Packages changed: Mesa (26.2.4 -> 26.2.5) Mesa-drivers (26.2.4 -> 26.2.5) MicroOS-release (20261011 -> 20261018) PackageKit alsa aurorae6 (6.7.5 -> 6.8.0) bash bluedevil6 (6.7.5 -> 6.8.0) breeze6 (6.7.5 -> 6.8.0) breeze6-gtk (6.7.5 -> 6.8.0) chromaprint (1.6.0 -> 1.6.2) containerd (1.7.33 -> 2.3.3) curl (8.22.0 -> 8.23.0) discover6 (6.7.5 -> 6.8.0) dracut (112+suse.54.g5c7a104 -> 112+suse.57.g23bbfee) ffado (2.4.9 -> 2.5.0) ffmpeg-8 flatpak-kcm6 (6.7.5 -> 6.8.0) freetype2 (2.14.3 -> 2.15.0) fwupd ghostscript gpg2 (2.5.22 -> 2.5.24) grub2 (2.14 -> 2.16) kactivitymanagerd6 (6.7.5 -> 6.8.0) kde-cli-tools6 (6.7.5 -> 6.8.0) kde-gtk-config6 (6.7.5 -> 6.8.0) kdecoration6 (6.7.5 -> 6.8.0) kdeplasma6-addons (6.7.5 -> 6.8.0) kernel-source (7.2.9 -> 7.2.11) kglobalacceld6 (6.7.5 -> 6.8.0) kinfocenter6 (6.7.5 -> 6.8.0) kmenuedit6 (6.7.5 -> 6.8.0) knighttime6 (6.7.5 -> 6.8.0) kpipewire6 (6.7.5 -> 6.8.0) kscreen6 (6.7.5 -> 6.8.0) kscreenlocker6 (6.7.5 -> 6.8.0) ksshaskpass6 (6.7.5 -> 6.8.0) ksystemstats6 (6.7.5 -> 6.8.0) kwayland-integration6 (6.7.5 -> 6.8.0) kwayland6 (6.7.5 -> 6.8.0) kwin6 (6.7.5 -> 6.8.0) layer-shell-qt6 (6.7.5 -> 6.8.0) libX11 (1.8.13 -> 1.8.14) libXi (1.8.3 -> 1.8.4) libXpm (3.5.18 -> 3.5.20) libXrender (0.9.12 -> 0.9.13) libXtst (1.2.5 -> 1.2.6) libbpf (1.7.0 -> 1.8.0) libeconf (0.8.5 -> 0.8.6) libheif (1.23.5 -> 1.23.6) libkscreen6 (6.7.5 -> 6.8.0) libksysguard6 (6.7.5 -> 6.8.0) libplasma6 (6.7.5 -> 6.8.0) libsndfile live555 (2026.08.25 -> 2026.10.13) llvm23 (23.1.2 -> 23.1.3) microos-tools (4.0+git29 -> 4.0+git31) milou6 (6.7.5 -> 6.8.0) oath-toolkit (2.6.14 -> 2.6.15) open-vm-tools openssh (10.5p1 -> 10.6p1) openssl-3 phonon-vlc-qt6 pipewire plasma5support6 (6.7.5 -> 6.8.0) plasma6-activities (6.7.5 -> 6.8.0) plasma6-activities-stats (6.7.5 -> 6.8.0) plasma6-browser-integration (6.7.5 -> 6.8.0) plasma6-desktop (6.7.5 -> 6.8.0) plasma6-integration (6.7.5 -> 6.8.0) plasma6-nm (6.7.5 -> 6.8.0) plasma6-openSUSE plasma6-pa (6.7.5 -> 6.8.0) plasma6-print-manager (6.7.5 -> 6.8.0) plasma6-systemmonitor (6.7.5 -> 6.8.0) plasma6-workspace (6.7.5 -> 6.8.0) polkit-default-privs (1550+20261009.03465cb -> 1550+20261016.b8e1631) polkit-kde-agent-6 (6.7.5 -> 6.8.0) poppler (26.09.0 -> 26.10.0) poppler-qt6 (26.09.0 -> 26.10.0) powerdevil6 (6.7.5 -> 6.8.0) python-urllib3 python313 (3.13.15 -> 3.13.16) python313-core (3.13.15 -> 3.13.16) qqc2-breeze-style6 (6.7.5 -> 6.8.0) qt6-base (6.11.2 -> 6.12.0) qt6-declarative (6.11.2 -> 6.12.0) qt6-imageformats (6.11.2 -> 6.12.0) qt6-location (6.11.2 -> 6.12.0) qt6-multimedia (6.11.2 -> 6.12.0) qt6-positioning (6.11.2 -> 6.12.0) qt6-qt5compat (6.11.2 -> 6.12.0) qt6-quick3d (6.11.2 -> 6.12.0) qt6-quicktimeline (6.11.2 -> 6.12.0) qt6-shadertools (6.11.2 -> 6.12.0) qt6-speech (6.11.2 -> 6.12.0) qt6-svg (6.11.2 -> 6.12.0) qt6-tools (6.11.2 -> 6.12.0) qt6-virtualkeyboard (6.11.2 -> 6.12.0) qt6-webchannel (6.11.2 -> 6.12.0) qt6-webengine qt6-webview (6.11.2 -> 6.12.0) sbc sddm-kcm6 (6.7.5 -> 6.8.0) sdl2-compat selinux-policy (20261006 -> 20261014) sof-firmware (2026.09.1 -> 2026.09.2) spectacle (6.7.5 -> 6.8.0) systemd (261.2 -> 261.3) systemsettings6 (6.7.5 -> 6.8.0) tesseract-ocr tesseract-ocr-traineddata vid_stab (1.1.1 -> 1.1.2) vim (9.2.1161 -> 9.2.1202) vlc wtmpdb (0.76.0+git20260730.89c0861 -> 0.76.0+git20261016.cab5ed0) xdg-desktop-portal-kde6 (6.7.5 -> 6.8.0) zix (0.8.0 -> 0.8.2) === Details === ==== Mesa ==== Version update (26.2.4 -> 26.2.5) Subpackages: Mesa-libEGL1 Mesa-libGL1 libgbm1 - Mesa-libRusticlOpenCL: no longer require libclc(llvmN); see changes during update of libclc to version 23.1.0 ... - Update to 26.2.5 bugfix release - -> https://docs.mesa3d.org/relnotes/26.2.5 - Add n_hardcode-libclc-path.patch to work around missing libclc.pc with libclc 23. Upstream might solve this via config option. - Downport upstream patches so that we find newer libclc files: * U_nir-load_libclc-do-not-compare-sys_path-against-NULL.patch * U_nir-load_libclc-turn-sys_path-into-an-array.patch * U_nir-load_libclc-add-llvm-23-libclc-paths.patch ==== Mesa-drivers ==== Version update (26.2.4 -> 26.2.5) Subpackages: Mesa-dri Mesa-vulkan-device-select libvulkan_lvp - Mesa-libRusticlOpenCL: no longer require libclc(llvmN); see changes during update of libclc to version 23.1.0 ... - Update to 26.2.5 bugfix release - -> https://docs.mesa3d.org/relnotes/26.2.5 - Add n_hardcode-libclc-path.patch to work around missing libclc.pc with libclc 23. Upstream might solve this via config option. - Downport upstream patches so that we find newer libclc files: * U_nir-load_libclc-do-not-compare-sys_path-against-NULL.patch * U_nir-load_libclc-turn-sys_path-into-an-array.patch * U_nir-load_libclc-add-llvm-23-libclc-paths.patch ==== MicroOS-release ==== Version update (20261011 -> 20261018) Subpackages: MicroOS-release-appliance MicroOS-release-dvd - automatically generated by openSUSE-release-tools/pkglistgen ==== PackageKit ==== Subpackages: PackageKit-backend-dnf5 libpackagekit-glib2-18 typelib-1_0-PackageKitGlib-1_0 - Update version dependencies according to meson.build. ==== alsa ==== - Fix integer overflow in topology control code (CVE-2026-96674, bsc#1282564): 0003-topology-fix-uint32_t-overflow-in-control-decoder-si.patch - Fix binding index validations in multi plugin (CVE-2026-96675, bsc#1282563): 0004-pcm-replace-multi-plugin-binding-asserts-with-EINVAL.patch ==== aurorae6 ==== Version update (6.7.5 -> 6.8.0) - Update to 6.8.0: * New feature release * For more details see https://kde.org/announcements/plasma/6/6.8.0 - Changes since 6.7.91: * Update version for new release 6.8.0 - Update to 6.7.91: * New bugfix release * For more details see https://kde.org/announcements/plasma/6/6.7.91 - Changes since 6.7.90: * Update version for new release 6.7.91 - Update to 6.7.90: * New feature release * For more details see https://kde.org/announcements/plasma/6/6.7.90 - Changes since 6.7.5: * Update version for new release 6.7.90 * v2: Visualize checked state * Refresh decoration geometry when maximized state changes without resizing * CI: Require all tests to pass * v2: Fix rendering with scale factors less than 100% (kde#520272) * Update version for new release 6.7.80 ==== bash ==== Subpackages: bash-sh - Add temporary patch bash-5.3.19-workaround.patch from mailing list * Patch 19 (commit 549639c) changed legal_variable_starter() in general.h to index sh_syntaxtab[] directly, but without the (unsigned char) cast that the sibling macros in syntax.h use (shellmeta, shellbreak, shellquote). ==== bluedevil6 ==== Version update (6.7.5 -> 6.8.0) - Update to 6.8.0: * New feature release * For more details see https://kde.org/announcements/plasma/6/6.8.0 - Changes since 6.7.91: * Update version for new release 6.8.0 * wizard: always start our own discovery session (kde#526178) - Update to 6.7.91: * New bugfix release * For more details see https://kde.org/announcements/plasma/6/6.7.91 - Changes since 6.7.90: * Update version for new release 6.7.91 * Escape html in device name - Update to 6.7.90: * New feature release * For more details see https://kde.org/announcements/plasma/6/6.7.90 - Changes since 6.7.5: * Update version for new release 6.7.90 * Move configure button from hamburger menu (kde#516134) * i18n: Fix dialog translation for Forget Device * applet: inherit icon from action * Install kcfg files * Add smoke test for applet * kded: Drop KX11Extras usage * Skip kcm_smoketest with kcmutils < 6.27.0 * Update version for new release 6.7.80 ==== breeze6 ==== Version update (6.7.5 -> 6.8.0) Subpackages: breeze6-cursors breeze6-decoration breeze6-style breeze6-style-qt5 breeze6-wallpapers - Update to 6.8.0: * New feature release * For more details see https://kde.org/announcements/plasma/6/6.8.0 - Changes since 6.7.91: * Update version for new release 6.8.0 * kdecoration: Remove corner radius when tiled (kde#490716) - Update to 6.7.91: * New bugfix release * For more details see https://kde.org/announcements/plasma/6/6.7.91 - Changes since 6.7.90: * Update version for new release 6.7.91 * kdecoration: updateButtonsGeometry() when borders change - Update to 6.7.90: * New feature release * For more details see https://kde.org/announcements/plasma/6/6.7.90 - Changes since 6.7.5: * Update version for new release 6.7.90 * Replace Waterfall wallpaper with Hanabi * Use font metrics to only inset where the text can spare it (kde#523118) * Use ubuntu image for Qt5 CI * Remove warning (found by cmake --warn-uninitialized -Werror=dev ) * Install kcfg files * kdecoration: Add support for shadow only decorations * kdecoration: Change the way top corners are rounded when titlebar is hidden * breezehelper: Fix asymmetric separators on immutable tabs * kdecoration: add 'resize' margin for top border * Fix crash in WindowManager::registerQuickItem (kde#491000) * BreezeStyle: Fix ViewItemDecoration/Indicator adjustment on RTL style (kde#518835,kde#518837) * BreezeHelper: Use brush instead of color for renderFocusRect * CI: Require passing tests * Move old wallpaper, add new one, update previews * Skip kcm smoke tests with kcmutils < 6.27.0 * Update version for new release 6.7.80 ==== breeze6-gtk ==== Version update (6.7.5 -> 6.8.0) Subpackages: gtk3-metatheme-breeze6 metatheme-breeze6-common - Update to 6.8.0: * New feature release * For more details see https://kde.org/announcements/plasma/6/6.8.0 - Changes since 6.7.91: * Update version for new release 6.8.0 - Update to 6.7.91: * New bugfix release * For more details see https://kde.org/announcements/plasma/6/6.7.91 - Changes since 6.7.90: * Update version for new release 6.7.91 - Update to 6.7.90: * New feature release * For more details see https://kde.org/announcements/plasma/6/6.7.90 - Changes since 6.7.5: * Update version for new release 6.7.90 * gtk4/window_decorations: fix buttons overflow * gtk4/window_decorations: remove radius for non-csd * gtk4/menu: fix menu shadow and menu item highlight * gtk2: remove unsupported "direction" keyword from entry theme (kde#465279) * Enable LSAN in CI * _sidebar: fix color for the sidebar line separator (kde#484383) * CI: Require all tests to pass * Update version for new release 6.7.80 ==== chromaprint ==== Version update (1.6.0 -> 1.6.2) - Update to version 1.6.2: * Fixed a crash in fpcalc when the channel layout changes mid-stream (e.g. AC-3 files switching between 5.1 and stereo) * Fixed decoding of audio with more than 8 planar channels in fpcalc * Fingerprint decoding now rejects invalid input that previously caused undefined behaviour (shifting past 32 bits) * The C API encoding/decoding functions now return an error for a negative size, a NULL buffer with a nonzero size, and, when encoding, more items than the fingerprint header can hold (previously silently truncated) - Update to version 1.6.1: * Fixed a heap buffer overflow when decoding a fingerprint that has extra data after the encoded values. Applications that decode fingerprints from untrusted sources should update. * Fixed building against FFmpeg 4.x, which had not compiled since the channel layout API changed in 5.1 * Audio can now be fed in buffers that do not end on a frame boundary; previously a partial frame at the end of a call was dropped * Fixed an implicit integer conversion warning on LLVM * Fixed installing to absolute paths * Build fpcalc against the system FFmpeg in CI ==== containerd ==== Version update (1.7.33 -> 2.3.3) - Update to containerd v2.3.3, a major version upgrade from 1.7.33: * https://github.com/containerd/containerd/releases/tag/v2.3.3 - Bump minimum Go version to 1.26, required by upstream go.mod (go 1.26.3) - Update Go import path to github.com/containerd/containerd/v2 to match the module path change in containerd 2.x, and own the resulting intermediate go_contribsrcdir directory in the devel package - Drop 0002-CVE-2026-39821-idna-update-from-x-text-fix-ToUnicode.patch and 0003-CVE-2026-33814-http2-prevent-hanging-Transport-due-t.patch: both fixes are already included upstream in v2.3.3 (golang.org/x/net is pinned to the fixed v0.55.0, and the required go 1.26.3 toolchain carries the http2 stdlib fix) - Rebase patches: * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch - Remove invalid patch * 0002-CVE-2026-33186-containerd-google.golang.org-grpc-aut.patch - Add patches * 0002-CVE-2026-39821-idna-update-from-x-text-fix-ToUnicode.patch * 0003-CVE-2026-33814-http2-prevent-hanging-Transport-due-t.patch - Drop patches * 0004-CVE-2026-39821-idna-update-from-x-text-fix-ToUnicode.patch * 0005-CVE-2026-33814-http2-prevent-hanging-Transport-due-t.patch ==== curl ==== Version update (8.22.0 -> 8.23.0) Subpackages: libcurl4 - Update to 8.23.0: * Security fixes: - CVE-2026-92388: FTP wildcard write callback mixup (bsc#1285016) - CVE-2026-92389: TFTP direction confusion (bsc#1285015) - CVE-2026-87866: wolfSSL public-key pinning bypass (bsc#1285019) - CVE-2026-87862: HSTS cache import drops longer-lived child (bsc#1285023) - CVE-2026-87861: cross-origin reuse of a Negotiate connection (bsc#1285024) - CVE-2026-87864: IMAP APPEND plus CRLF conversion command injection (bsc#1285021) - CVE-2026-87863: HSTS response erases persisted entries (bsc#1285022) - CVE-2026-86410: redirect to SFTP or SCP bypasses host verification (bsc#1285030) - CVE-2026-87865: knownhost callback mismatches key as missing (bsc#1285020) - CVE-2026-92387: never-ending loop via server response omission (bsc#1285017) - CVE-2026-92386: server-set cookie aborts cookie jar load (bsc#1285018) - CVE-2026-86412: server-set cookie erases cookie jar (bsc#1285028) - CVE-2026-86413: Negotiate credentials sent to redirected origin (bsc#1285027) - CVE-2026-86414: leaking host credentials to HTTP proxy (bsc#1285026) - CVE-2026-92392: HTTP/2 upload Use-After-Free (bsc#1285012) - CVE-2026-94266: password leak in CURLINFO_EFFECTIVE_URL (bsc#1285010) - CVE-2026-92391: curl_mime_free stack overflow by recursion (bsc#1285013) - CVE-2026-92390: -J no-clobber guarantee bypassed with 103 early hints (bsc#1285014) - CVE-2026-107929: local interface connection reuse mixup (bsc#1285008) - CVE-2026-107928: info leak uploading over WebSockets with GnuTLS (bsc#1285009) - CVE-2026-94265: Authorization: Negotiate sent to foreign origin (bsc#1285011) - CVE-2026-86409: stale SigV4 headers sent unintended (bsc#1285031) - CVE-2026-86411: FTP connection reuse inherits client-certificate (bsc#1285029) * Changes: - lib: CURL_GLOBAL_WIN32 -> CURL_GLOBAL_WINSOCK - SMB: drop support - tool_cb_wrt: inject the no-clobber number before the extension - tool_cb_wrt: try up to .9999 when no-clobbering * Bugfixes: - conncache: never discard a connection still in use - curl-openssl.m4: sync LibreSSL detection method with rest of forks - cw-out: avoid O(n^2) work while buffering paused output - cw-pause: fix O(N^2) list traversal in cw_pause_flush - DEPRECATE: Common Name support in TLS certificates for OpenSSL - ftp: require TLS on the data connection for implicit FTPS - ftp: tighten use_ssl check for conn reuse - global_init: tidy up, simplify, fix issues - GnuTLS: remove our own OCSP signature verification - gtls: no early return on verify fail - headers: avoid O(n^2) rescans in curl_easy_nextheader() - hsts: cap max-age to two years - HTTP-CONNECT: do not react to 401 responses - http2: don't send a CURLE_SEND_ERROR after a valid http2 response - http2: fix reset after 1xx response - http2: initialize URL handle for server pushes - http2: limit trailers and headers count - http: abide to close-rules when transfer-encoding off - http: ignore Proxy-Authenticate unless the response comes from a proxy - http: only enable Negotiate/NTLM to allowed origins - http: reject empty header names - http: reject resumed uploads - http_aws_sigv4: fix the s3express service name - if2ip: check interface name case sensitive - imap: compare selected mailbox names case-sensitively - libssh2: match hashed known_hosts entries by host - libssh2: skip repeat checkp() for already-absent hashed key types - libssh: work with empty priv_key - openssl/gtls: reject CRLfile with native CA store, matching rustls - openssl: fix OpenSSL v4.1 no-deprecated build - openssl: support X509 store caching when CApath is configured - openssl: use non-deprecated API for MD5/MD4 - ossl_verifyhost: remove assumption of null-termination of ASN1_STRING. - peer: compare zoneid case sensitive - peer: parsing a zoneid as number fix - peer: preserve ipv6 props from "connect-to" - pingpong: schedule server response timeouts for the socket API - rtsp: do not send a learned session id to another origin - rustls: break recv loop on empty plain text - rustls: consume CURLOPT_SSLCERT_BLOB / CURLOPT_SSLKEY_BLOB - schannel: retain close_notify records across send retries - socks: support CURLAUTH_ONLY in CURLOPT_SOCKS5_AUTH - socks: track SOCKS5 authentication per socket, not per connection - sws: fix connection-monitor for connections closed before a request - telnet: make it work through proxy tunnels - tool: (re)set SSL verification in --libcurl output - tool_getparam: restore --socks5-gssapi-service - url: match connections without force reuse and candidates - url: ntlm/negotiate, prohibit connection reuse on follows - vtls_scache: remember lock state locally * Remove now unrecognized option: --disable-tls-srp * Rebase libcurl-ocloexec.patch ==== discover6 ==== Version update (6.7.5 -> 6.8.0) Subpackages: discover6-backend-flatpak discover6-backend-fwupd discover6-notifier - Update to 6.8.0: * New feature release * For more details see https://kde.org/announcements/plasma/6/6.8.0 - Changes since 6.7.91: * Prepare ResourcesUpdatesModel before running headless updates (kde#519082) * Update version for new release 6.8.0 * DiscoverDrawer: Set selected state on busy icon * Fix updates progress bar alignment on mobile (kde#526718) * Make the distro error message selectable and fix the "Report this issue" link (kde#518350) - Update to 6.7.91: * New bugfix release * For more details see https://kde.org/announcements/plasma/6/6.7.91 - Changes since 6.7.90: * Update version for new release 6.7.91 - Update to 6.7.90: * New feature release * For more details see https://kde.org/announcements/plasma/6/6.7.90 - Too many changes to list here - Refresh 0001-Warning-for-FlatHub.patch ==== dracut ==== Version update (112+suse.54.g5c7a104 -> 112+suse.57.g23bbfee) Subpackages: dracut-ima - Update to version 112+suse.57.g23bbfee: * test(FULL-SYSTEMD): remove unnecessary checks for openSUSE * test: prefer test_marker_check over check_qemu_log * fix: replace /boot/dracut with /var/lib/dracut/images in dracut-rpm-tmpfiles.conf ==== ffado ==== Version update (2.4.9 -> 2.5.0) - Update to version 2.5.0: * ffado-mixer: visual and functional improvements; window geometry and state are restored on start, device state can auto-restore. * Fix crossbar router state restoration and setting restoration with multiple devices present. * Support multiple M-Audio ProFire 2626 devices simultaneously via unique GUIDs, with corrected routing tables. * Python type-mismatch and device-nickname fixes. ==== ffmpeg-8 ==== Subpackages: libavcodec62 libavfilter11 libavformat62 libavutil60 libswresample6 libswscale9 - Enable RealAudio Lossless, RealVideo 3.0 and 4.0 decoders. ==== flatpak-kcm6 ==== Version update (6.7.5 -> 6.8.0) - Update to 6.8.0: * New feature release * For more details see https://kde.org/announcements/plasma/6/6.8.0 - No code changes since 6.7.91 - Update to 6.7.91: * New bugfix release * For more details see https://kde.org/announcements/plasma/6/6.7.91 - Changes since 6.7.90: * Show settings for host apps if permission is set - Update to 6.7.90: * New feature release * For more details see https://kde.org/announcements/plasma/6/6.7.90 - Changes since 6.7.5: * Add missing Qt::Qml link * KCM: Port the permissions page to the new Forms * ui/FlatpakPermissions: make env var label and textfield equal width * ui/FlatpakComponent: fix ListView Accessible.description * kcm_app-permissions.json: fix BugReportUrl * Remove xcb session warning * CI: Require all tests to pass * Skip kcm_smoketest with kcmutils < 6.27.0 ==== freetype2 ==== Version update (2.14.3 -> 2.15.0) - Update to 2.15.0 - Important changes * Support for the ISO Open Font Format, Edition 5, including the new 'VARC' table and mixed cubic and conic outline segments * OpenType fonts with more than 65536 glyphs can now be handled * The anti-aliased rasterizer now uses dynamic heap memory for large glyphs, improving performance at sizes above 40 ppem * TrueType version 40 interpreter ClearType rendering improvements - Important security fixes * CVE-2026-27171, bsc#1258392: apply the upstream zlib security fix to the internal gzip code (upstream issue #1468) * More bugs with potential security implications were found and fixed, all users should update - Dropped patches (fixed upstream) * freetype-CVE-2026-50811.patch ==== fwupd ==== Subpackages: libfwupd3 typelib-1_0-Fwupd-2_0 - move Polkit rules into the proper package - package org.freedesktop.fwupd.rules to allow fwupd-refresh.service to succeed for the "fwupd-refresh" service user (bsc#1279948). - add polkit-rules.patch: patch out the "wheel" group part from the Polkit policy, which was the reason for not packaging the rules files previously. ==== ghostscript ==== - Ghostscript version 10.08.0 also fixes in particular the following two security issues, see the Ghostscript upstream git repository checkout of its 'ghostpdl-10.08.0' git tag which ends on Sep 8 2026 (not its 'gs10.08.0' branch which already ends Aug 18 2026), cf. the current https://ghostscript.com/releases/index.html "The latest release is Ghostscript 10.08.0 (2026-09-08)": - CVE-2026-103226 "Stack buffer overflow in gdevpsfx.c type1_callsubr(): unbounded ipstack push in pdfwrite Type 1->2 font converter" https://bugs.ghostscript.com/show_bug.cgi?id=709672 "stack-based buffer overflow in `pdfwrite` via crafted font data" (bsc#1283917) - CVE-2026-101258 "Heap buffer overflow (OOB write) via array-wrapped shading `/Function` (`base/gsfunc3.c`)" https://bugs.ghostscript.com/show_bug.cgi?id=709462 "-dSAFER sandbox bypass via Type 5 shading OOB write and procedure-stream use-after-free" (bsc#1284397) - It seems the reason why the below CVE-2026-39919 and the above two CVE-2026-103226 CVE-2026-101258 are not listed in the Ghostscript upstream release notes is that those CVEs came after the Ghostscript 10.08.0 release date (Sep 8 2026) according to what the Ghostscript upstream bug reports show https://bugs.ghostscript.com/show_bug.cgi?id=709666 therein CVE-2026-39919 is mentioned on 2026-09-15 https://bugs.ghostscript.com/show_bug.cgi?id=709672 therein CVE-2026-103226 is mentioned on 2026-10-01 https://bugs.ghostscript.com/show_bug.cgi?id=709462 therein CVE-2026-101258 is mentioned on 2026-10-07 ==== gpg2 ==== Version update (2.5.22 -> 2.5.24) - Update to 2.5.24: * scd: Fix for regression in 2.5.23 related to the new Nitrokey detection - Update to 2.5.23: * gpg: New option --allow-9980 to enable the processing of RFC-9980 specified data structures. The use of this option is only recommended if external policy requirements demand the use of these governmental approved specification. PGP folks requiring some PQC resistance should keep on using the standard LibrePGP Kyber algorithm introduced 2 years ago * gpg: In 9980 mode support PQC encryption using ML-KEM (aka Kyber) with X448, X25519, Brainpool, or NIST curves as specified by RFC-9980 et al * gpg: In 9980 mode support ED25519 and X25519 as specified by RFC-9580 under the names "ietf27" and "ietf27". * gpg: Add experimental support for a --compliance=fips mode to use GCM for bulk encryption. * scd: Add Nitrokey 3 to pcsc-shared interference detection * gpgsm: Fix an exploitable printf bug when using the debug option "--debug x509" * dirmngr: Make the LDAP upload flags also work for KS_SEARCH * dirmngr: Fix OOB read in DNS CERT record parser * scd: Fix OOB access in DO parsing of faulty cards * dirmngr: Add a mitigation for badly configured web key directories * New option --debug-no-libgcrypt for gpg, gpgsm, and agent This debug option is useful to avoid cluttering other debug output with libgcrypt generated debug details * gpg: New --list-options "debug-show-sexp" to print a secret key as an s-expression - drop patches due to different upstream changes: * gnupg-add-test-cases-for-import-without-uid.patch * gnupg-allow-import-of-previously-known-keys-even-without-UIDs.patch - Rebase patches: * gnupg-add_legacy_FIPS_mode_option.patch * Rebase gnupg-revert-rfc4880bis.patch ==== grub2 ==== Version update (2.14 -> 2.16) Subpackages: grub2-arm64-efi grub2-common grub2-snapper-plugin - Fix PowerPC PCIe NVMe disk discovery (bsc#1239799 ltc#211961 bsc#1245357 ltc#214095) * 0001-ieee1275-ofdisk-fix-NULL-deref-and-use-after-free-in.patch * 0002-ieee1275-ofdisk-enumerate-all-PCIe-NVMe-namespaces.patch - Add upstream patch to fix CDROM boot failures (boo#1282614): * 0001-disk-i386-pc-biosdisk-Fix-retry-of-CDROM-reads.patch - fix typos in description - Fix a potential boot error when loading the synthesized initrd * 0001-Skip-in-place-verifier-for-the-synthesized-initrd.patch - Backport upstream fixes to verify linux initrd in place to avoid the potential OOM (bsc#1275739 bsc#1223982 ltc#206196 jsc#PED-8373) * 0001-kern-file-record-file-type-and-track-in-place-verifi.patch * 0002-verifiers-support-in-place-verification.patch * 0003-tpm-tpcm-mark-TPM-and-TPCM-verifiers-as-in-place-cap.patch * 0004-loader-linux-measure-initrd-in-place.patch * 0005-docs-grub-dev.texi-Document-in-place-verification.patch - Patch refreshed * 0001-clean-up-crypttab-and-linux-modules-dependency.patch * 0009-Add-crypttab_entry-to-obviate-the-need-to-input-pass.patch - fix typos - Update to 2.16 * libgcrypt 1.12.2. * libtasn1 4.21.0. * ML-DSA post-quantum signature support for appended signatures. * Certificate revocation (dbx) checks for appended signatures. * PKCS#7 signedAttrs verification and X.509 validity period checking. * NVMe native disk support. * NVMe over Fibre Channel and multiple NVMe boot paths on IEEE 1275. * virtio-net driver. * AMBA PL011 UART support. * DHCPv6 support and network configuration from the UEFI device path. * Argon2 password hashing for GRUB users and the grub-mkpasswd-argon2 utility. * Access levels for authentication in grub-mkconfig. * MFA key protector. * TPCM (Trusted Platform Control Module) verifier on x86_64 EFI. * New tpm_record_pcrs command exposing a TPM PCR snapshot to the OS. * New efibootnext module and 31_efi_bootnext script for one-shot boot entries. * New connectefi, lsefivar, btrfs-info, btrfs-list-subvols and btrfs-get-default-subvol commands. * Downstream SBAT support and SBAT level validation in grub-mkimage. * Serial port addresses restricted to firmware-described UARTs under lockdown. * Drop UGA Draw and Console Control protocols support. * GitLab CI with multi-architecture builds, clang jobs and weekly Coverity scans. * Cygwin and mingw cross-build fixes. * Filesystems hardening and fixes. * Video readers and font fixes found by fuzzing. * EFI code improvements and fixes. * Network stack fixes. * Coverity and memory leak fixes. * ofpath and grub-install host utility robustness fixes. * Tests improvements. * Documentation improvements. * ... and tons of other fixes and cleanups... - Patch removed * 0001-fs-btrfs-mark-Btrfs-on-disk-structs-as-GRUB_PACKED.patch * 0002-fs-btrfs-add-btrfs-info-command.patch * 0003-fs-btrfs-add-btrfs-list-subvols-command.patch * 0004-fs-btrfs-add-btrfs-get-default-subvol-command.patch * 0001-lvm-allocate-metadata-buffer-from-raw-contents.patch * 0001-net-http-Check-result-of-grub_netbuff_put-in-http_re.patch * 0002-efinet-Add-structures-for-PXE-messages.patch * 0003-efinet-bootp-add-net_dhcp6-command-supporting-dhcpv6.patch * 0004-grub.texi-Add-net_dhcp6-document.patch * 0005-bootp-Process-DHCPACK-packet-during-HTTP-Boot.patch * 0006-efinet-Configure-network-from-UEFI-device-path.patch * 0007-efinet-Set-DNS-server-from-UEFI-protocol.patch * 0008-kern-efi-efi-Print-URI-and-DNS-device-path-info.patch * 0009-kern-efi-efi-Correct-endianness-in-IPv6-device-path.patch * 0010-bootp-Fix-logical-operator-in-DHCP-option-overload-c.patch * 0001-test-Fix-f-test-on-files-over-network.patch * 0002-http-Return-HTTP-status-code-in-http_establish.patch * 0003-docs-Clarify-test-for-files-on-TFTP-and-HTTP.patch * 0004-tftp-Fix-hang-when-file-is-a-directory.patch * 0001-cacheinfo-fix-hit-ratio-calculation-and-statistics-o.patch * 0002-disk-fix-cache-lock-and-hit-counter-for-invalidated-.patch * 0003-disk-reduce-cache-slot-thrashing.patch * 0001-ieee1275-powerpc-implements-fibre-channel-discovery-.patch * 0001-ieee1275-implement-FCP-methods-for-WWPN-and-LUNs.patch * 0001-ieee1275-add-support-for-NVMeoFC.patch * 0002-ieee1275-ofpath-enable-NVMeoF-logical-device-transla.patch * 0003-ieee1275-change-the-logic-of-ieee1275_get_devargs.patch * 0001-Make-grub.cfg-compatible-to-old-binaries.patch * 0001-ieee1275-support-added-for-multiple-nvme-bootpaths.patch * 0001-ofpath-Add-error-check-in-NVMEoF-device-translation.patch * grub2-bls-boot-show-snapshot.patch * 0001-getroot-Skip-mount-points-in-grub_find_device.patch * 0001-00_header-Omit-loading-efi_uga-on-non-x86-EFI-platfo.patch * 0001-Revert-configure-Print-a-more-helpful-error-if-autoc.patch * 0002-Revert-configure-Check-linker-for-image-base-support.patch * 0001-mdraid1x-fix-raid_disks-decoding-on-big-endian-syste.patch * 0001-Mandatory-install-device-check-for-PowerPC.patch * 0001-osdep-linux-ofpath-Update-strstr-calls.patch * 0001-util-probe-Save-strrchr-ret-val-to-const-data-ptr.patch * 0002-util-resolve-Save-str-r-chr-ret-val-to-const-data-pt.patch * gcc16.patch * 0001-lib-hwfeatures-gcry-Fix-write_cr0-writing-to-CR4.patch - Patch rebased * use-grub2-as-a-package-name.patch * info-dir-entry.patch * grub2-sysfb.patch ... changelog too long, skipping 27 lines ... 0001-grub-core-sbat.csv.in-Set-vendor_package_name-to-gru.patch ==== kactivitymanagerd6 ==== Version update (6.7.5 -> 6.8.0) - Update to 6.8.0: * New feature release * For more details see https://kde.org/announcements/plasma/6/6.8.0 - Changes since 6.7.91: * Update version for new release 6.8.0 - Update to 6.7.91: * New bugfix release * For more details see https://kde.org/announcements/plasma/6/6.7.91 - Changes since 6.7.90: * Update version for new release 6.7.91 - Update to 6.7.90: * New feature release * For more details see https://kde.org/announcements/plasma/6/6.7.90 - Changes since 6.7.5: * Update version for new release 6.7.90 * plugins/sqlite: don't drop "applications:" when unlinking * StatsPlugin: escape backslashes in LIKE patterns * Don't concatenate strings when generating SQL for removing resources * Fix URI sanitization * No need to reconnect the timer every time config changes * No need to send the ActivityRemoved signal twice * QSet is not ordered, use contains instead of binary_search * StatsPlugin: Do not crash with wrong dbus calls * Remove warning (found by cmake --warn-uninitialized -Werror=dev ) * Activities: Jump to next activity if it's the current before removing one (kde#521124) * StatsPlugin: fix url-filters breaking with glob patterns * StatsPlugin: Don't try to log events in limbo state (kde#520595) * Update version for new release 6.7.80 ==== kde-cli-tools6 ==== Version update (6.7.5 -> 6.8.0) - Update to 6.8.0: * New feature release * For more details see https://kde.org/announcements/plasma/6/6.8.0 - Changes since 6.7.91: * Update version for new release 6.8.0 - Update to 6.7.91: * New bugfix release * For more details see https://kde.org/announcements/plasma/6/6.7.91 - Changes since 6.7.90: * Update version for new release 6.7.91 - Update to 6.7.90: * New feature release * For more details see https://kde.org/announcements/plasma/6/6.7.90 - Changes since 6.7.5: * Update version for new release 6.7.90 * Remove settings specific to konqueror * Remove warning (found by cmake --warn-uninitialized -Werror=dev ) * kstart: Unset desktop file name (kde#521679) * Force file extensions to be LtR (kde#518909) * Update version for new release 6.7.80 ==== kde-gtk-config6 ==== Version update (6.7.5 -> 6.8.0) Subpackages: kde-gtk-config6-gtk3 - Update to 6.8.0: * New feature release * For more details see https://kde.org/announcements/plasma/6/6.8.0 - Changes since 6.7.91: * Update version for new release 6.8.0 - Update to 6.7.91: * New bugfix release * For more details see https://kde.org/announcements/plasma/6/6.7.91 - Changes since 6.7.90: * Update version for new release 6.7.91 - Update to 6.7.90: * New feature release * For more details see https://kde.org/announcements/plasma/6/6.7.90 - Changes since 6.7.5: * Update version for new release 6.7.90 * preview3: drop unused XEmbed feature * Improve GTK 2 dark theme detection * Drop forceFontDPI handling * CI: Require all tests to pass * Update version for new release 6.7.80 ==== kdecoration6 ==== Version update (6.7.5 -> 6.8.0) Subpackages: libkdecorations3-6 libkdecorations3private2 - Update to 6.8.0: * New feature release * For more details see https://kde.org/announcements/plasma/6/6.8.0 - Changes since 6.7.91: * Update version for new release 6.8.0 - Update to 6.7.91: * New bugfix release * For more details see https://kde.org/announcements/plasma/6/6.7.91 - Changes since 6.7.90: * Update version for new release 6.7.91 - Update to 6.7.90: * New feature release * For more details see https://kde.org/announcements/plasma/6/6.7.90 - Changes since 6.7.5: * Update version for new release 6.7.90 * Remove warning (found by cmake --warn-uninitialized -Werror=dev ) * Mark unused parameter in MockWindow::requestShowWindowMenu * Add support for shadow-only decorations * CI: Require all tests to pass * Fix spaceship operator * Update version for new release 6.7.80 ==== kdeplasma6-addons ==== Version update (6.7.5 -> 6.8.0) - Update to 6.8.0: * New feature release * For more details see https://kde.org/announcements/plasma/6/6.8.0 - Changes since 6.7.91: * Update version for new release 6.8.0 * applets/weather: remove wetter.com ion * wallpapers/potd: remove epod (kde#526633) * applets/weather: show tooltip if no data available * applets/weather: finish envcan forecast request on lookup failure * applets/weather: fix crash in EnvCan when forecast file is missing (kde#512054) * applets/dict: make it look more plasma-style * applets/comic: avoid infinite reload loop (kde#525856) * applets/mediaframe, dictionary: add separators around config views - Update to 6.7.91: * New bugfix release * For more details see https://kde.org/announcements/plasma/6/6.7.91 - Changes since 6.7.90: * Update version for new release 6.7.91 * applets/dict: fix desktop widget at minimum sizes * applets/weather: fix Wetter.com forecast timestamps (kde#520315) * applets/weather: fix bbcukmet location search cancellation - Update to 6.7.90: * New feature release * For more details see https://kde.org/announcements/plasma/6/6.7.90 - Too many changes to list here - Update vendor.tar.zst ==== kernel-source ==== Version update (7.2.9 -> 7.2.11) Subpackages: kernel-64kb kernel-default - Update patches.kernel.org/7.2.7-012-drm-virtio-Fix-a-NULL-vs-ERR_PTR-bug-in-virtio_.patch (bsc#1012628 CVE-2026-98404 bsc#1285556). - Update patches.kernel.org/7.2.7-055-net-iptunnel-fix-stale-transport-header-during-.patch (bsc#1012628 CVE-2026-98401 bsc#1285574). - Update patches.kernel.org/7.2.7-520-exec-do_close_on_exec-before-taking-exec_update.patch (bsc#1012628 CVE-2026-98388 bsc#1285582). - Update patches.kernel.org/7.2.7-574-s390-crypto-Fix-skcipher_walk-return-code-handl.patch (bsc#1012628 CVE-2026-98387 bsc#1285552). - Update patches.kernel.org/7.2.8-028-RDMA-uverbs-Fix-mmap_lock-disassociation_lock-c.patch (bsc#1012628 CVE-2026-98431 bsc#1285559). - Update patches.kernel.org/7.2.8-049-wifi-mwifiex-fix-IRQ-leak-using-wrong-index-in-.patch (bsc#1012628 CVE-2026-98426 bsc#1285562). - Update patches.kernel.org/7.2.8-070-wifi-mac80211-don-t-warn-when-an-IBSS-has-no-ch.patch (bsc#1012628 CVE-2026-98425 bsc#1285567). - Update patches.kernel.org/7.2.8-078-wifi-cfg80211-undo-netns-switch-if-renaming-the.patch (bsc#1012628 CVE-2026-98424 bsc#1285566). - Update patches.kernel.org/7.2.8-081-wifi-mac80211_hwsim-don-t-hand-frames-to-mac802.patch (bsc#1012628 CVE-2026-98423 bsc#1285565). - Update patches.kernel.org/7.2.8-083-wifi-mac80211-reset-the-AP_VLAN-tailroom-counte.patch (bsc#1012628 CVE-2026-98422 bsc#1285561). - Update patches.kernel.org/7.2.8-084-wifi-mac80211-require-a-peer-station-for-TDLS-s.patch (bsc#1012628 CVE-2026-98421 bsc#1285564). - Update patches.kernel.org/7.2.8-098-RDMA-efa-Keep-admin-queues-alive-while-IRQ-is-r.patch (bsc#1012628 CVE-2026-98430 bsc#1285558). - Update patches.kernel.org/7.2.8-099-RDMA-efa-Keep-EQ-resources-alive-while-IRQ-is-r.patch (bsc#1012628 CVE-2026-98429 bsc#1285563). - Update patches.kernel.org/7.2.8-137-ALSA-usb-6fire-Avoid-embedded-URBs.patch (bsc#1012628 CVE-2026-98428 bsc#1285560). - Update patches.kernel.org/7.2.8-141-ksmbd-follow-SMB2-session-expiration-semantics.patch (bsc#1012628 CVE-2026-98420 bsc#1285557). - Update patches.kernel.org/7.2.8-185-drop_monitor-fix-out-of-bounds-write-in-reset_p.patch (bsc#1012628 CVE-2026-98419 bsc#1285555). - Update patches.kernel.org/7.2.8-204-net-sched-codel-bound-the-dropping-loop-per-deq.patch (bsc#1012628 CVE-2026-98427 bsc#1285572). - Update patches.kernel.org/7.2.8-226-sched-core-Avoid-false-migration-warning-for-pr.patch (bsc#1012628 CVE-2026-98418 bsc#1285576). - Update patches.kernel.org/7.2.8-289-dmaengine-ti-k3-udma-glue-fix-NULL-dereference-.patch (bsc#1012628 CVE-2026-98416 bsc#1285569). - Update patches.kernel.org/7.2.8-308-soc-samsung-exynos-pmu-fix-use-after-free-of-in.patch (bsc#1012628 CVE-2026-98415 bsc#1285578). - Update patches.kernel.org/7.2.8-310-memcg-avoid-charging-the-root-memcg-from-obj_cg.patch (bsc#1012628 CVE-2026-98414 bsc#1285580). - Update patches.kernel.org/7.2.8-373-watchdog-da9063-fix-suspend-resume-handling-of-.patch (bsc#1012628 CVE-2026-98410 bsc#1285587). - Update patches.kernel.org/7.2.8-385-wifi-rsi-fix-heap-OOB-write-on-key-removal.patch (bsc#1012628 CVE-2026-98407 bsc#1285553). - Update patches.kernel.org/7.2.8-426-smb-client-fix-missing-iov-bounds-check-in-pars.patch (bsc#1012628 CVE-2026-98405 bsc#1285583). - Update patches.kernel.org/7.2.9-398-sched-cache-Decouple-sched_cache_group-from-mm-.patch (bsc#1012628 CVE-2026-98385 bsc#1285039). suse-add-cves - commit 308af37 - Linux 7.2.11 (bsc#1012628). - HID: steam: Clean up locking (bsc#1012628). - HID: steam: Refactor registration (bsc#1012628). - HID: steam: Rearrange teardown sequence (bsc#1012628). - HID: steam: Fully unregister controller when hidraw is opened (bsc#1012628). - mm/mremap: fix locked_vm leak from MREMAP_DONTUNMAP self-merge (bsc#1012628). - io_uring/kbuf: don't charge provided buffer rings to RLIMIT_MEMLOCK (bsc#1012628). - io_uring: do not charge the SQ/CQ rings to RLIMIT_MEMLOCK (bsc#1012628). - io_uring/memmap: account the pages a compound region really uses (bsc#1012628). - drm/amd/display: Don't replace a sink mode that shares the native totals (bsc#1012628). - sched_ext: Call ops.dequeue() when a task arrives on a remote local DSQ (bsc#1012628). - sched_ext: Generate qseq from a per-task counter (bsc#1012628). - drm/vc4: Fix binner slot allocation failing on an idle GPU (bsc#1012628). - drm/vc4: Disable the V3D interrupt across runtime suspend ... changelog too long, skipping 1953 lines ... - commit 8c0ce5c ==== kglobalacceld6 ==== Version update (6.7.5 -> 6.8.0) Subpackages: libKGlobalAccelD6-0 - Update to 6.8.0: * New feature release * For more details see https://kde.org/announcements/plasma/6/6.8.0 - Changes since 6.7.91: * Update version for new release 6.8.0 - Update to 6.7.91: * New bugfix release * For more details see https://kde.org/announcements/plasma/6/6.7.91 - Changes since 6.7.90: * Update version for new release 6.7.91 * Drop obsolete KF6WindowSystem dependency - Update to 6.7.90: * New feature release * For more details see https://kde.org/announcements/plasma/6/6.7.90 - Changes since 6.7.5: * Update version for new release 6.7.90 * Implement setInverseShortcutActions D-Bus method and config storage * kglobalaccel_version_header is never defined * Dissolve KGlobalAccelInterface * Drop PACKAGE_INCLUDE_QCHTARGETS from CMake config * Drop desktop file * Remove Qt6Widgets from config file * Normalize various empty shortcut formats to empty set * Normalize Backtab to Shift+Tab * Improve GlobalShortcut lookups * Fix normalization of modifier-only shortcuts * Drop plugin loading * Drop GlobalShortcutsRegistry::setDBusPath * Drop KGlobalAccelInterface::grabKey() * Drop Xorg bits * CI: Require all tests to pass * Make actionList report information about GlobalShortcut with the smallest serial * Port GlobalShortcut away from GlobalShortcutsRegistry::getShortcutByKey() * Make GlobalShortcutsRegistry::getShortcutsByKey() report all matching shortcuts * Refactor how Component objects are created at runtime * Fix loading settings from null KConfigGroup * Update version for new release 6.7.80 * Workaround kglobalacceld not grabbing some modifier-only combinations (kde#520100) ==== kinfocenter6 ==== Version update (6.7.5 -> 6.8.0) - Update to 6.8.0: * New feature release * For more details see https://kde.org/announcements/plasma/6/6.8.0 - Changes since 6.7.91: * Update version for new release 6.8.0 - Update to 6.7.91: * New bugfix release * For more details see https://kde.org/announcements/plasma/6/6.7.91 - Changes since 6.7.90: * Update version for new release 6.7.91 * CommandOutputKCM: Fix wrapping (kde#523197) * Add a tad more info to libva-utils's set_package_properties - Update to 6.7.90: * New feature release * For more details see https://kde.org/announcements/plasma/6/6.7.90 - Too many changes to list here ==== kmenuedit6 ==== Version update (6.7.5 -> 6.8.0) - Update to 6.8.0: * New feature release * For more details see https://kde.org/announcements/plasma/6/6.8.0 - Changes since 6.7.91: * Update version for new release 6.8.0 - Update to 6.7.91: * New bugfix release * For more details see https://kde.org/announcements/plasma/6/6.7.91 - Changes since 6.7.90: * Update version for new release 6.7.91 * guard m_desktopFile (kde#525598) - Update to 6.7.90: * New feature release * For more details see https://kde.org/announcements/plasma/6/6.7.90 - Changes since 6.7.5: * Update version for new release 6.7.90 * update version for new release * menufile: Replace deprecated QDomDocument::setContent * Increase KDE_COMPILERSETTINGS_LEVEL to 6.13 * Replace Qt's deprecated foreach / Q_FOREACH * Use nulltpr instead of 0 * Use Q_EMIT instead of emit * update version for new release * Remove frames around qgroupbox elements * update version for new release * treeview: don't create desktop file names with invalid characters * CI: Require all tests to pass * Update version for new release 6.7.80 ==== knighttime6 ==== Version update (6.7.5 -> 6.8.0) Subpackages: libKNightTime0 - Update to 6.8.0: * New feature release * For more details see https://kde.org/announcements/plasma/6/6.8.0 - Changes since 6.7.91: * Update version for new release 6.8.0 - Update to 6.7.91: * New bugfix release * For more details see https://kde.org/announcements/plasma/6/6.7.91 - Changes since 6.7.90: * Update version for new release 6.7.91 - Update to 6.7.90: * New feature release * For more details see https://kde.org/announcements/plasma/6/6.7.90 - Changes since 6.7.5: * Update version for new release 6.7.90 * CI: Require all tests to pass * Update version for new release 6.7.80 ==== kpipewire6 ==== Version update (6.7.5 -> 6.8.0) Subpackages: kpipewire6-imports libKPipeWire6 libKPipeWireDmaBuf6 libKPipeWireRecord6 - Update to 6.8.0: * New feature release * For more details see https://kde.org/announcements/plasma/6/6.8.0 - Changes since 6.7.91: * Update version for new release 6.8.0 - Update to 6.7.91: * New bugfix release * For more details see https://kde.org/announcements/plasma/6/6.7.91 - Changes since 6.7.90: * Update version for new release 6.7.91 * Fix compile with clang and KPIPEWIRE_DEPRECATED - Update to 6.7.90: * New feature release * For more details see https://kde.org/announcements/plasma/6/6.7.90 - Too many changes to list here ==== kscreen6 ==== Version update (6.7.5 -> 6.8.0) - Update to 6.8.0: * New feature release * For more details see https://kde.org/announcements/plasma/6/6.8.0 - Changes since 6.7.91: * Update version for new release 6.8.0 - Update to 6.7.91: * New bugfix release * For more details see https://kde.org/announcements/plasma/6/6.7.91 - Changes since 6.7.90: * Update version for new release 6.7.91 * fix info button for sRGB color intensity (kde#525540) * Force StackLayout the same height as the hint of the current item (kde#525718) - Update to 6.7.90: * New feature release * For more details see https://kde.org/announcements/plasma/6/6.7.90 - Too many changes to list here ==== kscreenlocker6 ==== Version update (6.7.5 -> 6.8.0) Subpackages: libKScreenLocker6 - Update to 6.8.0: * New feature release * For more details see https://kde.org/announcements/plasma/6/6.8.0 - Changes since 6.7.91: * Update version for new release 6.8.0 * Remove attemptCount in KSldApp::lock() * Always send DBus replies immediately (kde#525900) * Fix screenlocker showing up when switching users (kde#525765) - Update to 6.7.91: * New bugfix release * For more details see https://kde.org/announcements/plasma/6/6.7.91 - Changes since 6.7.90: * Update version for new release 6.7.91 * Adding "Switch to Last-Used Keyboard Layout" to the shortcut exceptions list. * greeter: allow dumping when debugging is enabled * prctls: set dumpable as long * prctls: drop unused include * worker: set dumpable prctl * cmake: drop unused header checks * greeter: use new prctls.h and make it a namespace * diewithparent: rename to prctls * greeter: tighten fingerprint setup conditions * worker: break apart main a bit * diewithparent: change conditions around * worker: use out_ptr * worker: harden against unexpected stdin problems * worker: exit if we are orphaned at startup * worker: exit if dieWithParent doesn't work * Drop obsolete Wayland dependencies - Update to 6.7.90: * New feature release * For more details see https://kde.org/announcements/plasma/6/6.7.90 - Too many changes to list here ==== ksshaskpass6 ==== Version update (6.7.5 -> 6.8.0) - Update to 6.8.0: * New feature release * For more details see https://kde.org/announcements/plasma/6/6.8.0 - Changes since 6.7.91: * Update version for new release 6.8.0 - Update to 6.7.91: * New bugfix release * For more details see https://kde.org/announcements/plasma/6/6.7.91 - Changes since 6.7.90: * Update version for new release 6.7.91 - Update to 6.7.90: * New feature release * For more details see https://kde.org/announcements/plasma/6/6.7.90 - Changes since 6.7.5: * Update version for new release 6.7.90 * Consider password incorrect when same SSH process asks the same prompt again * Delete password when remember is unchecked * Add custom ClearText dialog (kde#343562) * Drop window title * Don't offer to remember password without identifier * Handle when unknown host prompt has no period after the finger print * Handle unknown host when key is known for someone else * Support ssh-keygen (kde#485418) * Support unknown RSA when it has a colon (kde#444862) * Add autotest * Split prompt into its own static library * Add BSD-3-Clause license * prompt: Fix password change prompts * CI: Require all tests to pass * Update version for new release 6.7.80 ==== ksystemstats6 ==== Version update (6.7.5 -> 6.8.0) - Update to 6.8.0: * New feature release * For more details see https://kde.org/announcements/plasma/6/6.8.0 - Changes since 6.7.91: * Update version for new release 6.8.0 - Update to 6.7.91: * New bugfix release * For more details see https://kde.org/announcements/plasma/6/6.7.91 - Changes since 6.7.90: * Update version for new release 6.7.91 * Remove unused variable in Xe Plugin - Update to 6.7.90: * New feature release * For more details see https://kde.org/announcements/plasma/6/6.7.90 - Changes since 6.7.5: * Update version for new release 6.7.90 * Fix i915 PMU path for discrete Intel GPUs (kde#517334) * osinfo: Provide some fallbacks for the version property (kde#523727) * Fix crashes in KSysGuard::SensorObject::id() * CMake: Provide explicit WITH_NM option for KF6NetworkManagerQt dep * Updated variable naming to be correct! * Add VRAM percentage sensors. * Guard ksystemstats_intel_helper against path traversal * Enable LSAN in CI * CI: Require all tests to pass * Harden Xe GPU plugin and adapt to PCI-based GPU enumeration * Address David's review feedback on Xe GPU support * Add fan, VRAM temperature, and power sensors for Xe GPUs * Move VRAM querying from Xe helper to LinuxXeGpu * Add Intel Xe GPU driver support (kde#512866) * Update version for new release 6.7.80 ==== kwayland-integration6 ==== Version update (6.7.5 -> 6.8.0) - Update to 6.8.0: * New feature release * For more details see https://kde.org/announcements/plasma/6/6.8.0 - Changes since 6.7.91: * Update version for new release 6.8.0 - Update to 6.7.91: * New bugfix release * For more details see https://kde.org/announcements/plasma/6/6.7.91 - Changes since 6.7.90: * Update version for new release 6.7.91 - Update to 6.7.90: * New feature release * For more details see https://kde.org/announcements/plasma/6/6.7.90 - Changes since 6.7.5: * Update version for new release 6.7.90 * Enable LSAN in CI * CI: Require all tests to pass * Drop FreeBSD CI * Update version for new release 6.7.80 ==== kwayland6 ==== Version update (6.7.5 -> 6.8.0) Subpackages: libKWaylandClient6 - Update to 6.8.0: * New feature release * For more details see https://kde.org/announcements/plasma/6/6.8.0 - Changes since 6.7.91: * Update version for new release 6.8.0 - Update to 6.7.91: * New bugfix release * For more details see https://kde.org/announcements/plasma/6/6.7.91 - Changes since 6.7.90: * Update version for new release 6.7.91 - Update to 6.7.90: * New feature release * For more details see https://kde.org/announcements/plasma/6/6.7.90 - Changes since 6.7.5: * cmake: bump plasma-wayland-protocols dep to 1.22.0 * Update version for new release 6.7.90 * Bump required libwayland version * Add support for wl_fixes.ack_global_remove * Fix cmake using --warn-uninitialized -Werror=dev * Remove obsolete doxygen file * Enable LSAN in CI * CI: Require all tests to pass * Update version for new release 6.7.80 * Does not build without PlasmaWaylandProtocols 1.21.0 ==== kwin6 ==== Version update (6.7.5 -> 6.8.0) Subpackages: libkwin6 - Add patch to fix some alpha compositing issues: * 0001-opengl-gltexture-use-swizzles-to-ignore-non-existent.patch - Update to 6.8.0: * New feature release * For more details see https://kde.org/announcements/plasma/6/6.8.0 - Changes since 6.7.91: * wayland/seat: actually update the effective pointer focus surface * wayland/seat: fix implicit pointer grabs on subsurfaces * autotests/integration: add test cases for implicit pointer grabs * plugins/slowkeys: Remove unused KF6::WindowSystem dependency * plugins/slowkeys: Cleanup includes * plugins/slowkeys: Fix sending the released events (kde#523419) * plugins/slowkeys: Use Q_UNREACHABLE_RETURN * wayland/pointerconstraints_v1: don't require a commit for locking or unlocking (kde#526010) * autotests/integration: add an autotest for pointer warping with pointer locks * Add KWIN_WAYLAND_SUPPORT_COMMIT_TIMING_V1 environment variable * Update version for new release 6.8.0 * xwayland: Ensure that we always reset Selection::m_waylandSource * wayland/pointerwarp: also set the locked pointer position to the warp request (kde#524804) * plugins/screencast: Fix crash in OutputScreenCastSource::render() and RegionScreenCastSource::render() * plugins/screenshot: Make opengl context current in ScreenshotLayer::beginFrame() * plugins/screenshot: Fix a crash in CaptureScreen() * utils/svgcursorreader: Render at device resolution to avoid blurry filtered cursors (kde#526691) * backends/drm: don't use 3x4 Matrix for YUV conversions yet * backends/drm: fix BT2020 fixed matrix enum strings * backends/drm: add support for YCbCr->RGB conversion in color pipelines * helpers/dialoghelper: Fix build without XCB * helpers/killer: Fix build without XCB * Remove xcb/xcb.h include in shadow.h (kde#526689) * qpa: use a single persistent OpenGL context for Qt (kde#522424) * screencast: Avoid plasmashell windows from being hidden * Remove stray xcb/xcb.h include (kde#526250) * core/udmabufallocator: pad buffer sizes to 64 pixels * effectloader: Warn when an effect was built for another KWin version * opengl/eglbackend: don't limit format+modifiers of the main GPU to Vulkan * Fix QTP0004 warnings * Port away from JSON_ keywords in ecm_setup_qtplugin_macro_names() * Use QT_NO_PLUGIN with ecm_add_qml_module() * Set CMP0127 policy * Fix leaking EI events * helpers/wayland_wrapper: skip wayland-0 * xkb: Manage compose table using unique_ptr * xkb: Use unique_ptr to manage state * xkb: Use unique_ptr to manage keymaps * wayland: Implement kde-output-device-v2 v26 (kde#525314) * plugins/screenshot: make the context current after prePaint (kde#524840) * Revert "Enable ASAN" * plugins/screencast: don't hide the portal's windows from the screencast * opengl/eglcontext: request realtime priority when possible * Revert "backends/drm,virtual: don't render on virtual outputs for screencasts" * Revert "wayland: destroy mode resources when the output device resource is released" * Enable ASAN - Update to 6.7.91: * New bugfix release * For more details see https://kde.org/announcements/plasma/6/6.7.91 - Too many changes to list here - Update to 6.7.90: * New feature release * For more details see https://kde.org/announcements/plasma/6/6.7.90 - Too many changes to list here ==== layer-shell-qt6 ==== Version update (6.7.5 -> 6.8.0) Subpackages: libLayerShellQtInterface6 - Update to 6.8.0: * New feature release * For more details see https://kde.org/announcements/plasma/6/6.8.0 - Changes since 6.7.91: * Update version for new release 6.8.0 - Update to 6.7.91: * New bugfix release * For more details see https://kde.org/announcements/plasma/6/6.7.91 - Changes since 6.7.90: * Update version for new release 6.7.91 - Update to 6.7.90: * New feature release * For more details see https://kde.org/announcements/plasma/6/6.7.90 - Changes since 6.7.5: * Update version for new release 6.7.90 * CI: Require all tests to pass * Update version for new release 6.7.80 ==== libX11 ==== Version update (1.8.13 -> 1.8.14) Subpackages: libX11-6 libX11-data libX11-xcb1 - Update to 1.8.13; this release includes: * ximcp: bound XIM_OPEN_REPLY attribute lengths (CVE-2026-94283) (!310) * ximcp: bound XIM_REGISTER_TRIGGERKEYS keylist lengths (CVE-2026-94284) (!310) * lcGenConv: bound byteM_parse_codeset() reads (CVE-2026-94285) (!310) * xkb: Check the keysym range in _XkbReadKeyActions (CVE-2026-88806) (!309) * OpenDisplay: avoid NULL dereference in out-of-memory error path (!307) * XSetFontPath: zero-initialize packed font path buffer (#248, !306) * _XSend: treat xcb_writev returning 0 as failure (!305) * _XSend: discard the output buffer after an I/O error (!305) * XkbSetIndicatorMap: avoid undefined behavior due to left shift (#246, !304) * nls: Add ca_ES.UTF-8@valencia locale (#234, !303) * Xutil.h: add include of Xresource.h (#242, !302) * xkb: fix incorrect size check when growing doodads in a section (!300) * XlibInt.c: use correct type for Win32 in SocketBytesReadable() (!299) * XlibInt.h: prevent Win32 CreateWindow macro from leaking into our code (!299) - superseded the following patches: * 0001-1281653_CVE-2026-94283_ximcp-bound-XIM_OPEN_REPLY-attribute-lengths-to-the-.patch * 0002-1281657_CVE-2026-94284_ximcp-bound-XIM_REGISTER_TRIGGERKEYS-keylist-lengths.patch * 0003-1281661_CVE-2026-94285_lcGenConv-bound-byteM_parse_codeset-reads-to-remaini.patch * u_xkb-Check-the-keysym-range-in-_XkbReadKeyActions-CVE.patch ==== libXi ==== Version update (1.8.3 -> 1.8.4) - Update to version 1.8.4 * This release includes the fixes for the issues listed in https://lists.x.org/archives/xorg-announce/2026-October/003752.html as well as additional hardening and bug fixes. - supersedes the following patches: * 0001-boo1281605_CVE-2026-93541_XQueryDeviceState-check-ValuatorClass-num_valuators-.patch * 0002-boo1281606_CVE-2026-93542_size_classes-copy_classes-bound-XI2-class-lengths-to.patch * 0003-boo1281608_CVE-2026-93543_size_classes-copy_classes-enforce-XI2-per-type-class.patch * 0004-boo1281609_CVE-2026-93544_XIQueryDevice-keep-padded-name-and-class-bytes-withi.patch * 0005-boo1281612_CVE-2026-93545_XListInputDevices-validate-device-name-lengths-again.patch * 0006-boo1281615_CVE-2026-94281_XListInputDevices-validate-class-lengths-cumulativel.patch * 0007-boo1281651_CVE-2026-94282_wireToEnterLeave-validate-buttons_len-against-the-re.patch * boo1285084_CVE-2026-109089_XGetDeviceControl-require-reply-control-to-match-the.patch * boo1285085_CVE-2026-109090_XGetDeviceControl-size-DEVICE_ENABLE-replies-for-XDe.patch - boo1285084_CVE-2026-109089_XGetDeviceControl-require-reply-control-to-match-the.patch * XGetDeviceControl Control Type Mismatch Heap Buffer Overflow (bsc#1285084, CVE-2026-109089) - boo1285085_CVE-2026-109090_XGetDeviceControl-size-DEVICE_ENABLE-replies-for-XDe.patch * XGetDeviceControl DEVICE_ENABLE Heap Buffer Overflow (bsc#1285085, CVE-2026-109090) ==== libXpm ==== Version update (3.5.18 -> 3.5.20) - Update to 3.5.20 * This release fixes CVE-2026-94287. For more information, see the advisory: https://lists.x.org/archives/xorg-announce/2026-October/003752.html - supersedes the following patches * 0001-boo1281669_CVE-2026-94287_ParsePixels-reject-zero-dimension-XPM-images.patch * 0001-Fix-CVE-2026-4367-Out-of-bounds-read-in-xpmNextWord.patch ==== libXrender ==== Version update (0.9.12 -> 0.9.13) - Update to version 0.9.13 * This release fixes CVE-2026-88807. For more information, see the advisory: https://lists.x.org/archives/xorg-announce/2026-October/003752.html - supersedes u_Check-numSubpixel-against-numScreens-to-avoid-OOB-wr.patch ==== libXtst ==== Version update (1.2.5 -> 1.2.6) - Update to version 1.2.6 * This release provides fixes for CVE-2026-94286 & CVE-2026-109088 - supersedes the following patches: * 0001-boo1281665_CVE-2026-94286_parse_reply_call_callback-check-element-size-against.patch * boo1285083_CVE-2026-109088_parse_reply_call_callback-reject-zero-progress-RECOR.patch - boo1285083_CVE-2026-109088_parse_reply_call_callback-reject-zero-progress-RECOR.patch * libXtst RECORD EnableContext Reply Endless Loop (boo#1285083, CVE-2026-109088) ==== libbpf ==== Version update (1.7.0 -> 1.8.0) - Update to version 1.8.0 * Add f{entry,exit,session}.multi support on x86-64 * Add tp.s/raw_tp.s/tp_btf.s (sleepable) support * Support attaching struct_ops maps to cgroups * Support reading BPF streams through pollable fds * Support custom loads of individual programs from prepared BPF objects * Add helpers to change specific program flags while preserving others * Support kernel logs for map creation and fd-based uprobe_multi targets * Add BTF kind layouts, 24-bit vlen, and location kinds * Add type lookup within the current BTF object * Add allowlist for kernel module BTF loading * Emit BTF declaration tags as C attributes * Add .percpu global variable and callx (indirect call) support * Optimize nop/nop10 USDTs on Linux 7.3+, use regular uprobes otherwise - Update %license to LICENSE.LGPL-2.1-only ==== libeconf ==== Version update (0.8.5 -> 0.8.6) - Update to version 0.8.6: * Add new option DEFAULT_QUOTES for econf_newKeyFile_with_options. * NEW API calls: econf_hasQuotes, econf_setQuotes ==== libheif ==== Version update (1.23.5 -> 1.23.6) - description typo fixes - Add optional vvenc plugin - Update to version 1.23.6: * Security fixes: + (GHSA-h4h8-qgvc-m7r2) Memory exhaustion in the OpenJPEG decoder plugin through the tile and component counts of a JPEG 2000 codestream. + (GHSA-fcmw-5764-7rq8) Memory exhaustion in the uncompressed (unci) decoder with generic compression. + (GHSA-6fqc-p7r8-2g36) CPU exhaustion in the unci decoder with generic compression. + (GHSA-q7mw-2fmm-5q94) Heap out-of-bounds read in libsharpyuv through sample values above the bit depth of an image. + (GHSA-vv35-6hxg-95x8) The bit depth that an image handle reports could differ from the bit depth of the decoded image, so that an application reading the planes with the bit depth of the handle read out of bounds. + (GHSA-8p2c-9wv4-rx4p) Null pointer dereference when decoding an image sequence in which a chunk of a visual track references a non-visual sample entry. + (GHSA-86ch-j429-fpr2) With the FFmpeg decoder plugin, the image size limit was not reliably applied before an HEVC bitstream reached FFmpeg, so a file could make the decoder allocate buffers for a much larger picture than its ispe property declares. + (GHSA-3gwx-cjv4-jr74) Reachable assertion when decoding a grid image whose tiles have an alpha plane of more than 16 bits, which unci tiles can have since v1.22.0. + (GHSA-hqpw-h8p6-22q9) Heap out-of-bounds read of up to 6 bytes in the FFmpeg decoder plugin. + (GHSA-hvwh-xpj6-ph5x) Use after free of an error message in the WebP (since v1.22.1) and raw (since v1.22.0) input loaders of heif-enc. + (GHSA-v5rj-g4wv-j5w3) Decoded images could contain sample values above their declared bit depth. * For hardening, bug fixes and behavior changes, please see: https://github.com/strukturag/libheif/releases/tag/v1.23.6 - fix typo ==== libkscreen6 ==== Version update (6.7.5 -> 6.8.0) Subpackages: libKF6Screen8 libKF6ScreenDpms8 libkscreen6-plugin - Update to 6.8.0: * New feature release * For more details see https://kde.org/announcements/plasma/6/6.8.0 - Changes since 6.7.91: * Update version for new release 6.8.0 * test: Give config operation time to finish * backends/kwayland: Implement kde_output_device_mode_v2 - Update to 6.7.91: * New bugfix release * For more details see https://kde.org/announcements/plasma/6/6.7.91 - Changes since 6.7.90: * Update version for new release 6.7.91 * Remove XcbDpmsHelper and XCB::DPMS dependency * Make XCB a required dependency * Drop obsolete libxcb-randr dependency - Update to 6.7.90: * New feature release * For more details see https://kde.org/announcements/plasma/6/6.7.90 - Too many changes to list here ==== libksysguard6 ==== Version update (6.7.5 -> 6.8.0) Subpackages: ksysguardsystemstats6-data libKSysGuardSystemStats2 libksysguard6-imports - Add patch to disable one-shot rescheduling for now, security review not complete yet (boo#1281596): * 0001-Drop-org.kde.ksysguard.processlisthelper.applyschedu.patch - Update to 6.8.0: * New feature release * For more details see https://kde.org/announcements/plasma/6/6.8.0 - Changes since 6.7.91: * Update version for new release 6.8.0 * processcore/gpu: don't include GTT memory as GPU memory * processcore/gpu: don't double count GPU memory total/resident/memory drm keys (kde#525481) - Update to 6.7.91: * New bugfix release * For more details see https://kde.org/announcements/plasma/6/6.7.91 - Changes since 6.7.90: * Update version for new release 6.7.91 * Elide text in Choices header (kde#525825) * GroupedText: Force heading to be plain text - Update to 6.7.90: * New feature release * For more details see https://kde.org/announcements/plasma/6/6.7.90 - Changes since 6.7.5: * Update version for new release 6.7.90 * Add missing include * processcore: add ProcessController::applyScheduling for one-shot rescheduling * systemstats: don't keep dangling SensorObject pointers in SensorContainer (kde#523562) * Remove obsolete doxygen file * processcore: add functionality to set CPU affinity (kde#429151) * Fix precision for doubles passed as strings (kde#521041) * processcore: Do not return unformatted data for formatted data in ProcessSensor * Update version for new release 6.7.80 ==== libplasma6 ==== Version update (6.7.5 -> 6.8.0) Subpackages: libplasma6-components libplasma6-desktoptheme - Update to 6.8.0: * New feature release * For more details see https://kde.org/announcements/plasma/6/6.8.0 - Changes since 6.7.91: * Update version for new release 6.8.0 * plasmaextracomponents: use tooltipdelay in ActionTextField * EdgeEventForwarder: Avoid potential recursion (kde#501289) * declarativeimports/core: allow keeping tooltip open when clicked * declarativeimports/plasmaextracomponents: PasswordField a11y/tooltip (kde#525790) - Update to 6.7.91: * New bugfix release * For more details see https://kde.org/announcements/plasma/6/6.7.91 - Changes since 6.7.90: * Update version for new release 6.7.91 * declarative/plasmacomponents: make focused TabButton less linky * Corona: add a signal when isUiReady changes for any containment - Update to 6.7.90: * New feature release * For more details see https://kde.org/announcements/plasma/6/6.7.90 - Too many changes to list here ==== libsndfile ==== - Add another fix for CVE-2022-33065: libsndfile-CVE-2022-33065-2.patch - Fix misaligned memory access issue in psf_binheader_readf() (bsc#1282670, CVE-2026-88386) libsndfile-CVE-2026-88386.patch ==== live555 ==== Version update (2026.08.25 -> 2026.10.13) Subpackages: libBasicUsageEnvironment2 libUsageEnvironment3 libgroupsock33 libliveMedia120 - Update to version 2026.10.13: * Updated the "H263plusVideoRTPSource" code to protect against a malicious series of incoming packets possibly overflowing a buffer. ==== llvm23 ==== Version update (23.1.2 -> 23.1.3) - Update to version 23.1.3. * This release contains bug-fixes for the LLVM 23.1.0 release. This release is API and ABI compatible with 23.1.0. ==== microos-tools ==== Version update (4.0+git29 -> 4.0+git31) Subpackages: man-online selinux-autorelabel zypp-excludedocs zypp-no-multiversion zypp-no-recommends zypp-single-rpmtrans - Update to version 4.0+git31: * Make sure $ROOT_SELINUX/etc is read-write * import-pubring: use temp dir and kill agents afterwards ==== milou6 ==== Version update (6.7.5 -> 6.8.0) - Update to 6.8.0: * New feature release * For more details see https://kde.org/announcements/plasma/6/6.8.0 - Changes since 6.7.91: * Update version for new release 6.8.0 * lib/ResultDelegate: explicitly pass unhandled Tab presses (kde#387951) * plasmoid: also reset currentItem on open, and clean up a bit * plasmoid: allow going back to search field using arrow keys * lib/ResultsView: don't accept edge arrows without keyNavigationWraps - Update to 6.7.91: * New bugfix release * For more details see https://kde.org/announcements/plasma/6/6.7.91 - Changes since 6.7.90: * Update version for new release 6.7.91 - Update to 6.7.90: * New feature release * For more details see https://kde.org/announcements/plasma/6/6.7.90 - Changes since 6.7.5: * Update version for new release 6.7.90 * plasmoid: add BugReportUrl * lib/ResultsView: consider all data changes results (kde#521598) * Enable LSAN in CI * Update version for new release 6.7.80 ==== oath-toolkit ==== Version update (2.6.14 -> 2.6.15) Subpackages: liboath0 libpskc0 oath-toolkit-xml pam_oath - Update to version 2.6.15 * oathtool: Add --hex which correspond to the long-time default behaviour. * oathtool: Reject --hotp --totp instead of treating it as --totp. * oathtool: Reject further nonsense parameter combinations. Combining --hotp with --time-step-size, --start-time, or --now does not make sense. Combining --totp with --counter does not make sense. All these are now rejected as user errors. * libpskc: Fix PSKC signature verification bypass. See https://oath-toolkit.codeberg.page/CVE-2026-109117.html ==== open-vm-tools ==== Subpackages: libvmtools0 - Fix build with containerd 2.3.3 (boo#1284086): Update detect-suse-location.patch to locate the containerd grpc protobuf definitions in the new github.com/containerd/containerd/v2 module directory, and to no longer require the gogo protobuf extensions, which were dropped in containerd 2. The previous containerd 1.x layout is still detected and supported. ==== openssh ==== Version update (10.5p1 -> 10.6p1) Subpackages: openssh-clients openssh-common openssh-server - Update to openssh 10.6p1: = Future deprecation notice * scp(1): begin deprecating the -R flag, which is used to perform a remote-to-remote copy by executing scp on a remote host. This option is a fragile optimisation that is difficult to use because it requires credentials on the remote host. It also creates security risks if the shell quoting rules on the remote system where the copy is performed differ from the client's expectations. From OpenSSH 10.6, this option will continue to work but will cause a deprecation warning to be emitted to standard error. In a future release, the option will be ignored and will leave in place the default remote-to-remote copy behaviour (copy via the host running scp). * sshd(8): support for platforms that do not allow file descriptor passing and that also require root privilege for PTY allocation will be removed in a future release. Affected platforms are known to include SCO OpenServer 5 and QNX 6 but may include other similarly old operating systems. This deprecation can be avoided if the user community for these platforms is able to assist us in building alternatives, such as avoiding the need for root in PTY allocation. = Potentially-incompatible changes * ssh(1), sshd(8): compression will be less effective as a result of the change noted below in the "Security" section * ssh(1): destination usernames entered on the commandline are now more strictly checked and will refuse usernames that include backslash and dollar symbols. Usernames that are specified by the "User" directive in configuration files are not subject to these restrictions. The motivation for this change is mentioned below in the "Security" section. * sshd(8): on platforms that do not support file descriptor passing and that require root for PTY allocation, the GatewayPorts and StreamLocalForwarding options are forcibly disabled. The motivation for this change is discussed below in the "Security" section. = Security * sftp(1): more strictly validate paths returned from the server to avoid some cases where a server could return paths that could manipulate a recursive copy operation into writing outside its target directory. Report and patch from Junghoon Cho. * sshd(8): when GSSAPIAuthentication is in use, only store GSSAPI credentials when authentication has succeeded. Avoids a situation where credentials from a failed GSSAPIAuthentication attempt may persist and be made inappropriately available if another authentication subsequently succeeds. Issue report and patch from Moritz Theile. * sshd(8): reset GSSAPIAuthentication before authentication, avoiding state from one authentication attempt being confused with that of a later attempt. Report and feedback from Moritz Theile. * sshd(8), ssh(1): disable LZ77 dictionary coder to mitigate the side-channel leaks described in "Crossing the Streams: SSH Plaintext Recovery via a Common Compression Context in Multiplexed Channels" by Fabian Bäumer and Marcus Brinkmann, preprint https://arxiv.org/abs/2609.07709 (2026) A chosen-plaintext attack method exists which makes use of dictionary-based compression to recover secrets from one channel by interacting with the SSH session's shared compression dictionary through another channel. Attacker-controlled input can recognizably reflect into the total length of transmitted ciphertexts by virtue of LZ77 replacing repeated strings with back-references into the SSH session's encoder search buffer, which is shared across all channels. For this reason, the documentation already recommended against enabling compression for connections that share trusted and untrusted traffic. This change will reduce the effectiveness of the Compression option. Users are encouraged to use application-level compression over the SSH protocol where possible, as this will typically be more effective and will be completely immune to this type of attack. * ssh(1): disallow '$' and '\' characters in usernames entered on the command-line to avoid usernames from untrusted sources yielding injection in shell context via ProxyCommand, Match exec, etc. Usernames specified via the configuration files are not subject this this control. Reported by SecBuddyF KeenLab Tencent (CodeBuddy Security) We continue to recommend against directly exposing ssh(1) and other tools' command-lines to untrusted input. Mitigations such as this can not be absolute given the variety of shells and user configurations in use. * ssh-keygen(1): correct handling of Daylight Saving Time when converting dates. Previous handling could cause errors of up to +/- 1 hour (unless you are in the Antarctica/Troll timezone, where the error could be +/- 2 hours). These errors could result in creation of certificates with incorrect expiry times. bz4004; from Khush Patel * sshd(8), ssh(1): ensure that compressed payloads don't inflate past the maximum supported packet length. Reported by Oleh Konko. * sshd(8): fully honor the authorized_keys "restrict" keyword, which was not being properly applied to tunnel forwarding (PermitTunnel, disabled by default). This is a separate problem to the one fixed in openssh-10.5. * sshd(8): correctly handle some options that accept "none". Some options, including AuthorizedPrincipalsFile, were documented as accepting "none" as a way to disable them; however, when ... changelog too long, skipping 158 lines ... * openssh-10.5p1-propagate-restrict-keyword.patch ==== openssl-3 ==== Subpackages: libopenssl3 - Build with enable-sslkeylog to support the SSLKEYLOGFILE environment variable usage. (jsc#PED-17079) ==== phonon-vlc-qt6 ==== - Update Requires to new vlc-plugins-desktop, removes installation of GUI, for headless installations, or users that don't actually * use* vlc as a video player, and only want it for the phonon backend. https://build.opensuse.org/request/show/1382584 ==== pipewire ==== Subpackages: gstreamer-plugin-pipewire libpipewire-0_3-0 pipewire-alsa pipewire-modules-0_3 pipewire-pulseaudio pipewire-spa-plugins-0_2 pipewire-spa-tools pipewire-tools - Move the Recommends: alsa-ucm-conf to the -modules subpackage, which is always installed unlike pipewire-alsa. - Add alsa-ucm-conf Recommends to pipewire-alsa sub-package. Pull in alsa-ucm-conf by default. ==== plasma5support6 ==== Version update (6.7.5 -> 6.8.0) Subpackages: libPlasma5Support6 - Update to 6.8.0: * New feature release * For more details see https://kde.org/announcements/plasma/6/6.8.0 - Changes since 6.7.91: * Update version for new release 6.8.0 - Update to 6.7.91: * New bugfix release * For more details see https://kde.org/announcements/plasma/6/6.7.91 - Changes since 6.7.90: * Update version for new release 6.7.91 - Update to 6.7.90: * New feature release * For more details see https://kde.org/announcements/plasma/6/6.7.90 - Changes since 6.7.5: * Update version for new release 6.7.90 * weather/bbcukmet: Fix malformed validation string for BBC Weather source * Fix screen power management inhibition never being re-acquirable (kde#523605) * Remove warning (found by cmake --warn-uninitialized -Werror=dev ) * Replace declaration with include * mouse dataengine: Drop obsolete X11 support (CursorNotificationHandler) * Enable LSAN in CI * Enforce passing tests * Make PluginTest work * Update version for new release 6.7.80 ==== plasma6-activities ==== Version update (6.7.5 -> 6.8.0) Subpackages: libPlasmaActivities7 plasma6-activities-imports - Update to 6.8.0: * New feature release * For more details see https://kde.org/announcements/plasma/6/6.8.0 - Changes since 6.7.91: * Update version for new release 6.8.0 - Update to 6.7.91: * New bugfix release * For more details see https://kde.org/announcements/plasma/6/6.7.91 - Changes since 6.7.90: * Update version for new release 6.7.91 - Update to 6.7.90: * New feature release * For more details see https://kde.org/announcements/plasma/6/6.7.90 - Changes since 6.7.5: * Update version for new release 6.7.90 * Enable LSAN in CI * CI: Require all tests to pass * Update version for new release 6.7.80 ==== plasma6-activities-stats ==== Version update (6.7.5 -> 6.8.0) Subpackages: libPlasmaActivitiesStats1 - Update to 6.8.0: * New feature release * For more details see https://kde.org/announcements/plasma/6/6.8.0 - Changes since 6.7.91: * Update version for new release 6.8.0 - Update to 6.7.91: * New bugfix release * For more details see https://kde.org/announcements/plasma/6/6.7.91 - Changes since 6.7.90: * Update version for new release 6.7.91 - Update to 6.7.90: * New feature release * For more details see https://kde.org/announcements/plasma/6/6.7.90 - Changes since 6.7.5: * Update version for new release 6.7.90 * Enable LSAN in CI * Update version for new release 6.7.80 ==== plasma6-browser-integration ==== Version update (6.7.5 -> 6.8.0) - Update to 6.8.0: * New feature release * For more details see https://kde.org/announcements/plasma/6/6.8.0 - Changes since 6.7.91: * Update version for new release 6.8.0 - Update to 6.7.91: * New bugfix release * For more details see https://kde.org/announcements/plasma/6/6.7.91 - Changes since 6.7.90: * Update version for new release 6.7.91 - Update to 6.7.90: * New feature release * For more details see https://kde.org/announcements/plasma/6/6.7.90 - Changes since 6.7.5: * Update version for new release 6.7.90 * purpose: Disallow purpose share for inactive tab or window * Add support for Micrsoft Edge flatpak (kde#521109) * Remove unneeded QOverload::of for connecting to QProcess:finished signal * Update version for new release 6.7.80 ==== plasma6-desktop ==== Version update (6.7.5 -> 6.8.0) Subpackages: plasma6-desktop-emojier - Update to 6.8.0: * New feature release * For more details see https://kde.org/announcements/plasma/6/6.8.0 - Changes since 6.7.91: * kcms/tablet: Clean up canberra context * Update version for new release 6.8.0 * kcms/dateandtime: Auth manually before issuing calls to timedate1 * kcms/dateandtime: Calculate timeDiff before doing blocking things * Positioner: Fix off by one when checking whether an item fits * panel: Factor in vkbd state for floating panel state * applets/taskmanager: avoid ReleaseWithinBounds for TapHandler * kcms/tablet: Minor fixups to other refreshInputSequence calls * kcms/tablet: fix setting of stylus and pad buttons * Ask for bash in 50-krunner-activate-typing.sh * containments/desktop: Watch for KRunner with QDBusServiceWatcher * kcms/touchpad: Load name and sysName properties (kde#521800) * fix systemsettings ui font color * applets/taskManager: don't hide tooltip when mute clicked * applets/window-list: qualify parent names * applets/window-list: simplify delegate keyboard activation * applets/window-list: explicitly unset focus after click * applets/window-list: remove MenuButton mnemonic * applets/window-list: fix glitch when closing - Update to 6.7.91: * New bugfix release * For more details see https://kde.org/announcements/plasma/6/6.7.91 - Changes since 6.7.90: * Update version for new release 6.7.91 * Emojier: Fix incorrect buttons/placeholder when search gives no results * kcm_keys: fix layouting issues (kde#525725) * desktopppackage/configuration: fix GridViewKCM detection * lockscreenui: only show prompt when authenticator needs it * applets/kicker: don't set anchors.fill on PlasmoidItem * Panel: take into account the add widgets button for minimum width (kde#525826) * Containments/FolderView: fix isUiReady never going true * RenameEditor: Match text color to the custom background (kde#525319) * Revert "Port lockscreen/SDDM footer to a reuseable component" * Revert "lockscreen: pass new footer to WallpaperFader" - Drop patches, now upstream: * 0001-Revert-lockscreen-pass-new-footer-to-WallpaperFader.patch * 0002-Revert-Port-lockscreen-SDDM-footer-to-a-reuseable-co.patch - Update to 6.7.90: * New feature release * For more details see https://kde.org/announcements/plasma/6/6.7.90 - Too many changes to list here - Add patches to fix login with SDDM: * 0001-Revert-lockscreen-pass-new-footer-to-WallpaperFader.patch * 0002-Revert-Port-lockscreen-SDDM-footer-to-a-reuseable-co.patch - Add patch to fix virtual keyboard behaviour in SDDM: * 0001-Revert-sddm-theme-drop-vkb-wrapper-use-KWinVirtualKe.patch ==== plasma6-integration ==== Version update (6.7.5 -> 6.8.0) Subpackages: plasma6-integration-plugin plasma6-integration-plugin-qt5 - Update to 6.8.0: * New feature release * For more details see https://kde.org/announcements/plasma/6/6.8.0 - Changes since 6.7.91: * Update version for new release 6.8.0 - Update to 6.7.91: * New bugfix release * For more details see https://kde.org/announcements/plasma/6/6.7.91 - Changes since 6.7.90: * Update version for new release 6.7.91 * KDEPlatformTheme: don't automatically turn Union on by default * qt5: Fix build with WITH_X11=FALSE - Update to 6.7.90: * New feature release * For more details see https://kde.org/announcements/plasma/6/6.7.90 - Changes since 6.7.5: * Update version for new release 6.7.90 * Remove linux (Qt5) CI * MessageDialogHelper: don't set WA_DeleteOnClose (kde#523039) * Use explicit WITH_X11 build option instead of relying on HAVE_X11 automagic * qt6: Skip loading palettes when widget style changes * kdeplatformtheme: Don't return a color dialog for a font dialog * Provide native color dialog backed by QColorDialog (kde#520987) * Message dialogs: Fix standard button codes for custom buttons * Create CMake find modules for fonts * Fix wrong return code when exec'ing our implementation of QMessageDialog (kde#520747) * KDEPlatformTheme: Set Union quick style enabled if Union widgets style is set * Clean up icon engines in tests * Delete QPA in test * Set theme name to lower and compare it * messagedialoghelper: Play sound for message box * Update version for new release 6.7.80 * kde-ci.yml: Update dependencies after 186ae66 * Drop unused dependencies ==== plasma6-nm ==== Version update (6.7.5 -> 6.8.0) Subpackages: plasma6-nm-openconnect plasma6-nm-openvpn - Update to 6.8.0: * New feature release * For more details see https://kde.org/announcements/plasma/6/6.8.0 - Changes since 6.7.91: * Update version for new release 6.8.0 * NetworkModel: don't leak devices via the statistics lambdas - Update to 6.7.91: * New bugfix release * For more details see https://kde.org/announcements/plasma/6/6.7.91 - Changes since 6.7.90: * Update version for new release 6.7.91 * KCM: Layout fixes (kde#443553) * HTML-escape connection details - Update to 6.7.90: * New feature release * For more details see https://kde.org/announcements/plasma/6/6.7.90 - Too many changes to list here ==== plasma6-openSUSE ==== - Update to 6.8.0 - Update to 6.7.91 - Update to 6.7.90 ==== plasma6-pa ==== Version update (6.7.5 -> 6.8.0) - Update to 6.8.0: * New feature release * For more details see https://kde.org/announcements/plasma/6/6.8.0 - Changes since 6.7.91: * Update version for new release 6.8.0 - Update to 6.7.91: * New bugfix release * For more details see https://kde.org/announcements/plasma/6/6.7.91 - Changes since 6.7.90: * Update version for new release 6.7.91 - Update to 6.7.90: * New feature release * For more details see https://kde.org/announcements/plasma/6/6.7.90 - Changes since 6.7.5: * Update version for new release 6.7.90 * VolumeFeedback: overlap chiming instead of hard-cancelling * KCM: Silence spurious warnings in Rename Devices dialog * kcm: Also make rename delegate for source items fill width * kcm: keep the Rename Devices Save Button visible while disabled (kde# 508211) * Initialize preferred audio devices on construction (kde#500828,kde#521973) * Improve presentation of PulseAudio errors and their translations * applet: set a sensible default size * Use the source's native sample rate for the microphone test (kde#523693) * microphoneindicator: Show correct information in OSD when using to toggle mute (kde#472107) * Install kcfg file * Fix use of active port when there are no ports at all. * Port to declarative type registration * Update version for new release 6.7.80 * Fix kirigami-addons cmake find call ==== plasma6-print-manager ==== Version update (6.7.5 -> 6.8.0) - Update to 6.8.0: * New feature release * For more details see https://kde.org/announcements/plasma/6/6.8.0 - Changes since 6.7.91: * Update version for new release 6.8.0 - Update to 6.7.91: * New bugfix release * For more details see https://kde.org/announcements/plasma/6/6.7.91 - Changes since 6.7.90: * Update version for new release 6.7.91 - Update to 6.7.90: * New feature release * For more details see https://kde.org/announcements/plasma/6/6.7.90 - Changes since 6.7.5: * Update version for new release 6.7.90 * Don't report server as unavailable until it's actually known * tests: Add proper color attributes to mock printer configs * kded: Notify when a print job is sent to a printer that is offline (kde#362143) * Remove some X11 bits * Remove warning (found by cmake --warn-uninitialized -Werror=dev ) * libkcups: Refactor constructor/helpers for public use * kded: Rename class MarkerLevelChecker to CupsWatcher * libkcups/kded: Consolidate marker level helpers into KCupsPrinter * Remove unused Plasma::Plasma linkage * libkcups,apps: Update icon logic for printer type * libkcups/plasmoid: Add a timer to reload the job queue when not empty (kde#512442) * configure-printer: Store window size in state config * configure-printer: Fix restoring window size * Clean up state from old print-queue app * [print-queue] Elide job processing message * kcm: Use Kirigami.StyleHints.showFramedBackground for ScrollView * set selected: property on ItemDelegates's contentItem stuff * Add missing qqml.h include * Fix most qmllint warnings * Mark missing QML module dependencies * Enable qmllint in CI * Skip kcm_smoketest with kcmutils < 6.27.0 * Update version for new release 6.7.80 ==== plasma6-systemmonitor ==== Version update (6.7.5 -> 6.8.0) - Update to 6.8.0: * New feature release * For more details see https://kde.org/announcements/plasma/6/6.8.0 - Changes since 6.7.91: * Update version for new release 6.8.0 * page/EditablePage: round heightForContent down * Fix cache clean up with ComponentCacheModel (kde#525978) - Update to 6.7.91: * New bugfix release * For more details see https://kde.org/announcements/plasma/6/6.7.91 - Changes since 6.7.90: * Update version for new release 6.7.91 - Update to 6.7.90: * New feature release * For more details see https://kde.org/announcements/plasma/6/6.7.90 - Changes since 6.7.5: * Update version for new release 6.7.90 * Fix process termination when used in RtL language (kde#522233) * Fix type name in kcfg file * Install kcfg file * Add UI to set CPU affinity * table: Set focus to search field of ColumnConfigurationDialog * table: Change ColumnConfigDialog search filter to filter on text edit * table: Port ColumnConfigurationDialog from Dialog to Window (kde#517723) * processtable: Remove unnecessary separator * table: Hide the icon for processes in tree mode if it is empty (kde#442095) * table: Do nothing if data() functions are passed an invalid index * table: Make sure to cleanup sorted columns when using "hide column" on table * table: Explicitly remove duplicate entries from sortedColumns in ColumnSFModel (kde#518073) * Replace "applications-all" with "applications-all-symbolic" * Use similar capitalization as sibling menu items for "Edit or Remove Pages…" * Fix initial page from commandline * Enable LSAN in CI * Framework 'Kquickcharts' is required for graphs to work * CI: Require all tests to pass * Update version for new release 6.7.80 ==== plasma6-workspace ==== Version update (6.7.5 -> 6.8.0) Subpackages: plasma6-session plasma6-workspace-libs - Update to 6.8.0: * New feature release * For more details see https://kde.org/announcements/plasma/6/6.8.0 - Changes since 6.7.91: * Update version for new release 6.8.0 * klipper/declarative: better starting listview position * klipper/declarative: handle arrow nav w/o starred items better * Klipper: Block hover after keyboard navigation * klipper/declarative: always show full delegate with arrow nav * component/containmentlayoutmanager: avoid startup completion checks * krunner/RunCommand: rotate expander when expanded * krunner/RunCommand: fix break tab navigation with non-default history * krunner: allow switching to "Enable suggestions" during runtime * krunner/RunCommand: close on Escape even from buttons * krunner/RunCommand: allow arrow key navigation to buttons * krunner/RunCommand: allow arrow navigation from list to SearchField * libnotificationmanager: Add parent to NotificationFilterProxyModel * applets/kicker: fix ComputerModel system apps (kde#526297) * Klipper: Unset default shortcut instead of deleting its action * Klipper: Remember who gets actions on selection * applets/notifications: explicitly allow copy/link actions (kde#508520) * devicenotifications: Don't notify when all screens go away or reappear * libnotificationmanager: When processed items is zero, only show total * Klipper: Do not set minimum config window size (kde#457837) * Klipper: Keep the buttons of tall entries at the top again * applets/systemtray: Fix plasmoids not appearing in system tray model * kcms/region_language: explain the "C" locale * devicenotifications: Add support for kde-output-device-mode-v2 v26 * Klipper: Restore the action popup for copied files * applets/systemtray: Refine click feedback * devicenotifications: Don't notify for internal screen being removed * Fix the window mapping again (kde#506562) * klipper/declarative: don't switch tabs without tabs (kde#526385) * cmake: use correct version for union * Klipper: Fix search behaviour (kde#452176) * Klipper: Guard against characters with high surrogates at 100th position (kde#508224) * Klipper: Use in-code function instead of kconf_update * kfontinst: Fix finished message being cut off * applets/systemtray: Handle applets without a configure action * notificationmanager: fix typo in property name * plasma-shutdown: Guard against concurrent logout/reboot/shutdown requests (kde#525911) * klipper: Set barcode as drag pixmap * klipper: Port away from nested event loops (kde#526007) * Fix compilation with qtbase >= 1a000288b81a57fcd380522b6a0497674dbe91bb (kde#526210) * klipper/declarative: always go to first entry from TabBar - Update to 6.7.91: * New bugfix release * For more details see https://kde.org/announcements/plasma/6/6.7.91 - Changes since 6.7.90: * Update version for new release 6.7.91 * geotimezoned: Don't show time zone OSD when clock didn't actually change * runners/services: Truncate to fit in assigned bitap space (kde#525983,kde#[numberofthebugreport]) * Fix translation in virtualkeyboard to loginlockscreen * systemtray: Port away from Animator (kde#487699) * systemtray: Fix potential crash * systemtray: drop X11 leftovers * shell: Disable Qt RHI pipeline cache * When the map is initiallised the map items are initialise at the given zoom level and visible map in the window. When the window is enlarged the items are not resized so they only fill the original area. * geotimezoned: Remember connection when time zone did not change * klipper/configdialog: Add i18n context * ShellCorona: track uiReady in a more robust way (kde#525327) * Klipper: Make the applet icon show in a panel thicker than 105 pixels * 🍒components/loginlockscreen: Make the virtual keyboard button follow HIG - Update to 6.7.90: * New feature release * For more details see https://kde.org/announcements/plasma/6/6.7.90 - Too many changes to list here - Refresh 0001-Use-qdbus6.patch - Add patch to fix Virtual Keyboard in SDDM: * 0001-Revert-lookandfeel-Drop-VirtualKeyboardLoader.patch ==== polkit-default-privs ==== Version update (1550+20261009.03465cb -> 1550+20261016.b8e1631) - Update to version 1550+20261016.b8e1631: * profiles: add "meta" action for ksysguard processlisthelper (bsc#1281596) - Update to version 1550+20261014.754cdd0: * profiles: add noctalia-greeter (bsc#1285400) ==== polkit-kde-agent-6 ==== Version update (6.7.5 -> 6.8.0) - Update to 6.8.0: * New feature release * For more details see https://kde.org/announcements/plasma/6/6.8.0 - Changes since 6.7.91: * Update version for new release 6.8.0 - Update to 6.7.91: * New bugfix release * For more details see https://kde.org/announcements/plasma/6/6.7.91 - Changes since 6.7.90: * Update version for new release 6.7.91 - Update to 6.7.90: * New feature release * For more details see https://kde.org/announcements/plasma/6/6.7.90 - Changes since 6.7.5: * Update version for new release 6.7.90 * port dialog to bigscreen * add Kirigami to CMakeLists.txt and .kde-ci.yml * Drop X11 support via KX11Extras * Enable LSAN in CI * CI: Require all tests to pass * Update version for new release 6.7.80 ==== poppler ==== Version update (26.09.0 -> 26.10.0) - Update to version 26.10.0: core: * Support for eidas (cades-b) signatures * Enable font subsetting when using the windows font backend * Enable brotli streams * NSS-signatures-backend: Be a bit more lenient on what we consider valid cert usage * NSS-signatures-backend: Mark hardware keys as such * NSS-signatures-backend: Reuse password callback for token PIN prompts * PSOutputDev: fix rendering of files when using -preload * Fix rendering of some Forms * Improve code a bit when finding fonts fails * Fix dest dict to name tree fallback when resolving named destination. Issue #1788 * Internal code improvements * Fix crashes in malformed documents utils: * pdfsig: Write some error message if signing fails * pdfsig: Replace -etsi with -etsi-cades-b and support it with -add-signature qt5: * Deprecate CertificateInfo::publicKey() * Map the annotation rules flags a bit closer to the spec qt6: * Deprecate CertificateInfo::publicKey() * Map the annotation rules flags a bit closer to the spec * Add API to query and select CAdES-B / S/MIME signature type build system: * libbrotlidec is now required for brotli stream support * Find libharfbuzz via pkgconfig * Conditionalise test builds and test dependencies based on enabled frontends * Fix intermittent glib API docs build failure * Don't scan for c++ modules * oss-fuzz build updates - fixes CVE-2026-107705 [bsc#1284844] ==== poppler-qt6 ==== Version update (26.09.0 -> 26.10.0) - Update to version 26.10.0: core: * Support for eidas (cades-b) signatures * Enable font subsetting when using the windows font backend * Enable brotli streams * NSS-signatures-backend: Be a bit more lenient on what we consider valid cert usage * NSS-signatures-backend: Mark hardware keys as such * NSS-signatures-backend: Reuse password callback for token PIN prompts * PSOutputDev: fix rendering of files when using -preload * Fix rendering of some Forms * Improve code a bit when finding fonts fails * Fix dest dict to name tree fallback when resolving named destination. Issue #1788 * Internal code improvements * Fix crashes in malformed documents utils: * pdfsig: Write some error message if signing fails * pdfsig: Replace -etsi with -etsi-cades-b and support it with -add-signature qt5: * Deprecate CertificateInfo::publicKey() * Map the annotation rules flags a bit closer to the spec qt6: * Deprecate CertificateInfo::publicKey() * Map the annotation rules flags a bit closer to the spec * Add API to query and select CAdES-B / S/MIME signature type build system: * libbrotlidec is now required for brotli stream support * Find libharfbuzz via pkgconfig * Conditionalise test builds and test dependencies based on enabled frontends * Fix intermittent glib API docs build failure * Don't scan for c++ modules * oss-fuzz build updates - fixes CVE-2026-107705 [bsc#1284844] ==== powerdevil6 ==== Version update (6.7.5 -> 6.8.0) - Update to 6.8.0: * New feature release * For more details see https://kde.org/announcements/plasma/6/6.8.0 - Changes since 6.7.91: * Update version for new release 6.8.0 * daemon: Treat a keyboard backlight maximum of 0 as unsupported (kde#525916) * applets/brightness: Don't query kameleon when it isn't installed * applets/brightness: improve screen reader a11y (kde#519226,kde#508485) * applets/brightness: improve keyboard navigation - Update to 6.7.91: * New bugfix release * For more details see https://kde.org/announcements/plasma/6/6.7.91 - Changes since 6.7.90: * Update version for new release 6.7.91 * applets/brightness: fix Slider binding issues (kde#523281) * Brightness Applet: avoid binding loops (kde#525216) * applets/brightness: Fix displaying transition times when night light is always on - Update to 6.7.90: * New feature release * For more details see https://kde.org/announcements/plasma/6/6.7.90 - Too many changes to list here ==== python-urllib3 ==== - add gzip-tests.patch and ssl-test.patch to fix tests ==== python313 ==== Version update (3.13.15 -> 3.13.16) - Update to 3.13.16: - Security - gh-158446: Fix a crash or incorrect output that could occur when formatting a float or complex with a precision close to the platform’s INT_MAX. PyOS_double_to_string() now raises ValueError for any precision of that magnitude, regardless of presentation type or value, as the format string parsers already did for precisions above INT_MAX. - gh-157190: Fixed a vulnerability in the tarfile data and tar extraction filters where a crafted archive using a hard link to a symbolic link could change the permissions and modification time of a file outside the destination directory, and expose its contents inside the extracted tree. This addresses CVE 2026-82049. (bsc#1280459, CVE-2026-82049) - gh-156793: asyncio: loop.start_tls() and loop.create_connection() now validate the server_hostname argument if an ssl.SSLContext is passed with check_hostname set to True. (bsc#1283826, CVE-2026-19553) - gh-156793: ssl.SSLContext.wrap_bio() now validates its server_side, server_hostname and session arguments similar to ssl.SSLContext.wrap_socket(). - In particular, a context with check_hostname enabled and no server_hostname passed to wrap_bio() now raises ValueError instead of completing a handshake that verified the certificate chain without verifying the peer’s identity, with no indication that the check had been skipped. - gh-157265: In tarfile, when extracting a link falls back to extracting a member of the archive, skip the member when the filter function returns None when called with the extracted member’s name replaced with the link’s. - gh-157190: Fixed a vulnerability in the tarfile data and tar extraction filters where a crafted archive using a hard link to a symbolic link could change the permissions and modification time of a file outside the destination directory, and expose its contents inside the extracted tree. This addresses CVE 2026-82049. (bsc#1280459, CVE-2026-82049) - gh-157953: Update bundled libexpat to version 2.8.5. - gh-156002: Bound the amount of data zipfile decompresses per read for members compressed with bzip2, LZMA, or Zstandard, matching the existing limit for deflate. A small archive member could previously expand into an unbounded allocation even when read in small chunks. (bsc#1277111, CVE-2026-15310) - gh-155999: Fix the tarfile tar and data extraction filters creating directories outside the destination for members whose name leaves the destination and returns to it, such as ../evil/../dest/sub/file. The containment check used the resolved path, but intermediate directories were created from the name as given. (bsc#1276227, CVE-2026-19672) - gh-156293: Fix a crash in ssl when an sni_callback switches a connection to another SSLContext and the context that carries the callback is no longer referenced by the application. Servers that keep their sni_callback context alive (the usual case when it wraps the listening socket or is stored on the server object) were not affected. This addresses CVE 2026-19445. (bsc#1283969, CVE-2026-19445) - gh-155292: Change the stringprep module and encodings.idna codec to not consider Unicode codepoint attributes beyond those defined in RFC 3454. (bsc#1276226, CVE-2026-17084) - gh-155694: Fix CVE 2026-15806 by scoping HTTPPasswordMgr credentials to the URL scheme, preventing credentials stored for an HTTPS URL from being used for a matching HTTP URL, while URIs without a scheme continue to match any scheme (bsc#1276223, CVE-2026-15806). - Core and Builtins - gh-158364: Fix crash when sys._current_frames() or sys._current_exceptions() is called while another interpreter is running. - gh-158254: Reverse iterators over a dict and its views now raise RuntimeError if the dictionary’s keys change during iteration, like forward iterators, instead of yielding entries for the new keys. - gh-154175: Move GIL drop request bit fetching to live under the GIL so the PyThreadState it accesses is guaranteed not to be deallocated. Deallocation could occur when a daemon thread was shutting down after the main thread. - gh-156091: Fix a crash when compiling deeply nested inlined list, set, or dict comprehensions. A SyntaxError is now raised when the nesting exceeds the compiler’s static block limit. - gh-156894: Fix the position of syntax errors which cover a range if the line contains non-ASCII characters before the error. - gh-155525: Fix quadratic-time tokenization of modules containing many f-strings. - gh-156114: Fix a crash in the perf trampoline when a code object has a name or filename that cannot be encoded to UTF-8. Patched by Shamil Abdulaev. - gh-156196: A failed assignment to an attribute defined with PyMemberDef of type Py_T_LONG, Py_T_LONGLONG, Py_T_PYSSIZET or Py_T_DOUBLE no longer changes its value. - gh-156189: Fix a crash when deleting the f_trace_opcodes attribute of a frame object. It now raises AttributeError. - gh-155752: Fix a crash when a types.GenericAlias argument gains a __typing_subst__ hook after the alias parameters have been cached. - gh-155526: Fix spurious OverflowError for abs(nanj) in case ... changelog too long, skipping 452 lines ... - Update sphinx9-runtime-node.patch ==== python313-core ==== Version update (3.13.15 -> 3.13.16) Subpackages: libpython3_13-1_0 python313-base - Update to 3.13.16: - Security - gh-158446: Fix a crash or incorrect output that could occur when formatting a float or complex with a precision close to the platform’s INT_MAX. PyOS_double_to_string() now raises ValueError for any precision of that magnitude, regardless of presentation type or value, as the format string parsers already did for precisions above INT_MAX. - gh-157190: Fixed a vulnerability in the tarfile data and tar extraction filters where a crafted archive using a hard link to a symbolic link could change the permissions and modification time of a file outside the destination directory, and expose its contents inside the extracted tree. This addresses CVE 2026-82049. (bsc#1280459, CVE-2026-82049) - gh-156793: asyncio: loop.start_tls() and loop.create_connection() now validate the server_hostname argument if an ssl.SSLContext is passed with check_hostname set to True. (bsc#1283826, CVE-2026-19553) - gh-156793: ssl.SSLContext.wrap_bio() now validates its server_side, server_hostname and session arguments similar to ssl.SSLContext.wrap_socket(). - In particular, a context with check_hostname enabled and no server_hostname passed to wrap_bio() now raises ValueError instead of completing a handshake that verified the certificate chain without verifying the peer’s identity, with no indication that the check had been skipped. - gh-157265: In tarfile, when extracting a link falls back to extracting a member of the archive, skip the member when the filter function returns None when called with the extracted member’s name replaced with the link’s. - gh-157190: Fixed a vulnerability in the tarfile data and tar extraction filters where a crafted archive using a hard link to a symbolic link could change the permissions and modification time of a file outside the destination directory, and expose its contents inside the extracted tree. This addresses CVE 2026-82049. (bsc#1280459, CVE-2026-82049) - gh-157953: Update bundled libexpat to version 2.8.5. - gh-156002: Bound the amount of data zipfile decompresses per read for members compressed with bzip2, LZMA, or Zstandard, matching the existing limit for deflate. A small archive member could previously expand into an unbounded allocation even when read in small chunks. (bsc#1277111, CVE-2026-15310) - gh-155999: Fix the tarfile tar and data extraction filters creating directories outside the destination for members whose name leaves the destination and returns to it, such as ../evil/../dest/sub/file. The containment check used the resolved path, but intermediate directories were created from the name as given. (bsc#1276227, CVE-2026-19672) - gh-156293: Fix a crash in ssl when an sni_callback switches a connection to another SSLContext and the context that carries the callback is no longer referenced by the application. Servers that keep their sni_callback context alive (the usual case when it wraps the listening socket or is stored on the server object) were not affected. This addresses CVE 2026-19445. (bsc#1283969, CVE-2026-19445) - gh-155292: Change the stringprep module and encodings.idna codec to not consider Unicode codepoint attributes beyond those defined in RFC 3454. (bsc#1276226, CVE-2026-17084) - gh-155694: Fix CVE 2026-15806 by scoping HTTPPasswordMgr credentials to the URL scheme, preventing credentials stored for an HTTPS URL from being used for a matching HTTP URL, while URIs without a scheme continue to match any scheme (bsc#1276223, CVE-2026-15806). - Core and Builtins - gh-158364: Fix crash when sys._current_frames() or sys._current_exceptions() is called while another interpreter is running. - gh-158254: Reverse iterators over a dict and its views now raise RuntimeError if the dictionary’s keys change during iteration, like forward iterators, instead of yielding entries for the new keys. - gh-154175: Move GIL drop request bit fetching to live under the GIL so the PyThreadState it accesses is guaranteed not to be deallocated. Deallocation could occur when a daemon thread was shutting down after the main thread. - gh-156091: Fix a crash when compiling deeply nested inlined list, set, or dict comprehensions. A SyntaxError is now raised when the nesting exceeds the compiler’s static block limit. - gh-156894: Fix the position of syntax errors which cover a range if the line contains non-ASCII characters before the error. - gh-155525: Fix quadratic-time tokenization of modules containing many f-strings. - gh-156114: Fix a crash in the perf trampoline when a code object has a name or filename that cannot be encoded to UTF-8. Patched by Shamil Abdulaev. - gh-156196: A failed assignment to an attribute defined with PyMemberDef of type Py_T_LONG, Py_T_LONGLONG, Py_T_PYSSIZET or Py_T_DOUBLE no longer changes its value. - gh-156189: Fix a crash when deleting the f_trace_opcodes attribute of a frame object. It now raises AttributeError. - gh-155752: Fix a crash when a types.GenericAlias argument gains a __typing_subst__ hook after the alias parameters have been cached. - gh-155526: Fix spurious OverflowError for abs(nanj) in case ... changelog too long, skipping 452 lines ... - Update sphinx9-runtime-node.patch ==== qqc2-breeze-style6 ==== Version update (6.7.5 -> 6.8.0) - Update to 6.8.0: * New feature release * For more details see https://kde.org/announcements/plasma/6/6.8.0 - Changes since 6.7.91: * Update version for new release 6.8.0 * CursorHandle: Fix typo * CursorDelegate: Fix lag when scrolling while text field is focused - Update to 6.7.91: * New bugfix release * For more details see https://kde.org/announcements/plasma/6/6.7.91 - Changes since 6.7.90: * Update version for new release 6.7.91 - Update to 6.7.90: * New feature release * For more details see https://kde.org/announcements/plasma/6/6.7.90 - Changes since 6.7.5: * Update version for new release 6.7.90 * Fix horizontal padding when full-width glyph is unavailable * Implement ComboBox implicitContentWidthPolicy sizing * Remove warning (found by cmake --warn-uninitialized -Werror=dev ) * CI: Require all tests to pass * Update version for new release 6.7.80 ==== qt6-base ==== Version update (6.11.2 -> 6.12.0) Subpackages: libQt6Concurrent6 libQt6Core6 libQt6DBus6 libQt6Gui6 libQt6Network6 libQt6OpenGL6 libQt6OpenGLWidgets6 libQt6PrintSupport6 libQt6Sql6 libQt6Test6 libQt6WaylandClient6 libQt6Widgets6 libQt6WlShellIntegration6 libQt6Xml6 qt6-network-tls qt6-networkinformation-connman qt6-networkinformation-glib qt6-networkinformation-nm qt6-printsupport-cups qt6-sql-sqlite qt6-wayland - Add upstream changes: * 6.12.0_Fix_touchpad_scrolling.patch * build_with_md4c_0_6_0.patch - Update to 6.12.0 https://www.qt.io/blog/qt-6.12-released - Drop patches: * 0001-CMake-Handle-generated-headers-in-syncqt-scan-all-mo.patch * 0001-QIconLoader-Don-t-consider-fallbackThemeName-in-them.patch * 0001-Use-newer-GCC-on-Leap.patch ==== qt6-declarative ==== Version update (6.11.2 -> 6.12.0) Subpackages: libQt6LabsAnimation6 libQt6LabsFolderListModel6 libQt6LabsPlatform6 libQt6LabsQmlModels6 libQt6LabsSettings6 libQt6LabsSharedImage6 libQt6LabsStyleKit6 libQt6LabsSynchronizer6 libQt6LabsWavefrontMesh6 libQt6Qml6 libQt6QmlCore6 libQt6QmlLocalStorage6 libQt6QmlMeta6 libQt6QmlModels6 libQt6QmlNetwork6 libQt6QmlWorkerScript6 libQt6QmlXmlListModel6 libQt6Quick6 libQt6QuickControls2-6 libQt6QuickControls2Impl6 libQt6QuickDialogs2-6 libQt6QuickDialogs2QuickImpl6 libQt6QuickDialogs2Utils6 libQt6QuickEffects6 libQt6QuickLayouts6 libQt6QuickParticles6 libQt6QuickShapes6 libQt6QuickTemplates2-6 libQt6QuickTest6 libQt6QuickVectorImage6 libQt6QuickWidgets6 qt6-declarative-imports - Update to 6.12.0 https://www.qt.io/blog/qt-6.12-released - Drop patch: * 0001-QML-engine-Correctly-compare-composites-when-multipl.patch ==== qt6-imageformats ==== Version update (6.11.2 -> 6.12.0) - Update to 6.12.0 https://www.qt.io/blog/qt-6.12-released ==== qt6-location ==== Version update (6.11.2 -> 6.12.0) Subpackages: libQt6Location6 - Update to 6.12.0 https://www.qt.io/blog/qt-6.12-released ==== qt6-multimedia ==== Version update (6.11.2 -> 6.12.0) Subpackages: libQt6Multimedia6 libQt6MultimediaQuick6 libQt6MultimediaWidgets6 libQt6Quick3DSpatialAudio6 libQt6SpatialAudio6 qt6-multimedia-imports - Update to 6.12.0 https://www.qt.io/blog/qt-6.12-released ==== qt6-positioning ==== Version update (6.11.2 -> 6.12.0) Subpackages: libQt6Positioning6 libQt6PositioningQuick6 qt6-positioning-imports - Update to 6.12.0 https://www.qt.io/blog/qt-6.12-released ==== qt6-qt5compat ==== Version update (6.11.2 -> 6.12.0) Subpackages: libQt6Core5Compat6 qt6-qt5compat-imports - Update to 6.12.0 https://www.qt.io/blog/qt-6.12-released ==== qt6-quick3d ==== Version update (6.11.2 -> 6.12.0) Subpackages: libQt6Quick3D6 libQt6Quick3DAssetImport6 libQt6Quick3DAssetUtils6 libQt6Quick3DEffects6 libQt6Quick3DHelpers6 libQt6Quick3DHelpersImpl6 libQt6Quick3DParticleEffects6 libQt6Quick3DParticles6 libQt6Quick3DRuntimeRender6 libQt6Quick3DUtils6 libQt6Quick3DXr6 qt6-quick3d-imports - Update to 6.12.0 https://www.qt.io/blog/qt-6.12-released ==== qt6-quicktimeline ==== Version update (6.11.2 -> 6.12.0) - Update to 6.12.0 https://www.qt.io/blog/qt-6.12-released ==== qt6-shadertools ==== Version update (6.11.2 -> 6.12.0) - Update to 6.12.0 https://www.qt.io/blog/qt-6.12-released ==== qt6-speech ==== Version update (6.11.2 -> 6.12.0) Subpackages: libQt6TextToSpeech6 qt6-texttospeech - Update to 6.12.0 https://www.qt.io/blog/qt-6.12-released ==== qt6-svg ==== Version update (6.11.2 -> 6.12.0) - Update to 6.12.0 https://www.qt.io/blog/qt-6.12-released ==== qt6-tools ==== Version update (6.11.2 -> 6.12.0) Subpackages: libQt6UiTools6 qt6-tools-qdbus - Update to 6.12.0 https://www.qt.io/blog/qt-6.12-released - Drop patches: * 0001-QDoc-Add-LLVM-22-implementation-to-QualTypeNames-for.patch * 0002-CMake-Add-LLVM-22-to-supported-QDoc-Clang-versions.patch * 0001-QDoc-Use-deterministic-tiebreaker-for-shared-notifie.patch * 0003-CMake-Add-LLVM-23-to-supported-QDoc-Clang-versions.patch ==== qt6-virtualkeyboard ==== Version update (6.11.2 -> 6.12.0) Subpackages: libQt6HunspellInputMethod6 libQt6VirtualKeyboard6 libQt6VirtualKeyboardQml6 qt6-virtualkeyboard-imports - Update to 6.12.0 https://www.qt.io/blog/qt-6.12-released ==== qt6-webchannel ==== Version update (6.11.2 -> 6.12.0) Subpackages: libQt6WebChannel6 libQt6WebChannelQuick6 qt6-webchannel-imports - Update to 6.12.0 https://www.qt.io/blog/qt-6.12-released ==== qt6-webengine ==== Subpackages: libQt6WebEngineCore6 libQt6WebEngineQuick6 libQt6WebEngineWidgets6 qt6-webengine-imports - Prepare package for upcoming 6.140.0 release ==== qt6-webview ==== Version update (6.11.2 -> 6.12.0) - Update to 6.12.0 https://www.qt.io/blog/qt-6.12-released ==== sbc ==== - Add Fix-offby1-sbc_unpack_frame_internal.patch (CVE-2026-16473 bsc#1272367) ==== sddm-kcm6 ==== Version update (6.7.5 -> 6.8.0) - Update to 6.8.0: * New feature release * For more details see https://kde.org/announcements/plasma/6/6.8.0 - Changes since 6.7.91: * Update version for new release 6.8.0 * Fix misuse of QByteArray::data on a temporal - Update to 6.7.91: * New bugfix release * For more details see https://kde.org/announcements/plasma/6/6.7.91 - Changes since 6.7.90: * Update version for new release 6.7.91 - Update to 6.7.90: * New feature release * For more details see https://kde.org/announcements/plasma/6/6.7.90 - Changes since 6.7.5: * Update version for new release 6.7.90 * Add missing Qt::Qml link * Add missing qqml.h include * CI: Require all tests to pass * Update version for new release 6.7.80 ==== sdl2-compat ==== - Rewrite special SDL3 require to do without an architecture list [boo#1285523] ==== selinux-policy ==== Version update (20261006 -> 20261014) Subpackages: selinux-policy-targeted - Update to version 20261014: * Allow account-utils domains to getattr/setattr their sockets (bsc#1284992) * Allow wtmpdb to getattr/setattr its sockets (bsc#1284992) * Allow rebootmgr send over varlink to systemd_report_t (bsc#1284659) * Introduce systemd_report_t domain (bsc#1284659) * Extend CI for SLE 16.1 ==== sof-firmware ==== Version update (2026.09.1 -> 2026.09.2) - Update to version 2026.09.2: * Updated v2.15.1 topology binaries for Intel targets, fixing SoundWire digital microphones * New topology sof-cht-rt5677.tplg ==== spectacle ==== Version update (6.7.5 -> 6.8.0) - Update to 6.8.0: * New feature release * For more details see https://kde.org/announcements/plasma/6/6.8.0 - Changes since 6.7.91: * Update version for new release 6.8.0 * Prevent premature exit during recording startup (kde#516848) * Fix sharing images (kde#525413) - Update to 6.7.91: * New bugfix release * For more details see https://kde.org/announcements/plasma/6/6.7.91 - Changes since 6.7.90: * Update version for new release 6.7.91 * Remove message shown after image is shared - Update to 6.7.90: * New feature release * For more details see https://kde.org/announcements/plasma/6/6.7.90 - Too many changes to list here ==== systemd ==== Version update (261.2 -> 261.3) Subpackages: libsystemd0 libudev1 systemd-boot systemd-container udev - pam: use "pam_rootok" in the "auth" stack of our PAM config for systemd-run0 (bsc#1253133) and similarly update our PAM config for systemd-user to replace "pam_deny" with "pam_rootok". Previously SUSE PAM config used for systemd user instances already relied on "pam_deny" for the PAM "auth" management to avoid falling back on the noisy "other" pam service (see bsc#1190515). However "pam_deny" had the drawback to still log the failure at the debug level. SUSE PAM configs now consistently rely on "pam_rootok" to avoid any noisy debug logs, see upstream commit 34e5f14c3496097c4157a5ed8a13ed4c4b1c48a9. - Import commit 3255daee1572366b74fe92f002a3d60ecbb27103 (merge of v261.3) For a complete list of changes, visit: https://github.com/openSUSE/systemd/compare/4925d9f07fc697efccd98a93046ff535b8832445...3255daee1572366b74fe92f002a3d60ecbb27103 - Move systemd-pcrextend from experimental to udev (bsc#1274948) - Move systemd-measure from experimental to udev to fix ukify ==== systemsettings6 ==== Version update (6.7.5 -> 6.8.0) - Update to 6.8.0: * New feature release * For more details see https://kde.org/announcements/plasma/6/6.8.0 - Changes since 6.7.91: * Update version for new release 6.8.0 - Update to 6.7.91: * New bugfix release * For more details see https://kde.org/announcements/plasma/6/6.7.91 - Changes since 6.7.90: * Update version for new release 6.7.91 - Update to 6.7.90: * New feature release * For more details see https://kde.org/announcements/plasma/6/6.7.90 - Changes since 6.7.5: * Update version for new release 6.7.90 * runner: remove soft hyphens in keywords used for searching * runner: support for translated keywords * Fix loadModule not resetting subCategoryModel parent for modules w/o a submenu (kde#524340,kde#514006) * Use KConfigXT for settings * systemsettings.desktop: add Plasma 7 TODO notice for kcm_powerdevil * SettingsBase: add an exception for external kcms * chore: add default merge request template * Don't call activateWindow() from the constructor * CI: Require all tests to pass * Update version for new release 6.7.80 * ci: depend on @same plasma-activities version ==== tesseract-ocr ==== Subpackages: libtesseract5 tesseract-ocr-common - Remove unused BuildRequires: libxslt-tools, plantuml and pkgconfig(fontconfig) are not used by the build (fontconfig is pulled in via pkgconfig(pangoft2) anyway); verified by a full rebuild without them ==== tesseract-ocr-traineddata ==== - Remove unused BuildRequires: python3-packaging; nothing in the spec uses Python and the built packages are unchanged - Rewrap the generated descriptions of the language, script and doc subpackages so no line exceeds the length limit (description-line-too-long) - Add the missing Provides for the pre-rename names tesseract-traineddata-orientation_and_script_detection and tesseract-traineddata-math_equation to the osd and equ subpackages, matching the language subpackages (obsolete-not-provided) ==== vid_stab ==== Version update (1.1.1 -> 1.1.2) - Update to version 1.1.2: * Fix asymmetry between writing and reading of the binary transformation file, which corrupted subsequent reads * Drop remaining ORC references * ARM support via sse2neon; fix serialisation on Darwin PPC and on architectures with unsigned char by default * Fix build with CMake 4 and respect CMAKE_OSX_ARCHITECTURES ==== vim ==== Version update (9.2.1161 -> 9.2.1202) Subpackages: vim-data-common vim-small - Update to 9.2.1202: * Arbitrary code execution via Ruby omni-completion, Rmd syntax highlighting and Cargo quickfix hooks (GHSA-4xgr-vqh2-xfx8, GHSA-x2w5-pj55-7hpc, GHSA-4vf6-278g-hq7j) * Revert the experimental ":source ++dryrun" feature * Fix cursor position with 'linebreak' and a large 'tabstop'; gj/gk no longer lose a column with virtual text above a line * Fix regexp matches ending inside a UTF-8 character and missed case-folded literal matches * Fix Vim9 crashes (long "implements" lists, lambdas split over lines or assigning to an enclosing argument, object method calls, long tuple types) and memory leaks on sixel quantize errors and with 'quickfixtextfunc' * Fix fixed-size windows growing when others close, :autocmd completion after ++args, CTRL-W with a pending CursorHold, the message pager dropping blank separators, unstable fuzzy completion order, and setreg() widths for unprintable chars * Many more fixes and improvements; see upstream's release notes for the full list - Spec cleanup: * Use %make_build for the autoconf regeneration step ==== vlc ==== Subpackages: libvlc5 libvlccore9 vlc-noX vlc-plugins-desktop - Switch to qt6: * Drop libQt5Gui-private-headers-devel, pkgconfig(Qt5Core), pkgconfig(Qt5Gui), pkgconfig(Qt5Svg), pkgconfig(Qt5Widgets) and pkgconfig(Qt5X11Extras). Further: disable pkgconfig(libprojectM) and drop outright conditional pkgconfig(libprojectM-qt5). * Add qt6-base-private-devel, qt6-gui-private-devel, pkgconfig(Qt6Core), pkgconfig(Qt6Gui), pkgconfig(Qt6Svg) and pkgconfig(Qt6Widgets). - Drop vlc-projectM-qt5.patch: Obsolete for all currently supported versions of openSUSE. - Add pkgconfig(vpl) BuildRequires: Build qsv plugin. ==== wtmpdb ==== Version update (0.76.0+git20260730.89c0861 -> 0.76.0+git20261016.cab5ed0) Subpackages: libwtmpdb0 - Update to version 0.76.0+git20261016.cab5ed0: * Try first varlink to get soft_reboots_count, increase count size * Use DefaultDependencies=no [bsc#1284234] ==== xdg-desktop-portal-kde6 ==== Version update (6.7.5 -> 6.8.0) - Update to 6.8.0: * New feature release * For more details see https://kde.org/announcements/plasma/6/6.8.0 - Changes since 6.7.91: * Update version for new release 6.8.0 * Add a fallback to std::function when std::move_only_function is not available * Add a test for the settingsportal * Introduce x-d-p-kde-internal library * settings: Fix ReadAll and ReadOnce corner cases - Update to 6.7.91: * New bugfix release * For more details see https://kde.org/announcements/plasma/6/6.7.91 - Changes since 6.7.90: * Update version for new release 6.7.91 - Update to 6.7.90: * New feature release * For more details see https://kde.org/announcements/plasma/6/6.7.90 - Too many changes to list here ==== zix ==== Version update (0.8.0 -> 0.8.2) - Update to version 0.8.2: * Fix build with configure checks disabled * Fix handling of invalid ring size parameters * Fix potential out of bounds access on error - Drop unneeded cmake BuildRequires. - Use autosetup and ldconfig_scriptlets macros.