuildRequire for libsodium</changelog>
  <changelog author="vzhestkov@suse.com" date="1778760000">- Use non vendored tornado with Python 3.11 (bsc#1257583, bsc#1259700)
- Added:
  * use-non-vendored-tornado-with-python-3.11.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1779451200">- Add 'show_changes' arg to 'file.append/file.prepend" states
- Added:
  * add-show_changes-to-file.append-and-file.prepend-sta.patch</changelog>
  <changelog author="yeray.gutierrez@suse.com" date="1780488000">- Calculate UUID grain for Xen PV guests (bsc#1255418)
- Added:
  * calculate-uuid-grain-for-xen-pv-guests-759.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1780920000">- Fix deprecation warnings when running on Python 3.13
- Added:
  * fix-deprecation-warnings-when-running-on-python-3.13.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1781092800">- Fix ImportError during reentrant SIGTERM shutdown
- Fix broken "pkg.info_installed" after migration to salt.utils.timeutil
- Added:
  * fix-importerror-during-reentrant-sigterm-shutdown.patch
  * fix-broken-pkg.info_installed-after-moving-to-salt.u.patch</changelog>
  <changelog author="vzhestkov@suse.com" date="1782216000">- Fix the tests failing after switching to non-vendored tornado
- Fix the default group in tests for new users in SLE 15.6
- Use AsyncHTTPClient in salt.utils.http (bsc#1268325)
- Fix file fetching with cp module on non-vendored tornado
- Decode binary pillars for salt-ssh to avoid exceptions (bsc#1263822)
- Added:
  * fix-the-tests-failing-after-switching-to-non-vendore.patch
  * fix-the-default-group-in-tests-for-new-users-in-sle-.patch
  * use-asynchttpclient-in-salt.utils.http-bsc-1268325.patch
  * fix-file-fetching-with-non-vendored-tornado.patch
  * decode-binary-pillars-for-salt-ssh-to-avoid-exceptio.patch</changelog>
  <changelog author="vzhestkov@suse.com" date="1782820800">- Bundled python module OpenSSL was updated with CVE fix:
  * CVE-2026-40475: improper input handling of null bytes
    can lead to silent data truncation and security-state
    inconsistency (bsc#1262803)</changelog>
  <changelog author="vzhestkov@suse.com" date="1783080000">- Bundled python module tornado was updated with CVE fixes:
  * CVE-2026-49853: authorization header forwarded across
    cross-origin redirects in SimpleAsyncHTTPClient (bsc#1268395)
  * CVE-2026-49854: out-of-bounds memory access via C extension
    (bsc#1268396)
  * CVE-2026-49855: AsyncHTTPClient accumulates decompressed chunks
    without size limit (gzip bomb) (bsc#1268397)</changelog>
  <changelog author="marek.czernek@suse.com" date="1784116800">- Stabilize testsuite tests and fix AllEventsHandler
- Switch apache2ctl to apachectl for SUSE OSes (bsc#1252286)
- Support attrlist in ldap.managed (bsc#1257151)
- Added:
  * stabilize-testsuite-tests-and-fix-alleventshandler-7.patch
  * switch-apache2ctl-to-apachectl-for-suse-oses-bsc-125.patch
  * support-attrlist-in-ldap.managed-746.patch</changelog>
  <changelog author="vzhestkov@suse.com" date="1785240000">- Bundled python module jinja2 was updated to 3.1.6 with CVE fixes:
  * CVE-2024-22195: Fix compiler error when checking if required
    blocks in parent templates are xmlattr filter does not allow
    keys with spaces. (bsc#1218722)
- Bundled python module idna was updated with CVE fix:
  * CVE-2026-45409: Specially crafted inputs to idna.encode()
    can bypass earlier security fix (bsc#1265413)
- Bundled python module urllib3 was updated with CVE fix:
  * CVE-2026-44431: sensitive information disclosure due to
    sensitive headers being forwarded across origins in proxied
    low-level redirects (bsc#1265267)
- Bundled python module lxml was updated to 6.1.1 with CVE fixes:
  * CVE-2026-49825: The known link attributes in
    ``lxml.html.defs.link_attrs`` were missing ``xlink:href``,
    which can be used for URL bypass attacks in embedded
    SVG/MathML/etc. content. (bsc#1270285, CVE-2026-49825)
    https://github.com/fedora-python/lxml_html_clean/security/
    advisories/GHSA-4jhm-jv67-739f
  * CVE-2026-41066: This release fixes a possible external entity
    injection (XXE) vulnerability in ``iterparse()`` and
    the ``ETCompatXMLParser``. (bsc#1263254, CVE-2026-41066)
- Bundled python was updated with CVE fixes:
  * CVE-2026-3446: Preventing ignoring excess Base64 data
    after the first padded quad in non-strict (default) mode.
    (bsc#1261970, CVE-2026-3446, gh#python/cpython#145264).
  * CVE-2026-3479: pkgutil.get_data() has the same security model
    as open(). The documented limitations ensure compatibility with
    non-filesystem loaders; Python doesn't check that.
    (bsc#1259989, CVE-2026-3479, gh#python/cpython#146121).
- Bundled python module pyopenssl contains CVE fixes:
  * CVE-2026-27459: large cookie value can lead to a buffer overflow
    (bsc#1271428, CVE-2026-27459)
- Remove unused paramiko python module from the bundle.
- Cleanup commented packages in include-rpm and include-deb
- Modified:
  * include-deb
  * include-rpm</changelog>
  <changelog author="marek.czernek@suse.com" date="1785326400">- Fix unit tests that fail due to async Tornado usage
- Added:
  * stabilize-testsuite-773.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1785412800">- Prevent broken Salt Bundle on Ubuntu due regression in "tar" package
  from Ubuntu repositories (bsc#1271613)</changelog>
  <changelog author="vzhestkov@suse.com" date="1786017600">- Bundled python was updated with CVE fixes:
  * CVE-2026-13346: Arbitrary file installation via malicious package
    indexes. Remove ensurepip with bundled .whl files. (bsc#1273094)
  * CVE-2026-0864: Normalize all line endings (CR, CRLF, and LF) in
    configparser (bsc#1269066, gh#python/cpython#143927)
  * CVE-2026-1502: reject CR/LF in HTTP tunnel request headers
    (bsc#1261969, gh#python/cpython#146211)
  * CVE-2026-3276: Fix O(n^2) canonical ordering in
    unicodedata.normalize() (bsc#1267581, gh#python/cpython#149079)
  * CVE-2026-4360: Pass filter_function to TarFile._extract_one()
    during .extract() (bsc#1269959, gh#python/cpython#151987)
  * CVE-2026-4786: fix webbrowser %action substitution bypass of
    dash-prefix check (bsc#1262319, gh#python/cpython#148169)
  * CVE-2026-6019: protect against HTML injection by
    Base64-encoding cookie values embedded in JS
    (bsc#1262654, gh#python/cpython#90309)
  * CVE-2026-6100: prevent dangling pointer, which can end in the
    use-after-free error (bsc#1262098, gh#python/cpython#148395)
  * CVE-2026-7210: Use XML_SetHashSalt16Bytes in
    pyexpat/_elementtree when possible
    (bsc#1264962, gh#python/cpython#149018).
  * CVE-2026-7774: tarfile.data_filter: validate written link
    target (bsc#1267821, gh#149486)
  * CVE-2026-8328: Make ftplib not trust the PASV response
    (bsc#1265268)
  * CVE-2026-11940: fix the symlink escape via tarfile
    hardlink-extraction fallback (bsc#1268977)
  * CVE-2026-11972: Make tarfile._Stream.seek break at EOF
    (bsc#1269788, gh#python/cpython#151981)
  * CVE-2026-15308: Fix quadratic complexity in incremental parsing
    in HTMLParser (bsc#1271192, gh#python/cpython#153030)
- Bundled python module pip was updated to 25.0.1 with CVE fixes:
  * CVE-2026-13346: Arbitrary file installation via malicious package
    indexes (bsc#1273094)
  * CVE-2026-8643: Path traversal via malicious entry point name in pip
    wheel installation allows arbitrary file overwrite(bsc#1266669)
  * CVE-2026-6357: pip self-update functionality can import newly
    installed modules after wheel installation (bsc#1263442)
  * CVE-2026-3219: pip doesn't reject concatenated ZIP (bsc#1262429)
  * CVE-2026-1703: files may be extracted outside the installation
    directory when installing and extracting maliciously crafted
    wheel archives (bsc#1257599, gh#pypa/pip#13777)</changelog>
  <changelog author="marek.czernek@suse.com" date="1786449600">- Fix test failures with pytest&gt;=8
- Added:
  * migrate-rest_tornado-saltnado-tests-to-pytest-774.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1787832000">- Honor proxy settings in gitfs, git_pillar and winrepo (bsc#1261147)
- Added:
  * honor-proxy-settings-in-gitfs-git_pillar-and-winrepo.patch</changelog>
</package>
<package pkgid="9027dd9d6d6740f4bb5415dfe2b81f8aa0485152a296b22becf37fd86ca1bcf4" name="venv-salt-minion-testsuite" arch="x86_64">
  <version epoch="0" ver="3006.0" rel="260715.140.1"/>
  <changelog author="vzhestkov@suse.com" date="1773403200">- Add x86_64_v2 as a possible rpm package architecture
- Make users with backslash working for salt-ssh (bsc#1254629)
- Fix ansible.playbooks extra-vars quoting (bsc#1257831)
- Fix virtualenv call in test helper to use proper python version
- Added:
  * add-x86_64_v2-as-a-possible-rpm-package-architecture.patch
  * make-users-with-backslash-working-for-salt-ssh-bsc-1.patch
  * fix-ansible.playbooks-extra-vars-quoting-bsc-1257831.patch
  * fix-virtualenv-call-in-test-helper-to-use-proper-pyt.patch</changelog>
  <changelog author="vzhestkov@suse.com" date="1773748800">- Backport security patch for Salt vendored tornado (bsc#1259554):
  * CVE-2026-31958: Add limits on multipart form data parsing
- Added:
  * backport-of-the-cve-2026-31958-fix-bsc-1259554.patch</changelog>
  <changelog author="marek.czernek@suse.com" date="1776168000">- Fix testsuite failures
- Added:
  * fix-test-failures-754.patch</changelog>
  <changelog author="marek.czernek@suse.com" date="1777291200">- BDSA-2025-60810: Harden Tornado from invalid HTTP reason phrases
- Read full URI from ldap pillar config (bsc#1254900)
- Added:
  * bdsa-2025-60810-harden-against-invalid-http-reason-p.patch
  * read-full-uri-from-ldap-pillar-config-753.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1778155200">- Specify .SO ver explicitly in BuildRequire for libsodium</changelog>
  <changelog author="vzhestkov@suse.com" date="1778760000">- Use non vendored tornado with Python 3.11 (bsc#1257583, bsc#1259700)
- Added:
  * use-non-vendored-tornado-with-python-3.11.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1779451200">- Add 'show_changes' arg to 'file.append/file.prepend" states
- Added:
  * add-show_changes-to-file.append-and-file.prepend-sta.patch</changelog>
  <changelog author="yeray.gutierrez@suse.com" date="1780488000">- Calculate UUID grain for Xen PV guests (bsc#1255418)
- Added:
  * calculate-uuid-grain-for-xen-pv-guests-759.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1780920000">- Fix deprecation warnings when running on Python 3.13
- Added:
  * fix-deprecation-warnings-when-running-on-python-3.13.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1781092800">- Fix ImportError during reentrant SIGTERM shutdown
- Fix broken "pkg.info_installed" after migration to salt.utils.timeutil
- Added:
  * fix-importerror-during-reentrant-sigterm-shutdown.patch
  * fix-broken-pkg.info_installed-after-moving-to-salt.u.patch</changelog>
  <changelog author="vzhestkov@suse.com" date="1782216000">- Fix the tests failing after switching to non-vendored tornado
- Fix the default group in tests for new users in SLE 15.6
- Use AsyncHTTPClient in salt.utils.http (bsc#1268325)
- Fix file fetching with cp module on non-vendored tornado
- Decode binary pillars for salt-ssh to avoid exceptions (bsc#1263822)
- Added:
  * fix-the-tests-failing-after-switching-to-non-vendore.patch
  * fix-the-default-group-in-tests-for-new-users-in-sle-.patch
  * use-asynchttpclient-in-salt.utils.http-bsc-1268325.patch
  * fix-file-fetching-with-non-vendored-tornado.patch
  * decode-binary-pillars-for-salt-ssh-to-avoid-exceptio.patch</changelog>
  <changelog author="vzhestkov@suse.com" date="1782820800">- Bundled python module OpenSSL was updated with CVE fix:
  * CVE-2026-40475: improper input handling of null bytes
    can lead to silent data truncation and security-state
    inconsistency (bsc#1262803)</changelog>
  <changelog author="vzhestkov@suse.com" date="1783080000">- Bundled python module tornado was updated with CVE fixes:
  * CVE-2026-49853: authorization header forwarded across
    cross-origin redirects in SimpleAsyncHTTPClient (bsc#1268395)
  * CVE-2026-49854: out-of-bounds memory access via C extension
    (bsc#1268396)
  * CVE-2026-49855: AsyncHTTPClient accumulates decompressed chunks
    without size limit (gzip bomb) (bsc#1268397)</changelog>
  <changelog author="marek.czernek@suse.com" date="1784116800">- Stabilize testsuite tests and fix AllEventsHandler
- Switch apache2ctl to apachectl for SUSE OSes (bsc#1252286)
- Support attrlist in ldap.managed (bsc#1257151)
- Added:
  * stabilize-testsuite-tests-and-fix-alleventshandler-7.patch
  * switch-apache2ctl-to-apachectl-for-suse-oses-bsc-125.patch
  * support-attrlist-in-ldap.managed-746.patch</changelog>
  <changelog author="vzhestkov@suse.com" date="1785240000">- Bundled python module jinja2 was updated to 3.1.6 with CVE fixes:
  * CVE-2024-22195: Fix compiler error when checking if required
    blocks in parent templates are xmlattr filter does not allow
    keys with spaces. (bsc#1218722)
- Bundled python module idna was updated with CVE fix:
  * CVE-2026-45409: Specially crafted inputs to idna.encode()
    can bypass earlier security fix (bsc#1265413)
- Bundled python module urllib3 was updated with CVE fix:
  * CVE-2026-44431: sensitive information disclosure due to
    sensitive headers being forwarded across origins in proxied
    low-level redirects (bsc#1265267)
- Bundled python module lxml was updated to 6.1.1 with CVE fixes:
  * CVE-2026-49825: The known link attributes in
    ``lxml.html.defs.link_attrs`` were missing ``xlink:href``,
    which can be used for URL bypass attacks in embedded
    SVG/MathML/etc. content. (bsc#1270285, CVE-2026-49825)
    https://github.com/fedora-python/lxml_html_clean/security/
    advisories/GHSA-4jhm-jv67-739f
  * CVE-2026-41066: This release fixes a possible external entity
    injection (XXE) vulnerability in ``iterparse()`` and
    the ``ETCompatXMLParser``. (bsc#1263254, CVE-2026-41066)
- Bundled python was updated with CVE fixes:
  * CVE-2026-3446: Preventing ignoring excess Base64 data
    after the first padded quad in non-strict (default) mode.
    (bsc#1261970, CVE-2026-3446, gh#python/cpython#145264).
  * CVE-2026-3479: pkgutil.get_data() has the same security model
    as open(). The documented limitations ensure compatibility with
    non-filesystem loaders; Python doesn't check that.
    (bsc#1259989, CVE-2026-3479, gh#python/cpython#146121).
- Bundled python module pyopenssl contains CVE fixes:
  * CVE-2026-27459: large cookie value can lead to a buffer overflow
    (bsc#1271428, CVE-2026-27459)
- Remove unused paramiko python module from the bundle.
- Cleanup commented packages in include-rpm and include-deb
- Modified:
  * include-deb
  * include-rpm</changelog>
  <changelog author="marek.czernek@suse.com" date="1785326400">- Fix unit tests that fail due to async Tornado usage
- Added:
  * stabilize-testsuite-773.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1785412800">- Prevent broken Salt Bundle on Ubuntu due regression in "tar" package
  from Ubuntu repositories (bsc#1271613)</changelog>
  <changelog author="vzhestkov@suse.com" date="1786017600">- Bundled python was updated with CVE fixes:
  * CVE-2026-13346: Arbitrary file installation via malicious package
    indexes. Remove ensurepip with bundled .whl files. (bsc#1273094)
  * CVE-2026-0864: Normalize all line endings (CR, CRLF, and LF) in
    configparser (bsc#1269066, gh#python/cpython#143927)
  * CVE-2026-1502: reject CR/LF in HTTP tunnel request headers
    (bsc#1261969, gh#python/cpython#146211)
  * CVE-2026-3276: Fix O(n^2) canonical ordering in
    unicodedata.normalize() (bsc#1267581, gh#python/cpython#149079)
  * CVE-2026-4360: Pass filter_function to TarFile._extract_one()
    during .extract() (bsc#1269959, gh#python/cpython#151987)
  * CVE-2026-4786: fix webbrowser %action substitution bypass of
    dash-prefix check (bsc#1262319, gh#python/cpython#148169)
  * CVE-2026-6019: protect against HTML injection by
    Base64-encoding cookie values embedded in JS
    (bsc#1262654, gh#python/cpython#90309)
  * CVE-2026-6100: prevent dangling pointer, which can end in the
    use-after-free error (bsc#1262098, gh#python/cpython#148395)
  * CVE-2026-7210: Use XML_SetHashSalt16Bytes in
    pyexpat/_elementtree when possible
    (bsc#1264962, gh#python/cpython#149018).
  * CVE-2026-7774: tarfile.data_filter: validate written link
    target (bsc#1267821, gh#149486)
  * CVE-2026-8328: Make ftplib not trust the PASV response
    (bsc#1265268)
  * CVE-2026-11940: fix the symlink escape via tarfile
    hardlink-extraction fallback (bsc#1268977)
  * CVE-2026-11972: Make tarfile._Stream.seek break at EOF
    (bsc#1269788, gh#python/cpython#151981)
  * CVE-2026-15308: Fix quadratic complexity in incremental parsing
    in HTMLParser (bsc#1271192, gh#python/cpython#153030)
- Bundled python module pip was updated to 25.0.1 with CVE fixes:
  * CVE-2026-13346: Arbitrary file installation via malicious package
    indexes (bsc#1273094)
  * CVE-2026-8643: Path traversal via malicious entry point name in pip
    wheel installation allows arbitrary file overwrite(bsc#1266669)
  * CVE-2026-6357: pip self-update functionality can import newly
    installed modules after wheel installation (bsc#1263442)
  * CVE-2026-3219: pip doesn't reject concatenated ZIP (bsc#1262429)
  * CVE-2026-1703: files may be extracted outside the installation
    directory when installing and extracting maliciously crafted
    wheel archives (bsc#1257599, gh#pypa/pip#13777)</changelog>
  <changelog author="marek.czernek@suse.com" date="1786449600">- Fix test failures with pytest&gt;=8
- Added:
  * migrate-rest_tornado-saltnado-tests-to-pytest-774.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1787832000">- Honor proxy settings in gitfs, git_pillar and winrepo (bsc#1261147)
- Added:
  * honor-proxy-settings-in-gitfs-git_pillar-and-winrepo.patch</changelog>
</package>
</otherdata>