Packages changed:
  7zip (26.03 -> 26.04)
  GraphicsMagick (1.3.48 -> 1.3.49)
  MozillaFirefox (157.0.1 -> 158.0)
  adobe-sourcecodepro-fonts (2.038 -> 2.042)
  cups (2.4.19 -> 2.4.20)
  erofs-utils (1.9.3 -> 1.9.4)
  gcin (2.9.0 -> 2.9.4)
  gedit (50.0 -> 51.0)
  git
  graphviz
  gstreamer-plugins-bad
  kscreenlocker6
  ldacBT (2.0.2.5 -> 2.0.2.6)
  lerc (4.1.0 -> 4.2.0)
  libaom (3.13.1 -> 3.15.2)
  libconfig (1.8.1 -> 1.8.2)
  libgedit-amtk (5.10.0 -> 5.11.0)
  libgedit-gfls (0.4.2 -> 0.5.0)
  libgedit-gtksourceview (299.7.1 -> 299.8.0)
  libgedit-tepl (6.14.0 -> 6.15.0)
  libpaper (2.2.8 -> 2.3.0)
  libzip (1.11.4 -> 1.12.1)
  live555 (2026.10.13 -> 2026.10.17)
  memtest86+ (8.10 -> 9.00)
  mjpegtools
  mozilla-nss (3.129 -> 3.130)
  netpbm (11.14.0 -> 11.16.1)
  ntfs-3g_ntfsprogs (2026.7.7 -> 2026.9.28)
  openSUSE-release (20261018 -> 20261020)
  os-prober (1.81 -> 1.85)
  polkit (127 -> 128)
  sdbootutil (1+git20260929.26b6989 -> 1+git20261007.53bc127)
  selinux-policy (20261014 -> 20261019)
  systemd (261.3 -> 261.4)
  upower (1.91.4 -> 1.91.5)
  vlc

=== Details ===

==== 7zip ====
Version update (26.03 -> 26.04)

- Update to 26.04:
  * Some bugs and vulnerabilities were fixed (no details published upstream).

==== GraphicsMagick ====
Version update (1.3.48 -> 1.3.49)
Subpackages: libGraphicsMagick++-Q16-12 libGraphicsMagick-Q16-3 libGraphicsMagick3-config

- Update to version 1.3.49 (security and bugfix release):
  * CVE-2026-109964: heap buffer underwrite in the PICT decoder
    via crafted files on 32-bit builds (boo#1285424)
  * CVE-2026-42326: heap buffer over-read in IPTC attribute
    handling via malicious input (boo#1268092)
  * Drop patches adopted upstream in this release:
    GraphicsMagick-CVE-2025-55154.patch,
    GraphicsMagick-CVE-2026-56379.patch,
    GraphicsMagick-CVE-2026-61464.patch,
    GraphicsMagick-CVE-2026-103118.patch
  * PICT arithmetic-overflow checks, MAT NULL-image guard, TIFF
    adjoin double-free fix (Debian#1146076), X11 NULL ximage
    guard, WPG NULL ps_data guard, PNG writer image-type support,
    LevelImage() 'black/white/mid' parsing, posix_fallocate()
    pixel cache
  * Spec cleanup: drop Group tags, use pkgconfig(libwmf) provider
  * CVE-2026-46559 (boo#1268121) is not affected: JP2 support is
    not built (--without-jp2)
  * CVE-2026-46692 (boo#1268120) is not affected: no
    distribute-cache feature exists in GraphicsMagick
  * CVE-2026-46557 (boo#1268123) is not affected: no fx operation
    exists in GraphicsMagick
  * CVE-2026-46521 (boo#1268124) is not affected: the MIFF coder
    has no LZMA path
  * CVE-2026-53465 (boo#1268100) is not affected: no SF3 encoder
    exists in GraphicsMagick (only SFW)

==== MozillaFirefox ====
Version update (157.0.1 -> 158.0)
Subpackages: MozillaFirefox-branding-upstream MozillaFirefox-translations-common

- Mozilla Firefox 158.0
  * https://www.firefox.com/en-US/firefox/158.0/releasenotes/
  MFSA 2026-106 (bsc#1284493)
  * CVE-2026-109704 (bmo#2037979)
    Privilege escalation in the Application Update component
  * CVE-2026-109705 (bmo#2040905)
    Sandbox escape, site isolation issue due to incorrect boundary
    conditions, use-after-free in the Networking component
  * CVE-2026-109706 (bmo#2053649)
    Use-after-free in the Storage: IndexedDB component
  * CVE-2026-109707 (bmo#2059150)
    Sandbox escape due to use-after-free in the Networking component
  * CVE-2026-109708 (bmo#2059151)
    Sandbox escape due to incorrect boundary conditions in the
    Networking component
  * CVE-2026-109709 (bmo#2067976)
    Information disclosure, privilege escalation in the Security:
    Process Sandboxing component
  * CVE-2026-109710 (bmo#2068338)
    Use-after-free in the Graphics: Text component
  * CVE-2026-109711 (bmo#2068344)
    Use-after-free in the Graphics: Canvas2D component
  * CVE-2026-109712 (bmo#2068420)
    Sandbox escape due to uninitialized memory in the Graphics
    component
  * CVE-2026-109713 (bmo#2068421)
    Use-after-free in the Crash Reporting component
  * CVE-2026-109714 (bmo#2069765)
    Incorrect boundary conditions in the Layout component
  * CVE-2026-109715 (bmo#2073267)
    Incorrect boundary conditions in the JavaScript Engine component
  * CVE-2026-109716 (bmo#2073269)
    Incorrect boundary conditions in the JavaScript Engine component
  * CVE-2026-109717 (bmo#2073647)
    Use-after-free in the DOM: Bindings (WebIDL) component
  * CVE-2026-109718 (bmo#2073692)
    Use-after-free in the XML component
  * CVE-2026-109719 (bmo#2073969)
    Race condition, use-after-free in the Graphics: CanvasWebGL
    component
  * CVE-2026-109720 (bmo#2074160)
    JIT miscompilation in the JavaScript: WebAssembly component
  * CVE-2026-109721 (bmo#2074161)
    Incorrect boundary conditions in the JavaScript Engine: JIT
    component
  * CVE-2026-109722 (bmo#2074164)
    JIT miscompilation in the JavaScript Engine: JIT component
  * CVE-2026-109723 (bmo#2074171)
    Integer overflow in the Layout: Text and Fonts component
  * CVE-2026-109724 (bmo#2074193)
    Use-after-free in the DOM: Core & HTML component
  * CVE-2026-109725 (bmo#2074208)
    Use-after-free in the DOM: Core & HTML component
  * CVE-2026-109726 (bmo#2074212)
    Use-after-free in the SVG component
  * CVE-2026-109727 (bmo#2074213)
    Use-after-free in the Audio/Video component
  * CVE-2026-109728 (bmo#2074625)
    Use-after-free in the DOM: Animation component
  * CVE-2026-109729 (bmo#2074632)
    Use-after-free in the JavaScript Engine: JIT component
  * CVE-2026-109730 (bmo#2074896)
    Integer overflow in the Graphics component
  * CVE-2026-109731 (bmo#2075436)
    Incorrect boundary conditions in the Graphics: Canvas2D
    component
  * CVE-2026-109732 (bmo#2075998)
    Use-after-free in the DOM: Streams component
  * CVE-2026-109733 (bmo#2076269)
    JIT miscompilation in the JavaScript Engine: JIT component
  * CVE-2026-109734 (bmo#1926318)
    Mitigation bypass in the DOM: Security component
  * CVE-2026-109735 (bmo#2028727)
    Use-after-free in the DOM: Animation component
  * CVE-2026-109736 (bmo#2029784)
    Frame poisoning in the Layout component
  * CVE-2026-109737 (bmo#2044525)
    Mitigation bypass in the Enterprise Policies component
  * CVE-2026-109738 (bmo#2047722)
    Use-after-free in the Audio/Video: Playback component
  * CVE-2026-109739 (bmo#2049069)
    Privilege escalation in the WebExtensions component
  * CVE-2026-109740 (bmo#2057113)
    Sandbox escape due to incorrect boundary conditions in the
    Widget: Win32 component
  * CVE-2026-109741 (bmo#2058651)
    Use-after-free in the Storage: Bucket File System component
  * CVE-2026-109742 (bmo#2058800)
    Information disclosure in the PDF Viewer component
  * CVE-2026-109743 (bmo#2059195)
    Privilege escalation in the Panning and Zooming component
  * CVE-2026-109744 (bmo#2059211)
    Other issue in the DOM: File component
  * CVE-2026-109745 (bmo#2061784)
    Sandbox escape due to uninitialized memory in the DOM: Web
    Serial component
  * CVE-2026-109746 (bmo#2063005)
    Mitigation bypass in the DOM: Security component
  * CVE-2026-109747 (bmo#2065402)
    ... changelog too long, skipping 70 lines ...
- rebased patches

==== adobe-sourcecodepro-fonts ====
Version update (2.038 -> 2.042)

- Update to version 2.042 (uprights) / 1.062 (italics) / 1.026 (variable):
  * Re-compiled so static instances correspond to the Variable Font versions
- Drop obsolete Group and BuildRoot tags

==== cups ====
Version update (2.4.19 -> 2.4.20)
Subpackages: cups-client cups-config libcups2 libcupsimage2

- fix_mailto_validation.patch is
  "Fix: mailto notifier rejects valid email addresses
  containing dots"
  https://github.com/OpenPrinting/cups/pull/1745
  "Regression: mailto notifier rejects valid email addresses
  containing dots/periods"
  https://github.com/OpenPrinting/cups/issues/1744
- Version upgrade to 2.4.20:
  See https://github.com/openprinting/cups/releases
  CUPS 2.4.20 provides amount of bug fixes and security fixes:
  Assigned CVE ids:
  CVE-2025-55480 (bsc#1284277)
  CVE-2026-61702 (bsc#1284278)
  CVE-2026-87875 (bsc#1279945)
  CVE-2026-87876 (bsc#1279944)
  CVE-2026-55453 (bsc#1284275)
  CVE-2026-55467 (bsc#1284276)
  CVE-2026-105326 (bsc#1284274)
  Several fixes use GHSA id of security advisory
  due long waiting time for CVE ids from CNA.
  Due our changed policy the fixes referencing GHSA id are for:
  * vulnerabilities with CVSS < 7.0, which we take
    as lower priority vulnerabilities,
  * issues which require print admin rights for triggering them,
  * issues where its fix is security hardening patch/feature.
  Per our security policy, issues which require print admin rights,
  or are security hardening patches, are not taken as vulnerability
  and they reference a security advisory due convenience, see
  https://github.com/OpenPrinting/cups?tab=security-ov-file
  More details in CHANGES.md - excerpts:
  * SECURITY-5.7: The scheduler did not open temporary PPD files
    in exclusive mode (CVE-2026-55480)
  * SECURITY-5.5: The scheduler did not remove all job status
    attributes from a job creation request (GHSA-7j85-5r23-xhvh)
  * SECURITY-5.3: The scheduler did not validate the request
    language value (CVE-2026-61702)
  * SECURITY-4.6: Attribute names were not validated
    as proper keyword values (GHSA-w9hj-hq9p-m7f6)
  * SECURITY-4.3: The `cupsUTF32toUTF8` function incorrectly
    treated UTF-32 values as 64-bit (CVE-2026-87875)
  * SECURITY-4.1: Held jobs for temporary print queues could
    crash the scheduler (GHSA-qqm8-4q5h-jg55)
  * SECURITY-3.3: The backend did not sanitize IPP attribute
    strings (CVE-2026-55453)
  * SECURITY-3.3: The scheduler did not filter out group separators
    from job submissions (GHSA-wjc4-qhjr-5m5x)
  * SECURITY-3.0: Quota and policy operations did not treat
    usernames as case-sensitive (CVE-2026-87876)
  * SECURITY-3.0: The scheduler's startup permission checks
    were vulnerable to TOU attacks (GHSA-gj33-wxpv-6fgg)
  * SECURITY-2.5: The scheduler did not sanitize
    fax numbers (CVE-2026-55467)
  * SECURITY-2.5: The 'mailto' notifier did not sanitize
    the recipient address provided to the sendmail
    command (CVE-2026-105326)
  * SECURITY-2.3: The scheduler could crash when modifying
    a class (GHSA-pwg4-pv39-8c22)
  * Fixed handling of multiple PPD: keywords from filters
    (Issue #1562, related to CVE-2026-34980)
  Issues are those at https://github.com/OpenPrinting/cups/issues
- Adapted downgrade-autoconf-requirement.patch for CUPS 2.4.20
- cups-2.4.19-CVE-2026-87875.patch
  is no longer needed because the issue is fixed upstream.
- avoid_C99_loop_initial_declarations.patch avoids
  "ppd-cache.c:2173:5: error: 'for' loop initial declarations
  are only allowed in C99 mode"
  which happens when building CUPS 2.4.20 on older SLE12
  https://github.com/OpenPrinting/cups/issues/1742

==== erofs-utils ====
Version update (1.9.3 -> 1.9.4)

- Update to release 1.9.4
  * Fixed an uninitialized mutex in mkfs

==== gcin ====
Version update (2.9.0 -> 2.9.4)
Subpackages: gcin-gtk2 gcin-gtk3 gcin-qt5 libgcin-im-client1

- Update to version 2.9.4:
  * Improved automatic word selection in phonetic input and cursor
    placement after phrase selection
  * Ubuntu 24.04 and desktop indicator support
  * Fix a crash from garbled text when mistyping English input
- Fix row-width mismatch with get_en_miss_cand() (fatal with gcc14
  and later): gcin-en-miss-cand-fix.patch
- Drop the new Wayland custom-surface block in win0.cpp, it uses
  GDK APIs no longer present and its substance is commented out:
  gcin-drop-wayland-block.patch
- Fix heap overflow building the en-american table on aarch64
  (length bytes must be read as signed char): tsa2d32-sign-fix.patch
- Drop Group tags; fetch the tarball over https and use
  pkgconfig-style BuildRequires with canonical build macros

==== gedit ====
Version update (50.0 -> 51.0)
Subpackages: gedit-lang

- Update to version 51.0:
  * Updated translations.
- Update version dependencies according to meson.build.
- Update to version 51.alpha1:
  * News in 51.alpha1:
    + Copy the plugins from the gedit-plugins repository: Word Completion,
    Smart Spaces, Draw Spaces and Bookmarks. The gedit-plugins repository
    will be archived.
    + Guidelines: no LLM AI tools.
    + Replace git submodule of libgd by a simple copy of the needed sources.
    + Adapt the code after libgedit API changes.
    + MacOS: small build simplification.
    + Don't annotate get_type() functions with G_GNUC_CONST.
    + Small improvements here and there.
  * Updated translations.
- Provide/Obsolete the merged plugin packages: gedit-plugin-bookmarks,
  gedit-plugin-drawspaces, gedit-plugin-smartspaces, and
  gedit-plugin-wordcompletion.

==== git ====
Subpackages: git-core git-email git-gui git-svn git-web gitk perl-Git

- Add zsh BuildRequires: Needed due to zsh-completion dirs.

==== graphviz ====
Subpackages: libcdt6 libcgraph10 libgvc7 libpathplan4 libxdot5

- remove weirdly named nmame directory

==== gstreamer-plugins-bad ====
Subpackages: gstreamer-plugins-bad-lang libgstadaptivedemux-1_0-0 libgstanalytics-1_0-0 libgstbadaudio-1_0-0 libgstbasecamerabinsrc-1_0-0 libgstcodecparsers-1_0-0 libgstcodecs-1_0-0 libgstcuda-1_0-0 libgsthip-1_0-0 libgstinsertbin-1_0-0 libgstisoff-1_0-0 libgstmpegts-1_0-0 libgstmse-1_0-0 libgstphotography-1_0-0 libgstplay-1_0-0 libgstsctp-1_0-0 libgsturidownloader-1_0-0 libgstva-1_0-0 libgstvulkan-1_0-0 libgstwayland-1_0-0 libgstwebrtc-1_0-0 libgstwebrtcnice-1_0-0

- Drop pkgconfig(webrtc-audio-coding-1) BuildRequires: Not needed
  nor used since 1.26.0.
- Replace pkgconfig(webrtc-audio-processing-1) with
  pkgconfig(webrtc-audio-processing-2) BuildRequires: Use current
  upstream preferd version of webrtc-audio-processing.

==== kscreenlocker6 ====
Subpackages: kscreenlocker6-imports kscreenlocker6-lang libKScreenLocker6

- Update to respun 6.8.0 tarball that may avoid some authentication
  issues:
  * greeter: do not defer locked check to authenticator objects
  * worker: drop time check (kde#526194)

==== ldacBT ====
Version update (2.0.2.5 -> 2.0.2.6)

- Update to 2.0.2.6: no functional changes, upstream only
  re-shipped the bundled libldac tarball in the release
- Spec cleanup via spec-cleaner

==== lerc ====
Version update (4.1.0 -> 4.2.0)

- Update to version 4.2.0
  * Enforce size limits: input data and compressed blob limited to
    2 GB per band and 4 GB over all bands; oversized dimensions now
    report a new DimensionsTooLarge error instead of risking
    integer overflows from bogus blob headers
  * Coverity fixes and overflow checks
  * 4.1.1: fixed two security issues and minor bugs (no CVE IDs
    assigned upstream)
- Refresh pylerc-use-syslib.patch for the 4.2.0 sources
- Drop Group tag (spec-cleaner run)

==== libaom ====
Version update (3.13.1 -> 3.15.2)

- Update to version 3.15.2 (ABI compatible, soname unchanged):
  * 3.14.0: layered-image compression/quality gains, external rate
    control API (experimental), new tuning modes and codec controls.
  * 3.15.0: force-max-q option, low-complexity VOD decode mode,
    IntraBC RTC improvements, VMAF/PSNR and speed work.
  * 3.15.1/3.15.2: encoder bug fixes.
  * Security fixes:
  - CVE-2026-56208: heap-buffer-overflow in AV1 encoder LAP mode
    (boo#1268650)
  - CVE-2026-56209: bounds-check bypass in AV1E_SET_SVC_LAYER_ID
    (boo#1268651)
  - CVE-2026-56210: OOB heap read via unchecked SVC layer_id
    (boo#1268653)
  - CVE-2026-56211: out-of-range SVC layer selection
    (boo#1268655)
  - CVE-2026-13906: heap OOB read in
    av1_int_pro_motion_estimation
- Drop libaom-0001-Do-not-disable-_FORTIFY_SOURCE.patch:
  upstream no longer forces _FORTIFY_SOURCE=0.
- Rebase system-gtest.patch, libaom-cmake.patch to restructured
  cmake/ tree.
- Modernize spec file (drop Group tags).

==== libconfig ====
Version update (1.8.1 -> 1.8.2)

- Update to release 1.8.2
  * Minor documentation updates

==== libgedit-amtk ====
Version update (5.10.0 -> 5.11.0)
Subpackages: libgedit-amtk-5-0 libgedit-amtk-5-lang typelib-1_0-Amtk-5

- Update to version 5.11.0:
  * Factory: add create_model_button*() functions for creating
    GtkModelButton's.
  * Test-headerbar:
    + Demo for creating a GtkPopoverMenu with GtkModelButton's, and comment out
    the GMenuModel creation (GtkPopoverMenu is more flexible).
    + Demo of iconic buttons with tooltips, linked horizontally and placed in
    the GtkPopoverMenu.
  * Don't annotate get_type() functions with G_GNUC_CONST.
  * Updated translations.
- Update version dependencies according to meson.build.

==== libgedit-gfls ====
Version update (0.4.2 -> 0.5.0)
Subpackages: libgedit-gfls-1-0 libgedit-gfls-lang

- Update to version 0.5.0:
  * Updated translations.
- Update to version 0.5.alpha2:
  * News in 0.5.alpha2, 2026-10-07:
    + New class: GflsEncodingConverter.
    + New class: GflsUtf8AutoConverter (work-in-progress).
    + GflsValidatedString: make it a GObject class.
    + Change gfls_encoding_convert() API.
    + Remove GflsBytesRegion (no longer used).
    + Reference manual:
    + Write an introduction and a file loading overview.
    + Regroup related classes together in chapters.
  * News in 0.5.alpha, 2026-08-12:
    + New features: GflsByteArray, GflsValidatedString,
    GflsValidatedStringBuilder, GflsValidatedStringChunk, UTF-8 validation,
    and some utils functions.
    + Encoding conversion: more docs and more tests.
    + GflsEncoding: class copied and adapted from libgedit-gtksourceview.
    + Don't annotate get_type() functions with G_GNUC_CONST.
  * Updated translations.

==== libgedit-gtksourceview ====
Version update (299.7.1 -> 299.8.0)
Subpackages: libgedit-gtksourceview-lang typelib-1_0-GtkSource-300

- Update to version 299.8.0:
  * Updated translations.
- Update version dependencies according to meson.build.
- Update to version 299.8.alpha:
  * News in 299.8.alpha, 2026-08-22:
    + GtkSourceFileLoader: code refactorings.
    + Words completion provider: code refactorings.
    + Use GflsEncoding, remove GtkSourceEncoding.
    + Don't annotate get_type() functions with G_GNUC_CONST.
- Update version dependencies according to meson.build.

==== libgedit-tepl ====
Version update (6.14.0 -> 6.15.0)
Subpackages: libgedit-tepl-6-lang typelib-1_0-Tepl-6

- Update to version 6.15.0:
  * TeplCodeCommentView: fine tune the behavior.
  * Don't annotate get_type() functions with G_GNUC_CONST.
  * Updated translations.
- Update version dependencies according to meson.build.
- Update version dependencies according to meson.build.

==== libpaper ====
Version update (2.2.8 -> 2.3.0)
Subpackages: libpaper-tools libpaper2

- Update to 2.3.0:
  * Remove the previously-deprecated paperconf(1) utility.
  * Remove /etc/papersize and $XDG_CONFIG_HOME/papersize configuration;
    use the PAPERSIZE environment variable instead.
- Run upstream test suite during build.

==== libzip ====
Version update (1.11.4 -> 1.12.1)

- update to 1.12.1:
  * Protect against denial of service attack
  (GHSA-m3wq-j48p-jxwh, actually fixed in 1.12)
  * Fix compile issues.
  * Fix adding and replacing files in torrentzip archives
  * Fix error handling in zip_source_filep_create()
- update to 1.12:
  * Keep order of local extra fields, even if an identical extra
    field is present in the central directory
  * Add zip_source_at_eof() and ZIP_SOURCE_AT_EOF
  * Consistently report CRC and decryption errors when reading
    exactly to end-of-file.
  * Remove Mbed TLS support - the required functions were made
    private
  * Securely clear passwords and key material before freeing it
  * Use SipHash hash function with per-table random keys. This
    prevents hash flooding attacks
  * Add compile time option to limit LZMA window size
  * Add more comprehensive fuzzers for metadata and write code
    paths
  * Fix zip_source_is_seekable()
  * Fix setting incorrect WinZIP AES version in some cases
  * Further improvements to overall stability and other minor
    adjustments have been made

==== live555 ====
Version update (2026.10.13 -> 2026.10.17)
Subpackages: libBasicUsageEnvironment2 libUsageEnvironment3 libgroupsock33 libliveMedia120

- Update to version 2026.10.17:
  * Matroska: guard the AAC codec-private config string allocation
    against oversized values (boo#1254419, CVE-2025-65406).
  * BasicTaskScheduler: honor FD_SETSIZE in the select loop instead
    of a hardcoded descriptor limit.
  * Spec cleanup: drop obsolete Group tags, use %make_build.

==== memtest86+ ====
Version update (8.10 -> 9.00)
Subpackages: memtest86+-bls memtest86+-grub2

- Update to 9.00
  - Support AArch64 (ARM64), tested on Snapdragon X and RPi 4/5
  - Save report to USB drive (FAT32 formatted only)
  - Redesigned test suite: 128/256-bit SIMD tests (SSE2/AVX2/NEON/LASX)
  - New bus stress test and RowHammer test (test 11, off by default)
  - Improved bit fade test, corrupted SPD detection test
  - RAM info from DMI when SPD is unavailable, 100+ new DRAM brands
  - Machine-parseable serial log, better serial automation
  - EFI images signed with the Memtest86+ Secure Boot key
- Enable aarch64 builds (new build/aarch64 dir upstream)

==== mjpegtools ====
Subpackages: liblavfile-2_2-0 liblavjpeg-2_2-0 liblavplay-2_2-0 liblavrec-2_2-0 libmjpegutils-2_2-0 libmpeg2encpp-2_2-0 libmplex2-2_2-0

- Stop building support for Quicktime playback/recording: Drop
  pkgconfig(libquicktime) BuildRequires.
- Modernizse spec: Use ldconfig_scriptlets, drop obsolete Group tag

==== mozilla-nss ====
Version update (3.129 -> 3.130)
Subpackages: libfreebl3 libsoftokn3 mozilla-nss-certs mozilla-nss-tools

- update to NSS 3.130
  * bmo#2072042 - selfserv: drain connections before closing
  * bmo#2072396 - reduce core file detection frequency in CI runs
  * bmo#2074429 - applied clang-format on nss
  * bmo#2074515 - Include blapit.h to expose AES_BLOCK_SIZE and SHA_*_LENGTH
  * bmo#2073728 - remove some unused types and functions from lib/pki
  * bmo#2012680 - Testcases for DER_GetInteger error handling
  * bmo#2054712 - Don't accept post-handshake CertificateRequest in DTLS
  * bmo#1951159 - release the decoded certificate when
    CERT_NewTempCertificate fails
  * bmo#2072384 - remove unnecessary certs dependencies in CI graph
  * bmo#2072554 - add missing return in do_key_slot when no internal key slot
  * bmo#2072682 - initialize referenceCount in crlutil's CRL allocations
  * bmo#2072682 - take a reference in cmsutil's CMS decrypt-key callback
  * bmo#2072682 - release-assert softoken session and db reference counts
  * bmo#2072682 - release-assert stan object reference counts
  * bmo#2072682 - release-assert pk11wrap slot, module and symkey
    reference counts
  * bmo#2072682 - release-assert SSL reference counts
  * bmo#2072682 - release-assert CRL and GeneralNameList reference counts
  * bmo#2072682 - free never-live symkeys directly in pk11_getKeyFromList
  * bmo#2072682 - abort on detected key object double frees
  * bmo#2072633 - return CKR_HOST_MEMORY when PORT_NewArena fails in
    jpakesftk.c
  * bmo#2072389 - fix uninitialized SECItem.type in SECKEY_ConvertToPublicKey
  * bmo#2047359 - propagate the PKCS#12 max element length to nested decoders
  * bmo#2068001 - Switch NSS to WIN95 target and remove Windows fiber code
  * bmo#2030245 - Add Windows ARM64 build support to NSS
  * bmo#2019001 - Update policy for mlkem1024 named group and others
  * bmo#2061391 - perform session object removals under slot lock
  * bmo#2028690 - Keep the default input size limit in
    NSS_CMSMessage_CreateFromDER
  * bmo#2028690 - Thread element limits through the QuickDER decoder and
    raise them for CRLs
  * bmo#2028690 - Limit ASN.1 group element count and total streamed input
  * bmo#2028690 - Add SEC_QuickDERDecodeItemWithLimits
  * bmo#2028690 - Place a default size limit on ASN.1 decoder inputs
  * bmo#1951159 - populate NSSCertificate::id at creation
  * bmo#2064306 - avoid VLA in tls_ech_unittest.cc
  * bmo#2070118 - Change the error from decode_error to illegal_parameter
    for the case when update field in Key Update is neither
    update_requested nor update_not_requested
  * bmo#2064311 - Remove HPKE internals from public headers
  * bmo#2064306 - HPKE P-256 and P-384 KEMs
  * bmo#2070669 - NSS release process improvements
  * bmo#2070421 - Set _NSPR_BUILD_ for Windows builds
  * bmo#2064502 - add tsan build for NSS in treeherder
- fix LD_LIBRARY_PATH setting to not include the current wd

==== netpbm ====
Version update (11.14.0 -> 11.16.1)
Subpackages: libnetpbm11

- Update to 11.16.1:
  * 11.16.01: fix jbigtopnm failure on certain multi-image inputs,
    pnmnorm wrong output with huge images and memory corruption with
  - wvalue above maxval, and ppmglobe color-name background specs.
  * 11.16.00: new pamnoise tool; pnmtojbig long options and better
    errors; ppmtoarbtxt '#' substitution class; more precise
    pnmhisteq; many robustness fixes (picttoppm, jbigtopnm, sgitopnm,
    tgatoppm, winicontopam, xpmtoppm, pamtogif, pgmtexture, pjtoppm,
    thinkjettopbm, lispmtopgm, pbmtomda, mdatopbm, mrftopbm).
  * 11.15.00: new pbmtobrush tool; makeman is Python 3 only; fixes
    to pamcut, pbmtopgm, ppmtopict, pnmtoddif and imgtoppm.
  * 11.14.01: fixes to pamcut, pbmtopgm, ppmtopict and pnmtojbig.
- Drop makeman-py3.patch (upstream uses Python 3 now) and
  netpbm-gcc-warnings.patch (upstream silences -Wreturn-type with
  pragmas now); refresh netpbm-security-code.patch for the new
  sources (sgitopnm, imgtoppm and mdatopbm hunks fixed upstream).
- Spec cleanup: drop Group tags, pkgconfig BuildRequires, %make_build.
- Disable pnmhisteq.test on all arches: upstream broke Test 4
  in 11.15 (trailing whitespace after line continuations).

==== ntfs-3g_ntfsprogs ====
Version update (2026.7.7 -> 2026.9.28)
Subpackages: ntfs-3g ntfsprogs

- Update to version 2026.9.28 (including the 2026.9.18 security
  release; CVEs for its fixes are still pending, tracked by boo#):
  * Heap out-of-bounds read/write in ntfs_ie_add_vcn (boo#1281763),
    heap data corruption in ntfs_mapping_pairs_decompress
    (boo#1281762), heap buffer overflows in ntfs_external_attr_find
    (boo#1281761), ntfs_ea_check_wsldev (boo#1281760),
    ntfs_check_restart_area (boo#1281759), ntfs_same_sid
    (boo#1281757) and ntfs_acl_owner (boo#1281756), and
    denial-of-service in ntfs_inode_attach_all_extents (boo#1281758).
  * Guard against multiple creator-owner and creator-group ACEs
    during ACL inheritance; fix stale $MFTMirr data in ntfsresize.
  * Fix MST-fixup return-value regression, ntfslabel options
    starting with '-', and use-after-free/improper realloc cases.
- Drop patches adopted upstream:
  * 1_ntfs-3g_2026.7.7-SA_2026-06-1_05.patch
  * 2_ntfs-3g_2026.7.7-SA_2026-06-1_07.patch
  * 3_ntfs-3g_2026.7.7-SA_2026-06-1_08.patch
  * 4_ntfs-3g_2026.7.7-SA_2026-06-1_10.patch
  * 5_ntfs-3g_2026.7.7-SA_2026-06-1_11.patch
  * 6_ntfs-3g_2026.7.7-SA_2026-06-1_12.patch
  * 7_ntfs-3g_2026.7.7-SA_2026-06-1_19.patch
  * 8_ntfs-3g_2026.7.7-SA_2026-06-1_20.patch
- Soname bump: libntfs-3g.so.90 -> libntfs-3g.so.91.
- Spec cleanup: drop Group tags, use pkgconfig() BuildRequires,
  explicitly require gcc and make.
- Add CVE patch bundle:
  * bsc#1281763: 1_ntfs-3g_2026.7.7-SA_2026-06-1_05.patch
  * bsc#1281762: 2_ntfs-3g_2026.7.7-SA_2026-06-1_07.patch
  * bsc#1281761: 3_ntfs-3g_2026.7.7-SA_2026-06-1_08.patch
  * bsc#1281760: 4_ntfs-3g_2026.7.7-SA_2026-06-1_10.patch
  * bsc#1281759: 5_ntfs-3g_2026.7.7-SA_2026-06-1_11.patch
  * bsc#1281758: 6_ntfs-3g_2026.7.7-SA_2026-06-1_12.patch
  * bsc#1281757: 7_ntfs-3g_2026.7.7-SA_2026-06-1_19.patch
  * bsc#1281756: 8_ntfs-3g_2026.7.7-SA_2026-06-1_20.patch

==== openSUSE-release ====
Version update (20261018 -> 20261020)
Subpackages: openSUSE-release-appliance-custom openSUSE-release-dvd

- automatically generated by openSUSE-release-tools/pkglistgen

==== os-prober ====
Version update (1.81 -> 1.85)

- Update to version 1.85:
  * Detect Windows 12 via refactored version matching in 20microsoft.
  * Make the EFI locale check locale-independent (LC_ALL=C).
  * Install path made usrmerge-compliant; support the noudeb profile.
- All 25 SUSE patches still apply cleanly, no rebasing needed.
- Spec cleanup: drop Group tag, pkgconfig(udev), use %make_build.

==== polkit ====
Version update (127 -> 128)
Subpackages: libpolkit-agent-1-0 libpolkit-gobject-1-0 pkexec typelib-1_0-Polkit-1_0

- Update to version 128 (CVE-2026-4897 and CVE-2026-85498):
  * fix two authentication-helper input vulnerabilities (CVE-2026-4897
    bsc#1260859 and CVE-2026-85498 bsc#1278714).
  * Sanitize values written to syslog from authorization requests
  * Fix a use-after-free in the authentication agent's session handling
  * Revalidate the administrator behind cached auth_admin_keep authorizations
  * Fix agent cleanup races, resource leaks, and several error-path leaks
  * Support systemd watchdog notifications and locked system accounts with
    systemd 257+
  * Improve FreeBSD and Solaris portability, including tests without Linux user
    namespaces
  * Add a polkit-agent-helper manual page and expand contributor documentation
  * Remove the systemd service memory limits introduced in polkit 127
  * Updated translations.
- Update version dependencies according to meson.build.
- Drop patches fixed upstream:
  * 0001-Revert-memory-limits-in-systemd-unit-to-mitigate-mem.patch
  * 0001-CVE-2026-4897-getline-string-overflow.patch

==== sdbootutil ====
Version update (1+git20260929.26b6989 -> 1+git20261007.53bc127)
Subpackages: sdbootutil-bash-completion sdbootutil-dracut-measure-pcr sdbootutil-snapper

- Update to version 1+git20261007.53bc127:
  * doc: add raw-disk-image architecture document

==== selinux-policy ====
Version update (20261014 -> 20261019)
Subpackages: selinux-policy-targeted

- Update to version 20261019:
  * Allow systemd_nsresourced_t setuid/setgid inside a userns (bsc#1285095)
  * broaden ld.so.cache regex to include temporary files (bsc#1270243)

==== systemd ====
Version update (261.3 -> 261.4)
Subpackages: libsystemd0 libsystemd0-32bit libudev1 systemd-32bit systemd-boot systemd-container systemd-lang udev

- Import commit f408418369c8d20f9025b39c03f4ece2a0ee7041 (merge of v261.4)
  This update includes the following fixes:
    a9f077a4f3 seccomp: also refuse sched_setattr() in RestrictRealtime= (bsc#1285434)
    1f8fca2185 nspawn: mask socket() arguments to 32 bits in the NETLINK_AUDIT filter (bsc#1284982)
    b9a6730266 seccomp: mask setns() nstype to 32 bits in RestrictNamespaces= (bsc#1284982)
    f739a5ac5a seccomp: mask socket() domain to 32 bits in RestrictAddressFamilies= (bsc#1284982)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/3255daee1572366b74fe92f002a3d60ecbb27103...f408418369c8d20f9025b39c03f4ece2a0ee7041
  Rebase 0001-Drop-or-soften-some-upstream-warnings.patch

==== upower ====
Version update (1.91.4 -> 1.91.5)
Subpackages: libupower-glib3 typelib-1_0-UpowerGlib-1_0 upower-lang

- Update to 1.91.5:
  * Prefer live sysfs threshold values over hwdb CHARGE_LIMIT
  * Keep keyboard backlight event IO active on ENODATA/EINTR
  * Hide device batteries that report being offline
  * Remove all BlueZ devices when the service vanishes
- Spec cleanup: drop obsolete Group tags, use pkgconfig()
  style BuildRequires

==== vlc ====
Subpackages: libvlc5 libvlccore9 vlc-codec-gstreamer vlc-lang vlc-noX vlc-plugins-desktop vlc-qt

- Add conditional for pkgconfig(vpl) BuildRequires and plugin,
  exclude %{arm} ppc64le %{ppc} s390x.
- Add conditional for pkgconfig(libnfs) BuildRequires and plugin,
  exclude %{arm}