Packages changed:
  MicroOS-release (20260709 -> 20260714)
  bash
  blog (2.45 -> 2.46)
  busybox (1.37.0 -> 1.38.0)
  busybox-links (1.37.0 -> 1.38.0)
  checkpolicy (3.10 -> 3.11)
  chrony
  cryptsetup
  ethtool (7.0 -> 7.1)
  freetype2 (2.14.2 -> 2.14.3)
  grub2
  gstreamer (1.28.4 -> 1.28.5)
  gstreamer-plugins-bad (1.28.4+24 -> 1.28.5)
  gstreamer-plugins-base (1.28.4 -> 1.28.5)
  kernel-firmware-amdgpu (20260614 -> 20260629)
  kernel-firmware-bluetooth (20260618 -> 20260629)
  kernel-firmware-i915 (20260610 -> 20260706)
  kernel-firmware-iwlwifi
  kernel-firmware-media (20260610 -> 20260706)
  kernel-firmware-mediatek (20260619 -> 20260629)
  kernel-firmware-nvidia
  kernel-firmware-platform (20260610 -> 20260629)
  kernel-firmware-qcom (20260619 -> 20260629)
  kernel-firmware-realtek (20260614 -> 20260629)
  kernel-firmware-sound (20260618 -> 20260706)
  libcamera (0.7.1 -> 0.7.2)
  libdovi (3.3.2 -> 3.4.0)
  libpsl (0.22.0 -> 0.23.0)
  libseccomp (2.6.0 -> 2.6.1)
  libselinux (3.10 -> 3.11)
  libselinux-bindings (3.10 -> 3.11)
  libsemanage (3.10 -> 3.11)
  libsepol (3.10 -> 3.11)
  libxml2
  permissions (1699_20260512 -> 1699_20260707)
  policycoreutils (3.10 -> 3.11)
  python-rpds-py (0.30.0 -> 2026.6.3)
  python-semanage (3.10 -> 3.11)
  qemu (10.2.2 -> 11.0.2)
  sdbootutil (1+git20260506.25d47bf -> 1+git20260714.d9bb736)
  selinux-policy (20260618 -> 20260702)
  timezone (2026b -> 2026c)
  wget
  wpa_supplicant
  xrdb (1.2.2 -> 1.2.3)
  xset (1.2.5 -> 1.2.6)
  xsetroot (1.1.3 -> 1.1.4)

=== Details ===

==== MicroOS-release ====
Version update (20260709 -> 20260714)
Subpackages: MicroOS-release-appliance MicroOS-release-dvd

- automatically generated by openSUSE-release-tools/pkglistgen

==== bash ====
Subpackages: bash-sh

- Add workaround for msginit which ignores SOURCE_DATE_EPOCH (boo#1268542)

==== blog ====
Version update (2.45 -> 2.46)
Subpackages: libblogger2

- Update to version 2.46
  Implement Plymouth-compatible display-message and hide-message commands
  This commit adds support for the display-message and hide-message
  Plymouth commands, allowing external tools to print status updates
  directly to the boot console via blogctl.
  Key changes:
    Add MAGIC_SHOW_MSG and MAGIC_HIDE_MSG protocols to blogctl and
    parse the --text= argument using getopt_long_only().
    Broadcast display-message payloads to all active hardware consoles
    via c->out() to ensure immediate visual feedback, while simultaneously
    logging it to /var/log/boot.log via copylog().
    Add \r\n line endings to printed messages to prevent the staircase
    effect on serial terminals operating in raw mode.
    Handle hide-message as a visual no-op (replying with an ACK only)
    to deliberately avoid ANSI clear-screen sequences that would corrupt
    the output on line-based, half-duplex consoles like the s390x 3215.
    Update the blogctl.8 manual page to document the new commands and
    their specific behavior regarding screen clearing.
  Implement Plymouth-compatible ask-for-password and ask-question commands
  This commit extends blogctl to act as a lightweight, fully functional
  replacement for Plymouth's interactive prompt commands, allowing scripts
  to securely ask for passwords or questions on the system console.
  Key changes:
    Add support for ask-for-password and ask-question in blogctl.
    Use getopt_long_only() to robustly parse GNU-style long options
    (--prompt, --command, --number-of-tries, --dont-pause-progress).
    Offload the retry-loop and command execution (popen) entirely to
    the blogctl client, keeping the blogd daemon simple and secure.
    Fix an epoll EEXIST crash in console.c by separating the daemon's
    process state (asking) from the requested prompt type (ask_mode),
    resolving a race condition during socket handler registration.
    Comply strictly with the Plymouth protocol: enforce 1-byte prompt
    length limits, handle little-endian length headers (le32toh),
    and ensure null-terminated payloads via asprintf.
    Update the blogctl.8 manual page to document the new commands.
  Back to use constructor for initial seed
  for the process lifetime and inherited across fork()
  Make tty wait logic real and fix SIGHUP/inotify cleanup
  Better in-memory reversible obfuscation for cached passwords
  This is not cryptographic protection against a memory-reading attacker.
  It is only meant to avoid trivial/plaintext exposure in memory.
  Fix resource leaks and harden IPC validations
  This commit addresses several issues found by static code analysis,
  focusing on memory hygiene, file descriptor management, and robust
  error handling.
  Key changes:
    Fix memory and file descriptor leaks in error paths (proc.c, shm.c, tty.c)
    and ensure all pending coldstart requests are freed on shutdown.
    Harden the systemd ask-password interface by adding boundary checks
    for UNIX socket paths, verifying sendto payloads, and gracefully
    handling missing directories during early boot without fatal errors.
    Improve IPC protocol safety by strictly validating the MAGIC_CHROOT
    argument (must be an absolute path) and sending an explicit NACK on failure.
    Prevent stale terminal states on s390x by clearing the VMCP cache
    prior to parsing a new QUERY TERMINAL reply.
  User the --wait option of the blogctl quit command
  Add an --wait option specially for quit of blogctl
  Fix gh##7
  setting blog.silent=true causes it to be non-silent
  Make shared library a executable
  Refactor daemon to use synchronous signalfd and epoll event loop
  This commit migrates the core architecture from traditional, asynchronous
  signal handling to a modern, synchronous event loop using signalfd. By
  integrating signal handling directly into the epoll multiplexer, we eliminate
  race conditions, unexpected EINTR interruptions during I/O operations, and
  complex reentrancy issues.
  Key changes:
    Add setup_signalfd() to block essential signals (SIGINT, SIGQUIT, SIGTERM,
    SIGSYS, SIGIO, SIGCHLD) globally and route them through a dedicated file
    descriptor monitored by epoll.
    Shield epoll_pwait() using a fully populated signal mask (omask) to
    guarantee uninterrupted I/O processing.
    Prevent socket handlers (MAGIC_SYS_INIT, MAGIC_CLOSE) from accidentally
    unblocking signals and resetting dispositions when signalfd is active.
    Sanitize the inherited signal mask in forked child processes
    (e.g., systemd password prompts on tty) by resetting it to an empty
    mask via sigprocmask(), ensuring agents run without restrictions.
    Replace the ALIGNED_SIZEOF macro with a cleaner align_up(type, boundary)
    macro and fix memset() sizes to correctly zero out trailing padding bytes.
    Update the Makefile to compile a stripped-down fallback object
    (signals_stripped.o compiled with -DNO_SIGNALFD) to ensure the passive
    libblogger.so library remains unaffected by the signalfd architecture.
  Some minor changes in quit and umount unit services
  The HVC consoles are like sclp console
  and can do colours as well
- Silent some rpmlint warnings

==== busybox ====
Version update (1.37.0 -> 1.38.0)

- Update to version 1.38.0:
  * New applets: sha384sum, vmstat, ssl_server, lsblk, uuidgen
  * Security: Disallow path traversals in archival (CVE-2023-39810)
  * archival: Sanitize filenames on output to prevent control sequence attacks
  * ash/hush: Implement <<< here_string syntax and improve bash compatibility
  * libbb: Add yescrypt password hashing support
  * tls: Implement server-side code and support ECDHE_RSA
  * httpd: Add connection limits (-M), POSTDATA read timeouts, and CGI logging
  * telnet/telnetd: Rewrite to use generic fd polling and I/O loop
  * cut: Major fixes for empty delimiters, ranges, and output-delimiter support
  * cp: Fix 'cp -aT' overwriting symlink to directories
  * fdisk: Fix GPT disk size overflow and add 4K sector size support
  * top: Reduce flicker and show RSS instead of VIRT by default
  * udhcpc6: Fix potential buffer overflow
  * many other small fixes and optimizations
- Remove patches included in the new version:
  * busybox-1.37.0-fix-conditional-for-sha1_process_block64_shaNI.patch
  * busybox-1.37.0-fix-regression-n2.patch
  * busybox-1.37.0-hexdump-add-tests-for-x-handle-little-big-endian-pro.patch
  * busybox-1.37.0-hexdump-fix-regression-for-uint16-on-big-endian-syst.patch
  * busybox-1.37.0-od-make-B-test-little-endian-only-add-variant-for-bi.patch
  * 0001-archival-libarchive-sanitize-filenames-on-output-pre.patch
  * 0001-nsenter-unshare-don-t-use-xvfork_parent_waits_and_ex.patch
  * 0001-tar-strip-unsafe-hardlink-components-GNU-tar-does-th.patch
  * 0002-tar-only-strip-unsafe-components-from-hardlinks-not-.patch
  * 0001-udhcpc6-fix-buffer-overflow.patch
  * 0002-udhcpc6-check-the-size-of-D6_OPT_IAPREFIX-option.patch

==== busybox-links ====
Version update (1.37.0 -> 1.38.0)
Subpackages: busybox-coreutils busybox-grep busybox-gzip busybox-hostname busybox-sed busybox-xz

- Adapt to busybox 1.38, new applets: sha384sum, ssl_server, vmstat,
  lsblk, uuidgen
- Keep passwd in shadow package (it was split in shadow-pw-mgmt in the
  full featured version)

==== checkpolicy ====
Version update (3.10 -> 3.11)

- Update to version 3.11
  https://github.com/SELinuxProject/selinux/releases/tag/3.11
  - User-visible changes:
  - Fixed checkpolicy handling of out-of-range and complement at range boundaries
    for xperm rules (#530, #531).
  - Dropped legacy fscon statement support from checkpolicy - never used in
    SELinux policies for mainline kernels (#518).
  - Development-relevant changes:
  - Reformatted entire tree based on .clang-format and added new
    check-format/format make targets to check and/or reformat code to match.
    This is now a requirement for new patches.
  - Test fixes
  - Notable Bugfixes:
  - checkpolicy: remove unneeded malloc() casts
  - checkpolicy: add missing strdup() failure checks
  - checkpolicy: use calloc() so no need to do memset()
  - checkpolicy: replace malloc()+memset() with calloc()

==== chrony ====
Subpackages: chrony-pool-openSUSE

- boo#1257934: support libnettle 4.0 (chrony-libnettle4.patch).

==== cryptsetup ====
Subpackages: libcryptsetup12

- Fix for (bsc#1270254) to avoid undesired pinning of all volume
  keys (via the thread keyring) through the caller's credentials
  when the kernel opens a file. This is due to the refactoring in
  kernel commit a28d893eb327 ("md: port block device access to file")
  that accidentally causes the caller's thread keyring to be kept
  alive long beyond the caller's lifetime, the kernel part is tracked
  in (bsc#1270252).
  * Add keyring key type. [b6fb6fc0]
  * Load volume keys in intermediary keyring linked in thread
    keyring. [413a3dd0]
  * Use unique intermediary keyring name per device. [04ef07a7]
  * Add regression tests. [bfcb0c38, bb5e8e9f, e6573494, aa214c09]
  * Add upstream patches:
  - cryptsetup-Add-keyring-key-type.patch
  - cryptsetup-Load-volume-keys-in-intermediary-keyring-linked-in-t.patch
  - cryptsetup-Use-unique-intermediary-keyring-name-per-device.patch
  - cryptsetup-tests-revoke-keys-instead-unlinking-from-thread-keyr.patch
  - cryptsetup-tests-verify-VK-and-internal-keyring-cleanup-after-p.patch
  - cryptsetup-tests-refactor-keyring-helpers.patch
  - cryptsetup-tests-verify-intermediary-keyring-cleanup-after-cryp.patch

==== ethtool ====
Version update (7.0 -> 7.1)

- Update to release 7.1
  * Added netlink support for RX CQE Coalescing params
  * netlink: module-eeprom: Add 'hex on pages on' option for
    page-organized hex dump
  * netlink: fec: Add missing newlines in FEC statistics output
  * ethtool: Add man page and bash completion for 'pages on|off'
  * ethtool: Update pause stats struct
  * ethtool: Add --disable-netlink to help output
  * qsfp: add support for newer SFF-8636 compliance codes
  * sfpid: add support for newer SFF-8472 compliance codes
  * sfpid: fix 10G Base-ER module detection
- Delete bf023af442f63e16f1699128c7ce467eddc6d340.patch,
  d35d87fbcda97fe31df79d62277743214641892a.patch (merged)

==== freetype2 ====
Version update (2.14.2 -> 2.14.3)

- update to 2.14.3
- Important bug fixes
  * A bunch of potential security problems have been found. All
    users should update.
- Miscellaneous
  * If configuration option `TT_CONFIG_OPTION_GPOS_KERNING` is
    active, GPOS-based kerning could miss some value pairs (bug
    introduced in version 2.14.0).
- Added patch:
  * freetype-CVE-2026-50811.patch
    + upstream fix for issue #1436, bsc#1271045, CVE-2026-50811:
    out-of-bounds read vulnerabilityin src/truetype/ttgxvar.c in
    the TT_Get_Var_Design implementation used by
    FT_Get_Var_Design_Coordinates

==== grub2 ====
Subpackages: grub2-arm64-efi grub2-common grub2-snapper-plugin

- Fix broken bash completion on arm64 images when the bash-completion package
  is not installed (bsc#1259132)
  * 0001-bash-completion-add-_init_completion-marker.patch

==== gstreamer ====
Version update (1.28.4 -> 1.28.5)
Subpackages: libgstreamer-1_0-0

- Update to version 1.28.5:
  + Highlighted bugfixes:
  - Various security fixes and playback fixes
  - Fix subtitles cause green flickering with VA decoders on AMD
    GPUs
  - core: Fix sticky event raciness when pads are linked mid-push
  - appsrc: Uniformly handle EOS events being pushed
  - audio-resampler-neon fails to build for targets with neon but
    without thumb
  - avtp: Correct ptime generation from avtp timestamp
  - fmp4mux: Various fixes for splitting at fragment boundaries
  - gldownload: fix wrong DRM format negotiation causing R/B
    channel swap
  - gdkpixbufdec: Drop rank to NONE and handle resolution/format
    changes
  - gopbuffer: add support for H.266/VVC
  - h265decoder: Fix HEVC with alpha decoding
  - mp4mux: fix AC-3 template caps so muxer can accept input from
    ac3parse
  - mpegtsmux: Always assign PTS to output buffers in CBR mode
  - mpegtsmux: Output buffers with PCR-only bitrate-padding
    packets have wrong PTS
  - rtcpbuffer: Fix parsing of SR+SDES compound packets
    (regression from security fix)
  - rtspsrc2: Allow disabling SRTP/SRTCP encryption and SRTP
    authentication
  - tsdemux: Improve PTS rollover handling in ignore-pcr mode,
    fixing intermittent corruption with YouTube HLS streams
  - textaccumulate: output joined single buffer, add list as meta
  - threadshare: add ts-clocksync
  - webrtcsink: negotiation fixes and improvements
  - Various bug fixes, build fixes, memory leak fixes, and other
    stability and reliability improvements
  + gstreamer:
  - caps: fix field name leak in gst_caps_structure_simplify
  - info: Use a more optimized version of GST_TIME_ARGS
  - pads: Fix sticky event raciness when linked mid-push
  - typefindhelper: Drop unnecessary check for factories without
    a function
  - Use named pipes when spawning gst-ptp-helper on Windows

==== gstreamer-plugins-bad ====
Version update (1.28.4+24 -> 1.28.5)
Subpackages: libgstphotography-1_0-0 libgstplay-1_0-0

- Update to version 1.28.5:
  + amcviddec: Fix double-free happening when codec gets
    reconfigured
  + avtp: Correct ptime generation from avtp timestamp
  + ccconverter: Use truncated length when converting CEA608 raw to
    CEA708 CDP
  + curlsmtpsink: Use the correct content-type if known
  + d3d12: Fix command list leak
  + dtlsconnection: Allocate large enough buffer for the peer
    certificate subject DN
  + h264parse: Check for enough slice header data being available
  + h2654parse: Unset GValue in every code path
  + h265decoder: Fix HEVC with alpha decoding
  + h266parser: Avoid out-of-bounds read if too many exp slices are
    signalled
  + h266parser: Check bounds before writing to CTU entrypoint
    array
  + h266parser: Check aspect ratio index against lookup table
    length
  + h266parser: Heap-allocate parameter sets before parse to avoid
    stack overflow
  + h266parser: Use long bit skipping function for potentially
    large values
  + mpeg4videoparse: Ensure enough config data is available before
    extracting profile/level
  + mpegpsdemux: Release stream lock when seeking fails
  + mpegtsmux: Always assign PTS to output buffers in CBR mode
  + mpegtsmux: Output buffers with PCR-only bitrate-padding packets
    have wrong PTS
  + mxfdemux: fix essence track offsets array population
  + netsim: Fix racy test failures
  + pcapparse: Add missing bounds checks to ensure packets are
    large enough
  + pnmdec: Avoid overflows when calculating frame sizes
  + qroverlay: Fix use after free bug
  + rfbsrc: Use correct bpp for copying hextile data
  + rfbsrc: Validate framebuffer update rectangles against the
    framebuffer size
  + rtmp2: Don't retry on G_IO_ERROR_TIMED_OUT
  + rtmp2: Remove socket timeout after handshake completes
  + rtpsink: fix mutex not unlocked on invalid URI in set_property
  + tsdemux: YouTube HLS streams have intermittent corruption
  + tsdemux: Improve PTS rollover handling in ignore-pcr mode
  + v4l2decoder: Fix media_fd leak when video_fd open fails
  + va: surfacecopy: get surface's image in gst_va_surface_copy
  + va: VOBSUB: compositing error with VA decoder in NV12
  + va: radeonsi: subtitles cause green flickering
  + va: radeonsi: Subtitles cause green flickering with VA decoders
  + videoparsers: Always clear LCEVC enhancement data when
    resetting frame
  + videoparsers: Leak of LCEVC user data
  + vnmdec: Avoid integer overflows when rectangle positions and
    sizes
  + vp9parser: Check that enough data is available for parsing
    superframe info
  + webrtcbin: validate remote dtls certificates
  + webrtcsdp: Fix inverted fingerprint existence logic

==== gstreamer-plugins-base ====
Version update (1.28.4 -> 1.28.5)
Subpackages: libgstallocators-1_0-0 libgstapp-1_0-0 libgstaudio-1_0-0 libgstgl-1_0-0 libgstpbutils-1_0-0 libgstriff-1_0-0 libgsttag-1_0-0 libgstvideo-1_0-0

- Update to version 1.28.5:
  + appsink: Clear local sample storage when flushing
  + appsrc: Uniformly handle EOS events being pushed
  + audio-resampler-neon fails to build for targets with neon but
    without thumb
  + encoding-target: Validate that encoding profile name is UTF-8
    before using it
  + gldownload: fix wrong DRM format negotiation causing R/B
    channel swap
  + opusdec: Don't use any channel positions for >64 channels
  + rtcpbuffer: Fix parsing of SR+SDES compound packets (regression
    from security fix)
  + subparse: Don't allow very small framerates for microdvd
    subtitles
  + typefind: assorted fixes for the image-rs plugin typefinding
  + typefindhelper: Drop unnecessary check for factories without a
    function
  + WBMP typefinding rejects a valid 1280x800 file
  + typefinding: detect animation on PNG (and WebP, GIF, AVIF)
  + typefindfunctions: remove Sun and Andrew raster format
    typefinders
  + uridecodebin3: deactivate input_item in erroneous ready->paused
    transition
  + vorbistag: Check for enough base64 data before trying to decode
  + xmptag: Don't allocate -1 bytes of memory if there's only a
    single tag
  + xmptag: Handle fractions with 0 denominator as invalid

==== kernel-firmware-amdgpu ====
Version update (20260614 -> 20260629)

- Update to version 20260629 (git commit 3ee099cd4a20):
  * amdgpu: DMCUB updates for various ASICs
  * amdgpu: DMCUB updates for various ASICs

==== kernel-firmware-bluetooth ====
Version update (20260618 -> 20260629)

- Update to version 20260629 (git commit 3ee099cd4a20):
  * QCA: Update Bluetooth QCA6698 firmware to 2.1.2-00072

==== kernel-firmware-i915 ====
Version update (20260610 -> 20260706)

- Update to version 20260706 (git commit 2c35b1ed46f6):
  * xe: Release GuC firmware for NVL-S
- Update aliases from 7.1 / 7.2-rc1

==== kernel-firmware-iwlwifi ====

- Update aliases from 7.1 / 7.2-rc1

==== kernel-firmware-media ====
Version update (20260610 -> 20260706)

- Update to version 20260706 (git commit 2c35b1ed46f6):
  * qcom: vpu: add Gen2 firmware binary for Purwa

==== kernel-firmware-mediatek ====
Version update (20260619 -> 20260629)

- Update to version 20260629 (git commit 3ee099cd4a20):
  * mediatek MT7922: update bluetooth firmware to 20260605203811
  * mediatek MT7925: update bluetooth firmware to 20260605184935
  * linux-firmware: update firmware for MT7925 WiFi device
  * linux-firmware: update firmware for MT7922 WiFi device
- Update aliases

==== kernel-firmware-nvidia ====

- Update aliases from 7.1 / 7.2-rc1

==== kernel-firmware-platform ====
Version update (20260610 -> 20260629)

- Update to version 20260629 (git commit 3ee099cd4a20):
  * linux-firmware: Update AMD SEV firmware
  * nxp: add firmware for IW61x WiFi device
- Update aliases

==== kernel-firmware-qcom ====
Version update (20260619 -> 20260629)

- Update to version 20260629 (git commit 3ee099cd4a20):
  * qcom: add LPAICP firmware for shikra platform
- Update aliases

==== kernel-firmware-realtek ====
Version update (20260614 -> 20260629)

- Update to version 20260629 (git commit 3ee099cd4a20):
  * rtw89: 8852a: add TX power track R34
- Update aliases

==== kernel-firmware-sound ====
Version update (20260618 -> 20260706)

- Update to version 20260706 (git commit 2c35b1ed46f6):
  * cirrus: cs35l56: Update firmware for the ASUS UX5406SA
- Update to version 20260703 (git commit c95059a3774b):
  * cirrus: cs42l45: Update CS42L45 SDCA codec firmware for Dell laptops
  * cirrus: cs35l56: Add firmware for Cirrus Amps for a few Dell laptops
- Update to version 20260629 (git commit 3ee099cd4a20):
  * linux-firmware: qcom: sync audioreach firmwares from v1.0.4 build
  * linux-firmware: Add firmware for new projects
- Update aliases

==== libcamera ====
Version update (0.7.1 -> 0.7.2)
Subpackages: libcamera-base0_7 libcamera0_7

- Update to release 0.7.2
  * Fixes two separate saturation handling bugs in both the SoftISP
    and the Raspberry Pi IPA.
  * On the SoftISP, 12-bit formats are now supported, black level
    correction is 'fixed' and there are interesting performance
    improvements with eGL buffer caching.
  * Within the IPA handling, support for Sony IMX678 was added, as
    well as Omnivision OV08x40 and OV01A10, and moved to a
    proportional AGC algorithm for the simple pipeline handler.
- Delete libcamera-ov02e10-initial-support.patch

==== libdovi ====
Version update (3.3.2 -> 3.4.0)

- Update to 3.4.0:
  * dovi_rpu_add_cmv40_safe_default_metadata: Adds CMv4.0 default
    metadata to an existing CMv2.9 RPU
  * dovi_generate_from_json: Allows generating a list of RPUs from
    JSON
  * dovi_rpu_remove_cmv40_metadata: Allows to completely remove CM
    v4.0 metadata from the RPU
  * dovi/level11: improve byte1 parsing and remove byte2 validation

==== libpsl ====
Version update (0.22.0 -> 0.23.0)

- Update to version 0.23.0:
  * Properly handle leading dot in domains (CVE-2026-8924)
  * Using libidn as runtime now requires explicit configuration
  * Modernize configure.ac
  * Simplify license headers
- Regenerate the built-in PSL and test DAFSA files from the system
  publicsuffix at build time, so they stay in sync with the packaged
  list and test-is-public-all no longer fails on version skew

==== libseccomp ====
Version update (2.6.0 -> 2.6.1)

- Produce unique .src.rpm files per multibuild flavor.
- Update to release 2.6.1
  * Fixed incorrect 64-bit comparison merge that can weaken
    libseccomp filters.
  * Fixed issue where oversized libseccomp filters can trigger a
    double free.
  * Fixed issue where oversized libseccomp filters can trigger a
    heap corruption.
  * Fixed struct aliasing undefined behavior in the internal
    libseccomp hash algorithm.
  * Fixed issue where extraneous bytes were being copied to the
    destination buffer in seccomp_export_bpf_mem().
  * Fix a bug where merged libseccomp filters failed to merge the
    notify_used flag, leading to no listener file descriptor being
    generated.
- 62-sim-arch_transactions-remove-fuzzer.patch: removed upstream
- Fixes in SPEC file.
- Update make-python-build.patch to work with multiple versions
  of Python interpreters.
- Add python-pip-packages.patch, modernize-python-build.patch
- Enable _multibuild back.
- Add support for generating of multiple versions of Python
  subpackages (using %python_subpackage_only).

==== libselinux ====
Version update (3.10 -> 3.11)
Subpackages: libselinux1 selinux-tools

- Update to version 3.11
  https://github.com/SELinuxProject/selinux/releases/tag/3.11
  - User-visible changes:
  - Several security improvements in libselinux
  - Rewrote libselinux selinux_restorecon(3) to eliminate TOCTOU issues in file
    relabeling if /proc is available
  - Fixed libselinux constructor to not clobber errno (#445).
  - Fixed libselinux selabel_partial_match(3) to correctly find partial matches.
  - Fixed libselinux selinux_init_policy_load() to still try to mount selinuxfs on
    /sys/fs/selinux even if the mount of sysfs on /sys fails - this can occur
    legitimately within a user namespace.
  - Improved restorecon related functionality in libselinux
  - Development-relevant changes:
  - Reformatted entire tree based on .clang-format and added new
    check-format/format make targets to check and/or reformat code to match.
    This is now a requirement for new patches.
  - Fixed libselinux build for non-pthread builds.
  - Multiple fixes for musl/llvm-based builds, including adding a new
    EXTRA_LD_FLAGS variable that can be set for libselinux builds to pass
  - -undefined-version through to lld (#511 thru #515).
  - Fixed uclibc build failure (#435).
  - Build shared libraries with -fPIC for LTO.
  - Notable bug fixes:
  - libselinux: avoid out-of-bounds access on zero-length lines
- Packaging changes:
  - Drop patch restorecon-Only-log-error-on-readonly-fs-bsc-1232226.patch
    as it was accepted upstream
  - Rewrite skip_cycles.patch since the code path has been rewritten entirely
    upstream

==== libselinux-bindings ====
Version update (3.10 -> 3.11)

- Update to version 3.11
  https://github.com/SELinuxProject/selinux/releases/tag/3.11
  - Development-relevant changes:
  - Reformatted entire tree based on .clang-format and added new
    check-format/format make targets to check and/or reformat code to match.
    This is now a requirement for new patches.
  - libselinux and python use system Python3 build module
  - Updated pywrap build targets for modern python builds using the Python3 build
    module.
  - Build shared libraries with -fPIC for LTO.
- Packaging changes:
  - Add python-build as BuildRequires
  - Drop python3.6 build in 15.7, as python-build is not available for python3.6
  - Add workaround in Makefile as python multi build does not work
    with the combined dist/ folder from upstream

==== libsemanage ====
Version update (3.10 -> 3.11)
Subpackages: libsemanage-conf libsemanage2

- Update to version 3.11
  https://github.com/SELinuxProject/selinux/releases/tag/3.11
  - Development-relevant changes:
  - Reformatted entire tree based on .clang-format and added new
    check-format/format make targets to check and/or reformat code to match.
    This is now a requirement for new patches.
  - Test fixes
  - Notable bug fixes:
  - libsemanage: guard end of path in semanage_fc_find_meta
  - libsemanage: bunzip: guard against size overflow
  - libsemanage: genhomedircon: fix STR_COMPARATOR() passed to lfind()
  - libsemanage: genhomdircon: handle NULL bsearch() in get_users()
  - libsemanage: fix OOB cleanup in semanage_direct_list()
  - libsemanage: make expand-check a proper boolean option
  - libsemanage: use 'bool' for boolean options
  - libsemanage: Do not use vfork()
  - libsemanage: Do not discard ‘const’ qualifier

==== libsepol ====
Version update (3.10 -> 3.11)

- Update to version 3.11
  https://github.com/SELinuxProject/selinux/releases/tag/3.11
  - User-visible changes:
  - Fixed libsepol generation of constraint expressions with a list of names when
    writing policy.conf from CIL.
  - Fixed libsepol to generate constrain/validatetrans instead of
    mlsconstrain/mlsvalidatetrans when converting a module to CIL unless the
    constraint contains an expression based on level.
  - Fixed libsepol selection of tunableif or booleanif and to skip empty
    conditional blocks when converting a module to CIL.
  - Fixed libsepol/secilc reporting of CIL source file info.
  - Fixed libsepol to require at least one perm in a CIL classperm and to
    correctly count the number of elements in the avtab.
  - Fixed libsepol to link xperm rule permissions correctly.
  - Fixed libsepol off-by-one error in cats_ebitmap_len().
  - Development-relevant changes:
  - Reformatted entire tree based on .clang-format and added new
    check-format/format make targets to check and/or reformat code to match.
    This is now a requirement for new patches.
  - Many hardening fixes spanning the entire tree
  - Notable bug fixes:
  - libsepol: cast to unsigned char in ctype calls
  - libsepol: bound type values in type_set_expand negset loop
  - libsepol/cil: fix double free of borrowed type datum on error path

==== libxml2 ====
Subpackages: libxml2-16 libxml2-tools

- CVE-2026-11979: stack-based buffer overflows in the `xmlcatalog` utility when running in `--shell` mode (bsc#1269790)
  * Add patch libxml2-CVE-2026-11979.patch

==== permissions ====
Version update (1699_20260512 -> 1699_20260707)
Subpackages: permctl permissions-config

- Update to version 1699_20260707:
  * profiles: add cap_perfmon for ksystemstats6 (bsc#1262779)

==== policycoreutils ====
Version update (3.10 -> 3.11)
Subpackages: policycoreutils-python-utils python313-policycoreutils

- Move the sandbox subpackage to the separate selinux-sandbox package (bsc#1270534)
  drop policycoreutils-sandbox-fix-cleanup.patch
- Update to version 3.11
  https://github.com/SELinuxProject/selinux/releases/tag/3.11
  - User-visible changes:
  - Several security improvements in dbus and gui
  - Dropped Python 2 support from audit2why
  - Added `setfiles -A` option to disable SELINUX_RESTORECON_ADD_ASSOC
  - restorecon only logs error on read-only filesystem instead of failing (allows
    relabeling with read-only BTRFS subvolumes)
  - Introduced a new SELINUX_RESTORECON_SKIP_MULTILINK flag to
    selinux_restorecon(3); if set, then selinux_restorecon(3) will refuse to
    relabel files with multiple hard links to prevent mislabeling them. Updated
    restorecond(8) to always pass this flag when relabeling files to prevent
    mislabeling hard links to files owned by others, e.g. when relabeling user
    home directories or /tmp.
  - Fixed semanage audit fd creation to avoid hitting RLIMIT_NOFILE on large
    semanage import operations (#291).
  - Improved semanage-fcontext(8) manpage
  - Fixed dispol and dismod to show all options in the -h text.
  - Development-relevant changes:
  - Reformatted entire tree based on .clang-format and added new
    check-format/format make targets to check and/or reformat code to match.
    This is now a requirement for new patches.
  - Updated pywrap build targets for modern python builds using the Python3 build
    module.
  - Disabled build isolation for sepolicy python module.
  - Fixed build errors with glibc 2.43.
  - Updated pywrap build targets for modern python builds using the Python3 build
    module.
- Packaging changes:
  - Drop sepolicy-build-isolation.patch
    was accepted upstream
  - Drop sandbox-sandbox-fix-saving-file-changes.patch
    was accepted upstream
  - Add python-build as new BuildRequires
  - Rewrite policycoreutils-sandbox-fix-cleanup.patch
    Code was rewritten upstream, dropped the part in seunshare.c
  - Rewrite usr_etc.patch
    Did not apply anymore due to code changes

==== python-rpds-py ====
Version update (0.30.0 -> 2026.6.3)

- Update to 2026.6.3:
  * Update to PyO3 0.28.0
  * Drop support for 3.10. Add 3.15.

==== python-semanage ====
Version update (3.10 -> 3.11)

- Update to version 3.11
  https://github.com/SELinuxProject/selinux/releases/tag/3.11
  - Development-relevant changes:
  - Reformatted entire tree based on .clang-format and added new
    check-format/format make targets to check and/or reformat code to match.
    This is now a requirement for new patches.
  - Fixed libsemanage pywrap target deps for parallel builds.
- Packaging changes:
  - Drop 1266385-libsemanage-Require-LIBSO-before-SWIGSO-and-SWIGRUBY.patch
    was accepted upstream

==== qemu ====
Version update (10.2.2 -> 11.0.2)

- Update to latest stable release (11.0.2)
  Full backport list here:
  https://lore.kernel.org/qemu-devel/20260627082913.181C717AB6B@think4mjt.localdomain/
  Bugs and CVEs fixed:
  - bsc#1268794 (CVE-2026-48914)
  A selection of them is reported here below:
  linux-user: Fix AT_PHDR when program headers are relocated into their own segment
  hw/pci: Replace assert with bounds check and return
  ppc/pnv_phb3: Error out on invalid config access
  linux-user/xtensa: fix unlock of uninitialized frame pointer on sigreturn
  linux-user/xtensa: save/restore FP registers across signal delivery
  target/xtensa: add cpu_set_fcr/fsr helpers to sync fp_status
  target/arm/hvf: Stop pre-allocating cpreg_vmstate arrays
  ui/sdl2: Set GL ES profile before creating initial GL context
  ui/sdl2: Explicitly specify EGL platform
  hw/9pfs: reject . and .. in Twstat rename
  hw/9pfs: fix abort due to illegal name with Twstat rename
  gdbstub: Update x86 control register bits
  target/i386: apply mod to immediate count of an RCL/RCR operation
  hw/uefi: fix parse_hexstr
  target/riscv: mask vxrm csrw write to the low 2 bits
  disas/riscv.c: fix inst_length()
  target/riscv/tcg: disable svnapot if satp_mode < sv39
  target/riscv/cpu_helper.c: add PMA access fault
  target/riscv/cpu_helper.c: fault with reserved PTE.PBMT val
  target/riscv/insn_trans/trans_rvzicbo.c.inc: save opcode before helpers
  disas/riscv.c: add 'cbo' insns to disassembler
  target/riscv/csr.c: fix mstatus.UXL reserved value
  target/riscv/csr.c: do not allow mstatus MPV/GVA writes
  target/riscv/tcg: disable svpbmt if satp_mode < sv39
  target/riscv/cpu_helper.c: allow LOAD_ADDR_MIS promotion to AMO fault
  virtio: Allow to fill a whole virtqueue in order
  amd_iommu: Reject non-decreasing NextLevel in fetch_pte()
  amd_iommu: Follow root pointer before page walk and use 1-based levels
  libvduse: fix buffer overflow in vduse_queue_read_indirect_desc()
  libvhost-user: fix buffer overflow in virtqueue_read_indirect_desc()
  tests/qtest: Add amd-iommu command buffer head wrap test
  amd_iommu: Update command buffer head ptr in MMIO region after wraparound
  amd_iommu: restrict command buffer head/tail ranges to ring size
  linux-user: add preadv2/preadv2
  system/rtc: Fix a possible year-2038 integer overflow problem
  linux-user/strace: add fsmount series of syscalls
  linux-user: implement fsmount(2) series of syscalls
  fpu: Handle all rounding modes in partsN_uncanon_normal
  hw/usb/hcd-ohci: Clean up USBPacket before freeing ISO TD packet
  qed: Don't try to flush during incoming migration
  iotests: test shared mmap for fuse export
  block/export/fuse: set FUSE_DIRECT_IO_ALLOW_MMAP flag to fix regression
  block/export/fuse: use struct fuse_init_in
  qcow2: Fix data loss on zero write with detect-zeroes=unmap
  iotests/046: Test that discard/write_zeroes wait for dependencies
  qcow2: Fix corruption on discard during write with COW
  qemu-io: Add 'aio_discard' command
  virtio-blk: add missing VIRTIO_BLK_T_SCSI_CMD size check (CVE-2026-48914)
  block/io: fallback to bounce buffer if BLKZEROOUT is not supported because of alignment
  hw/i3c: fix CMD/data FIFO depth reset values to match real silicon
  s390x/pci: Fix interrupt forwarding disable for interpreted devices
  target/s390x: Make container ids in SysIB_15x 1-based
  lcitool: remove Cirrus CI support
  gitlab: remove x64-freebsd-14-build Cirrus job
  gitlab: add initial MacOS 15 on gitlab runner
  ci: drop cirrus MacOS build
  tests/unit: add test-envlist covering setenv/unsetenv name matching
  util/envlist: fix prefix-match in envlist_unsetenv() name lookup
  ...
- Fix bsc#1268279, bsc#1268245, bsc#1263098:
  * [openSUSE][RPM] spec: fix post-build-checks failure for qemu-tools (bsc#1263098)
  * [openSUSE][RPM] spec: fix missing unversioned ppc64 cross-compiler binaries (bsc#1268245)
  * ppc/spapr: Skip system reset for quiesced CPUs (bsc#1268279)
- Update to latest stable release (11.0.1)
  Full backport list here:
  https://lore.kernel.org/qemu-devel/20260528061820.CEE521691A9@think4mjt.localdomain/
  A selection of them is reported here below:
  block/graph-lock: fix missed wakeup in bdrv_graph_co_rdunlock()
  commit: Drain nodes across all of bdrv_commit()
  block: Add more defaults to DEFAULT_BLOCK_CONF
  block: Create DEFAULT_BLOCK_CONF macro
  ide-test: Test reset during TRIM
  ide-test: Factor out wait_dma_completion()
  ide: Clean up ide_trim_co_entry() to be idiomatic coroutine code
  ide: Minimal fix for deadlock between TRIM and drain
  block: Add flags parameter to blk_*_pdiscard()
  block: Add blk_co_start/end_request() and BDRV_REQ_NO_QUEUE
  blkdebug: Add 'delay-ns' option
  linux-user/sh4: Fix setup_sigtramp to match Linux kernel trampoline pattern
  linux-user/sh4: Fix target_ucontext tuc_link field type
  linux-user: Fix AT_EXECFN in AUXV for symlinked programs
  hw/nvme: fix admin cq msix setup
  target/arm/hvf: Fix WFI halting to stop idle vCPU spinning
  tests/functional/qemu_test/asset.py: Don't use setxattr when it doesn't exist
  hw/remote/machine.c: Mark x-remote machine as OK for AArch64 and AArch32
  meson.build: Add -fzero-init-padding-bits=all
  tests/qtest/iommu-smmuv3-test: Skip if no TCG GICv3 device present
  ati-vga: fix ati_set_dirty address calculation
  hw/i2c/microbit_i2c: Don't index off end of twi_read_sequence[]
  aspeed/hace: Prevent total_req_len overflow
  aspeed/hace: Fix out-of-bounds read in has_padding()
  hw/misc/aspeed_sbc: Add bounds checking for OTP write operations
  hw/display/cirrus_vga: Fix packed-24 color-expansion transparent copies
    ... changelog too long, skipping 68 lines ...
  * [openSUSE][RPM] spec: enable passt support

==== sdbootutil ====
Version update (1+git20260506.25d47bf -> 1+git20260714.d9bb736)
Subpackages: sdbootutil-dracut-measure-pcr sdbootutil-snapper sdbootutil-tukit

- Update to version 1+git20260714.d9bb736:
  * tukit: do not fail if service is not found
- Update to version 1+git20260713.d869cf8:
  * Ignore errors in the snapper plugin
- Update to version 1+git20260709.7dfd021:
  * Remove the background process in the plugin
  * Fix missing initrd condition (bsc#1270420)
  * After reboot the shutdown service is not active
  * Disable the shutdown service after main service
  * Update uhmac dependencies (rust-openssl)
    bsc#1270192, CVE-2026-41676
    bsc#1270995, CVE-2026-45784
    bsc#1270922, CVE-2026-44662
    bsc#1270863, CVE-2026-41898
    bsc#1270742, CVE-2026-41681
    bsc#1270670, CVE-2026-41678
    bsc#1270616, CVE-2026-41677
    bsc#1270471, CVE-2026-42327
  * Add systemd transient service to update predictions
  * Install extra EFI binaries
- Update to version 1+git20260625.7fa275e:
  * Remove duplicate code and parametrize timers
  * Check boot entry before kernel installation
  * Re-install an old kernel if initrd cannot be reused
  * Skip installation for already installed kernel
  * Add configurable devicetree entry support
  * Set explicit kernel and initrd paths
  * Remove the full tmpdir in the service
  * Fix /run/sdbootutil permissions
  * Execute predictions in the background
  * Add --disable-predictions parameter
  * Fix comparison operator
  * Add print-loader-path command

==== selinux-policy ====
Version update (20260618 -> 20260702)
Subpackages: selinux-policy-targeted

- Update selinux-policy-sandbox description (bsc#1270534)
- Update to version 20260702:
  * Include key_socket in socket_class_set
  * Remove 14 permissive domains
  * ci: Run cockpit-machines tests in PRs
  * Remove the lockdown class from the policy
  * Allow systemd-logind the sys_ptrace capability in the user namespace
  * Allow systemd-sleep the perfmon capability
  * Allow sshd_session_t dyntransition to sftpd_t
  * Allow lttng kernel tracing
  * Allow loadkeys create and use its private tmpfs files
  * Allow journald create and use netlink_tcpdiag_socket
  * Fix typo in the comment of build.conf
  * Allow gpg_pinentry_t to write session dbus socket files
  * Allow systemd-hostnamed read hwdb files
  * Allow systemd-machined to manage nspawn runtime directory
  * Allow pcm-sensor-server the sys_admin capability
  * Allow nut/upsmon read nut_conf_t symlinks
  * Support new sanlock features - using libdm and SG_IO
  * Allow thumb_t mount proc filesystem
  * Allow aide connect to the GDM userdb provider socket
  * Allow postfix_postdrop_t/system_mail_t append to init unix domain stream sockets
  * Allow nfsd_t to create netlink_generic_socket (bsc#1267826)
  * Add anaconda_ioctl_fifo_files_install() and anaconda_write_fifo_files_install()
  * Allow install_t domain transition to insights_client_t
  * Allow staff user mounton /var/lib dirs
  * Allow systemd-coredump signull container runtime
  * Allow blueman get the attributes of a tmpfs filesystem
  * portage_compile_domain: Require xdm_xserver_tmp_t type
  * Add missing interface requirements
  * Dontaudit virt_driver_domain execmem
  * fixed file after comment from zpytela.
  * added caddy related paths.
  * Remove extra parameters from interface headers
  * Update bootupd policy for running lsblk
  * Allow pcscd_t to search cgroup
- Syncing with upstream rawhide selinux-policy up to:
  * 3cf2aa66a844ba5e87fb2a8f04be08c62cf5538a
- Update embedded container-selinux version to commit:
  * 9715eb09108e9fabb0fbaeee9044636b349370eb (v2.250.0)
- Update to version 20260630:
  * Allow snapper_sdbootutil_plugin_t create transient units (bsc#1267377)
  * Allow bootctl access unconfined_t pid (bsc#1267377)
  * Refactor sdbootutil into seperate module (bsc#1267377)
  * Allow pcrlock to send kernel dgram (bsc#1267377)
  * Add tiny sdbootutil module for sdbootutil snapper plugin changes (bsc#1267377)

==== timezone ====
Version update (2026b -> 2026c)

- Update to 2026c:
  * Alberta moved to permanent -06 on 2026-06-18
  * Morocco moves to permanent +00 on 2026-09-20
  * More integer overflow bugs have been fixed in zic

==== wget ====

- Fix buffer underflow in clean_metalink_link
  [bsc#1271033, CVE-2026-58469]
  * CVE-2026-58469.patch
- Fix integer overflow in parse_content_range
  [bsc#1271034, CVE-2026-58470]
  * CVE-2026-58470.patch
- Fix buffer size handling in filename conversion
  [bsc#1271035, CVE-2026-58471]
  * CVE-2026-58471.patch
- Fix integer+buffer overflow in html_quote_string
  [bsc#1271036, CVE-2026-58472]
  * CVE-2026-58472.patch

==== wpa_supplicant ====

- Add Require-network_ctx-and-AKMP-match-for-accepting-PMK.patch
  https://w1.fi/security/2026-2/
- Add SAE-Fix-crash-due-to-NULL-pointer-dereference-in-H2E.patch
  https://w1.fi/security/2026-3/
- Add CVE-2026-58374.patch: Missing multi-link parsing validation in
  wpa_supplicant and hostapd (bsc#1269892)
- Add wpa_supplicant_support_pem_encoded_chain.patch: OpenSSL:
  Support PEM encoded chain from ca_cert blob (bsc#1258365).

==== xrdb ====
Version update (1.2.2 -> 1.2.3)

- Update to bugfix release 1.2.3
- switch to Meson build system

==== xset ====
Version update (1.2.5 -> 1.2.6)

- Update to version 1.2.6:
  * Switch to Meson build system.
  * Add GPG validation for source archives.
  * The new release includes bugfixes.

==== xsetroot ====
Version update (1.1.3 -> 1.1.4)

- Update to version 1.1.4
  * -help should exit(0) not (1)
  * Accept --help & --version as aliases to -help & -version
  * Improve man page formatting
  * man page: fix warnings from `mandoc -T lint`
  * gitlab CI: drop the ci-fairy check-mr job
  * Strip trailing whitespace from source files
  * meson: Add option to build with meson
- Switch to Meson build system