Packages changed:
  GraphicsMagick
  apache2-mod_php8 (8.5.7 -> 8.5.8)
  bash
  blog (2.45 -> 2.46)
  busybox (1.37.0 -> 1.38.0)
  busybox-links (1.37.0 -> 1.38.0)
  checkpolicy (3.10 -> 3.11)
  chrony
  cifs-utils (7.6 -> 7.7)
  cryptsetup
  erofs-utils (1.8.10 -> 1.9.2)
  ethtool (7.0 -> 7.1)
  freerdp (3.27.1 -> 3.28.0)
  freetype2 (2.14.2 -> 2.14.3)
  gimp
  grub2
  gstreamer (1.28.4 -> 1.28.5)
  gstreamer-plugins-bad (1.28.4+24 -> 1.28.5)
  gstreamer-plugins-base (1.28.4 -> 1.28.5)
  gstreamer-plugins-good (1.28.4 -> 1.28.5)
  gstreamer-plugins-rs (1.28.4 -> 1.28.5)
  gstreamer-plugins-ugly (1.28.4 -> 1.28.5)
  ibus (1.5.33 -> 1.5.34)
  ibus_gtk4 (1.5.33 -> 1.5.34)
  kernel-firmware-amdgpu (20260614 -> 20260629)
  kernel-firmware-bluetooth (20260618 -> 20260629)
  kernel-firmware-i915 (20260610 -> 20260706)
  kernel-firmware-iwlwifi
  kernel-firmware-media (20260610 -> 20260706)
  kernel-firmware-mediatek (20260619 -> 20260629)
  kernel-firmware-nvidia
  kernel-firmware-platform (20260610 -> 20260629)
  kernel-firmware-qcom (20260619 -> 20260629)
  kernel-firmware-realtek (20260614 -> 20260629)
  kernel-firmware-sound (20260618 -> 20260706)
  libcamera (0.7.1 -> 0.7.2)
  libdovi (3.3.2 -> 3.4.0)
  libphonenumber (9.0.33 -> 9.0.34)
  libpsl (0.22.0 -> 0.23.0)
  libseccomp (2.6.0 -> 2.6.1)
  libselinux (3.10 -> 3.11)
  libselinux-bindings (3.10 -> 3.11)
  libsemanage (3.10 -> 3.11)
  libsepol (3.10 -> 3.11)
  libxml2
  openSUSE-release (20260709 -> 20260714)
  openblas_openmp
  openblas_pthreads
  permissions (1699_20260512 -> 1699_20260707)
  php8 (8.5.7 -> 8.5.8)
  policycoreutils (3.10 -> 3.11)
  postfix (3.11.4 -> 3.11.5)
  publicsuffix (20260622 -> 20260708)
  python-Pillow (12.2.0 -> 12.3.0)
  python-semanage (3.10 -> 3.11)
  qemu (10.2.2 -> 11.0.2)
  sdbootutil (1+git20260506.25d47bf -> 1+git20260714.d9bb736)
  selinux-policy (20260618 -> 20260702)
  spice-gtk
  timezone (2026b -> 2026c)
  wget
  wpa_supplicant
  xrdb (1.2.2 -> 1.2.3)
  xset (1.2.5 -> 1.2.6)
  xsetroot (1.1.3 -> 1.1.4)

=== Details ===

==== GraphicsMagick ====
Subpackages: libGraphicsMagick++-Q16-12 libGraphicsMagick-Q16-3 libGraphicsMagick3-config

- added patches
  CVE-2026-13606: memory corruption via crafted Photo CD (PCD) file [bsc#1269891]
  * GraphicsMagick-CVE-2026-13606.patch

==== apache2-mod_php8 ====
Version update (8.5.7 -> 8.5.8)

- fix build with GCC 16 (gh#php/php-src#22206) [boo#1267259]
- added patch
  + php-fix-build-gcc16.patch
- use system liburiparser [bsc#1270538] [bsc#1270539]
- version update to 8.5.8 (CVE-2026-14355 [bsc#1270351])
    CLI:
    Fixed bug GH-21901 (Stale getopt() optional value).
  Date:
    Fixed bug GH-18422 (int overflow in php_date_llabs).
  DOM:
    Fixed bug GH-22077 (UAF in custom XPath function).
  Opcache:
    Fixed tracing JIT crash when a VM interrupt is handled during an observed user function call.
    Fixed bug GH-21746 (Segfault with tracing JIT).
    Fixed bug GH-22004 (Assertion failure at ext/opcache/jit/zend_jit_trace.c).
    Fixed tailcall VM crash when a VM interrupt is handled from a VM helper.
  OpenSSL:
    Fix compatibility issues with OpenSSL 4.0.
  Standard:
    Fixed bug GH-21689 (version_compare() incorrectly handles versions ending with a dot).
  URI:
    Fixed CVE-2026-44927 (In uriparser before 1.0.2, there is pointer difference truncation to int in various places). (CVE-2026-44927)
    Fixed CVE-2026-44928 (In uriparser before 1.0.2, the function family EqualsUri can misclassify two unequal URIs as equal). (CVE-2026-44928)
- Revert changes for building with GCC 16

==== bash ====
Subpackages: bash-loadables bash-sh

- Add workaround for msginit which ignores SOURCE_DATE_EPOCH (boo#1268542)

==== blog ====
Version update (2.45 -> 2.46)
Subpackages: libblogger2

- Update to version 2.46
  Implement Plymouth-compatible display-message and hide-message commands
  This commit adds support for the display-message and hide-message
  Plymouth commands, allowing external tools to print status updates
  directly to the boot console via blogctl.
  Key changes:
    Add MAGIC_SHOW_MSG and MAGIC_HIDE_MSG protocols to blogctl and
    parse the --text= argument using getopt_long_only().
    Broadcast display-message payloads to all active hardware consoles
    via c->out() to ensure immediate visual feedback, while simultaneously
    logging it to /var/log/boot.log via copylog().
    Add \r\n line endings to printed messages to prevent the staircase
    effect on serial terminals operating in raw mode.
    Handle hide-message as a visual no-op (replying with an ACK only)
    to deliberately avoid ANSI clear-screen sequences that would corrupt
    the output on line-based, half-duplex consoles like the s390x 3215.
    Update the blogctl.8 manual page to document the new commands and
    their specific behavior regarding screen clearing.
  Implement Plymouth-compatible ask-for-password and ask-question commands
  This commit extends blogctl to act as a lightweight, fully functional
  replacement for Plymouth's interactive prompt commands, allowing scripts
  to securely ask for passwords or questions on the system console.
  Key changes:
    Add support for ask-for-password and ask-question in blogctl.
    Use getopt_long_only() to robustly parse GNU-style long options
    (--prompt, --command, --number-of-tries, --dont-pause-progress).
    Offload the retry-loop and command execution (popen) entirely to
    the blogctl client, keeping the blogd daemon simple and secure.
    Fix an epoll EEXIST crash in console.c by separating the daemon's
    process state (asking) from the requested prompt type (ask_mode),
    resolving a race condition during socket handler registration.
    Comply strictly with the Plymouth protocol: enforce 1-byte prompt
    length limits, handle little-endian length headers (le32toh),
    and ensure null-terminated payloads via asprintf.
    Update the blogctl.8 manual page to document the new commands.
  Back to use constructor for initial seed
  for the process lifetime and inherited across fork()
  Make tty wait logic real and fix SIGHUP/inotify cleanup
  Better in-memory reversible obfuscation for cached passwords
  This is not cryptographic protection against a memory-reading attacker.
  It is only meant to avoid trivial/plaintext exposure in memory.
  Fix resource leaks and harden IPC validations
  This commit addresses several issues found by static code analysis,
  focusing on memory hygiene, file descriptor management, and robust
  error handling.
  Key changes:
    Fix memory and file descriptor leaks in error paths (proc.c, shm.c, tty.c)
    and ensure all pending coldstart requests are freed on shutdown.
    Harden the systemd ask-password interface by adding boundary checks
    for UNIX socket paths, verifying sendto payloads, and gracefully
    handling missing directories during early boot without fatal errors.
    Improve IPC protocol safety by strictly validating the MAGIC_CHROOT
    argument (must be an absolute path) and sending an explicit NACK on failure.
    Prevent stale terminal states on s390x by clearing the VMCP cache
    prior to parsing a new QUERY TERMINAL reply.
  User the --wait option of the blogctl quit command
  Add an --wait option specially for quit of blogctl
  Fix gh##7
  setting blog.silent=true causes it to be non-silent
  Make shared library a executable
  Refactor daemon to use synchronous signalfd and epoll event loop
  This commit migrates the core architecture from traditional, asynchronous
  signal handling to a modern, synchronous event loop using signalfd. By
  integrating signal handling directly into the epoll multiplexer, we eliminate
  race conditions, unexpected EINTR interruptions during I/O operations, and
  complex reentrancy issues.
  Key changes:
    Add setup_signalfd() to block essential signals (SIGINT, SIGQUIT, SIGTERM,
    SIGSYS, SIGIO, SIGCHLD) globally and route them through a dedicated file
    descriptor monitored by epoll.
    Shield epoll_pwait() using a fully populated signal mask (omask) to
    guarantee uninterrupted I/O processing.
    Prevent socket handlers (MAGIC_SYS_INIT, MAGIC_CLOSE) from accidentally
    unblocking signals and resetting dispositions when signalfd is active.
    Sanitize the inherited signal mask in forked child processes
    (e.g., systemd password prompts on tty) by resetting it to an empty
    mask via sigprocmask(), ensuring agents run without restrictions.
    Replace the ALIGNED_SIZEOF macro with a cleaner align_up(type, boundary)
    macro and fix memset() sizes to correctly zero out trailing padding bytes.
    Update the Makefile to compile a stripped-down fallback object
    (signals_stripped.o compiled with -DNO_SIGNALFD) to ensure the passive
    libblogger.so library remains unaffected by the signalfd architecture.
  Some minor changes in quit and umount unit services
  The HVC consoles are like sclp console
  and can do colours as well
- Silent some rpmlint warnings

==== busybox ====
Version update (1.37.0 -> 1.38.0)
Subpackages: busybox-static

- Update to version 1.38.0:
  * New applets: sha384sum, vmstat, ssl_server, lsblk, uuidgen
  * Security: Disallow path traversals in archival (CVE-2023-39810)
  * archival: Sanitize filenames on output to prevent control sequence attacks
  * ash/hush: Implement <<< here_string syntax and improve bash compatibility
  * libbb: Add yescrypt password hashing support
  * tls: Implement server-side code and support ECDHE_RSA
  * httpd: Add connection limits (-M), POSTDATA read timeouts, and CGI logging
  * telnet/telnetd: Rewrite to use generic fd polling and I/O loop
  * cut: Major fixes for empty delimiters, ranges, and output-delimiter support
  * cp: Fix 'cp -aT' overwriting symlink to directories
  * fdisk: Fix GPT disk size overflow and add 4K sector size support
  * top: Reduce flicker and show RSS instead of VIRT by default
  * udhcpc6: Fix potential buffer overflow
  * many other small fixes and optimizations
- Remove patches included in the new version:
  * busybox-1.37.0-fix-conditional-for-sha1_process_block64_shaNI.patch
  * busybox-1.37.0-fix-regression-n2.patch
  * busybox-1.37.0-hexdump-add-tests-for-x-handle-little-big-endian-pro.patch
  * busybox-1.37.0-hexdump-fix-regression-for-uint16-on-big-endian-syst.patch
  * busybox-1.37.0-od-make-B-test-little-endian-only-add-variant-for-bi.patch
  * 0001-archival-libarchive-sanitize-filenames-on-output-pre.patch
  * 0001-nsenter-unshare-don-t-use-xvfork_parent_waits_and_ex.patch
  * 0001-tar-strip-unsafe-hardlink-components-GNU-tar-does-th.patch
  * 0002-tar-only-strip-unsafe-components-from-hardlinks-not-.patch
  * 0001-udhcpc6-fix-buffer-overflow.patch
  * 0002-udhcpc6-check-the-size-of-D6_OPT_IAPREFIX-option.patch

==== busybox-links ====
Version update (1.37.0 -> 1.38.0)
Subpackages: busybox-coreutils busybox-diffutils busybox-ed busybox-findutils busybox-gawk busybox-grep busybox-gzip busybox-man busybox-psmisc busybox-sed busybox-which busybox-xz

- Adapt to busybox 1.38, new applets: sha384sum, ssl_server, vmstat,
  lsblk, uuidgen
- Keep passwd in shadow package (it was split in shadow-pw-mgmt in the
  full featured version)

==== checkpolicy ====
Version update (3.10 -> 3.11)

- Update to version 3.11
  https://github.com/SELinuxProject/selinux/releases/tag/3.11
  - User-visible changes:
  - Fixed checkpolicy handling of out-of-range and complement at range boundaries
    for xperm rules (#530, #531).
  - Dropped legacy fscon statement support from checkpolicy - never used in
    SELinux policies for mainline kernels (#518).
  - Development-relevant changes:
  - Reformatted entire tree based on .clang-format and added new
    check-format/format make targets to check and/or reformat code to match.
    This is now a requirement for new patches.
  - Test fixes
  - Notable Bugfixes:
  - checkpolicy: remove unneeded malloc() casts
  - checkpolicy: add missing strdup() failure checks
  - checkpolicy: use calloc() so no need to do memset()
  - checkpolicy: replace malloc()+memset() with calloc()

==== chrony ====
Subpackages: chrony-pool-openSUSE

- boo#1257934: support libnettle 4.0 (chrony-libnettle4.patch).

==== cifs-utils ====
Version update (7.6 -> 7.7)
Subpackages: wb-cifs-idmap-plugin

- Update cifs-utils to 7.7:
  * cifs.upcall: fix regression with krb5 + creduid
  * cifs.upcall: Avoid int overflow after year 2038
  * mount.cifs: fix const correctness in parse_options
  * cifs.upcall: fix compiler warning with -Wvla
  * smbinfo: parse action and filename from change notifications

==== cryptsetup ====
Subpackages: cryptsetup-doc libcryptsetup12

- Fix for (bsc#1270254) to avoid undesired pinning of all volume
  keys (via the thread keyring) through the caller's credentials
  when the kernel opens a file. This is due to the refactoring in
  kernel commit a28d893eb327 ("md: port block device access to file")
  that accidentally causes the caller's thread keyring to be kept
  alive long beyond the caller's lifetime, the kernel part is tracked
  in (bsc#1270252).
  * Add keyring key type. [b6fb6fc0]
  * Load volume keys in intermediary keyring linked in thread
    keyring. [413a3dd0]
  * Use unique intermediary keyring name per device. [04ef07a7]
  * Add regression tests. [bfcb0c38, bb5e8e9f, e6573494, aa214c09]
  * Add upstream patches:
  - cryptsetup-Add-keyring-key-type.patch
  - cryptsetup-Load-volume-keys-in-intermediary-keyring-linked-in-t.patch
  - cryptsetup-Use-unique-intermediary-keyring-name-per-device.patch
  - cryptsetup-tests-revoke-keys-instead-unlinking-from-thread-keyr.patch
  - cryptsetup-tests-verify-VK-and-internal-keyring-cleanup-after-p.patch
  - cryptsetup-tests-refactor-keyring-helpers.patch
  - cryptsetup-tests-verify-intermediary-keyring-cleanup-after-cryp.patch

==== erofs-utils ====
Version update (1.8.10 -> 1.9.2)

- Update to release 1.9.2
  * Add 48-bit layout support for larger filesystems
  * Add metadata compression support
  * mkfs: Enable image creation from S3 storage and OCI registries
  * Implement an external mount helper for mounting remote EROFS
    filesystems
  * mount: Add support for mounting EROFS-native layers in OCI regs
  * mkfs: Support directory compression via the `--zD` option
  * mkfs: Enable isolated metadata zones to concentrate inodes and
    directories using the `--MZ` option
  * mkfs: Support customized lc,lp,pb properties for LZMA
  * mkfs: Add the `--xattr-inode-digest` option to enable page
    cache sharing by generating per-inode fingerprints
  * erofsfuse: Synchronize kernel patches to fix encoded extents
    and shared xattrs in the metabox
  * mkfs: Do not set LZ4_0PADDING for plain filesystems
  * fsck: Support extracting subtrees
  * mount: Fix a flag-clearing bug that can cause mount failures
  * mkfs: Fix a CPU spin that occurred when using `--tar=f` in
    conjunction with a closed stdin
  * mkfs: Fix crashes in the rebuild mode when the source images
    contains xattrs
  * mount: Add support for mounting EROFS images stored as S3
    objects
  * mkfs: Add FULLDATA rebuild support for combining multiple
    layered EROFS filesystems
  * mount: Add support for Fanotify and UBLK backends
  * mkfs, tarerofs: Support inode digest generation when using
    `--sort=none`

==== ethtool ====
Version update (7.0 -> 7.1)

- Update to release 7.1
  * Added netlink support for RX CQE Coalescing params
  * netlink: module-eeprom: Add 'hex on pages on' option for
    page-organized hex dump
  * netlink: fec: Add missing newlines in FEC statistics output
  * ethtool: Add man page and bash completion for 'pages on|off'
  * ethtool: Update pause stats struct
  * ethtool: Add --disable-netlink to help output
  * qsfp: add support for newer SFF-8636 compliance codes
  * sfpid: add support for newer SFF-8472 compliance codes
  * sfpid: fix 10G Base-ER module detection
- Delete bf023af442f63e16f1699128c7ce467eddc6d340.patch,
  d35d87fbcda97fe31df79d62277743214641892a.patch (merged)

==== freerdp ====
Version update (3.27.1 -> 3.28.0)
Subpackages: libfreerdp3-3 librdtk0-0 libwinpr3-3

- Update to version 3.28.0:
  + Feature and bugfix release.
  * iOS client has been revived by @bho3538
  * Android client build updates by @svncibrahim
  * Windows client did get some updates by @zorjen122
  * Server side smartcard API by @joantolo
  * Improved client statistics interface, now also supports static channels
  * Improved fuzzer and unit tests
  * CMake preset support making it easier to create a working build configuration,
    see https://github.com/FreeRDP/FreeRDP/wiki/Compilation#presets
  + CVE fixes:
  * CVE-XXXX-XXXXX (GHSA-pjqx-v446-x7fc)
  * CVE-XXXX-XXXXX (GHSA-9g22-w2gr-vcmp)
  * CVE-XXXX-XXXXX (GHSA-f27x-frr8-j9hc)
  * CVE-XXXX-XXXXX (GHSA-72j9-356v-88xq)
  * CVE-XXXX-XXXXX (GHSA-v64m-xxfw-hrv6)
  * CVE-2026-57158
  * CVE-2026-57157
  * CVE-2026-57156
  + Changes:
  * feat(client): Modernize iOS client. (iFreeRDP) (#12949)
  * [client,ios] remove some deprecation warnings (#12981)
  * Ios cmake (#12997)
  * [client,ios] add openh264 build (#13003)
  * [client,android] riscv64 support (#12923)
  * [client,android] make release configurable (#12929)
  * [client,android] allow overriding version name and code (#12931)
  * [client,android] redesign touch pointer (#12946)
  * [client,android] move external deps to own CMake file (#12992)
  * Android build (#12917)
  * [client,sdl] guard file clipboard (#12911)
  * [client,sdl] Askpass (#12925)
  * [client,sdl] throw a real exception instead of invalid bare throw (#12936)
  * [client,sdl] run sdl_OnUserNotificationEventHandler on SDL thread (#12941)
  * [client,sdl] fix mouse and touchpad natural scroll setting being ignored (#12967)
  * fix(client/win) Reset scroll offset when hiding scrollbars (#7536) (#12939)
  * feat(client/win): improve wfreerdp fullscreen floatbar controls (#12851)
  * Channel stats (#12964)
  * Statistics interface (#12968)
  * [core,channels] add freerdp_static_client_channel_stat_free (#12966)
  * Support RDPDR Device Control Responses (#12756)
  * Wlog appender context (#12907)
  * [winpr,image] bound unaligned bitmap read to declared image size (#12910)
  * [codec,color] add empty checks for copy (#12912)
  * Win credssp (#12913)
  * Adjustments for building on Windows with MSVC (#12916)
  * channel statistics and random gateway connection id (#12922)
  * [channels,video] bound frame copy to current surface size (#12919)
  * OSS-Fuzz: Add new fuzzers targets channels rail client (#12924)
  * [utils,smartcard] validate cbAtr against rgbAtr size on unpack (#12928)
  * [channels,rdpecam] fix device added notification parsing (#12930)
  * [emu,scard] bound select-by-AID compare to GIDS AID length (#12933)
  * Rails feature setting, xfreerdp kbd sync (#12927)
  * [core,orders] fix inverted overflow guard in update_read_delta_points (#12938)
  * [codec,mppc] add missing out of bounds check (#12942)
  * [channels,tsmf] bound visible rect read in update_geometry_info (#12943)
  * [channels,rdpecam] bound channel name read in device removed pdu (#12945)
  * [core,tcp] improve connection failure logging (#12950)
  * Warn fixes (#12951)
  * [codec,planar] fix range check, abort early (#12952)
  * [channels,rdpsnd,mac] recover audio after AVAudioEngine config change (#12958)
  * [codec,planar] range-check before control byte read in plane rle (#12956)
  * [channel,rail] fix tests and uninitialized variables (#12960)
  * [channels,rdpdr] fix off-by-one scan length in rdpdr_read_ustring (#12961)
  * [channels,remdesk] validate ctl pdu DataLength against received stream (#12955)
  * [channels,rdpsnd] bound client format pdu length to UINT16 (#12962)
  * Winpr harden parser checks (#12965)
  * [winpr,file] bound '?' wildcard match to file name length (#12969)
  * [channels,urbdrc] bound msusb descriptor reads to received length (#12971)
  * [core,update] fix the calling convention for Windows x86 (#12973)
  * [channels,drive] reject trailing '..' in contains_dotdot (#12974)
  * OSS-Fuzz: Add new fuzzer targeets WinPRClipboard processing (#12976)
  * Pr/12970 (#12975)
  * Cliprdr and rdpsnd fixes (#12980)
  * [channels,rail] fix order read/cleanup (#12979)
  * [core,utils] skip AuthenticateEx for RDP/TSL/SMARTCARD_PIN/FIDO_PIN (#12978)
  * replace NULL with nullptr (#12982)
  * [channels,cliprdr] fix pdu-tracker leak (#12983)
  * Fuzz fixes bmp (#12986)
  * [core,gateway] fix const warning (#12987)
  * [channels] bound dynamic channel message header to received length (#12988)
  * cmake: add minimal preset for lightweight builds (#12989)
  * Cleanup all (#12991)
  * Range checks (#12993)
  * Deprecations (#12994)
  * [winpr,string] fix winpr_strnstr needle length (gateway SIGSEGV) (#12995)
  * Bmp cache (#12999)
  * [codec,dsp] ensure out capacity in opus encode (#13001)
  * [winpr,string] match winpr_strnstr fallback to native strnstr (#13002)
  * Smartcard fixes (#13009)
  * [client,common] /smartcard-logon pass PEM directly (#13011)
  * Correct UTF-8 to UTF-16 length (#13012)

==== freetype2 ====
Version update (2.14.2 -> 2.14.3)

- update to 2.14.3
- Important bug fixes
  * A bunch of potential security problems have been found. All
    users should update.
- Miscellaneous
  * If configuration option `TT_CONFIG_OPTION_GPOS_KERNING` is
    active, GPOS-based kerning could miss some value pairs (bug
    introduced in version 2.14.0).
- Added patch:
  * freetype-CVE-2026-50811.patch
    + upstream fix for issue #1436, bsc#1271045, CVE-2026-50811:
    out-of-bounds read vulnerabilityin src/truetype/ttgxvar.c in
    the TT_Get_Var_Design implementation used by
    FT_Get_Var_Design_Coordinates

==== gimp ====
Subpackages: gimp-plugin-aa gimp-plugin-python3 libgimp-3_0-0 libgimpui-3_0-0

- Add gimp-CVE-2026-58379.patch:Fix PSP File Parsing Heap Buffer
  Overflow (CVE-2026-58379, bsc#1270299)
- Add gimp-CVE-2026-59089.patch:Fix Signed integer overflow
  (CVE-2026-59089, bsc#1270440)
- Lower gexiv2_min_version to 0.14.3, the one Leap 16.1 has atm

==== grub2 ====
Subpackages: grub2-arm64-efi grub2-arm64-efi-bls grub2-common grub2-snapper-plugin grub2-systemd-sleep-plugin

- Fix broken bash completion on arm64 images when the bash-completion package
  is not installed (bsc#1259132)
  * 0001-bash-completion-add-_init_completion-marker.patch

==== gstreamer ====
Version update (1.28.4 -> 1.28.5)
Subpackages: gstreamer-utils libgstreamer-1_0-0 typelib-1_0-Gst-1_0

- Update to version 1.28.5:
  + Highlighted bugfixes:
  - Various security fixes and playback fixes
  - Fix subtitles cause green flickering with VA decoders on AMD
    GPUs
  - core: Fix sticky event raciness when pads are linked mid-push
  - appsrc: Uniformly handle EOS events being pushed
  - audio-resampler-neon fails to build for targets with neon but
    without thumb
  - avtp: Correct ptime generation from avtp timestamp
  - fmp4mux: Various fixes for splitting at fragment boundaries
  - gldownload: fix wrong DRM format negotiation causing R/B
    channel swap
  - gdkpixbufdec: Drop rank to NONE and handle resolution/format
    changes
  - gopbuffer: add support for H.266/VVC
  - h265decoder: Fix HEVC with alpha decoding
  - mp4mux: fix AC-3 template caps so muxer can accept input from
    ac3parse
  - mpegtsmux: Always assign PTS to output buffers in CBR mode
  - mpegtsmux: Output buffers with PCR-only bitrate-padding
    packets have wrong PTS
  - rtcpbuffer: Fix parsing of SR+SDES compound packets
    (regression from security fix)
  - rtspsrc2: Allow disabling SRTP/SRTCP encryption and SRTP
    authentication
  - tsdemux: Improve PTS rollover handling in ignore-pcr mode,
    fixing intermittent corruption with YouTube HLS streams
  - textaccumulate: output joined single buffer, add list as meta
  - threadshare: add ts-clocksync
  - webrtcsink: negotiation fixes and improvements
  - Various bug fixes, build fixes, memory leak fixes, and other
    stability and reliability improvements
  + gstreamer:
  - caps: fix field name leak in gst_caps_structure_simplify
  - info: Use a more optimized version of GST_TIME_ARGS
  - pads: Fix sticky event raciness when linked mid-push
  - typefindhelper: Drop unnecessary check for factories without
    a function
  - Use named pipes when spawning gst-ptp-helper on Windows

==== gstreamer-plugins-bad ====
Version update (1.28.4+24 -> 1.28.5)
Subpackages: libgstadaptivedemux-1_0-0 libgstanalytics-1_0-0 libgstbadaudio-1_0-0 libgstbasecamerabinsrc-1_0-0 libgstcodecparsers-1_0-0 libgstcodecs-1_0-0 libgstcuda-1_0-0 libgsthip-1_0-0 libgstinsertbin-1_0-0 libgstisoff-1_0-0 libgstmpegts-1_0-0 libgstmse-1_0-0 libgstphotography-1_0-0 libgstplay-1_0-0 libgstsctp-1_0-0 libgsturidownloader-1_0-0 libgstva-1_0-0 libgstvulkan-1_0-0 libgstwayland-1_0-0 libgstwebrtc-1_0-0 libgstwebrtcnice-1_0-0

- Update to version 1.28.5:
  + amcviddec: Fix double-free happening when codec gets
    reconfigured
  + avtp: Correct ptime generation from avtp timestamp
  + ccconverter: Use truncated length when converting CEA608 raw to
    CEA708 CDP
  + curlsmtpsink: Use the correct content-type if known
  + d3d12: Fix command list leak
  + dtlsconnection: Allocate large enough buffer for the peer
    certificate subject DN
  + h264parse: Check for enough slice header data being available
  + h2654parse: Unset GValue in every code path
  + h265decoder: Fix HEVC with alpha decoding
  + h266parser: Avoid out-of-bounds read if too many exp slices are
    signalled
  + h266parser: Check bounds before writing to CTU entrypoint
    array
  + h266parser: Check aspect ratio index against lookup table
    length
  + h266parser: Heap-allocate parameter sets before parse to avoid
    stack overflow
  + h266parser: Use long bit skipping function for potentially
    large values
  + mpeg4videoparse: Ensure enough config data is available before
    extracting profile/level
  + mpegpsdemux: Release stream lock when seeking fails
  + mpegtsmux: Always assign PTS to output buffers in CBR mode
  + mpegtsmux: Output buffers with PCR-only bitrate-padding packets
    have wrong PTS
  + mxfdemux: fix essence track offsets array population
  + netsim: Fix racy test failures
  + pcapparse: Add missing bounds checks to ensure packets are
    large enough
  + pnmdec: Avoid overflows when calculating frame sizes
  + qroverlay: Fix use after free bug
  + rfbsrc: Use correct bpp for copying hextile data
  + rfbsrc: Validate framebuffer update rectangles against the
    framebuffer size
  + rtmp2: Don't retry on G_IO_ERROR_TIMED_OUT
  + rtmp2: Remove socket timeout after handshake completes
  + rtpsink: fix mutex not unlocked on invalid URI in set_property
  + tsdemux: YouTube HLS streams have intermittent corruption
  + tsdemux: Improve PTS rollover handling in ignore-pcr mode
  + v4l2decoder: Fix media_fd leak when video_fd open fails
  + va: surfacecopy: get surface's image in gst_va_surface_copy
  + va: VOBSUB: compositing error with VA decoder in NV12
  + va: radeonsi: subtitles cause green flickering
  + va: radeonsi: Subtitles cause green flickering with VA decoders
  + videoparsers: Always clear LCEVC enhancement data when
    resetting frame
  + videoparsers: Leak of LCEVC user data
  + vnmdec: Avoid integer overflows when rectangle positions and
    sizes
  + vp9parser: Check that enough data is available for parsing
    superframe info
  + webrtcbin: validate remote dtls certificates
  + webrtcsdp: Fix inverted fingerprint existence logic

==== gstreamer-plugins-base ====
Version update (1.28.4 -> 1.28.5)
Subpackages: libgstallocators-1_0-0 libgstapp-1_0-0 libgstaudio-1_0-0 libgstfft-1_0-0 libgstgl-1_0-0 libgstpbutils-1_0-0 libgstriff-1_0-0 libgstrtp-1_0-0 libgstrtsp-1_0-0 libgstsdp-1_0-0 libgsttag-1_0-0 libgstvideo-1_0-0 typelib-1_0-GstAudio-1_0 typelib-1_0-GstPbutils-1_0 typelib-1_0-GstTag-1_0 typelib-1_0-GstVideo-1_0

- Update to version 1.28.5:
  + appsink: Clear local sample storage when flushing
  + appsrc: Uniformly handle EOS events being pushed
  + audio-resampler-neon fails to build for targets with neon but
    without thumb
  + encoding-target: Validate that encoding profile name is UTF-8
    before using it
  + gldownload: fix wrong DRM format negotiation causing R/B
    channel swap
  + opusdec: Don't use any channel positions for >64 channels
  + rtcpbuffer: Fix parsing of SR+SDES compound packets (regression
    from security fix)
  + subparse: Don't allow very small framerates for microdvd
    subtitles
  + typefind: assorted fixes for the image-rs plugin typefinding
  + typefindhelper: Drop unnecessary check for factories without a
    function
  + WBMP typefinding rejects a valid 1280x800 file
  + typefinding: detect animation on PNG (and WebP, GIF, AVIF)
  + typefindfunctions: remove Sun and Andrew raster format
    typefinders
  + uridecodebin3: deactivate input_item in erroneous ready->paused
    transition
  + vorbistag: Check for enough base64 data before trying to decode
  + xmptag: Don't allocate -1 bytes of memory if there's only a
    single tag
  + xmptag: Handle fractions with 0 denominator as invalid

==== gstreamer-plugins-good ====
Version update (1.28.4 -> 1.28.5)
Subpackages: gstreamer-plugins-good-gtk

- Update to version 1.28.5:
  + flacenc: Fix g_object_notify on loose-mid-side-stereo property
  + gdkpixbufdec: Drop rank to NONE and handle resolution/format
    changes
  + gdkpixbufdec: stop advertising Sun and Andrew raster formats
  + gdkpixbufdec announces unsupported raster mediatypes
  + matroskademux: Don't pass non-GstElement pointers to
    GST_ELEMENT_ERROR
  + matroska: Update lzo decompression implementation from latest
    ffmpeg
  + mp4mux: fix AC-3 template caps so muxer can accept input from
    ac3parse
  + pngdec: fix wrong macro being used for ICC support test
  + qtmoovrecover: Validate box sizes
  + rtpceltdepay: error out if anyone tries to use this element
  + rtpjpegdepay: Ensure that quantization table is big enough
  + rtpsbcdepay: Check for available data in the adapter before
    getting data
  + shapewipe: Fix missing mutex unlock in shutdown path
  + wavparse: Avoid NULL pointer dereference when parsing adtl in
    push mode

==== gstreamer-plugins-rs ====
Version update (1.28.4 -> 1.28.5)

- Update to version 1.28.5:
  + fmp4mux: Various fixes for splitting at fragment boundaries
  + gopbuffer: add support for H.266/VVC
  + onvifmeta2relatiometa: fix inversion between width and height
  + rtprecv: fix buffer list split handling
  + rtspsrc2: digest authentication fixes
  + rtspsrc2: Allow disabling SRTP/SRTCP encryption and SRTP
    authentication
  + textaccumulate: output joined single buffer, add list as meta
  + threadshare: add ts-clocksync
  + webrtcsink: add support for h264 profile constrained-high
  + webrtcsink: allow change of interlace-mode in the input caps
  + webrtcsink: allow renegotiation if caps is missing
    interlace-mode
  + webrtcsink: fix negotiation for nvh264enc in the GLMemory case
  + webrtcsink: read rav1enc bitrate as i32
  + webrtcsrc, webrtcsink: Fix SDP renegotiation bugs
  + Update dependencies

==== gstreamer-plugins-ugly ====
Version update (1.28.4 -> 1.28.5)

- Update to version 1.28.5:
  + asfdemux: Ensure that enough data is available for reading all
    replicated extensions

==== ibus ====
Version update (1.5.33 -> 1.5.34)
Subpackages: ibus-dict-emoji ibus-gtk ibus-gtk3 libibus-1_0-5 typelib-1_0-IBus-1_0

- Upstream update to 1.5.34
  * no source changes from 1.5.34-rc2
  * replace a tar artifact with the released one
- Update version to 1.5.34-rc2(1.5.33.92)
  * Enhance panel --enable-wayland-im option without daemon
  * Enhance mouse position in Emojier category list
  * Enhance Emoji and Unicode notifications
  * Show Emoji annotations in GNOME
  * Refer QT_IM_MODULES to check Wayland configuration
  * Support input purpose and hints in ibus-wayland
  * Update simple.xml with xkeyboard-config 2.46
  * Fix locale compose features
  * Fix Backspace after commit-text in Ghostty
  * Fix "no memory" error with focus changes in Sway
  * Fix latch key in Latvian(tilde) keymap in ibus-wayland
  * Fix memory leaks
  * Fix SEGV in ibus-x11
  * Fix Panel bugs
  * Fix build issues
  * Replace ibus-daemon with ibus start in Github issue templace
  * IBus Wayland panel can run without --exec-daemon option for the debugging purpose
  * Follow mouse cursor in Emojier category list
  * Enhance the order of the loading locale compose file
  * Support to delete surrounding text feature with the Wayland input-method protocol
  * Add IBUS_INPUT_HINT_HIDDEN_TEXT
  * Enhance the pre-edit text in GNOME-Shell password including GDM
  * Show Emoji annotations in the candidate popup in GNOME
  * Update translators
- Refresh setup-switch-im.patch

==== ibus_gtk4 ====
Version update (1.5.33 -> 1.5.34)

- Upstream update to 1.5.34
  * no source changes from 1.5.34-rc2
  * replace a tar artifact with the released one
- Update version to 1.5.34-rc2(1.5.33.92)
  * Enhance panel --enable-wayland-im option without daemon
  * Enhance mouse position in Emojier category list
  * Enhance Emoji and Unicode notifications
  * Show Emoji annotations in GNOME
  * Refer QT_IM_MODULES to check Wayland configuration
  * Support input purpose and hints in ibus-wayland
  * Update simple.xml with xkeyboard-config 2.46
  * Fix locale compose features
  * Fix Backspace after commit-text in Ghostty
  * Fix "no memory" error with focus changes in Sway
  * Fix latch key in Latvian(tilde) keymap in ibus-wayland
  * Fix memory leaks
  * Fix SEGV in ibus-x11
  * Fix Panel bugs
  * Fix build issues
  * Replace ibus-daemon with ibus start in Github issue templace
  * IBus Wayland panel can run without --exec-daemon option for the debugging purpose
  * Follow mouse cursor in Emojier category list
  * Enhance the order of the loading locale compose file
  * Support to delete surrounding text feature with the Wayland input-method protocol
  * Add IBUS_INPUT_HINT_HIDDEN_TEXT
  * Enhance the pre-edit text in GNOME-Shell password including GDM
  * Show Emoji annotations in the candidate popup in GNOME
  * Update translators
- Refresh setup-switch-im.patch

==== kernel-firmware-amdgpu ====
Version update (20260614 -> 20260629)

- Update to version 20260629 (git commit 3ee099cd4a20):
  * amdgpu: DMCUB updates for various ASICs
  * amdgpu: DMCUB updates for various ASICs

==== kernel-firmware-bluetooth ====
Version update (20260618 -> 20260629)

- Update to version 20260629 (git commit 3ee099cd4a20):
  * QCA: Update Bluetooth QCA6698 firmware to 2.1.2-00072

==== kernel-firmware-i915 ====
Version update (20260610 -> 20260706)

- Update to version 20260706 (git commit 2c35b1ed46f6):
  * xe: Release GuC firmware for NVL-S
- Update aliases from 7.1 / 7.2-rc1

==== kernel-firmware-iwlwifi ====

- Update aliases from 7.1 / 7.2-rc1

==== kernel-firmware-media ====
Version update (20260610 -> 20260706)

- Update to version 20260706 (git commit 2c35b1ed46f6):
  * qcom: vpu: add Gen2 firmware binary for Purwa

==== kernel-firmware-mediatek ====
Version update (20260619 -> 20260629)

- Update to version 20260629 (git commit 3ee099cd4a20):
  * mediatek MT7922: update bluetooth firmware to 20260605203811
  * mediatek MT7925: update bluetooth firmware to 20260605184935
  * linux-firmware: update firmware for MT7925 WiFi device
  * linux-firmware: update firmware for MT7922 WiFi device
- Update aliases

==== kernel-firmware-nvidia ====

- Update aliases from 7.1 / 7.2-rc1

==== kernel-firmware-platform ====
Version update (20260610 -> 20260629)

- Update to version 20260629 (git commit 3ee099cd4a20):
  * linux-firmware: Update AMD SEV firmware
  * nxp: add firmware for IW61x WiFi device
- Update aliases

==== kernel-firmware-qcom ====
Version update (20260619 -> 20260629)

- Update to version 20260629 (git commit 3ee099cd4a20):
  * qcom: add LPAICP firmware for shikra platform
- Update aliases

==== kernel-firmware-realtek ====
Version update (20260614 -> 20260629)

- Update to version 20260629 (git commit 3ee099cd4a20):
  * rtw89: 8852a: add TX power track R34
- Update aliases

==== kernel-firmware-sound ====
Version update (20260618 -> 20260706)

- Update to version 20260706 (git commit 2c35b1ed46f6):
  * cirrus: cs35l56: Update firmware for the ASUS UX5406SA
- Update to version 20260703 (git commit c95059a3774b):
  * cirrus: cs42l45: Update CS42L45 SDCA codec firmware for Dell laptops
  * cirrus: cs35l56: Add firmware for Cirrus Amps for a few Dell laptops
- Update to version 20260629 (git commit 3ee099cd4a20):
  * linux-firmware: qcom: sync audioreach firmwares from v1.0.4 build
  * linux-firmware: Add firmware for new projects
- Update aliases

==== libcamera ====
Version update (0.7.1 -> 0.7.2)
Subpackages: libcamera-base0_7 libcamera0_7

- Update to release 0.7.2
  * Fixes two separate saturation handling bugs in both the SoftISP
    and the Raspberry Pi IPA.
  * On the SoftISP, 12-bit formats are now supported, black level
    correction is 'fixed' and there are interesting performance
    improvements with eGL buffer caching.
  * Within the IPA handling, support for Sony IMX678 was added, as
    well as Omnivision OV08x40 and OV01A10, and moved to a
    proportional AGC algorithm for the simple pipeline handler.
- Delete libcamera-ov02e10-initial-support.patch

==== libdovi ====
Version update (3.3.2 -> 3.4.0)

- Update to 3.4.0:
  * dovi_rpu_add_cmv40_safe_default_metadata: Adds CMv4.0 default
    metadata to an existing CMv2.9 RPU
  * dovi_generate_from_json: Allows generating a list of RPUs from
    JSON
  * dovi_rpu_remove_cmv40_metadata: Allows to completely remove CM
    v4.0 metadata from the RPU
  * dovi/level11: improve byte1 parsing and remove byte2 validation

==== libphonenumber ====
Version update (9.0.33 -> 9.0.34)

- update to 9.0.34:
  * Updated alternate formatting data for country calling code(s):
    34
  * Updated phone metadata for region code(s):
    CM, ES, GY, HN, MZ, SR, TM, TZ, US, UZ
  * Updated geocoding data for country calling code(s): 504 (en)
  * Updated carrier data for country calling code(s):
    46 (en), 255 (en), 258 (en), 352 (en), 381 (en), 592 (en), 597
    (en), 886 (en), 998 (en)
  * Updated / refreshed time zone meta data.

==== libpsl ====
Version update (0.22.0 -> 0.23.0)

- Update to version 0.23.0:
  * Properly handle leading dot in domains (CVE-2026-8924)
  * Using libidn as runtime now requires explicit configuration
  * Modernize configure.ac
  * Simplify license headers
- Regenerate the built-in PSL and test DAFSA files from the system
  publicsuffix at build time, so they stay in sync with the packaged
  list and test-is-public-all no longer fails on version skew

==== libseccomp ====
Version update (2.6.0 -> 2.6.1)

- Produce unique .src.rpm files per multibuild flavor.
- Update to release 2.6.1
  * Fixed incorrect 64-bit comparison merge that can weaken
    libseccomp filters.
  * Fixed issue where oversized libseccomp filters can trigger a
    double free.
  * Fixed issue where oversized libseccomp filters can trigger a
    heap corruption.
  * Fixed struct aliasing undefined behavior in the internal
    libseccomp hash algorithm.
  * Fixed issue where extraneous bytes were being copied to the
    destination buffer in seccomp_export_bpf_mem().
  * Fix a bug where merged libseccomp filters failed to merge the
    notify_used flag, leading to no listener file descriptor being
    generated.
- 62-sim-arch_transactions-remove-fuzzer.patch: removed upstream
- Fixes in SPEC file.
- Update make-python-build.patch to work with multiple versions
  of Python interpreters.
- Add python-pip-packages.patch, modernize-python-build.patch
- Enable _multibuild back.
- Add support for generating of multiple versions of Python
  subpackages (using %python_subpackage_only).

==== libselinux ====
Version update (3.10 -> 3.11)
Subpackages: libselinux1 selinux-tools

- Update to version 3.11
  https://github.com/SELinuxProject/selinux/releases/tag/3.11
  - User-visible changes:
  - Several security improvements in libselinux
  - Rewrote libselinux selinux_restorecon(3) to eliminate TOCTOU issues in file
    relabeling if /proc is available
  - Fixed libselinux constructor to not clobber errno (#445).
  - Fixed libselinux selabel_partial_match(3) to correctly find partial matches.
  - Fixed libselinux selinux_init_policy_load() to still try to mount selinuxfs on
    /sys/fs/selinux even if the mount of sysfs on /sys fails - this can occur
    legitimately within a user namespace.
  - Improved restorecon related functionality in libselinux
  - Development-relevant changes:
  - Reformatted entire tree based on .clang-format and added new
    check-format/format make targets to check and/or reformat code to match.
    This is now a requirement for new patches.
  - Fixed libselinux build for non-pthread builds.
  - Multiple fixes for musl/llvm-based builds, including adding a new
    EXTRA_LD_FLAGS variable that can be set for libselinux builds to pass
  - -undefined-version through to lld (#511 thru #515).
  - Fixed uclibc build failure (#435).
  - Build shared libraries with -fPIC for LTO.
  - Notable bug fixes:
  - libselinux: avoid out-of-bounds access on zero-length lines
- Packaging changes:
  - Drop patch restorecon-Only-log-error-on-readonly-fs-bsc-1232226.patch
    as it was accepted upstream
  - Rewrite skip_cycles.patch since the code path has been rewritten entirely
    upstream

==== libselinux-bindings ====
Version update (3.10 -> 3.11)

- Update to version 3.11
  https://github.com/SELinuxProject/selinux/releases/tag/3.11
  - Development-relevant changes:
  - Reformatted entire tree based on .clang-format and added new
    check-format/format make targets to check and/or reformat code to match.
    This is now a requirement for new patches.
  - libselinux and python use system Python3 build module
  - Updated pywrap build targets for modern python builds using the Python3 build
    module.
  - Build shared libraries with -fPIC for LTO.
- Packaging changes:
  - Add python-build as BuildRequires
  - Drop python3.6 build in 15.7, as python-build is not available for python3.6
  - Add workaround in Makefile as python multi build does not work
    with the combined dist/ folder from upstream

==== libsemanage ====
Version update (3.10 -> 3.11)
Subpackages: libsemanage-conf libsemanage2

- Update to version 3.11
  https://github.com/SELinuxProject/selinux/releases/tag/3.11
  - Development-relevant changes:
  - Reformatted entire tree based on .clang-format and added new
    check-format/format make targets to check and/or reformat code to match.
    This is now a requirement for new patches.
  - Test fixes
  - Notable bug fixes:
  - libsemanage: guard end of path in semanage_fc_find_meta
  - libsemanage: bunzip: guard against size overflow
  - libsemanage: genhomedircon: fix STR_COMPARATOR() passed to lfind()
  - libsemanage: genhomdircon: handle NULL bsearch() in get_users()
  - libsemanage: fix OOB cleanup in semanage_direct_list()
  - libsemanage: make expand-check a proper boolean option
  - libsemanage: use 'bool' for boolean options
  - libsemanage: Do not use vfork()
  - libsemanage: Do not discard ‘const’ qualifier

==== libsepol ====
Version update (3.10 -> 3.11)

- Update to version 3.11
  https://github.com/SELinuxProject/selinux/releases/tag/3.11
  - User-visible changes:
  - Fixed libsepol generation of constraint expressions with a list of names when
    writing policy.conf from CIL.
  - Fixed libsepol to generate constrain/validatetrans instead of
    mlsconstrain/mlsvalidatetrans when converting a module to CIL unless the
    constraint contains an expression based on level.
  - Fixed libsepol selection of tunableif or booleanif and to skip empty
    conditional blocks when converting a module to CIL.
  - Fixed libsepol/secilc reporting of CIL source file info.
  - Fixed libsepol to require at least one perm in a CIL classperm and to
    correctly count the number of elements in the avtab.
  - Fixed libsepol to link xperm rule permissions correctly.
  - Fixed libsepol off-by-one error in cats_ebitmap_len().
  - Development-relevant changes:
  - Reformatted entire tree based on .clang-format and added new
    check-format/format make targets to check and/or reformat code to match.
    This is now a requirement for new patches.
  - Many hardening fixes spanning the entire tree
  - Notable bug fixes:
  - libsepol: cast to unsigned char in ctype calls
  - libsepol: bound type values in type_set_expand negset loop
  - libsepol/cil: fix double free of borrowed type datum on error path

==== libxml2 ====
Subpackages: libxml2-16 libxml2-tools

- CVE-2026-11979: stack-based buffer overflows in the `xmlcatalog` utility when running in `--shell` mode (bsc#1269790)
  * Add patch libxml2-CVE-2026-11979.patch

==== openSUSE-release ====
Version update (20260709 -> 20260714)
Subpackages: openSUSE-release-appliance-custom openSUSE-release-dvd

- automatically generated by openSUSE-release-tools/pkglistgen

==== openblas_openmp ====
Subpackages: compatlibopenblas_openmp0 libopenblas_openmp0

- fixed wrong ownership of /usr/include for SLE16.1 builds and moved
  tests to non conflicting locations

==== openblas_pthreads ====
Subpackages: compatlibopenblas_pthreads0 libopenblas_pthreads0

- fixed wrong ownership of /usr/include for SLE16.1 builds and moved
  tests to non conflicting locations

==== permissions ====
Version update (1699_20260512 -> 1699_20260707)
Subpackages: permctl permissions-config

- Update to version 1699_20260707:
  * profiles: add cap_perfmon for ksystemstats6 (bsc#1262779)

==== php8 ====
Version update (8.5.7 -> 8.5.8)
Subpackages: php8-ctype php8-dom php8-iconv php8-openssl php8-pdo php8-sqlite php8-tokenizer php8-xmlreader php8-xmlwriter

- fix build with GCC 16 (gh#php/php-src#22206) [boo#1267259]
- added patch
  + php-fix-build-gcc16.patch
- use system liburiparser [bsc#1270538] [bsc#1270539]
- version update to 8.5.8 (CVE-2026-14355 [bsc#1270351])
    CLI:
    Fixed bug GH-21901 (Stale getopt() optional value).
  Date:
    Fixed bug GH-18422 (int overflow in php_date_llabs).
  DOM:
    Fixed bug GH-22077 (UAF in custom XPath function).
  Opcache:
    Fixed tracing JIT crash when a VM interrupt is handled during an observed user function call.
    Fixed bug GH-21746 (Segfault with tracing JIT).
    Fixed bug GH-22004 (Assertion failure at ext/opcache/jit/zend_jit_trace.c).
    Fixed tailcall VM crash when a VM interrupt is handled from a VM helper.
  OpenSSL:
    Fix compatibility issues with OpenSSL 4.0.
  Standard:
    Fixed bug GH-21689 (version_compare() incorrectly handles versions ending with a dot).
  URI:
    Fixed CVE-2026-44927 (In uriparser before 1.0.2, there is pointer difference truncation to int in various places). (CVE-2026-44927)
    Fixed CVE-2026-44928 (In uriparser before 1.0.2, the function family EqualsUri can misclassify two unequal URIs as equal). (CVE-2026-44928)
- Revert changes for building with GCC 16

==== policycoreutils ====
Version update (3.10 -> 3.11)
Subpackages: policycoreutils-python-utils python313-policycoreutils

- Move the sandbox subpackage to the separate selinux-sandbox package (bsc#1270534)
  drop policycoreutils-sandbox-fix-cleanup.patch
- Update to version 3.11
  https://github.com/SELinuxProject/selinux/releases/tag/3.11
  - User-visible changes:
  - Several security improvements in dbus and gui
  - Dropped Python 2 support from audit2why
  - Added `setfiles -A` option to disable SELINUX_RESTORECON_ADD_ASSOC
  - restorecon only logs error on read-only filesystem instead of failing (allows
    relabeling with read-only BTRFS subvolumes)
  - Introduced a new SELINUX_RESTORECON_SKIP_MULTILINK flag to
    selinux_restorecon(3); if set, then selinux_restorecon(3) will refuse to
    relabel files with multiple hard links to prevent mislabeling them. Updated
    restorecond(8) to always pass this flag when relabeling files to prevent
    mislabeling hard links to files owned by others, e.g. when relabeling user
    home directories or /tmp.
  - Fixed semanage audit fd creation to avoid hitting RLIMIT_NOFILE on large
    semanage import operations (#291).
  - Improved semanage-fcontext(8) manpage
  - Fixed dispol and dismod to show all options in the -h text.
  - Development-relevant changes:
  - Reformatted entire tree based on .clang-format and added new
    check-format/format make targets to check and/or reformat code to match.
    This is now a requirement for new patches.
  - Updated pywrap build targets for modern python builds using the Python3 build
    module.
  - Disabled build isolation for sepolicy python module.
  - Fixed build errors with glibc 2.43.
  - Updated pywrap build targets for modern python builds using the Python3 build
    module.
- Packaging changes:
  - Drop sepolicy-build-isolation.patch
    was accepted upstream
  - Drop sandbox-sandbox-fix-saving-file-changes.patch
    was accepted upstream
  - Add python-build as new BuildRequires
  - Rewrite policycoreutils-sandbox-fix-cleanup.patch
    Code was rewritten upstream, dropped the part in seunshare.c
  - Rewrite usr_etc.patch
    Did not apply anymore due to code changes

==== postfix ====
Version update (3.11.4 -> 3.11.5)

- update to 3.11.5
  This release addresses medium-impact problems that need to be fixed
  as some enable remote DOS, or local memory corruption.
  * Bug (defect introduced: Postfix 2.7, date: 20090617): out-of-memory
    condition with remote input in the postscreen dummy SMTP engine.
    This dummy engine is used after PREGREET or DNSBL checks fail,
    or when "after 220" protocol checks are enabled.
  * Bug (defect introduced: Postfix 2.0, date: 20030619): file
    system DOS: with smtpd_proxy_filter enabled, the before-filter
    SMTP server did not enforce the message size limit for mailbox
    From_ lines at the beginning of a message. With smtpd_proxy_filter
    disabled, the file size limit was still enforced by the cleanup
    daemon.
  * Bug (defect introduced: Postfix 2.3, date: 20060611): double
    ldap_msgfree(resloop) call during error handling when
    special_result_attribute is configured. An attacker who controls
    the LDAP server or can play attacker-in-the-middle could corrupt
    heap memory.
  * Bug (defect introduced: Postfix 3.4, date: 20190121): missing
    null termination in a postlogd process that was started with
    an EMPTY maillog_file setting, while receiving a message from
    a postlog command that was started with a NON-EMPTY maillog_file
    setting. Under these contradicting conditions, an unprivileged
    attacker could cause postlogd to write null bytes to stack
    memory as it tokenized text outside the receive buffer, and
    possibly gain 'postfix' privilege.
  * Bug (defect introduced: Postfix 2.3, date: 20060711): one-byte
    heap over-write in the Milter client with soft_bounce=yes while
    processing a malformed SMFIR_REPLYCODE Milter response. An
    attacker who controls the Milter or who can play attacker-in-the-middle
    could corrupt heap memory.
  * Bug (defect introduced: Postfix 2.1, date: 20030619): SMTP
    server panic() in smtpd_proxy_filter when handling long mailbox
    From_ lines at the beginning of a message.
  * Bug (defect introduced: Postfix 3.1, date: 20151129): a missing
    return statement in the SHOWQ_CLEANUP_AND_RETURN() macro. A
    local user could submit a crafted message that triggered a
    read-after-free and panic() in the unprivileged showq daemon
    (which scans the mail queue for the 'postqueue -p' and 'mailq'
    commands). This could happen only before a message had been
    picked up by the pickup(8) daemon.
  * Bug: (defect introduced: Postfix 3.10, date: 20240925): NULL
    pointer read in the TLSRPT client, caused by missing STR_OR_NULL()
    wrappers.
  * Bug (defect introduced: Postfix < alpha, date: 1997): missing
    recursion guard while processing :include: files that directly
    include other :include: files in local(8) aliases or .forward
    files. This could result in exhausting stack space (segfault)
    or file handles (fatal error). This is not a global DOS; it
    affected at most two parallel delivery processes for the local
    recipient who created the condition.
  * Bug (defect introduced: postfix-3.11.0-RC1, date: 20251222):
    heap memory over-read in the cleanup daemon as it handled a
    milter "shutdown" reply. The over-read memory was logged after
    masking unprintable content.
  * Bug (defect introduced: Postfix 2.3, date: 20050526): limited
    (<= 11 byte) heap over-read in the cleanup daemon. This could
    be triggered by local user with a crafted queue file, but the
    over-read content was not disclosed and there was no other
    impact.
  * Bug (defect introduced: Postfix < alpha, date: 19971221): a
    signal handler in the postdrop command could call unlink() with
    a pathname that was already wiped and free()d, but not yet
    reused.
  * Bug (defect introduced: Postfix 3.11, date: 20260219): In the
    non-BerkeleyDB re-indexing server, vstream_fopen_as() ignored
    the uid and gid arguments and opened a database source file
    read-only as the 'postfix' user instead of the file owner.
  * Bug (defect introduced: Postfix 2.2. date: 20040829): after a
    RAND_bytes() call failure, do not rely on stack-based
    pseudo-randomness for tlsmgr seed generation, and for timing
    jitter of tlsmgr seed refresh intervals.
  * Bug (defect introduced: Postfix 2.3, date: 20060711): In the
    Milter client, null-terminate the SMFIR_REPLYCODE response data
    to exclude stale data when processing the result as a C string.
  * Hardening: make sure that optimizers will not delete a memset()
    call in myfree() that wipes memory.
  * Allow zero-length memory allocation requests. Many people have
    experience with systems that allow this, therefore it should
    not trigger a panic in Postfix.
  * Safety: added a global recursion guard in the local delivery
    agent.

==== publicsuffix ====
Version update (20260622 -> 20260708)

- Update to version 20260708:
  * Add dev.cv, store.cv, and sch.ac to PSL private domains for Code Fost Host (#2989)
  * Add grok.me (xAI) to PRIVATE section (#2993)
  * Remove info.at, biz.at (#2995)
  * remove mayfirst.org (#2994)
  * Add multiple dnsHome.de domains (#2916)
  * Add puter.site puter.app puter.work (#2914)

==== python-Pillow ====
Version update (12.2.0 -> 12.3.0)

- Update to 12.3.0 (fixes CVE-2026-42311 (bsc#1270404),
  CVE-2026-54059 (bsc#1270409), CVE-2026-54060 (bsc#1270410),
  CVE-2026-55379 (bsc#1270411), CVE-2026-55380 (bsc#1270412))
  * Remove non-image ImageCms modes
  * Speed up ImageChops operations
  * Speed up Image.filter()
  * Speed up Image.getchannel(), Image.merge(), Image.putalpha() and
    Image.split()
  * Speed up Image.fill(), Image.linear_gradient() and Image.radial_gradient().
  * Speed up Image.resample()
  * Speed up alpha_composite, matrix, negative, quantize
  * Remove PyErr_Clear() of "weird" exceptions
  * Check realloc return value
  * Add max_length to PdfStream decode()
  * Return early when there is no fill region
  * Allow error to be raised if PyDict_SetItemString fails
  * Speed up Image.blend()
  * Raise OverflowError if number of vertices is too large for Path
  * Remove unused HSV and LAB matrix conversion from C
  * Prevent reusing ImagingDecoderObject.setimage
  * Raise ValueError if FPX tile size is not 64px by 64px
  * Only clear error if it is BufferError
  * Apply XOR mask to 1 and L mode CUR images
  * Do not raise error from unknown channel ID when parsing PSD layers
  * Raise ValueError if P;2L or P;4L data is truncated in frombytes()
  * Embed SBOM into wheels
  * Do not set eval() globals in ImageMath.unsafe_eval()
  * Add Tcl/Tk license to wheels
  * Ensure map stride is at least one full row of pixels
  * Raise OverflowError if text width exceeds INT_MAX
  * Raise error if image modes do not match ImageCms transform modes
  * Use int64_t for text height
  * Return if error occurs in Py_mod_exec slot
  * Add decompression bomb checks to FontFile classes
  * If C error is raised, return NULL
  * Prevent saving 1 mode images as TGA with run-length encoding
  * Raise ValueError if EPS BeginBinary bytecount is negative
  * Do not DECREF tuple until tuple items are no longer used
  * Do not update NumPy automatically
  * Simplified code
  * If realloc fails, do not reduce block size
  * DECREF PyDict_GetItemRef result
  * Use int64_t to calculate paste box dimensions
  * Calculate JPEG2000 total_component_width for each tile in isolation
  * Raise ValueError if value is not bytes for TIFF_BYTE or TIFF_ASCII tag
  * Release Py_Buffer on error
  * Use os.startfile() in WindowsViewer show_file()
  * Validate large filter sizes when initializing RankFilter
  * Add decompression bomb check to GdImageFile
  * Free image bands when an error occurs while splitting an image
  * Check PyList_Append return value
  * Check WebPMuxNew return value
  * Check PyCapsule_New return value
  * Do not return negative width for text length
  * Add args argument to METH_NOARGS methods
  * Check ImagingNewDirty return value
  * Use int64_t for text width
  * Move PyDateTime_IMPORT inside Py_mod_exec slot
  * Validate size and rank when initializing RankFilter
  * Raise ValueError if insufficient data is read from DDS RGB file
  * Correct IFDRational.__float__() return value
  * Correct length when accessing ImagePath.Path subscript
  * Release reference on non-flattened sequence error
  * Do not release Py_buffer until buf is no longer in use
  * Do not resize macOS retina screenshots by default
  * Add abstract BaseImageFont class
  * Cast before multiplying
  * Limit radius to half width or height of rounded rectangle
  * linesize is always xsize multiplied by pixelsize
  * Check annotate_hash_table return value
  * Catch KeyError when checking mode from PNG IHDR chunk
  * Only pass one argument to C expand
  * Raise error if declared JPEG2000 marker length is too small
  * In _dump(), use Python PPM save, instead of C
  * Raise error consistently from inside ImagingNewArrow
  * Simplify RankFilter.c check
  * Support opening and saving L mode AVIF images with libavif >= 1.3.0
  * [pre-commit.ci] pre-commit autoupdate
  * Apply libtiff patch to fix CVE-2026-4775
  * Remove duplicate code
  * Switch iOS back to macos-26-intel
  * Don't use list as default in PdfParser read_prev_trailer
  * Add support for Python 3.15
  * Do not draw line or arc if width is zero
  * Use _accept check in WebP _open
  * Compare dist sizes vs latest PyPI release
  * Do not generate SBOM in scheduled run on fork
  * Use plugin method directly when saving PDFs
  * [pre-commit.ci] pre-commit autoupdate
  * Set Renovate prCreation to not-pending
  * Raise error if PNG transparency has incorrect type or length when saving
  * If PdfParser buffer is memoryview, release it when closing
  * Correct integer overflow in 16-bit resampling
  * SBOM: Use real versions from dependencies.json
  * Restrict SBOM upload to only Pillow JSON
  * Generate CycloneDX SBOM at release time via CI
  * Raise ValueError if ImageOps border has unsupported format
  * Unsafe pointer dereference from unchecked Python integer in Tk
    initialization
    ... changelog too long, skipping 11 lines ...
    https://pillow.readthedocs.io/en/stable/releasenotes/12.3.0.html

==== python-semanage ====
Version update (3.10 -> 3.11)

- Update to version 3.11
  https://github.com/SELinuxProject/selinux/releases/tag/3.11
  - Development-relevant changes:
  - Reformatted entire tree based on .clang-format and added new
    check-format/format make targets to check and/or reformat code to match.
    This is now a requirement for new patches.
  - Fixed libsemanage pywrap target deps for parallel builds.
- Packaging changes:
  - Drop 1266385-libsemanage-Require-LIBSO-before-SWIGSO-and-SWIGRUBY.patch
    was accepted upstream

==== qemu ====
Version update (10.2.2 -> 11.0.2)
Subpackages: qemu-arm qemu-audio-spice qemu-block-curl qemu-block-nfs qemu-block-rbd qemu-chardev-spice qemu-guest-agent qemu-hw-display-qxl qemu-hw-display-virtio-gpu qemu-hw-display-virtio-gpu-pci qemu-hw-display-virtio-vga qemu-hw-usb-host qemu-hw-usb-redirect qemu-hw-usb-smartcard qemu-img qemu-ksm qemu-pr-helper qemu-tools qemu-ui-curses qemu-ui-gtk qemu-ui-opengl qemu-ui-spice-app qemu-ui-spice-core qemu-vgabios

- Update to latest stable release (11.0.2)
  Full backport list here:
  https://lore.kernel.org/qemu-devel/20260627082913.181C717AB6B@think4mjt.localdomain/
  Bugs and CVEs fixed:
  - bsc#1268794 (CVE-2026-48914)
  A selection of them is reported here below:
  linux-user: Fix AT_PHDR when program headers are relocated into their own segment
  hw/pci: Replace assert with bounds check and return
  ppc/pnv_phb3: Error out on invalid config access
  linux-user/xtensa: fix unlock of uninitialized frame pointer on sigreturn
  linux-user/xtensa: save/restore FP registers across signal delivery
  target/xtensa: add cpu_set_fcr/fsr helpers to sync fp_status
  target/arm/hvf: Stop pre-allocating cpreg_vmstate arrays
  ui/sdl2: Set GL ES profile before creating initial GL context
  ui/sdl2: Explicitly specify EGL platform
  hw/9pfs: reject . and .. in Twstat rename
  hw/9pfs: fix abort due to illegal name with Twstat rename
  gdbstub: Update x86 control register bits
  target/i386: apply mod to immediate count of an RCL/RCR operation
  hw/uefi: fix parse_hexstr
  target/riscv: mask vxrm csrw write to the low 2 bits
  disas/riscv.c: fix inst_length()
  target/riscv/tcg: disable svnapot if satp_mode < sv39
  target/riscv/cpu_helper.c: add PMA access fault
  target/riscv/cpu_helper.c: fault with reserved PTE.PBMT val
  target/riscv/insn_trans/trans_rvzicbo.c.inc: save opcode before helpers
  disas/riscv.c: add 'cbo' insns to disassembler
  target/riscv/csr.c: fix mstatus.UXL reserved value
  target/riscv/csr.c: do not allow mstatus MPV/GVA writes
  target/riscv/tcg: disable svpbmt if satp_mode < sv39
  target/riscv/cpu_helper.c: allow LOAD_ADDR_MIS promotion to AMO fault
  virtio: Allow to fill a whole virtqueue in order
  amd_iommu: Reject non-decreasing NextLevel in fetch_pte()
  amd_iommu: Follow root pointer before page walk and use 1-based levels
  libvduse: fix buffer overflow in vduse_queue_read_indirect_desc()
  libvhost-user: fix buffer overflow in virtqueue_read_indirect_desc()
  tests/qtest: Add amd-iommu command buffer head wrap test
  amd_iommu: Update command buffer head ptr in MMIO region after wraparound
  amd_iommu: restrict command buffer head/tail ranges to ring size
  linux-user: add preadv2/preadv2
  system/rtc: Fix a possible year-2038 integer overflow problem
  linux-user/strace: add fsmount series of syscalls
  linux-user: implement fsmount(2) series of syscalls
  fpu: Handle all rounding modes in partsN_uncanon_normal
  hw/usb/hcd-ohci: Clean up USBPacket before freeing ISO TD packet
  qed: Don't try to flush during incoming migration
  iotests: test shared mmap for fuse export
  block/export/fuse: set FUSE_DIRECT_IO_ALLOW_MMAP flag to fix regression
  block/export/fuse: use struct fuse_init_in
  qcow2: Fix data loss on zero write with detect-zeroes=unmap
  iotests/046: Test that discard/write_zeroes wait for dependencies
  qcow2: Fix corruption on discard during write with COW
  qemu-io: Add 'aio_discard' command
  virtio-blk: add missing VIRTIO_BLK_T_SCSI_CMD size check (CVE-2026-48914)
  block/io: fallback to bounce buffer if BLKZEROOUT is not supported because of alignment
  hw/i3c: fix CMD/data FIFO depth reset values to match real silicon
  s390x/pci: Fix interrupt forwarding disable for interpreted devices
  target/s390x: Make container ids in SysIB_15x 1-based
  lcitool: remove Cirrus CI support
  gitlab: remove x64-freebsd-14-build Cirrus job
  gitlab: add initial MacOS 15 on gitlab runner
  ci: drop cirrus MacOS build
  tests/unit: add test-envlist covering setenv/unsetenv name matching
  util/envlist: fix prefix-match in envlist_unsetenv() name lookup
  ...
- Fix bsc#1268279, bsc#1268245, bsc#1263098:
  * [openSUSE][RPM] spec: fix post-build-checks failure for qemu-tools (bsc#1263098)
  * [openSUSE][RPM] spec: fix missing unversioned ppc64 cross-compiler binaries (bsc#1268245)
  * ppc/spapr: Skip system reset for quiesced CPUs (bsc#1268279)
- Update to latest stable release (11.0.1)
  Full backport list here:
  https://lore.kernel.org/qemu-devel/20260528061820.CEE521691A9@think4mjt.localdomain/
  A selection of them is reported here below:
  block/graph-lock: fix missed wakeup in bdrv_graph_co_rdunlock()
  commit: Drain nodes across all of bdrv_commit()
  block: Add more defaults to DEFAULT_BLOCK_CONF
  block: Create DEFAULT_BLOCK_CONF macro
  ide-test: Test reset during TRIM
  ide-test: Factor out wait_dma_completion()
  ide: Clean up ide_trim_co_entry() to be idiomatic coroutine code
  ide: Minimal fix for deadlock between TRIM and drain
  block: Add flags parameter to blk_*_pdiscard()
  block: Add blk_co_start/end_request() and BDRV_REQ_NO_QUEUE
  blkdebug: Add 'delay-ns' option
  linux-user/sh4: Fix setup_sigtramp to match Linux kernel trampoline pattern
  linux-user/sh4: Fix target_ucontext tuc_link field type
  linux-user: Fix AT_EXECFN in AUXV for symlinked programs
  hw/nvme: fix admin cq msix setup
  target/arm/hvf: Fix WFI halting to stop idle vCPU spinning
  tests/functional/qemu_test/asset.py: Don't use setxattr when it doesn't exist
  hw/remote/machine.c: Mark x-remote machine as OK for AArch64 and AArch32
  meson.build: Add -fzero-init-padding-bits=all
  tests/qtest/iommu-smmuv3-test: Skip if no TCG GICv3 device present
  ati-vga: fix ati_set_dirty address calculation
  hw/i2c/microbit_i2c: Don't index off end of twi_read_sequence[]
  aspeed/hace: Prevent total_req_len overflow
  aspeed/hace: Fix out-of-bounds read in has_padding()
  hw/misc/aspeed_sbc: Add bounds checking for OTP write operations
  hw/display/cirrus_vga: Fix packed-24 color-expansion transparent copies
    ... changelog too long, skipping 68 lines ...
  * [openSUSE][RPM] spec: enable passt support

==== sdbootutil ====
Version update (1+git20260506.25d47bf -> 1+git20260714.d9bb736)
Subpackages: sdbootutil-dracut-measure-pcr sdbootutil-snapper

- Update to version 1+git20260714.d9bb736:
  * tukit: do not fail if service is not found
- Update to version 1+git20260713.d869cf8:
  * Ignore errors in the snapper plugin
- Update to version 1+git20260709.7dfd021:
  * Remove the background process in the plugin
  * Fix missing initrd condition (bsc#1270420)
  * After reboot the shutdown service is not active
  * Disable the shutdown service after main service
  * Update uhmac dependencies (rust-openssl)
    bsc#1270192, CVE-2026-41676
    bsc#1270995, CVE-2026-45784
    bsc#1270922, CVE-2026-44662
    bsc#1270863, CVE-2026-41898
    bsc#1270742, CVE-2026-41681
    bsc#1270670, CVE-2026-41678
    bsc#1270616, CVE-2026-41677
    bsc#1270471, CVE-2026-42327
  * Add systemd transient service to update predictions
  * Install extra EFI binaries
- Update to version 1+git20260625.7fa275e:
  * Remove duplicate code and parametrize timers
  * Check boot entry before kernel installation
  * Re-install an old kernel if initrd cannot be reused
  * Skip installation for already installed kernel
  * Add configurable devicetree entry support
  * Set explicit kernel and initrd paths
  * Remove the full tmpdir in the service
  * Fix /run/sdbootutil permissions
  * Execute predictions in the background
  * Add --disable-predictions parameter
  * Fix comparison operator
  * Add print-loader-path command

==== selinux-policy ====
Version update (20260618 -> 20260702)
Subpackages: selinux-policy-targeted

- Update selinux-policy-sandbox description (bsc#1270534)
- Update to version 20260702:
  * Include key_socket in socket_class_set
  * Remove 14 permissive domains
  * ci: Run cockpit-machines tests in PRs
  * Remove the lockdown class from the policy
  * Allow systemd-logind the sys_ptrace capability in the user namespace
  * Allow systemd-sleep the perfmon capability
  * Allow sshd_session_t dyntransition to sftpd_t
  * Allow lttng kernel tracing
  * Allow loadkeys create and use its private tmpfs files
  * Allow journald create and use netlink_tcpdiag_socket
  * Fix typo in the comment of build.conf
  * Allow gpg_pinentry_t to write session dbus socket files
  * Allow systemd-hostnamed read hwdb files
  * Allow systemd-machined to manage nspawn runtime directory
  * Allow pcm-sensor-server the sys_admin capability
  * Allow nut/upsmon read nut_conf_t symlinks
  * Support new sanlock features - using libdm and SG_IO
  * Allow thumb_t mount proc filesystem
  * Allow aide connect to the GDM userdb provider socket
  * Allow postfix_postdrop_t/system_mail_t append to init unix domain stream sockets
  * Allow nfsd_t to create netlink_generic_socket (bsc#1267826)
  * Add anaconda_ioctl_fifo_files_install() and anaconda_write_fifo_files_install()
  * Allow install_t domain transition to insights_client_t
  * Allow staff user mounton /var/lib dirs
  * Allow systemd-coredump signull container runtime
  * Allow blueman get the attributes of a tmpfs filesystem
  * portage_compile_domain: Require xdm_xserver_tmp_t type
  * Add missing interface requirements
  * Dontaudit virt_driver_domain execmem
  * fixed file after comment from zpytela.
  * added caddy related paths.
  * Remove extra parameters from interface headers
  * Update bootupd policy for running lsblk
  * Allow pcscd_t to search cgroup
- Syncing with upstream rawhide selinux-policy up to:
  * 3cf2aa66a844ba5e87fb2a8f04be08c62cf5538a
- Update embedded container-selinux version to commit:
  * 9715eb09108e9fabb0fbaeee9044636b349370eb (v2.250.0)
- Update to version 20260630:
  * Allow snapper_sdbootutil_plugin_t create transient units (bsc#1267377)
  * Allow bootctl access unconfined_t pid (bsc#1267377)
  * Refactor sdbootutil into seperate module (bsc#1267377)
  * Allow pcrlock to send kernel dgram (bsc#1267377)
  * Add tiny sdbootutil module for sdbootutil snapper plugin changes (bsc#1267377)

==== spice-gtk ====
Subpackages: libspice-client-glib-2_0-8 libspice-client-glib-helper libspice-client-gtk-3_0-5

- Add BuildRequires for python3-base

==== timezone ====
Version update (2026b -> 2026c)
Subpackages: tzselect

- Update to 2026c:
  * Alberta moved to permanent -06 on 2026-06-18
  * Morocco moves to permanent +00 on 2026-09-20
  * More integer overflow bugs have been fixed in zic

==== wget ====

- Fix buffer underflow in clean_metalink_link
  [bsc#1271033, CVE-2026-58469]
  * CVE-2026-58469.patch
- Fix integer overflow in parse_content_range
  [bsc#1271034, CVE-2026-58470]
  * CVE-2026-58470.patch
- Fix buffer size handling in filename conversion
  [bsc#1271035, CVE-2026-58471]
  * CVE-2026-58471.patch
- Fix integer+buffer overflow in html_quote_string
  [bsc#1271036, CVE-2026-58472]
  * CVE-2026-58472.patch

==== wpa_supplicant ====

- Add Require-network_ctx-and-AKMP-match-for-accepting-PMK.patch
  https://w1.fi/security/2026-2/
- Add SAE-Fix-crash-due-to-NULL-pointer-dereference-in-H2E.patch
  https://w1.fi/security/2026-3/
- Add CVE-2026-58374.patch: Missing multi-link parsing validation in
  wpa_supplicant and hostapd (bsc#1269892)
- Add wpa_supplicant_support_pem_encoded_chain.patch: OpenSSL:
  Support PEM encoded chain from ca_cert blob (bsc#1258365).

==== xrdb ====
Version update (1.2.2 -> 1.2.3)

- Update to bugfix release 1.2.3
- switch to Meson build system

==== xset ====
Version update (1.2.5 -> 1.2.6)

- Update to version 1.2.6:
  * Switch to Meson build system.
  * Add GPG validation for source archives.
  * The new release includes bugfixes.

==== xsetroot ====
Version update (1.1.3 -> 1.1.4)

- Update to version 1.1.4
  * -help should exit(0) not (1)
  * Accept --help & --version as aliases to -help & -version
  * Improve man page formatting
  * man page: fix warnings from `mandoc -T lint`
  * gitlab CI: drop the ci-fairy check-mr job
  * Strip trailing whitespace from source files
  * meson: Add option to build with meson
- Switch to Meson build system