Packages changed: Mesa (26.2.5 -> 26.2.6) Mesa-drivers (26.2.5 -> 26.2.6) MicroOS-release (20261108 -> 20261111) c-ares (1.34.8 -> 1.34.9) dracut (112+suse.62.g1b64cef -> 112+suse.63.g62ea8ea) exfatprogs (1.4.3 -> 1.4.4) ghostscript gstreamer (1.28.8 -> 1.28.9) gstreamer-plugins-bad (1.28.8 -> 1.28.9) gstreamer-plugins-base (1.28.8 -> 1.28.9) harfbuzz (15.0.0 -> 15.1.0) hwdata (0.412 -> 0.413) kernel-source (7.3.1 -> 7.3.3) kirigami-addons6 (1.16.0 -> 1.16.1) kwin6 libdnf-plugin-txnupd (0.3.0 -> 0.4.0) libplist (2.8.0 -> 2.8.1) libsndfile live555 (2026.10.29 -> 2026.11.08) ncurses (6.6.20261017 -> 6.6.20261107) patterns-kde pipewire poppler (26.10.0 -> 26.11.0) poppler-qt6 (26.10.0 -> 26.11.0) python-cffi (2.0.0 -> 2.1.1) python-oauthlib (4.0.0 -> 4.0.1) qt6-declarative xorg-x11-server === Details === ==== Mesa ==== Version update (26.2.5 -> 26.2.6) Subpackages: Mesa-libEGL1 Mesa-libGL1 libgbm1 - Update to 26.2.6 bugfix release - -> https://docs.mesa3d.org/relnotes/26.2.6 ==== Mesa-drivers ==== Version update (26.2.5 -> 26.2.6) Subpackages: Mesa-dri Mesa-vulkan-device-select libvulkan_lvp - Update to 26.2.6 bugfix release - -> https://docs.mesa3d.org/relnotes/26.2.6 ==== MicroOS-release ==== Version update (20261108 -> 20261111) Subpackages: MicroOS-release-appliance MicroOS-release-dvd - automatically generated by openSUSE-release-tools/pkglistgen ==== c-ares ==== Version update (1.34.8 -> 1.34.9) - c-ares 1.34.9: * buffer overflow when ares_dup() or ares_save_options() runs while another thread changes the servers (bsc#1289583) * uninitialized memory returned for a numeric IPv6 name with a prefix length (bsc#1289584) * the query cache could return an answer obtained using different EDNS options (bsc#1289585) * use-after-free when an application cancels lookups from a callback, or shuts a channel down (bsc#1289578) * use-after-free of a connection after the socket-state callback returns (bsc#1289579) * use-after-free when an application cancels lookups from a server-state callback (bsc#1289580) * use-after-free of a server record when an application changes its DNS servers from a callback (bsc#1289581) * use-after-free of a cached DNS answer while the application is still reading it (bsc#1289582) * memory corruption when an application cancels its lookups after a connection failure (bsc#1289574) * a DNS reply that arrived from a different server than the one queried could be accepted (bsc#1289575) * use-after-free of a lookup after shutting down a failed connection (bsc#1289576) - test-fixes.patch: fix testsuite to only use localhost ==== dracut ==== Version update (112+suse.62.g1b64cef -> 112+suse.63.g62ea8ea) Subpackages: dracut-ima - Update to version 112+suse.63.g62ea8ea: * fix(systemd-resolved): use the same UID/GID for the systemd-resolve user/group (bsc#1289137) - fix(dracut-rpmlintrc): remove unused suse-missing-rclink rpmlint filter ==== exfatprogs ==== Version update (1.4.3 -> 1.4.4) - Update to 1.4.4: New features: * exfatprogs: add optional I/O statistics collection for profiling read, write, discard, zero-out, and sync operations. Changes: * mkfs.exfat: increase full-format speed by using BLKZEROOUT when supported, selecting larger zeroing batches, and improving quiet and trace progress output. * mkfs.exfat: reduce page-cache pollution during full formatting on systems supporting POSIX_FADV_NOREUSE. Bug fixes: * exfatprogs: fix parsing of kernel versions and boolean environment variables. * mkfs.exfat: avoid memory-reservation failures when creating very large allocation bitmaps. * mkfs.exfat: mark the percentage of used clusters as unknown until it is calculated. * fsck.exfat, exfat2img, and defrag.exfat: reject malformed boot sector geometry and prevent arithmetic overflows and out-of-bounds reads. * fsck.exfat: stop immediately on I/O errors instead of treating them as filesystem inconsistencies. * fsck.exfat: fix missing line breaks in error messages. * fsck.exfat: avoid printing version information during automatic repair with "-p" or "-a". * dump.exfat: print complete file timestamps in raw and ISO formats. * exfat2img: keep metadata image output on stdout free of status messages. * exfatprogs: correct usage text for overwrite and read-back verification options. ==== ghostscript ==== - Ghostscript version 10.08.0 also fixes the following two security issue (cf. the below entry dated "Tue Oct 13"): - CVE-2026-125396 "Type 1 font-loader `.forceput` save/restore UAF yields native read/write and controlled dispatch/RCE under `-dSAFER`" https://bugs.ghostscript.com/show_bug.cgi?id=709684 (bsc#1289822) - CVE-2026-112922 "Out-of-bounds read in ghostscript shade_next_color via integer overflow of indexed color index in mesh shading" https://bugs.ghostscript.com/show_bug.cgi?id=709572 (bsc#1288956) ==== gstreamer ==== Version update (1.28.8 -> 1.28.9) Subpackages: libgstreamer-1_0-0 - Update to version 1.28.9: * Highlighted bugfixes: + Various security fixes and playback fixes + decodebin3, playbin3: fix assertion that would crash music players with certain files and sources + qtdemux: fix seeking beyond the end of file in push mode + flvdemux: don't prematurely EOS on AVC/audio sequence end + rtspsrc: Reuse non-compliant URL fallback across tracks + H.264 and H.265 RTP depayloader header extension tracking fixes + level: Add 24 bits support + gtk4paintablesink: Mark EGL display as foreign to not terminate it + amfcodec: fix rate_control (H.265, AV1) and gop_size (H.265) properties + asio: fix stopping asio element causing crashes + cuda: Correctly save alpha and blend on property change + HLS: fix awss3hlssink EXT-X-PROGRAM-DATE-TIME moving at twice the speed of the target duration + hlssink3: Fix stream writing regression for CMAF and WebVTT sinks + isobmff: Fix NTP seconds roll-over past 2036 + Fix gap event regression in MPEG-PS demuxer with certain subtitle streams + qsv, d3d11, d3d12: Build fixes on latest msys2 environment + va: do not advertise unsupported formats in encoder caps + v4l2 video decoder fixes including delay negotiation for H.264 and H.265 for better decodebin2 compatibility + wayland: output hotplug fixes + webrtcsink: add support of mpph264enc encoder (rockchip) + Rust plugins: enable cross-compilation with sysroot in Meson build + cerbero: update ca-certificates and pip, and fix issue with rolling distro versions + Various bug fixes, build fixes, memory leak fixes, and other stability and reliability improvements * gstreamer: + paramspecs: Fix GType name mess with GstParamSpecArray/Fraction + taglist: don't critical when parsing random strings + value: Skip the caps attempt when a bracketed value can't be caps + value: unset the GValue when parsing a value token fails + value: validate int/double/fraction ranges when parsing + doc: Passing size=-1 to gst_buffer_extract_dup() returns all data + baseparse: Don't dereference frame->buffer after a zero-sized finish_frame() and explicitly forbid negative skip values from handle_frame() + base: Avoid memcpy()/memset() with NULL pointers and zero size + ptp: Make sure the ptp-helper tests are compiled and running unless tests are disabled ==== gstreamer-plugins-bad ==== Version update (1.28.8 -> 1.28.9) Subpackages: libgstphotography-1_0-0 libgstplay-1_0-0 - Update to version 1.28.9: * amfcodec: fix rate_control(h265, av1) and gop_size (h265) properties * analyticsoverlay: Remove Visualization classifier * androidmedia: Fix drain deadlock when the srcpad loop stops * asfmux: Fix header size calculation for non-BMP characters in string tags * asfmux: Minor fixes * asio: fix stopping asio element causing crashes * codecparsers, videoparsers: Fix OOB accesses and undefined behaviour found by fuzzing * codecparsers: Fix undefined shift in nal_reader_get_ue * codecparsers: h265: Do not overflow conformance window size * codecparsers: h265: Free SEI payload when parsing fails * codecparsers: h26x: Reject NALs with forbidden_zero_bit set * codecparsers: vp9: Do not read past the end of the frame data * cuda: Correctly save alpha and blend on property change * cudaipc: Release Unix socket server resources on teardown * d3d12h264enc: Various fixes and enhancement * eagl and vulkan: Remove internal_view from the superview when finalizing * faac: support faac >= 2.0 (faac_* API) * festival: check read return value * h26*parse: Reject malformed NALs with forbidden_zero_bit set * h264 parsing : UB fixes * h264decoder: Fix division by zero on bogus SPS dimensions * h264parse: Don't finish a zero-sized frame when no start code follows * h265parse: only extrapolate duration for vcl nal * h265parse: Fix use of uninitialized HRD parameters * h265parser: Handle oversized SEI payloads * h266parser: Fix infinite loop parsing picture timing SEI * h266parser: Fix out-of-bounds write when parsing DCI * h266parser: Validate that rectangular slices fit into the tile grid * hlsdemux: Validate PKCS7 padding before unpadding decrypted fragments * ivfparse: Reject frame sizes that overflow the size check * mpeg4videoparse: Clamp VOS length when no terminating start code * mpegdemux: compare to segment position for sending gap updates * mpegts: Various OOB reads and similar * mpegts: Various fixes * mxf: Fix metadata creation by using g_object_new, not g_type_create_instance * mxfdemux: fix a typo and improve log * mxfdemux: fix out-of-bounds read when looking up delta entry by delta_id * qsv,d3d11,d3d12: Build fixes on latest msys2 environment * rfbsrc: Various fixes * tensordecoders: fix leaks in classifiertensordec * tsdemux: Check AC-3 descriptor length before reading its fields * unixfdsink: Fix race when starting and stopping quickly * v4l2codecs: h264, h265: negotiate with the first picture * v4l2codecs: vp9: Minimize memory allocation * va: do not advertise unsupported formats in encoder caps * va: {vp8,vp9,av1}enc: check the result of gst_va_encode_picture_new() * vc1parser: Zero-initialize parsed structures * video: fix undefined behaviour on empty unregistered user data meta * videoconvertscale: Don't scale in the padding described by GstVideoMeta * vmnc: Drop colour cursor on pixel format change and various other crash fixes * vmnc: Render the correct cursor part when clipped & don't produce invalid RGB shift masks * vulkan: fix memory leaks in decoders * vulkanh265dec: pass sps_scaling_list_data_present_flag from the SPS * wayland: output hotplug fixes * wpe2: Fix mouse pointer buttons mismatch ==== gstreamer-plugins-base ==== Version update (1.28.8 -> 1.28.9) Subpackages: libgstallocators-1_0-0 libgstapp-1_0-0 libgstaudio-1_0-0 libgstgl-1_0-0 libgstpbutils-1_0-0 libgstriff-1_0-0 libgsttag-1_0-0 libgstvideo-1_0-0 - Update to version 1.28.9: * appsink: keep queued sticky events across a flush * eagl and vulkan: Remove internal_view from the superview when finalizing * decodebin3 aborts on giostreamsrc + parsebin with ID3-tagged MP3 * decodebin3: Crash in GstPad playing a MP3 file * decodebin3: mq_slot_handle_stream_start: assertion failed: (collection) * decodebin3: Null-deref crash in gst_decodebin_input_link_to_slot with Strawberry player * discoverer: Fix use-after-free when a stream reuses its parent * parsebin: Handle lazy stream-id generation * qsv,d3d11,d3d12: Build fixes on latest msys2 environment * samiparse: Drop already parsed text from the HTML context buffer * samiparse: Fix when encountering unclosed tags to prevent slowdown * udmabuf: Allow disabling via env var * video: fix undefined behaviour on empty unregistered user data meta * video: vbi: reject pixel widths narrower than one conversion group * videoconvertscale: Don't scale in the padding described by GstVideoMeta ==== harfbuzz ==== Version update (15.0.0 -> 15.1.0) Subpackages: libharfbuzz-gobject0 libharfbuzz-subset0 libharfbuzz0 typelib-1_0-HarfBuzz-0_0 - Update to version 15.1.0: * Add buffer deserialization APIs that report progress as a byte offset, for use from introspection bindings. * Fix Indic shaping of the Unicode 18 Devanagari and Bengali additions. * Fix Arabic fallback shaping: wrong ligatures when a component is missing from the font, and disappearing marks in legacy fonts. * Fix `COLR` glyph extents and mark positioning in fonts with empty layers. * Fix AAT shaping: wrong `kerx` kerning (formats 1 and 2) and mark positioning (format 4, a 14.3.0 regression), and ignored `kern` and `mort` tables with a non-first initial state. * Various fixes to the Graphite2 shaper. * Report HarfRust shaping failures through `hb_buffer_allocation_successful()`. * Fix wrong outlines in `gvar` fonts with intermediate tuples. * Fix `hb_face_create_or_fail()` rejecting face indices with named-instance bits set. * Fix wrong fallback metrics: the vertical descender in fonts without `vhea`, and the hanging baseline for some scripts. * Fix `hb_ot_layout_lookup_collect_glyph_alternates()` collecting garbage from `AlternateSubst` and `SingleSubst` format 1 lookups. * Speed up shaping on faces with many shape plans, `hb_language_from_string()`, vertical text with `hb-ft`, and `CBDT` and `sbix` fonts. * Fix crashes and deadlocks with FreeType, including `hb_ft_font_set_funcs()` on immutable fonts and font queries from color paint callbacks. * Fix crashes with NULL result pointers in `hb_ot_metrics_get_position_with_fallback()`, `hb_ot_layout_get_font_extents()`, and `hb_ot_layout_get_font_extents2()`. * Fix use-after-free in `hb_map_update()` when updating a map from itself. * Various fixes for crashes, hangs, and memory use with malformed fonts. * Faster subsetting of large `GSUB` and `GPOS` tables, and smaller `CFF` output. * Partially instancing or desubroutinizing `CFF2` fonts with nested blends now fails instead of changing the outlines. * Subsetting now fails if a glyph mapping assigns another glyph to glyph 0. * Fix `hb_subset_axis_range_from_string()` reading past the given length. * Fix subsetting beyond-64k variable fonts losing `HVAR` advance deltas. * Various subsetting and instancing fixes, mostly for `CFF`, `CFF2`, and `COLR`. * Fix rotated and skewed rectangle clips hiding their contents in the raster library, and out-of-bounds access when extents change during painting. * Fix the vector library mirroring path clips in SVG, and writing PDFs with wrong page bounds and misplaced or clipped `COLR` gradients. * Fix wrong clipping of `COLR` layers in the GPU library. * Various Cairo integration fixes, including a memory leak per scaled font. * Fix `hb-info --list-*` crashes on unusual fonts. * Various build and CI fixes. * New API: +hb_buffer_deserialize_glyphs2() +hb_buffer_deserialize_unicode2() ==== hwdata ==== Version update (0.412 -> 0.413) - Update to 0.413: * pci.ids refreshed to the 2026.10.31 snapshot (203 lines added, 34 removed); oui.txt and pnp.ids refreshed ==== kernel-source ==== Version update (7.3.1 -> 7.3.3) Subpackages: kernel-64kb kernel-default - Update patches.kernel.org/7.3.1-002-mm-damon-core-error-damos_commit_quota_goal-for.patch (bsc#1012628 CVE-2026-99240 bsc#1289193). - Update patches.kernel.org/7.3.1-003-Bluetooth-L2CAP-refuse-__l2cap_chan_add-if-chan.patch (bsc#1012628 CVE-2026-99239 bsc#1289189). - Update patches.kernel.org/7.3.1-005-tracing-Hold-trace_types_lock-when-updating-mod.patch (bsc#1012628 CVE-2026-99238 bsc#1289182). - Update patches.kernel.org/7.3.1-006-tracing-Hold-trace_types_lock-when-resetting-la.patch (bsc#1012628 CVE-2026-99237 bsc#1289181). - Update patches.kernel.org/7.3.1-007-tracing-Reject-incomplete-event-filter-expressi.patch (bsc#1012628 CVE-2026-99236 bsc#1289229). - Update patches.kernel.org/7.3.1-008-tracing-Save-the-event-file-instead-of-the-comp.patch (bsc#1012628 CVE-2026-99235 bsc#1289218). - Update patches.kernel.org/7.3.1-009-tracing-Unregister-field-variable-histograms-wh.patch (bsc#1012628 CVE-2026-99234 bsc#1289217). - Update patches.kernel.org/7.3.1-012-tracing-histograms-Verify-event_call-identity-w.patch (bsc#1012628 CVE-2026-99233 bsc#1289227). - Update patches.kernel.org/7.3.1-013-tracing-syscalls-Use-copy_from_user-for-the-fau.patch (bsc#1012628 CVE-2026-99232 bsc#1289228). - Update patches.kernel.org/7.3.1-017-io_uring-waitid-prevent-cancel-reference-wrap.patch (bsc#1012628 CVE-2026-99227 bsc#1289219). - Update patches.kernel.org/7.3.1-019-keys-Avoid-the-owner-account-dereference-in-nam.patch (bsc#1012628 CVE-2026-99226 bsc#1289220). - Update patches.kernel.org/7.3.1-020-keys-Check-the-authorization-payload-in-process.patch (bsc#1012628 CVE-2026-99225 bsc#1289221). - Update patches.kernel.org/7.3.1-021-keys-Protect-the-type-name-while-describing-a-k.patch (bsc#1012628 CVE-2026-99224 bsc#1289223). - Update patches.kernel.org/7.3.1-022-keys-make-keyring-indexes-independent-of-kernel.patch (bsc#1012628 CVE-2026-99223 bsc#1289224). - Update patches.kernel.org/7.3.1-023-keys-Protect-the-read-method-check-against-type.patch (bsc#1012628 CVE-2026-99222 bsc#1289209). - Update patches.kernel.org/7.3.1-024-KEYS-Fix-key_reject_and_link-race-with-keyring-.patch (bsc#1012628 CVE-2026-99245 bsc#1289347). - Update patches.kernel.org/7.3.1-026-keys-trusted_keys-return-immediately-after-TPM-.patch (bsc#1012628 CVE-2026-99221 bsc#1289204). - Update patches.kernel.org/7.3.1-027-asymmetric_keys-reject-trust-keys-without-IDs.patch (bsc#1012628 CVE-2026-99220 bsc#1289225). - Update patches.kernel.org/7.3.1-028-ftrace-Initialize-modname-and-offset-in-print_r.patch (bsc#1012628 CVE-2026-99219 bsc#1289188). - Update patches.kernel.org/7.3.1-029-coredump-hold-RCU-while-releasing-parked-thread.patch (bsc#1012628 CVE-2026-99218 bsc#1289176). - Update patches.kernel.org/7.3.1-038-pid_namespace-prevent-TIF_NOTIFY_SIGNAL-from-in.patch (bsc#1012628 CVE-2026-99244 bsc#1289343). - Update patches.kernel.org/7.3.2-017-io_uring-waitid-own-the-request-before-clearing.patch (bsc#1012628 CVE-2026-99231 bsc#1289215). - Update patches.kernel.org/7.3.2-018-io_uring-cmd-don-t-leave-list-poison-in-hash_no.patch (bsc#1012628 CVE-2026-99230 bsc#1289226). - Update patches.kernel.org/7.3.2-019-io_uring-wait-don-t-spin-on-a-stuck-overflow-li.patch (bsc#1012628 CVE-2026-99229 bsc#1289216). - Update patches.kernel.org/7.3.2-020-io_uring-io-wq-don-t-lose-the-signal-that-ends-.patch (bsc#1012628 CVE-2026-99228 bsc#1289222). - Update patches.kernel.org/7.3.2-021-io_uring-io-wq-don-t-hide-a-link-from-cancellat.patch (bsc#1012628 CVE-2026-99255 bsc#1289285). - Update patches.kernel.org/7.3.2-022-io_uring-don-t-flood-a-cancelling-task-with-tas.patch (bsc#1012628 CVE-2026-99254 bsc#1289306). - Update patches.kernel.org/7.3.2-024-io_uring-cancel-rearm-local-work-wake-up-before.patch (bsc#1012628 CVE-2026-99253 bsc#1289298). suse-add-cves - commit 69165fa - Linux 7.3.3 (bsc#1012628). - xen-blkback: Avoid UAF when reading I/O statistics (bsc#1012628). - xen-netback: defer xenvif_mcast_addr_list_free() (bsc#1012628). - xen-netback: Fix UAF when reading statistics data (bsc#1012628). - commit 380c3b2 - Linux 7.3.2 (bsc#1012628). - net: skbuff: propagate shared-frag marker in skb_zerocopy() (bsc#1012628). - ksmbd: wait for negotiation before receiving another PDU (bsc#1012628). - smb: smbdirect: don't wait for RDMA_CM_EVENT_DISCONNECTED in smbdirect_socket_destroy_sync() (bsc#1012628). ... changelog too long, skipping 985 lines ... - commit 8e02181 ==== kirigami-addons6 ==== Version update (1.16.0 -> 1.16.1) Subpackages: libKirigamiAddonsComponents6 libKirigamiAddonsStatefulApp6 libKirigamiApp6 - Update to 1.16.1 https://carlschwan.eu/2026/11/06/kirigami-addons-1.16.1/ ==== kwin6 ==== Subpackages: libkwin6 - Add xwayland build dependency ==== libdnf-plugin-txnupd ==== Version update (0.3.0 -> 0.4.0) - Update to 0.4.0: * Fix linking with libtukit * Finalize snapshots after libdnf5 closes rpmdb * Log finish() messages in logger * Report snapshot create failures, instead of aborting * apply-live: Sync /etc state before applying snapshot * Drop version information from manpage - Drop 3add4c39b5506f8bfafd1daca3bf6165e55c5e18.patch ==== libplist ==== Version update (2.8.0 -> 2.8.1) - Update to version 2.8.1: * Hardening: length-based range checks for bplist object data, node-count limit against crafted reference expansion, geometric bytearray growth fixing quadratic appends on large plists * Fix use-after-free in plist_copy_node(), double-free in node_from_xml() error paths and leaks on allocation failure across the XML, binary and OpenStep parsers * Fix plist_get_date_val() rounding and sign handling so dates round-trip, handle out-of-range and NaN without UB * No SONAME or API change (libtool 12:0:0 -> 12:1:0, headers unchanged); libplist-2_0-12 subpackages carry over - Spec cleanup: ldconfig scriptlets, macro-ified paths and build calls, reordered dependencies (no functional change) ==== libsndfile ==== - Replace the fix for CVE-2026-88372 with the upstream version: libsndfile-CVE-2026-88372.patch ==== live555 ==== Version update (2026.10.29 -> 2026.11.08) Subpackages: libBasicUsageEnvironment2 libUsageEnvironment3 libgroupsock33 libliveMedia122 - Update to version 2026.11.08: * In "MultiFramedRTPSource" (for handling RTP reception), handle the case where a malformed RTP special header could cause no data to get delivered, and get us into an infinite loop. We now reject (the rest of) the packet in this case. - Changes from version 2026.11.05: * Updated the 'authentication' fix that we made in version 2026.09.23: We no longer "reset()" the "Authenticator" if we get a "303" (REDIRECT) response, because the new server might still want to do Digest authentication (with the same username+password as the original server). Instead, once we receive a request for Digest authentication, we no longer allow Basic authentication (for this "RTSPClient") - either for the same server, or for any server that we get redirected to. ==== ncurses ==== Version update (6.6.20261017 -> 6.6.20261107) Subpackages: libncurses6 ncurses-utils terminfo-base - Add ncurses patch 20261107 + check for terminating NUL in canonical_name() for infocmp -F (report/testcase by Martin Mirchev). + fix an infinite loop in parse_ti_delay() on malformed terminfo (report/testcase by Martin Mirchev). + add valid_div() check to tparm '/' and '%' operators to guard against SIGFPE on dividing INT_MIN by -1 (report/testcase by Martin Mirchev). + add sanity-checks to _nc_infotocap() when moving mandatory padding (report/testcase by Martin Mirchev). + reorder check for missing '\0' in str_table and a strlen() call (report/testcase by Martin Mirchev). + add check in decode_xterm_X10() to ensure that enough bytes were read (report by Martin Mirchev). + use CLOCK_MONOTONIC instead of CLOCK_REALTIME when it is available (patch by Yeatol). + add limit check in lib_add_wch.c (report/testcase by Serhiy Storchaka), + improve cleanup on EOF in next_char (report by Oliver Zhang). + improve fix for filling cells for multicolumn characters in lib_addch.c (patch by Vassili Courzakis). + fixes for tvi910, tvi950, wy100 (patch by Adam Di Carlo) - Add ncurses patch 20261031 + improve configure check for wcwidth, for msys2 port. + modify configure check for multiuser systems to use getent if it is available. + remove obsolete configure macro CF_LDFLAGS_STATIC (prompted by discussion with Julian Waters). + modify convert_strings to disallow overlapping strings. + add null-pointer checks for terminfo/termcap function parameters. + pad str_table with a '\0' in case of malformed terminfo data which omits a '\0' on the final string (report/testcase by Can Ozkan). - Add ncurses patch 20261024 + modify initialization for term-driver return terminfo data when given a name in $TERM unless _nc_console_vt_supported() returns true, as in the missing-name branch (patch by Daniel Aliev). + correct initialization of fallback entries which using term-driver configuration (patch by Daniel Aliev). + correct limit check in lib_ins_wch.c (patch by Serhiy Storchaka, cf: 20260815) + initialize sp->_wacs_map for each screen, rather than reusing data, to help with delscreen (patch by Serhiy Storchaka, cf: 20260523). + improve ripoff window cleanup in delwin (report by Serhiy Storchaka). + fix a duplicate declaration of _nc_gettimeofday() (report by Abril Rincon Blanco). + improve check for end of file in next_char() (report by Lingfeng Chen). ==== patterns-kde ==== - Have the main pattern recommend opensuse-welcome. This used to be pulled in by the various X-related patterns (IIRC last via games), which was cleaned up. As we have no underlying pattern for graphical systems anymore, desktops need to pull it in directly. ==== pipewire ==== Subpackages: gstreamer-plugin-pipewire libpipewire-0_3-0 pipewire-alsa pipewire-modules-0_3 pipewire-pulseaudio pipewire-spa-plugins-0_2 pipewire-spa-tools pipewire-tools - Replace the patch with the upstream version from the 1.6 branch which includes the required #include * 0001-spa-libcamera-device-0.8-compatibility.patch - Add patch from upstream to fix compatibility with libcamera 0.8 * 0001-spa-libcamera-device-0.8-compatibility.patch ==== poppler ==== Version update (26.10.0 -> 26.11.0) - Update to version 26.11.0: * Core: + Fix subsetting annotations with multiline content + NSS: Fix crash if creating the hash context fails + Fix crash when saving documents with special forms + Properly apply password length limit + Annot: Fix the text width of widgets rotated 180 degrees + FlateStream::rewind: Don't consider the empty stream failing when reviwnding it + TextStringToUtf8: Fix PDFDocEncoding conversion + Internal code improvements + Fix crashes in malformed documents * Utils: + Increase max password length + Pdfsig: Allow to give multiple nss passwords + Pdfsig: Allow to input the password interactively * Qt6: + Expose the asset of RichMedia instances + Fix leak of RichMedia activation and deactivation + Check that Catalog::getForm() returns a Form before using it * Qt5: + Check that Catalog::getForm() returns a Form before using it + Fix leak of RichMedia activation and deactivation - Update version dependencies according to meson.build. - Bump soname following upstream changes. ==== poppler-qt6 ==== Version update (26.10.0 -> 26.11.0) - Update to version 26.11.0: * Core: + Fix subsetting annotations with multiline content + NSS: Fix crash if creating the hash context fails + Fix crash when saving documents with special forms + Properly apply password length limit + Annot: Fix the text width of widgets rotated 180 degrees + FlateStream::rewind: Don't consider the empty stream failing when reviwnding it + TextStringToUtf8: Fix PDFDocEncoding conversion + Internal code improvements + Fix crashes in malformed documents * Utils: + Increase max password length + Pdfsig: Allow to give multiple nss passwords + Pdfsig: Allow to input the password interactively * Qt6: + Expose the asset of RichMedia instances + Fix leak of RichMedia activation and deactivation + Check that Catalog::getForm() returns a Form before using it * Qt5: + Check that Catalog::getForm() returns a Form before using it + Fix leak of RichMedia activation and deactivation - Update version dependencies according to meson.build. - Bump soname following upstream changes. ==== python-cffi ==== Version update (2.0.0 -> 2.1.1) - update to 2.1.1: * Minimize internal Python API usage for interpreter and thread state sampling where possible. * Added the cffi-gen-src command-line tool * Added support for Python 3.15 and support for C extensions generated by CFFI to target the new abi3t free-threaded ABI. (#232) * Avoid crashes inside of __delitem__. (#235) * Avoid “string too big” error under MSVC. (#167) * Fix mingw builds. (#198) - drop support-pycparser-3.patch (upstream) ==== python-oauthlib ==== Version update (4.0.0 -> 4.0.1) - Update to 4.0.1: * CVE-2026-49272: Breaking: The device code flow token endpoint did not validate the device_code parameter, allowing a request with a known client_id and a bogus device_code to obtain a bearer token. (bsc#1288518) ==== qt6-declarative ==== Subpackages: libQt6LabsAnimation6 libQt6LabsFolderListModel6 libQt6LabsPlatform6 libQt6LabsQmlModels6 libQt6LabsSettings6 libQt6LabsSharedImage6 libQt6LabsStyleKit6 libQt6LabsSynchronizer6 libQt6LabsWavefrontMesh6 libQt6Qml6 libQt6QmlCore6 libQt6QmlDesignSupport6 libQt6QmlLocalStorage6 libQt6QmlMeta6 libQt6QmlModels6 libQt6QmlNetwork6 libQt6QmlWorkerScript6 libQt6QmlXmlListModel6 libQt6Quick6 libQt6QuickControls2-6 libQt6QuickControls2Impl6 libQt6QuickDialogs2-6 libQt6QuickDialogs2QuickImpl6 libQt6QuickDialogs2Utils6 libQt6QuickEffects6 libQt6QuickLayouts6 libQt6QuickParticles6 libQt6QuickShapes6 libQt6QuickTemplates2-6 libQt6QuickTest6 libQt6QuickVectorImage6 libQt6QuickWidgets6 qt6-declarative-imports - Re-add 0001-QML-engine-Correctly-compare-composites-when-multipl.patch (boo#1289020) ==== xorg-x11-server ==== Subpackages: xorg-x11-server-Xvfb - U_Revert-damage-Unlink-a-damage-from-the-list-it-was-a.patch * reverts commit 0fb16f3d, which mistakenly broke driver ABI (boo#1289271)