Packages changed:
389-ds (2.0.10~git0.21dd2802c -> 2.0.11~git13.e14935725)
Mesa (21.3.3 -> 21.3.4)
Mesa-drivers (21.3.3 -> 21.3.4)
MozillaFirefox (95.0.2 -> 96.0.1)
apache2
apache2-manual
apache2-prefork
apache2-utils
autoyast2 (4.4.24 -> 4.4.25)
avahi
aws-cli (1.22.28 -> 1.22.35)
btrfsprogs (5.15 -> 5.16)
busybox (1.34.1 -> 1.35.0)
clamav (0.103.4 -> 0.103.5)
cyrus-sasl
ddclient
emacs
fetchmail
firewalld (1.0.2 -> 1.0.3)
flatpak (1.12.2 -> 1.12.3)
frameworkintegration
freerdp (2.4.1 -> 2.5.0)
gdm (41.0 -> 41.3)
ghostscript
gnome-clocks
gnome-desktop (41.2 -> 41.3)
gnome-session (40.1.1 -> 41.3)
gnome-shell (41.2 -> 41.3)
grub2
gupnp (1.4.2 -> 1.4.3)
hdparm (9.62 -> 9.63)
iproute2 (5.15 -> 5.16)
libpipeline (1.5.3 -> 1.5.5)
libqb
libqt5-qtwebengine (5.15.7 -> 5.15.8)
libstorage-ng (4.4.72 -> 4.4.73)
linux-glibc-devel (5.15 -> 5.16)
mtr (0.94 -> 0.95)
mutter (41.2 -> 41.3)
nautilus (41.1 -> 41.2)
ncurses (6.3.20211127 -> 6.3.20220101)
nodejs-common
pam_mount
patterns-base
patterns-network
perl-Bootloader (0.936 -> 0.937)
perl-HTTP-Message (6.35 -> 6.36)
perl-IO-Socket-SSL (2.073 -> 2.074)
poppler (21.12.0 -> 22.01.0)
poppler-qt5 (21.12.0 -> 22.01.0)
pulseaudio
python-aiosmtpd
python-atpublic
python-boto3 (1.20.28 -> 1.20.35)
python-botocore (1.23.28 -> 1.23.35)
python-gtk
python-hiredis (1.1.0 -> 2.0.0)
python-python-lzo (1.12 -> 1.14)
python-tables (3.6.1 -> 3.7.0)
qemu
qpdf (10.4.0 -> 10.5.0)
rdma-core (38.0 -> 38.1)
rubygem-ruby-libvirt
shadow (4.9 -> 4.11.1)
sqlite3 (3.36.0 -> 3.37.1)
sssd
strace (5.15 -> 5.16)
tcsh (6.23.00 -> 6.23.02)
vim (8.2.3995 -> 8.2.4063)
virt-manager
wayland (1.19.0 -> 1.20.0)
xen
yast2 (4.4.34 -> 4.4.36)
yast2-dhcp-server (4.4.1 -> 4.4.2)
yast2-installation (4.4.33 -> 4.4.34)
yast2-packager (4.4.18 -> 4.4.19)
yast2-schema (4.4.7 -> 4.4.8)
yast2-security (4.4.6 -> 4.4.7)
yast2-storage-ng (4.4.31 -> 4.4.32)
=== Details ===
==== 389-ds ====
Version update (2.0.10~git0.21dd2802c -> 2.0.11~git13.e14935725)
Subpackages: lib389 libsvrcore0
- Fix %pre macro in pkg for systemd services
- Remove recommends on supportutils per review
- Remove insecure recommends on md5 sasl auth
- Add missing support utils plugin
- Update to version 2.0.11~git13.e14935725:
* Issue 5080 - BUG - multiple index types not handled in openldap migration (#5094)
* Issue 5079 - BUG - multiple ways to specific primary (#5087)
* Issue 4992 - BUG - slapd.socket container fix (#4993)
* Issue 5037 - in OpenQA changelog trimming can crashes (#5070)
* Issue 4299 - UI LDAP editor - add "edit" and "rename" functionality
* Issue 4962 - Fix various UI bugs - Database and Backups (#5044)
* Issue 5046 - BUG - update concread (#5047)
* Issue 5043 - BUG - Result must be used compiler warning (#5045)
* Issue 4165 - Don't apply RootDN access control restrictions to UNIX connections
* Issue 4931 - RFE: dsidm - add creation of service accounts
* Issue 5024 - BUG - windows ro replica sigsegv (#5027)
* Issue 5020 - BUG - improve clarity of posix win sync logging (#5021)
* Issue 5008 - If a non critical plugin can not be loaded/initialized, bootstrap should succeeds (#5009)
- Resolve boo#1194068 by adding required schema
- Update to version 2.0.11~git0.237913e86:
* Bump version to 2.0.11
* Issue 4962 - Fix various UI bugs - Settings and Monitor (#5016)
* Issue 5014 - UI - Add group creation to LDAP editor
* Issue 5006 - UI - LDAP editor tree not being properly updated
* Issue 5001 - Update CI test for new availableSASLMechs attribute
* Issue 4959 - Invalid /etc/hosts setup can cause isLocalHost to fail.
* Issue 5001 - Fix next round of UI bugs:
* Issue 4962 - Fix various UI bugs - dsctl and ciphers (#5000)
* Issue 4978 - use more portable python command for checking containers
* Issue 4678 - RFE automatique disable of virtual attribute checking (#4918)
* Issue 4972 - gecos with IA5 introduces a compatibility issue with previous (#4981)
* Issue 4978 - make installer robust
* Issue 4976 - Failure in suites/import/import_test.py::test_fast_slow_import
* Issue 4973 - update snmp to use /run/dirsrv for PID file
* Issue 4962 - Fix various UI bugs - Plugins (#4969)
* Issue 4973 - installer changes permissions on /run
* Issue 4092 - systemd-tmpfiles warnings
* Issue 4956 - Automember allows invalid regex, and does not log proper error
* Issue 4731 - Promoting/demoting a replica can crash the server
* Issue 4962 - Fix various UI bugs part 1
* Issue 3584 - Fix PBKDF2_SHA256 hashing in FIPS mode (#4949)
* Issue 4943 - Fix csn generator to limit time skew drift (#4946)
* Issue 2790 - Set db home directory by default
* Bump github contianer shm size to 4 gigs
* Issue 4299 - Merge LDAP editor code into Cockpit UI
* Issue 4938 - max_failure_count can be reached in dscontainer on slow machine with missing debug exception trace
* Issue 4921 - logconv.pl -j: Use of uninitialized value (#4922)
* Issue 4847 - BUG - potential deadlock in replica (#4936)
* Issue 4513 - fix ACI CI tests involving ip/hostname rules
* Issue 4925 - Performance ACI: targetfilter evaluation result can be reused (#4926)
* Issue 4916 - Memory leak in ldap-agent
==== Mesa ====
Version update (21.3.3 -> 21.3.4)
Subpackages: Mesa-dri-devel Mesa-libEGL1 Mesa-libGL1 Mesa-libglapi0 libgbm1
- update to 21.3.4
* bugfix release
==== Mesa-drivers ====
Version update (21.3.3 -> 21.3.4)
Subpackages: Mesa-dri Mesa-gallium Mesa-libva libvdpau_r300 libvdpau_r600 libvdpau_radeonsi libvulkan_radeon
- update to 21.3.4
* bugfix release
==== MozillaFirefox ====
Version update (95.0.2 -> 96.0.1)
Subpackages: MozillaFirefox-translations-common
- Mozilla Firefox 96.0.1
* Fixed: Improvements to make the parsing of content-length
headers more robust (bmo#1749957, boo#1194677)
- Mozilla Firefox 96.0
* https://www.mozilla.org/en-US/firefox/96.0/releasenotes
MFSA 2022-01 (bsc#1194547)
* CVE-2022-22746 (bmo#1735071)
Calling into reportValidity could have lead to fullscreen
window spoof
* CVE-2022-22743 (bmo#1739220)
Browser window spoof using fullscreen mode
* CVE-2022-22742 (bmo#1739923)
Out-of-bounds memory access when inserting text in edit mode
* CVE-2022-22741 (bmo#1740389)
Browser window spoof using fullscreen mode
* CVE-2022-22740 (bmo#1742334)
Use-after-free of ChannelEventQueue::mOwner
* CVE-2022-22738 (bmo#1742382)
Heap-buffer-overflow in blendGaussianBlur
* CVE-2022-22737 (bmo#1745874)
Race condition when playing audio files
* CVE-2021-4140 (bmo#1746720)
Iframe sandbox bypass with XSLT
* CVE-2022-22750 (bmo#1566608)
IPC passing of resource handles could have lead to sandbox
bypass
* CVE-2022-22749 (bmo#1705094)
Lack of URL restrictions when scanning QR codes
* CVE-2022-22748 (bmo#1705211)
Spoofed origin on external protocol launch dialog
* CVE-2022-22745 (bmo#1735856)
Leaking cross-origin URLs through securitypolicyviolation
event
* CVE-2022-22744 (bmo#1737252)
The 'Copy as curl' feature in DevTools did not fully escape
website-controlled data, potentially leading to command
injection
* CVE-2022-22747 (bmo#1735028)
Crash when handling empty pkcs7 sequence
* CVE-2022-22736 (bmo#1742692)
Potential local privilege escalation when loading modules
from the install directory.
* CVE-2022-22739 (bmo#1744158)
Missing throttling on external protocol launch dialog
* CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
Memory safety bugs fixed in Firefox 96 and Firefox ESR 91.5
* CVE-2022-22752 (bmo#1740534, bmo#1741210, bmo#1742770)
Memory safety bugs fixed in Firefox 96
- removed obsolete patches
* mozilla-bmo1745560.patch
* mozilla-bmo1744896.patch
* mozilla-sandbox-fips.patch
- requires
NSPR >= 4.33
NSS >= 3.73.1
==== apache2 ====
- Align some defaults in apache2-server-tuning.conf to upstream
defaults:
* Updated MaxRequestWorkers and ServerLimit to 256. [bsc#1194062]
- The old name MaxRequestsPerChild is changed to MaxConnectionsPerChild.
* See https://httpd.apache.org/docs/2.4/mod/mpm_common.html#maxconnectionsperchild
==== apache2-manual ====
- Align some defaults in apache2-server-tuning.conf to upstream
defaults:
* Updated MaxRequestWorkers and ServerLimit to 256. [bsc#1194062]
- The old name MaxRequestsPerChild is changed to MaxConnectionsPerChild.
* See https://httpd.apache.org/docs/2.4/mod/mpm_common.html#maxconnectionsperchild
==== apache2-prefork ====
- Align some defaults in apache2-server-tuning.conf to upstream
defaults:
* Updated MaxRequestWorkers and ServerLimit to 256. [bsc#1194062]
- The old name MaxRequestsPerChild is changed to MaxConnectionsPerChild.
* See https://httpd.apache.org/docs/2.4/mod/mpm_common.html#maxconnectionsperchild
==== apache2-utils ====
- Align some defaults in apache2-server-tuning.conf to upstream
defaults:
* Updated MaxRequestWorkers and ServerLimit to 256. [bsc#1194062]
- The old name MaxRequestsPerChild is changed to MaxConnectionsPerChild.
* See https://httpd.apache.org/docs/2.4/mod/mpm_common.html#maxconnectionsperchild
==== autoyast2 ====
Version update (4.4.24 -> 4.4.25)
Subpackages: autoyast2-installation
- Properly merge the autoupgrade workflow when using the online
medium (bsc#1192437, bsc#1194440).
- 4.4.25
==== avahi ====
Subpackages: libavahi-client3 libavahi-common3 libavahi-core7
- Move sftp-ssh and ssh services to the doc directory. They allow
a host's up/down status to be easily discovered and should not
be enabled by default (boo#1179060).
==== aws-cli ====
Version update (1.22.28 -> 1.22.35)
- Update to version 1.22.35
+ For detailed changes see
https://github.com/aws/aws-cli/blob/1.22.35/CHANGELOG.rst
- Update Requires in spec file from setup.py
==== btrfsprogs ====
Version update (5.15 -> 5.16)
Subpackages: btrfsprogs-udev-rules libbtrfs0
- Update to 5.16
* rescue: new subcommand clear-uuid-tree to fix failed mount due to bad uuid
subvolume keys, caught by tree-checker
* fi du: skip inaccessible files
* prop: properly resolve to symlink targets
* send, receive: fix crash after parent subvolume lookup errors
* build:
* fix build on 5.12+ kernels due to changes in linux/kernel.h
* fix build on musl with old kernel headers
* other:
* error handling fixes, cleanups, refactoring
* extent tree v2 preparatory work
* lots of RST documentation updates (last release with asciidoc sources),
https://btrfs.readthedocs.io
- Update to 5.15.1
* fi usage: fix wrongly reported space of used or unallocated space
* fix detection of block device discard capability
* check: add more sanity checks for checksum items
* build: make sphinx optional backend for documentation
==== busybox ====
Version update (1.34.1 -> 1.35.0)
Subpackages: busybox-static
- Update to 1.35.0
- Adjust busybox.config for new features in find, date and cpio
- Annotate CVEs already fixed in upstream, but not mentioned in .changes:
* CVE-2017-16544 (bsc#1069412): Insufficient sanitization of filenames when autocompleting
* CVE-2015-9261 (bsc#1102912): huft_build misuses a pointer, causing segfaults
* CVE-2016-2147 (bsc#970663): out of bounds write (heap) due to integer underflow in udhcpc
* CVE-2016-2148 (bsc#970662): heap-based buffer overflow in OPTION_6RD parsing
* CVE-2016-6301 (bsc#991940): NTP server denial of service flaw
* CVE-2017-15873 (bsc#1064976): The get_next_block function in archival/libarchive/decompress_bunzip2.c has an Integer Overflow
* CVE-2017-15874 (bsc#1064978): archival/libarchive/decompress_unlzma.c has an Integer Underflow
* CVE-2019-5747 (bsc#1121428): out of bounds read in udhcp components
* CVE-2021-42373, CVE-2021-42374, CVE-2021-42375, CVE-2021-42376,
CVE-2021-42377, CVE-2021-42378, CVE-2021-42379, CVE-2021-42380,
CVE-2021-42381, CVE-2021-42382, CVE-2021-42383, CVE-2021-42384,
CVE-2021-42385, CVE-2021-42386 (bsc#1192869) : v1.34.0 bugfixes
- CVE-2021-28831 (bsc#1184522): invalid free or segmentation fault via malformed gzip data
- CVE-2018-20679 (bsc#1121426): out of bounds read in udhcp
- CVE-2018-1000517 (bsc#1099260): Heap-based buffer overflow in the retrieve_file_data()
- CVE-2011-5325 (bsc#951562): tar directory traversal
- CVE-2018-1000500 (bsc#1099263): wget: Missing SSL certificate validation
==== clamav ====
Version update (0.103.4 -> 0.103.5)
Subpackages: libclamav9 libfreshclam2
- Update to 0.103.5
* CVE-2022-20698: Fix for invalid pointer read that may cause a crash.
This issue affects 0.104.1, 0.103.4 and prior when ClamAV is compiled
with libjson-c and the CL_SCAN_GENERAL_COLLECT_METADATA scan option
(the clamscan --gen-json option) is enabled.
* Fixed ability to disable the file size limit with libclamav C API,
like this:
cl_engine_set_num(engine, CL_ENGINE_MAX_FILESIZE, 0);
This issue didn't affect ClamD or ClamScan which also can disable the
limit by setting it to zero using MaxFileSize 0 in clamd.conf for ClamD,
or clamscan --max-filesize=0 for ClamScan.
Note: Internally, the max file size is still set to 2 GiB. Disabling the
limit for a scan will fall back on the internal 2 GiB limitation.
* Increased the maximum line length for ClamAV config files from 512 bytes
to 1,024 bytes to allow for longer config option strings.
* SigTool: Fix insufficient buffer size for --list-sigs that caused a
failure when listing a database containing one or more very long
signatures. This fix was backported from 0.104.
==== cyrus-sasl ====
Subpackages: cyrus-sasl-crammd5 cyrus-sasl-digestmd5 cyrus-sasl-gssapi cyrus-sasl-plain libsasl2-3
- postfix: sasl authentication with password fails (bsc#1194265)
Add config parameter --with-dblib=gdbm
- Avoid converting of /etc/sasldb2 by every update. Convert
/etc/sasldb2 only if it is a Berkeley DB
==== ddclient ====
- Modify the systemd service file so ddclient is run After
network-online.target instead of just network.target, since
running ddclient without being online is pointless.
- Added a Wants statement for the same systemd targets as in After
==== emacs ====
Subpackages: emacs-info emacs-nox emacs-x11 etags
- Skip patch boo1180353-6d8144a2.patch for emacs 25.3 as already
part of emacs 27.2: Was fix for boo#1180353 that was a possible
segmentation fault in case of stack overflow of etags
==== fetchmail ====
Subpackages: fetchmailconf
- fix [bsc#1194203]:
* Always create fetchmail group, even if the user is already
present, as a leftover from Leap 15.2 upgrade. This may happen
also if user is messing with groups/users directly or upgrading
from even an older fetchmail versions.
==== firewalld ====
Version update (1.0.2 -> 1.0.3)
Subpackages: firewalld-bash-completion firewalld-zsh-completion python3-firewall
- Update to 1.0.3:
* fix(io): _check_config() expects a dict
* feat(build): distribute an OCI container image
* fix(ipset): reduce cost of entry overlap detection
==== flatpak ====
Version update (1.12.2 -> 1.12.3)
Subpackages: libflatpak0 system-user-flatpak
- Update to 1.12.3:
+ CVE-2021-43860: a malicious repository could have sent invalid
application metadata in a way that hides some of the app
permissions displayed during installation (boo#1194610)
+ flatpak-builder could allow --mirror-screenshots-url commands
to create directories outside of the build directory
(boo#1194611)
+ Extra-data downloading now properly handles compressed
content-encodings which fixes checksum verification
+ Note: In some corner case server setups this may require the
extra-data checksum to be changed
+ Avoid unnecessary policy-kit dialog due to auto-pinning when
installing runtimes
+ Better handling of updates of extensions that exist in multiple
repositories
+ Fixed (initial) installation apps with renamed ids
+ Fixed regression in updates from no-enumerate remotes
+ We now verify checksums of summary caches, to better handle
local file corruption
+ Improved cli output for non-terminal targets
+ Flatpak run --session-bus now works
+ Fix build with PyParsing >= 3.0.4
+ Fixed "Since" annotations on FlatpakTransaction signals
+ bash auto completion now doesn't complete on command name
aliases
+ Minor improvements to the search command
+ Minor improvements to the list command
+ Minor improvements to the repair command
+ Add more tests
+ Updated translations.
- Drop support-new-pyparsing.patch: Fixed upstream.
==== frameworkintegration ====
Subpackages: frameworkintegration-plugin libKF5Style5
- Add upstream change to fix a regression in 5.90.0 (kde#448237)
* 0001-Fix-wrong-porting-of-KNSCore-Engine-configSearchLoca.patch
==== freerdp ====
Version update (2.4.1 -> 2.5.0)
Subpackages: libfreerdp2-2 libwinpr2-2
- Upgraded to freerdp 2.5.0
* Fixed smartcard login in case a redirection occurs the pin was lost
* Backported windows client drawing fixes
* Backported improved macOS keyboard layout detection
* Backported TcpConnectTimeout
* Backported LibreSSL compatibility patches
* Backported signal handler backtrace
* Backported OpenSSL 3.0 support
* Backport #gh:FreeRDP/FreeRDP#7539: Wayland client clipboard issues
* Backport #gh:FreeRDP/FreeRDP#7509: Various fixes regarding registry
emulation, addin loader and updated locale detection
* Backport #gh:FreeRDP/FreeRDP#7466: Android android_register_pointer
missing initialization
==== gdm ====
Version update (41.0 -> 41.3)
Subpackages: gdm-schema gdmflexiserver libgdm1 typelib-1_0-Gdm-1_0
- Update to version 41.3:
+ Juggle Xorg's -listen/-nolisten command line change better.
+ Fix session type selection.
+ Fix crash.
+ Drop vestigial gdm-pin service.
+ XDMCP fixes.
+ Wayland nvidia udev updates.
+ Updated translations.
- Rebase gdm-disable-wayland-on-mgag200-chipsets.patch.
- Drop gdm-daemon-Infer-session-type-from-desktop-file.patch and
gdm-restart-greeter-session-after-crash.patch: fixed upstream.
==== ghostscript ====
Subpackages: ghostscript-x11
- CVE-2021-45949.patch fixes CVE-2021-45949
heap-based buffer overflow in sampled_data_finish
cf. https://github.com/google/oss-fuzz-vulns/blob/main/vulns/ghostscript/OSV-2021-803.yaml
(bsc#1194304)
- CVE-2021-45944 use-after-free in sampled_data_sample
is already fixed in the Ghostscript 9.54.0 upstream sources
(bsc#1194303)
==== gnome-clocks ====
Subpackages: gnome-shell-search-provider-gnome-clocks
- Add appstream-glib, desktop-file-utils BuildRequires and check
section and meson_test macro, run tests during build.
- Modernize our Supplements to current standard.
==== gnome-desktop ====
Version update (41.2 -> 41.3)
Subpackages: gnome-version libgnome-desktop-3-19 libgnome-desktop-3_0-common typelib-1_0-GnomeDesktop-3_0
- Update to version 41.3:
+ No changes, version bump only.
==== gnome-session ====
Version update (40.1.1 -> 41.3)
Subpackages: gnome-session-core gnome-session-default-session gnome-session-wayland
- Update to version 41.3:
+ No changes, just version synching.
- Changes from version 40.8:
+ data: Install GNOME on Wayland session for X11 preferred setups
+ Don't spew as much into log when falling back to non-systemd sessions
+ Work better with certain versions of meson
+ Correct screwed up check for gnome-shell
+ Various cleanups and leak fixes
+ Updated translations.
- Rebase gnome-session-better-handle-empty-xdg_session_type.patch.
- Drop gnome-session-exit-when-lost-name-on-bus.patch: no longer
applicable.
==== gnome-shell ====
Version update (41.2 -> 41.3)
Subpackages: gnome-extensions gnome-shell-calendar
- Update to version 41.3:
+ Improve window tracking
+ Simplify scroll fade shader to work with old hardware
+ Tweak (un)minimize animations
+ Don't wake up screen in DND mode
+ Fix immediately withdrawn notifications getting stuck
+ Honor XDG SingleMainWindow key in .desktop files
+ Fixed crashes
+ Misc. bug fixes and cleanups
+ Updated translations.
- Modernize our Supplements in gnome-shell-calendar sub-package.
==== grub2 ====
Subpackages: grub2-arm64-efi grub2-snapper-plugin grub2-systemd-sleep-plugin
- Power guest secure boot with static keys: GRUB2 signing portion
(jsc#SLE-18271) (bsc#1192764)
* 0001-grub-install-Add-SUSE-signed-image-support-for-power.patch
- Power guest secure boot with static keys: GRUB2 signing portion
(jsc#SLE-18271) (bsc#1192764)
* grub2.spec
- Power guest secure boot with static keys: GRUB2 portion (jsc#SLE-18144)
(bsc#1192686)
* 0001-ieee1275-Drop-HEAP_MAX_ADDR-and-HEAP_MIN_SIZE-consta.patch
* 0002-ieee1275-claim-more-memory.patch
* 0003-ieee1275-request-memory-with-ibm-client-architecture.patch
* 0004-Add-suport-for-signing-grub-with-an-appended-signatu.patch
* 0005-docs-grub-Document-signing-grub-under-UEFI.patch
* 0006-docs-grub-Document-signing-grub-with-an-appended-sig.patch
* 0007-dl-provide-a-fake-grub_dl_set_persistent-for-the-emu.patch
* 0008-pgp-factor-out-rsa_pad.patch
* 0009-crypto-move-storage-for-grub_crypto_pk_-to-crypto.c.patch
* 0010-posix_wrap-tweaks-in-preparation-for-libtasn1.patch
* 0011-libtasn1-import-libtasn1-4.18.0.patch
* 0012-libtasn1-disable-code-not-needed-in-grub.patch
* 0013-libtasn1-changes-for-grub-compatibility.patch
* 0014-libtasn1-compile-into-asn1-module.patch
* 0015-test_asn1-test-module-for-libtasn1.patch
* 0016-grub-install-support-embedding-x509-certificates.patch
* 0017-appended-signatures-import-GNUTLS-s-ASN.1-descriptio.patch
* 0018-appended-signatures-parse-PKCS-7-signedData-and-X.50.patch
* 0019-appended-signatures-support-verifying-appended-signa.patch
* 0020-appended-signatures-verification-tests.patch
* 0021-appended-signatures-documentation.patch
* 0022-ieee1275-enter-lockdown-based-on-ibm-secure-boot.patch
* 0023-x509-allow-Digitial-Signature-plus-other-Key-Usages.patch
- Fix no menuentry is found if hibernation on btrfs RAID1 (bsc#1193090)
* grub2-systemd-sleep-plugin
==== gupnp ====
Version update (1.4.2 -> 1.4.3)
- Update to version 1.4.3:
+ ServiceProxy:
- Properly propagate cancelled actions in deprecated calls.
- Fix deprecated async calls, again.
==== hdparm ====
Version update (9.62 -> 9.63)
- Update to 9.63:
* new --sanitize-overwrite-passes flag, courtesy Michal Grzedzicki.
* "Plurals patch" from Martin Guy.
==== iproute2 ====
Version update (5.15 -> 5.16)
- remove routef from links; it doesn't exist anymore
- update to 5.16:
* devlink: Fix cmd_dev_param_set() to check configuration mode
* ip: add AMT support
* iplink_can: fix configuration ranges in print_usage() and add
unit
* tc: flower: Fix buffer overflow on large labels
* ip/ipnexthop: fix unsigned overflow in parse_nh_group_type_res()
* tc/m_vlan: fix print_vlan() conditional on TCA_VLAN_ACT_PUSH_ETH
* iplink_can: add new CAN FD bittiming parameters:
Transmitter Delay Compensation (TDC)
==== libpipeline ====
Version update (1.5.3 -> 1.5.5)
- Update to 1.5.5:
* Move release process to GitLab CI.
- Back to download from savannah.nongnu.org for a fully bootstrapped
tar ball without the need of autoconfig and gl
Compare https://gitlab.com/cjwatson/libpipeline/-/releases
and https://gitlab.com/cjwatson/libpipeline/-/packages/4425007
- Use autoconf
- update to 1.5.4:
* Building libpipeline now requires Autoconf >= 2.64.
* Developmed moved to Gitlab
==== libqb ====
- Retry if posix_fallocate is interrupted with EINTR (#453) (gh#ClusterLabs/libqb#451, bsc#1193737, bsc#1193912)
* bsc#1193737-0001-Retry-if-posix_fallocate-is-interrupted-with-EINTR-4.patch
==== libqt5-qtwebengine ====
Version update (5.15.7 -> 5.15.8)
- Update to version 5.15.8:
* Update Chromium:
[Backport] CVE-2021-3517: libxml2: Heap-based buffer overflow
in xmlEncodeEntitiesInternal() in entities.c
[Backport] CVE-2021-3541 libxml2: Exponential entity expansion
attack bypasses all existing protection mechanisms
[Backport] CVE-2021-37984 : Heap buffer overflow in PDFium
[Backport] CVE-2021-37987 : Use after free in Network APIs
[Backport] CVE-2021-37989 : Inappropriate implementation in Blink
[Backport] CVE-2021-37992 : Out of bounds read in WebAudio
[Backport] CVE-2021-37993 : Use after free in PDF Accessibility
[Backport] CVE-2021-37996 : Insufficient validation of untrusted
input in Downloads
[Backport] CVE-2021-38001 : Type Confusion in V8
[Backport] CVE-2021-38003 : Inappropriate implementation in V8
[Backport] CVE-2021-38005: Use after free in loader (1/3)
[Backport] CVE-2021-38005: Use after free in loader (2/3)
[Backport] CVE-2021-38005: Use after free in loader (3/3)
[Backport] CVE-2021-38007: Type Confusion in V8
[Backport] CVE-2021-38009: Inappropriate implementation in cache
[Backport] CVE-2021-38010: Inappropriate implementation in serviceworkers
[Backport] CVE-2021-38012: Type Confusion in V8
[Backport] CVE-2021-38015: Inappropriate implementation in input
[Backport] CVE-2021-38017: Insufficient policy enforcement in iframe
sandbox
[Backport] CVE-2021-38018: Inappropriate implementation in navigation
[Backport] CVE-2021-38019: Insufficient policy enforcement in CORS
[Backport] CVE-2021-38021: Inappropriate implementation in referrer
[Backport] CVE-2021-38022: Inappropriate implementation in WebAuthentication
[Backport] CVE-2021-4057: Use after free in file API
[Backport] CVE-2021-4058: Heap buffer overflow in ANGLE (1/2)
[Backport] CVE-2021-4058: Heap buffer overflow in ANGLE (2/2)
[Backport] CVE-2021-4059: Insufficient data validation in loader
[Backport] CVE-2021-4062: Heap buffer overflow in BFCache
[Backport] CVE-2021-4078: Type confusion in V8
[Backport] CVE-2021-4079: Out of bounds write in WebRTC
[Backport] CVE-2021-4098: Insufficient data validation in Mojo
[Backport] CVE-2021-4099: Use after free in Swiftshader
[Backport] CVE-2021-4101: Heap buffer overflow in Swiftshader.
[Backport] CVE-2021-4102: Use after free in V8
[Backport] Dependency for CVE-2021-37989
[Backport] Dependency for CVE-2021-38009
[Backport] Security bug 1245870
[Backport] Security bug 1252858
[Backport] Security bug 1259899
Bump V8_PATCH_LEVEL
Compile with GCC 11 -std=c++20
Fix stack overflow on gpu channel recreate with an error
Use wglSetPixelFormat directly only if in software mode
[Backport] Handle long SIGSTKSZ in glibc > 2.33
[Backport] abseil-cpp: Fixes build with latest glibc
* Handle qtpdf compilation with static runtime
* Add bitcode support for qtpdf on ios
* Do not access accessibility from qt post routines
* Blacklist javascriptClipboard test on ubuntu 20.04
* Re-enable network-service-in-process
* Bump version from 5.15.7 to 5.15.8
* Update patch level
* Fix pinch gesture
* Fix leak of properties after XkbRF_GetNamesProp
* Fix leak on getDefaultScreeenId
- Drop patch:
* 0001-Fix-build-with-glibc-2.34.patch
==== libstorage-ng ====
Version update (4.4.72 -> 4.4.73)
Subpackages: libstorage-ng-lang libstorage-ng-ruby libstorage-ng1
- Translated using Weblate (Indonesian) (bsc#1149754)
- 4.4.73
==== linux-glibc-devel ====
Version update (5.15 -> 5.16)
- Update to kernel headers 5.16
==== mtr ====
Version update (0.94 -> 0.95)
- update to 0.95:
* loads of fixes,
see https://raw.githubusercontent.com/traviscross/mtr/v0.95/NEWS
- mtr-0.75-manmtr.patch, mtr-0.87-manxmtr.patch: refreshed to apply
again
==== mutter ====
Version update (41.2 -> 41.3)
- Update to version 41.3:
+ Check keyboard serials for activation
+ Fix mixed up refresh rates in multi-monitor setups
+ Allow disabling HW cursors
+ Improve damage handling
+ Consider xrandr flags for advertised modes
+ Ensure constraints after client resize
+ window-group: Disable culling when rendinging clone to
offscreen buffer
+ Fix workspace switch animation in default plugin
+ Fix unfullscreening of window that were mapped fullscreen
+ Fix DMA-BUF screencasts with unredirected fullscreen windows
+ Fix orientation changes on devices with 90°
+ Fixed crashes
+ Plugged leaks
+ Misc. bug fixes and cleanups.
- Drop patches fixed upstream:
+ mutter-allow-disable-hardware-cursors.patch
+ mutter-initialize-saved_rect_fullscreen.patch
- Renumber patches yet again.
==== nautilus ====
Version update (41.1 -> 41.2)
Subpackages: gnome-shell-search-provider-nautilus libnautilus-extension1
- Update to version 41.2:
+ Avoid cropping format popover in Compress dialog.
+ Fix "Move to"/"Copy to" from Starred.
+ Fix memory leak on tab switch.
+ Updated translations.
==== ncurses ====
Version update (6.3.20211127 -> 6.3.20220101)
Subpackages: libncurses6 ncurses-utils terminfo terminfo-base terminfo-iterm terminfo-screen
- Add ncurses patch 20220101
+ add section on releasing memory to curs_termcap.3x and
curs_terminfo.3x manpages.
- Add ncurses patch 20211225
+ improve markup, e.g., for external manpage links in the manpages
(prompted by report by Helge Kreutzmann).
- Add ncurses patch 20211219
+ install ncurses-examples programs in libexecdir, adding a wrapper
script to invoke those.
+ add help-screen and screen-dump to test/combine.c
- Rename package ncurses-tests to ncurses-examples as upstream does
- Add ncurses patch 20211211
+ add test/combine.c, to demo/test combining characters.
- Add ncurses patch 20211204
+ improve configure check for getttynam (report by Werner Fink).
- Correct offsets of patch ncurses-6.3.dif
==== nodejs-common ====
- Use NodeJS 17 as default for TW
==== pam_mount ====
Subpackages: libcryptmount0
- Use the %_pam_moduledir macro in pam_mount.spec in order to
have the package follow UsrMerge.
[bsc#1190954, pam_mount.spec]
==== patterns-base ====
Subpackages: patterns-base-apparmor patterns-base-base patterns-base-basesystem patterns-base-basic_desktop patterns-base-console patterns-base-enhanced_base patterns-base-minimal_base patterns-base-selinux patterns-base-sw_management patterns-base-transactional_base patterns-base-x11 patterns-base-x11_enhanced
- Install PAM manual pages instead of the PDFs
- specfile cleanup
- Don't recommend ntfs-3g by default on TW, the kernel module got
improved
==== patterns-network ====
- Remove kismet from suggested packages: this has only an impact on
the DVD content, where we need some space.
==== perl-Bootloader ====
Version update (0.936 -> 0.937)
- merge gh#openSUSE/perl-bootloader#137
- grub2 install: Support secure boot on powerpc (bsc#1192764
jsc#SLE-18271).
- 0.937
==== perl-HTTP-Message ====
Version update (6.35 -> 6.36)
- updated to 6.36
see /usr/share/doc/packages/perl-HTTP-Message/Changes
6.36 2022-01-05 14:39:42Z
- Fix examples in HTTP::Request::Common synopsis: HTTP::Request::Common
does not put headers in an arrayref, unlike HTTP::Request (GH#170) (Karen
Etheridge)
- Update to contributing information (GH#171) (Håkon Hægland)
==== perl-IO-Socket-SSL ====
Version update (2.073 -> 2.074)
- updated to 2.074
see /usr/share/doc/packages/perl-IO-Socket-SSL/Changes
2.074
- add SSL_ciphersuites option for TLS 1.3 ciphers
- no longer use own default for ciphers, instead use system default but disable
some weak ciphers which might still be enabled on older systems
==== poppler ====
Version update (21.12.0 -> 22.01.0)
Subpackages: libpoppler-cpp0 libpoppler-glib8 poppler-tools
- Update to 22.01.0:
core:
* Allow local (relative to dll) fonts dir on Windows
* TextOutputDev: require more spacing between columns.
Issue #1093
* Fix crash in Splash::gouraudTriangleShadedFill. Issue #1183
* Fix crash when calling Form::reset()
* GfxSeparationColorSpace: Check validity of colorspace and
function. Issue #1184
* Minor code improvements
glib:
* Include glib.h before using defines from it
* Close file descriptors on error
* Plug some memory leaks
* Replace use of deprecated g_memdup/g_time_zone_new
* Remove FD-taking functions on windows
utils:
* pdfsig: Add support for documents with passwords
* pdfsig: Fix signing with -sign if nss password is needed
==== poppler-qt5 ====
Version update (21.12.0 -> 22.01.0)
- Update to 22.01.0:
core:
* Allow local (relative to dll) fonts dir on Windows
* TextOutputDev: require more spacing between columns.
Issue #1093
* Fix crash in Splash::gouraudTriangleShadedFill. Issue #1183
* Fix crash when calling Form::reset()
* GfxSeparationColorSpace: Check validity of colorspace and
function. Issue #1184
* Minor code improvements
glib:
* Include glib.h before using defines from it
* Close file descriptors on error
* Plug some memory leaks
* Replace use of deprecated g_memdup/g_time_zone_new
* Remove FD-taking functions on windows
utils:
* pdfsig: Add support for documents with passwords
* pdfsig: Fix signing with -sign if nss password is needed
==== pulseaudio ====
Subpackages: libpulse-mainloop-glib0 libpulse0 pulseaudio-bash-completion pulseaudio-gdm-hooks pulseaudio-module-bluetooth pulseaudio-module-gsettings pulseaudio-module-x11 pulseaudio-module-zeroconf pulseaudio-setup pulseaudio-utils pulseaudio-zsh-completion system-user-pulse
- Workaround for spurious errors in dump-modules command
(bsc#1194379):
pulseaudio-dump-module-Ignore-invalid-module-init-tools.patch
==== python-aiosmtpd ====
- Remove hardcoded conditional on python36 flavor which got removed
in Tumbleweed
==== python-atpublic ====
- Fix sybil usage in conftest based on sybil version.
* https://gitlab.com/warsaw/public/-/merge_requests/16
==== python-boto3 ====
Version update (1.20.28 -> 1.20.35)
- Update to version 1.20.35
* api-change:``pinpoint``: [``botocore``] Adds JourneyChannelSettings to WriteJourneyRequest
* api-change:``lexv2-runtime``: [``botocore``] Update lexv2-runtime client to latest version
* api-change:``nimble``: [``botocore``] Amazon Nimble Studio now supports validation for Launch
Profiles. Launch Profiles now report static validation results after create/update to detect errors
in network or active directory configuration.
* api-change:``glue``: [``botocore``] This SDK release adds support to pass run properties when
starting a workflow run
* api-change:``ssm``: [``botocore``] AWS Systems Manager adds category support for DescribeDocument
API
* api-change:``elasticache``: [``botocore``] AWS ElastiCache for Redis has added a new Engine Log
LogType in LogDelivery feature. You can now publish the Engine Log from your Amazon ElastiCache for
Redis clusters to Amazon CloudWatch Logs and Amazon Kinesis Data Firehose.
- from version 1.20.34
* api-change:``lexv2-models``: [``botocore``] Update lexv2-models client to latest version
* api-change:``elasticache``: [``botocore``] Doc only update for ElastiCache
* api-change:``honeycode``: [``botocore``] Honeycode is releasing new APIs to allow user to create,
delete and list tags on resources.
* api-change:``ec2``: [``botocore``] Hpc6a instances are powered by a third-generation AMD EPYC
processors (Milan) delivering all-core turbo frequency of 3.4 GHz
* api-change:``fms``: [``botocore``] Shield Advanced policies for Amazon CloudFront resources now
support automatic application layer DDoS mitigation. The max length for SecurityServicePolicyData
ManagedServiceData is now 8192 characters, instead of 4096.
* api-change:``pi``: [``botocore``] This release adds three Performance Insights APIs. Use
ListAvailableResourceMetrics to get available metrics, GetResourceMetadata to get feature metadata,
and ListAvailableResourceDimensions to list available dimensions. The AdditionalMetrics field in
DescribeDimensionKeys retrieves per-SQL metrics.
- from version 1.20.33
* api-change:``finspace-data``: [``botocore``] Documentation updates for FinSpace.
* api-change:``rds``: [``botocore``] This release adds the db-proxy event type to support
subscribing to RDS Proxy events.
* api-change:``ce``: [``botocore``] Doc only update for Cost Explorer API that fixes missing
clarifications for MatchOptions definitions
* api-change:``kendra``: [``botocore``] Amazon Kendra now supports advanced query language and
query-less search.
* api-change:``workspaces``: [``botocore``] Introducing new APIs for Workspaces audio optimization
with Amazon Connect: CreateConnectClientAddIn, DescribeConnectClientAddIns,
UpdateConnectClientAddIn and DeleteConnectClientAddIn.
* api-change:``iotevents-data``: [``botocore``] This release provides documentation updates for
Timer.timestamp in the IoT Events API Reference Guide.
* api-change:``ec2``: [``botocore``] EC2 Capacity Reservations now supports RHEL instance platforms
(RHEL with SQL Server Standard, RHEL with SQL Server Enterprise, RHEL with SQL Server Web, RHEL
with HA, RHEL with HA and SQL Server Standard, RHEL with HA and SQL Server Enterprise)
- from version 1.20.32
* api-change:``ec2``: [``botocore``] New feature: Updated EC2 API to support faster launching for
Windows images. Optimized images are pre-provisioned, using snapshots to launch instances up to 65%
faster.
* api-change:``compute-optimizer``: [``botocore``] Adds support for new Compute Optimizer
capability that makes it easier for customers to optimize their EC2 instances by leveraging
multiple CPU architectures.
* api-change:``lookoutmetrics``: [``botocore``] This release adds FailureType in the response of
DescribeAnomalyDetector.
* api-change:``databrew``: [``botocore``] This SDK release adds support for specifying a Bucket
Owner for an S3 location.
* api-change:``transcribe``: [``botocore``] Documentation updates for Amazon Transcribe.
- from version 1.20.31
* api-change:``medialive``: [``botocore``] This release adds support for selecting the Program Date
Time (PDT) Clock source algorithm for HLS outputs.
- from version 1.20.30
* api-change:``ec2``: [``botocore``] This release introduces On-Demand Capacity Reservation support
for Cluster Placement Groups, adds Tags on instance Metadata, and includes documentation updates
for Amazon EC2.
* api-change:``mediatailor``: [``botocore``] This release adds support for filler slate when
updating MediaTailor channels that use the linear playback mode.
* api-change:``opensearch``: [``botocore``] Amazon OpenSearch Service adds support for Fine Grained
Access Control for existing domains running Elasticsearch version 6.7 and above
* api-change:``iotwireless``: [``botocore``] Downlink Queue Management feature provides APIs for
customers to manage the queued messages destined to device inside AWS IoT Core for LoRaWAN.
Customer can view, delete or purge the queued message(s). It allows customer to preempt the queued
messages and let more urgent messages go through.
* api-change:``es``: [``botocore``] Amazon OpenSearch Service adds support for Fine Grained Access
Control for existing domains running Elasticsearch version 6.7 and above
* api-change:``mwaa``: [``botocore``] This release adds a "Source" field that provides the
initiator of an update, such as due to an automated patch from AWS or due to modification via
Console or API.
* api-change:``appsync``: [``botocore``] AppSync: AWS AppSync now supports configurable batching
sizes for AWS Lambda resolvers, Direct AWS Lambda resolvers and pipeline functions
- from version 1.20.29
* api-change:``cloudtrail``: [``botocore``] This release adds support for CloudTrail Lake, a new
feature that lets you run SQL-based queries on events that you have aggregated into event data
stores. New APIs have been added for creating and managing event data stores, and creating,
running, and managing queries in CloudTrail Lake.
* api-change:``iot``: [``botocore``] This release adds an automatic retry mechanism for AWS IoT
Jobs. You can now define a maximum number of retries for each Job rollout, along with the criteria
to trigger the retry for FAILED/TIMED_OUT/ALL(both FAILED an TIMED_OUT) job.
* api-change:``ec2``: [``botocore``] This release adds a new API called
ModifyVpcEndpointServicePayerResponsibility which allows VPC endpoint service owners to take payer
responsibility of their VPC Endpoint connections.
* api-change:``snowball``: [``botocore``] Updating validation rules for interfaces used in the
Snowball API to tighten security of service.
* api-change:``lakeformation``: [``botocore``] Add new APIs for 3rd Party Support for Lake Formation
* api-change:``appstream``: [``botocore``] Includes APIs for App Entitlement management regarding
entitlement and entitled application association.
* api-change:``eks``: [``botocore``] Amazon EKS now supports running applications using IPv6
address space
* api-change:``quicksight``: [``botocore``] Multiple Doc-only updates for Amazon QuickSight.
* api-change:``ecs``: [``botocore``] Documentation update for ticket fixes.
* api-change:``sagemaker``: [``botocore``] Amazon SageMaker now supports running training jobs on
ml.g5 instance types.
* api-change:``glue``: [``botocore``] Add Delta Lake target support for Glue Crawler and 3rd Party
Support for Lake Formation
- Update BuildRequires and Requires from setup.py
==== python-botocore ====
Version update (1.23.28 -> 1.23.35)
- Version update to 1.23.35
* api-change:``pinpoint``: Adds JourneyChannelSettings to WriteJourneyRequest
* api-change:``lexv2-runtime``: Update lexv2-runtime client to latest version
* api-change:``nimble``: Amazon Nimble Studio now supports validation for Launch Profiles. Launch
Profiles now report static validation results after create/update to detect errors in network or
active directory configuration.
* api-change:``glue``: This SDK release adds support to pass run properties when starting a
workflow run
* api-change:``ssm``: AWS Systems Manager adds category support for DescribeDocument API
* api-change:``elasticache``: AWS ElastiCache for Redis has added a new Engine Log LogType in
LogDelivery feature. You can now publish the Engine Log from your Amazon ElastiCache for Redis
clusters to Amazon CloudWatch Logs and Amazon Kinesis Data Firehose.
- from version 1.23.34
* api-change:``lexv2-models``: Update lexv2-models client to latest version
* api-change:``elasticache``: Doc only update for ElastiCache
* api-change:``honeycode``: Honeycode is releasing new APIs to allow user to create, delete and
list tags on resources.
* api-change:``ec2``: Hpc6a instances are powered by a third-generation AMD EPYC processors (Milan)
delivering all-core turbo frequency of 3.4 GHz
* api-change:``fms``: Shield Advanced policies for Amazon CloudFront resources now support
automatic application layer DDoS mitigation. The max length for SecurityServicePolicyData
ManagedServiceData is now 8192 characters, instead of 4096.
* api-change:``pi``: This release adds three Performance Insights APIs. Use
ListAvailableResourceMetrics to get available metrics, GetResourceMetadata to get feature metadata,
and ListAvailableResourceDimensions to list available dimensions. The AdditionalMetrics field in
DescribeDimensionKeys retrieves per-SQL metrics.
- from version 1.23.33
* api-change:``finspace-data``: Documentation updates for FinSpace.
* api-change:``rds``: This release adds the db-proxy event type to support subscribing to RDS Proxy
events.
* api-change:``ce``: Doc only update for Cost Explorer API that fixes missing clarifications for
MatchOptions definitions
* api-change:``kendra``: Amazon Kendra now supports advanced query language and query-less search.
* api-change:``workspaces``: Introducing new APIs for Workspaces audio optimization with Amazon
Connect: CreateConnectClientAddIn, DescribeConnectClientAddIns, UpdateConnectClientAddIn and
DeleteConnectClientAddIn.
* api-change:``iotevents-data``: This release provides documentation updates for Timer.timestamp in
the IoT Events API Reference Guide.
* api-change:``ec2``: EC2 Capacity Reservations now supports RHEL instance platforms (RHEL with SQL
Server Standard, RHEL with SQL Server Enterprise, RHEL with SQL Server Web, RHEL with HA, RHEL with
HA and SQL Server Standard, RHEL with HA and SQL Server Enterprise)
- from version 1.23.32
* api-change:``ec2``: New feature: Updated EC2 API to support faster launching for Windows images.
Optimized images are pre-provisioned, using snapshots to launch instances up to 65% faster.
* api-change:``compute-optimizer``: Adds support for new Compute Optimizer capability that makes it
easier for customers to optimize their EC2 instances by leveraging multiple CPU architectures.
* api-change:``lookoutmetrics``: This release adds FailureType in the response of
DescribeAnomalyDetector.
* api-change:``databrew``: This SDK release adds support for specifying a Bucket Owner for an S3
location.
* api-change:``transcribe``: Documentation updates for Amazon Transcribe.
- from version 1.23.31
* api-change:``medialive``: This release adds support for selecting the Program Date Time (PDT)
Clock source algorithm for HLS outputs.
- from version 1.23.30
* api-change:``ec2``: This release introduces On-Demand Capacity Reservation support for Cluster
Placement Groups, adds Tags on instance Metadata, and includes documentation updates for Amazon EC2.
* api-change:``mediatailor``: This release adds support for filler slate when updating MediaTailor
channels that use the linear playback mode.
* api-change:``opensearch``: Amazon OpenSearch Service adds support for Fine Grained Access Control
for existing domains running Elasticsearch version 6.7 and above
* api-change:``iotwireless``: Downlink Queue Management feature provides APIs for customers to
manage the queued messages destined to device inside AWS IoT Core for LoRaWAN. Customer can view,
delete or purge the queued message(s). It allows customer to preempt the queued messages and let
more urgent messages go through.
* api-change:``es``: Amazon OpenSearch Service adds support for Fine Grained Access Control for
existing domains running Elasticsearch version 6.7 and above
* api-change:``mwaa``: This release adds a "Source" field that provides the initiator of an update,
such as due to an automated patch from AWS or due to modification via Console or API.
* api-change:``appsync``: AppSync: AWS AppSync now supports configurable batching sizes for AWS
Lambda resolvers, Direct AWS Lambda resolvers and pipeline functions
- from version 1.23.29
* api-change:``cloudtrail``: This release adds support for CloudTrail Lake, a new feature that lets
you run SQL-based queries on events that you have aggregated into event data stores. New APIs have
been added for creating and managing event data stores, and creating, running, and managing queries
in CloudTrail Lake.
* api-change:``iot``: This release adds an automatic retry mechanism for AWS IoT Jobs. You can now
define a maximum number of retries for each Job rollout, along with the criteria to trigger the
retry for FAILED/TIMED_OUT/ALL(both FAILED an TIMED_OUT) job.
* api-change:``ec2``: This release adds a new API called
ModifyVpcEndpointServicePayerResponsibility which allows VPC endpoint service owners to take payer
responsibility of their VPC Endpoint connections.
* api-change:``snowball``: Updating validation rules for interfaces used in the Snowball API to
tighten security of service.
* api-change:``lakeformation``: Add new APIs for 3rd Party Support for Lake Formation
* api-change:``appstream``: Includes APIs for App Entitlement management regarding entitlement and
entitled application association.
* api-change:``eks``: Amazon EKS now supports running applications using IPv6 address space
* api-change:``quicksight``: Multiple Doc-only updates for Amazon QuickSight.
* api-change:``ecs``: Documentation update for ticket fixes.
* api-change:``sagemaker``: Amazon SageMaker now supports running training jobs on ml.g5 instance
types.
* api-change:``glue``: Add Delta Lake target support for Glue Crawler and 3rd Party Support for
Lake Formation
==== python-gtk ====
- add python-rpm-macros dependency
==== python-hiredis ====
Version update (1.1.0 -> 2.0.0)
- Update to 2.0.0
* Bump hiredis from 0.13.3 to 1.0.0 and consequently add support
for RESP3 (see #104)
* Add type hints (see #106)
* Drop support for EOL Python versions 2.7, 3.4, and 3.5 (see #103)
- Drop obsolete patches
* hiredis1.patch
* bump_hiredis_0.14.1.patch
- Update patches
* 0001-Use-system-libhiredis.patch
* drop-vendor-sources.patch
==== python-python-lzo ====
Version update (1.12 -> 1.14)
- Update to 1.14
* Add python2 support statement
* Fix 32bit int limitations
- Includes support for Python 3.10 now
==== python-tables ====
Version update (3.6.1 -> 3.7.0)
- Update to 3.7.0
* Compatibility with Python 3.10, numpy 1.21 and HDF5 1.12.
* Support for Python 3.5 has been dropped (#840 and #850).
* Internal C-Blosc sources updated to 1.21.1 (#931). Note that,
starting from C-Blosc 1.19 does not include the Snappy codec
sources anymore, so Snappy will be not available if you compile
from included sources; other packages (like conda or wheels),
may (or may not) include it.
* Switch to git submodule for the management of vendored c-blosc
sources.
* Improved code formatting and notation consistency (#873, #868,
[#865] thanks to Miroslav ?edivý).
* Improve the use of modern Python including :mod:pathlib,
f-strings (#859, #855, #839 and #818 thanks to Miroslav
?edivý).
* Simplified management of version information.
* Drop dependency on the deprecated distutils.
* Modernize the setup script and add support for PEP517 (#907).
* Fix pkg-config (setup.py) for Python 3.9 on Debian. Thanks to
Marco Sulla PR #792.
* Fix ROFileNode fails to return the fileno() (#633).
* Do not flush read only files (#915 thanks to @lrepiton).
* Drop the deprecated hdf5Version and File.open_count.
* the :func:get_tables_version and :func:get_hdf5_version
functions are now deprecated please use the coresponding
:data:tables.__version__ and :data:tables.hdf5_version instead.
- Drop patches fixed upstream
* PyTables-compat-numpy119.patch
* PyTables-pr810-tostring.patch
* PyTables-skip-test_vlarray.patch
* tables-pr862-lowercasefdtype.patch
- Replace Never-use-the-msse2-flag-explicitly.patch by use of
environment variable
==== qemu ====
Subpackages: qemu-accel-qtest qemu-accel-tcg-x86 qemu-arm qemu-audio-spice qemu-block-curl qemu-block-dmg qemu-block-gluster qemu-block-iscsi qemu-block-nfs qemu-block-rbd qemu-block-ssh qemu-chardev-baum qemu-chardev-spice qemu-guest-agent qemu-hw-display-qxl qemu-hw-display-virtio-gpu qemu-hw-display-virtio-gpu-pci qemu-hw-display-virtio-vga qemu-hw-usb-host qemu-hw-usb-redirect qemu-hw-usb-smartcard qemu-ipxe qemu-ksm qemu-lang qemu-microvm qemu-ppc qemu-s390x qemu-seabios qemu-sgabios qemu-skiboot qemu-tools qemu-ui-curses qemu-ui-gtk qemu-ui-opengl qemu-ui-spice-app qemu-ui-spice-core qemu-vgabios qemu-vhost-user-gpu qemu-x86
- It's time to really start requiring -F when using -b in
qemu-img for us as well. Users/customers have been warned
in the relevant release notes (bsc#1190135)
* Patches dropped:
Revert-qemu-img-Improve-error-for-rebase.patch
Revert-qemu-img-Require-F-with-b-backing.patch
==== qpdf ====
Version update (10.4.0 -> 10.5.0)
- add fix-signedness-warning.patch (build for aarch64)
- update to 10.5.0:
* Since qpdf version 8, using object accessor methods on an
instance of ``QPDFObjectHandle`` may create warnings if the
object is not of the expected type. These warnings now have an
error code of ``qpdf_e_object`` instead of
``qpdf_e_damaged_pdf``. Also, comments have been added to
:file:`QPDFObjectHandle.hh` to explain in more detail what the
behavior is. See :ref:`object-accessors` for a more in-depth
discussion.
* Add ``Pl_Buffer::getMallocBuffer()`` to initialize a buffer
allocated with ``malloc()`` for better cross-language
interoperability.
* Overhaul error handling for the object handle functions C API.
Some rare error conditions that would previously have caused a
crash are now trapped and reported, and the functions that
generate them return fallback values. See comments in the
``ERROR HANDLING`` section of :file:`include/qpdf/qpdf-c.h` for
details. In particular, exceptions thrown by the underlying C++
code when calling object accessors are caught and converted into
errors. The errors can be checked by calling ``qpdf_has_error``.
Use ``qpdf_silence_errors`` to prevent the error from being
written to stderr.
* Add ``qpdf_get_last_string_length`` to the C API to get the
length of the last string that was returned. This is needed to
handle strings that contain embedded null characters.
* Add ``qpdf_oh_is_initialized`` and
``qpdf_oh_new_uninitialized`` to the C API to make it possible
to work with uninitialized objects.
* Add ``qpdf_oh_new_object`` to the C API. This allows you to
clone an object handle.
* Add ``qpdf_get_object_by_id``, ``qpdf_make_indirect_object``,
and ``qpdf_replace_object``, exposing the corresponding methods
in ``QPDF`` and ``QPDFObjectHandle``.
- add build-without-pdf.patch to fix documentation installation
- enable documentation build, enable tests, enable werror
==== rdma-core ====
Version update (38.0 -> 38.1)
Subpackages: libefa1 libibverbs libibverbs1 libmlx4-1 libmlx5-1 librdmacm1 rdma-ndd
- Update to v38.1
- Major fixes for hns provider
==== rubygem-ruby-libvirt ====
- Drop BuildRequires: libvirt, not necessary and very expensive
==== shadow ====
Version update (4.9 -> 4.11.1)
Subpackages: login_defs
- The legacy code does not support /etc/login.defs.d used by YaST.
Enable libeconf to read it (bsc#1192954).
- Update to 4.11.1:
* build: include lib/shadowlog_internal.h in dist tarballs
- Update to 4.11:
* Handle possible TOCTTOU issues in usermod/userdel
- (CVE-2013-4235)
- Use O_NOFOLLOW when copying file
- Kill all user tasks in userdel
* Fix useradd -D segfault
* Clean up obsolete libc feature-check ifdefs
* Fix -fno-common build breaks due to duplicate Prog declarations
* Have single date_to_str definition
* Fix libsubid SONAME version
* Clarify licensing info, use SPDX.
- Update to 4.10:
* From this release forward, su from this package should be
considered deprecated. Please replace any users of it with su
from util-linux
* libsubid fixes
* Rename the test program list_subid_ranges to getsubids, write
a manpage, so distros can ship it.
* Add libeconf dep for new*idmap
* Allow all group types with usermod -G
* Avoid useradd generating empty subid range
* Handle NULL pw_passwd
* Fix default value SHA_get_salt_rounds
* Use https where possible in README
* Update content and format of README
* Translation updates
* Switch from xml2po to itstool in 'make dist'
* Fix double frees
* Add LOG_INIT configurable to useradd
* Add CREATE_MAIL_SPOOL documentation
* Create a security.md
* Fix su never being SIGKILLd when trapping TERM
* Fix wrong SELinux labels in several possible cases
* Fix missing chmod in chadowtb_move
* Handle malformed hushlogins entries
* Fix groupdel segv when passwd does not exist
* Fix covscan-found newgrp segfault
* Remove trailing slash on hoedir
* Fix passwd -l message - it does not change expirey
* Fix SIGCHLD handling bugs in su and vipw
* Remove special case for "" in usermod
* Implement usermod -rG to remove a specific group
* call pam_end() after fork in child path for su and login
* useradd: In absence of /etc/passwd, assume 0 == root
* lib: check NULL before freeing data
* Fix pwck segfault
- Remove because upstreamed:
* shadow-4.9-pwck-segfault.patch
* shadow-4.9-newgrp-segfault.patch
* shadow-4.9-useradd-subuid.patch
* shadow-4.9-sgent-free.patch
* shadow-passwd-handle-null.patch
* shadow-fix-sigabrt.patch
* shadow-libeconf-include.patch
* libsubid-build-fix.patch
- Refreshed:
* shadow-util-linux.patch
* shadow.changes
* shadow.keyring
* shadow.spec
* useradd-script.patch
* useradd-userkeleton.patch
* userdel-script.patch
- Update shadow.keyring:
* Serge Hallyn serge@hallyn.com (B175CFA98F192AF2)
* Christian Brauner christian@brauner.io (4880B8C9BD0E5106FC070F4F7B3C391EFEA93624)
==== sqlite3 ====
Version update (3.36.0 -> 3.37.1)
- update to 3.37.1:
* Fix a bug introduced by the UPSERT enhancements of version
3.35.0 that can cause incorrect byte-code to be generated for
some obscure but valid SQL, possibly resulting in a NULL-
pointer dereference.
* Fix an OOB read that can occur in FTS5 when reading corrupt
database files.
* Improved robustness of the --safe option in the CLI.
* Other minor fixes to assert() statements and test cases.
- SQLite3 3.37.0:
* STRICT tables provide a prescriptive style of data type
management, for developers who prefer that kind of thing.
* When adding columns that contain a CHECK constraint or a
generated column containing a NOT NULL constraint, the
ALTER TABLE ADD COLUMN now checks new constraints against
preexisting rows in the database and will only proceed if no
constraints are violated.
* Added the PRAGMA table_list statement.
* Add the .connection command, allowing the CLI to keep multiple
database connections open at the same time.
* Add the --safe command-line option that disables dot-commands
and SQL statements that might cause side-effects that extend
beyond the single database file named on the command-line.
* CLI: Performance improvements when reading SQL statements that
span many lines.
* Added the sqlite3_autovacuum_pages() interface.
* The sqlite3_deserialize() does not and has never worked
for the TEMP database. That limitation is now noted in the
documentation.
* The query planner now omits ORDER BY clauses on subqueries and
views if removing those clauses does not change the semantics
of the query.
* The generate_series table-valued function extension is modified
so that the first parameter ("START") is now required. This is
done as a way to demonstrate how to write table-valued
functions with required parameters. The legacy behavior is
available using the -DZERO_ARGUMENT_GENERATE_SERIES
compile-time option.
* Added new sqlite3_changes64() and sqlite3_total_changes64()
interfaces.
* Added the SQLITE_OPEN_EXRESCODE flag option to sqlite3_open_v2().
* Use less memory to hold the database schema.
==== sssd ====
Subpackages: libsss_certmap0 libsss_idmap0 libsss_nss_idmap0 sssd-krb5-common sssd-ldap
- Remove libsmbclient-devel BuildRequires in favor of
pkgconfig(smbclient)
==== strace ====
Version update (5.15 -> 5.16)
- Update to strace 5.16
* Improvements
* Implemented --secontext=mismatch option to find mismatches in SELinux
contexts.
* Implemented decoding of futex_waitv syscall introduced in Linux 5.16.
* Implemented decoding of BPF_LINK_GET_NEXT_ID and BPF_LINK_GET_FD_BY_ID bpf
syscall commands.
* Enhanced decoding of BPF_MAP_CREATE, BPF_PROG_TEST_RUN, and BPF_PROG_LOAD
bpf syscall commands.
* Enhanced decoding of BTRFS_IOC_FS_INFO ioctl command.
* Updated lists of AUDIT_*, BPF_*, BTRFS_*, DEVCONF_*, FAN_*, ETH_P_*,
IPV4_DEVCONF_*, KVM_*, NDA_*, SO_*, and V4L2_* constants.
* Updated lists of ioctl commands from Linux 5.16.
==== tcsh ====
Version update (6.23.00 -> 6.23.02)
Subpackages: tcsh-lang
- Update to tcsh 6.23.02
9. Make the \U escape up to 8 hex digits.
8. V6.23.01 - 20211209
7. add \cc and \Uhhh, and document escape sequences
6. add $'string with escapes' ("dollar-single-quotes") (Kimmo Suominen)
5. don't glob the filetest builtin arguments twice
4. remove the duplicate echo escape parsing code and use parseescape
3. add \x{hh} \xhh \uhhh (H.Merijn Brand)
2. fix and document ln=target
1. Merge in patches from pkgsrc:
- Modernize the installation targets so that they use INSTALL_DATA,
INSTALL_PROGRAM, and MKDIR_P.
- Enable SYSMALLOC and SHORT_STRINGS on NetBSD.
- Enable NO_FIX_MALLOC and SHORT_STRINGS on OpenBSD.
- Port patches
* tcsh-6.17.06-dspmbyte.dif
* tcsh-6.18.03-catalogs.dif
* tcsh-6.21.00.dif
==== vim ====
Version update (8.2.3995 -> 8.2.4063)
Subpackages: gvim vim-data vim-data-common
- disable-unreliable-tests-arch.patch: refresh
- Updated to version 8.2.4063, fixes the following problems
- fixes boo#1194559 CVE-2022-0156
* Not all sshconfig files are detected as such.
* Vim9: type checking for list and dict lacks information about declared
type.
* Vim9: not enough testing for extend() and map().
* Asan error for adding zero to NULL.
* Redundant check for NUL byte.
* Coverity warns for checking for NULL pointer after using it.
* Insert complete code uses global variables.
* First char typed in Select mode can be wrong.
* Error messages are spread out.
* Old compiler complains about struct init with variable.
* Error messages are spread out.
* Vim9: crash when declaring variable on the command line.
* Session does not restore help buffer properly when "options' is missing
from 'sessionoptions'.
* Error messages are spread out.
* Reading one byte beyond the end of the line.
* Error messages are spread out.
* Test fails because of changed error number.
* Error messages are spread out.
* Build failure without the spell feature.
* Git and gitcommit file types not properly recognized.
* Build failure with tiny features. (Tony Mechelynck)
* Vim9: incorrect error for argument that is shadowing var.
* Gcc warns for misleading indent in Athena menu code.
* ml_get error when win_execute redraws with Visual selection.
* Vim9: import mechanism is too complicated.
* Debugger test fails.
* Missing part of the :import changes.
* Two error messages in the wrong file.
* Using uninitialized variable.
* Confusing error message if imported name is used directly.
* Error for import not ending in .vim does not work for .vimrc.
* ml_get error with specific win_execute() command. (Sean Dewar)
* ml_get error with :doautoall and Visual area. (Sean Dewar)
* Debugging NFA regexp my crash, cached indent may be wrong.
* A script local funcref is not found from a mapping.
* Crash in xterm with only two lines. (Dominique Pellé)
* ATTRIBUTE_NORETURN is not needed.
* Running filetype tests leaves directory behind.
* Coverity warns for possibly using a NULL pointer.
* Timer triggered at the debug prompt may cause trouble.
* Vim9: script test file is getting too long.
* Insert mode completion is insufficiently tested.
* Various code not used when features are disabled.
* The xdiff library is linked in even when not used.
* Keeping track of allocated lines in user functions is too complicated.
* Using unitialized pointer.
* Vim9: build error.
* Using int for second argument of ga_init2().
* Vim9: no error when importing the same script twice.
* Some global functions are only used in one file.
* Some error messages not in the right place.
* Depending on the build features error messages are unused.
* gcc complains about use of "%p" in printf.
* Vim9: reading before the start of the line with "$" by itself.
* Vim9: need to prefix every item in an autoload script.
* Compiler complains about possibly uninitialized variable.
* Not easy to resize a window from a plugin.
* Vim9: autoload mechanism doesn't fully work yet.
* Vim9 script test fails.
* Vim9: line break in expression causes v:errmsg to be filled. (Yegappan
Lakshmanan)
* Vim9: memory leak when exporting function in autoload script.
* Vim9: not fully implementing the autoload mechanism.
* Vim9: import test failure in wrong line.
* Vim9: an expression of a map cannot access script-local items. (Maxim Kim)
* win_execute() is slow on systems where getcwd() or chdir() is slow. (Rick
Howe)
* Codecov bash script is deprecated.
* Match highlighting of tab too short.
* Vim9: exported function in autoload script not found. (Yegappan Lakshmanan)
==== virt-manager ====
Subpackages: virt-install virt-manager-common
- jsc#SLE-20855 KVM: Enable vfio-ccw and vfio-ap in virt-* tools
965480e8-virt-install-add-mediated-device.patch
f87e96d3-hostdev-use-method-get_mdev_uuid.patch
9d4002ee-tests-verify-MDEV-support.patch
9363e1e6-virt-xml-add-support-for-mediated-devices.patch
0e15cd51-virt-manager-enable-MDEV-support.patch
==== wayland ====
Version update (1.19.0 -> 1.20.0)
Subpackages: libwayland-client0 libwayland-cursor0 libwayland-egl1 libwayland-server0
- Add wayland-shm-Close-file-descriptors-not-needed.patch: For
platforms that support mremap(), we don't need to hold file
descriptors all the time, because programs like Xwayland will
hold a lot of file descriptors and may crash, this patch close
file descriptors earlier for those platforms (bsc#1194190).
- obsolete/provide libwayland-egl-devel 18.0.2 also on sle15-sp4
- Update to release 1.20
* A few protocol additions: wl_surface.offset allows clients to
update a surface's buffer offset independently from the
buffer, wl_output.name and description allow clients to
identify outputs without depending on xdg-output-unstable-v1.
* In protocol definitions, events have a new "type" attribute
and can now be marked as destructors.
* A number of bug fixes, including a race condition when
destroying proxies in multi-threaded clients.
==== xen ====
Subpackages: xen-libs xen-tools-domU
- bsc#1193307 - pci backend does not exist when attach a vf to a pv
guest
libxl-Fix-PV-hotplug-and-stubdom-coldplug.patch
Drop libxl-PCI-defer-backend-wait.patch
==== yast2 ====
Version update (4.4.34 -> 4.4.36)
Subpackages: yast2-logs
- Adapted Report.yesno_popup to Ruby 3 (bsc#1193192)
- 4.4.36
- Simplify slide show to support future parallel installations
(jsc#SLE-20437)
- 4.4.35
==== yast2-dhcp-server ====
Version update (4.4.1 -> 4.4.2)
- Fix DNS zone creation by fixing a maintained DNS zone check.
Reported and fixed by Daniel Pätzold <obel1x@web.de>
See github#yast/yast-dhcp-server#59.
- 4.4.2
==== yast2-installation ====
Version update (4.4.33 -> 4.4.34)
- Show release notes button in progress in Qt interface
(jsc#SLE-20437)
- 4.4.34
==== yast2-packager ====
Version update (4.4.18 -> 4.4.19)
- Simplify slide show to support future parallel installations
(jsc#SLE-20437)
- 4.4.19
==== yast2-schema ====
Version update (4.4.7 -> 4.4.8)
- Added lsm 'none' section to the security schema (jsc#SLE-22069)
- 4.4.8
==== yast2-security ====
Version update (4.4.6 -> 4.4.7)
Related to jsc#SLE-22069:
- Autoyast LSM section: added "none" section in order to mark it
as not selectable during the installation.
- 4.4.7
==== yast2-storage-ng ====
Version update (4.4.31 -> 4.4.32)
- Allow to skip the activation of the rest of LUKS devices
(bsc#1162545).
- Partitioner: always allow to provide password for closed LUKS
devices.
- 4.4.32